Earlier quoted context omitted.
let it crash != robustness not required Let it crash is an engineering design for systems large enough that statistically unlikely failures occur regularly. Like a data center or the original use case, telephone switch centers. Even if let it crash worked, it seems philosophically inappropriate for a drone controller.
Not at all, "let it crash" is simply a way of phrasing "consider reset in your flow of control". In embedded systems, certainly safety-critical ones, you have to consider the possibility of a reset path at all points in your flow of control. Your code resetting is a valid flow of control. This is absolutely necessary to get a properly robust system. Your drone system needs to be able to handle a reset at any point an…
It's a completely different use case.