How NASA Writes Space-Proof Code