> In modern NVIDIA chips, this RCM mode no longer exists. The new recovery modes meanwhile are running across multiple physically separate CPUs verifying each other (glitch one, the other notices), all running formally verified firmware written in SPARK (the thing you use for nuclear reactors and avionics).

I guess that, when you absolutely want zero surprises, Ada is the language of choice.