To be clear, the domain of correctness is broader than memory safety. For example, TigerBeetle follows NASA's The Power of Ten Rules for Safety-Critical Code.

To be clear, the domain of correctness is broader than memory safety. For example, TigerBeetle follows NASA's The Power of Ten Rules for Safety-Critical Code. We require that memory allocation failure be explicitly handled in the control flow, and that no dynamic memory allocation be used after initialization, that all resources (including memory) be explicitly limited, with no hidden allocations. Our language choices then came down to C or Zig. Zig made most sense. Zig's correctness philosophy (e.g. extremely explicit control flow) may be different to other languages. But Zig resonated with our own philosophy—in addition to the big examples already given above, we also noticed the little things (e.g. checked arithmetic enabled by default in safe builds).