This is incorrect. In avionics software, you want software that self-detects its own failure to quit immediately, and engage the backup system.

You do NOT want it to "soldier on" once it has entered an unknown state.

The general problem with error codes is they can be so easily ignored, and then the software is operating in an unknown and untested state.

I suspect the actual reason why they eschewed exceptions is because exceptions may not be able to guarantee hard realtime latency.