Assurance module

A method of mission planning for an aerospace application, the method comprising:

• generating or receiving a mission plan;
• generating an initial contingency plan having an associated safety-critical decision point;
• storing the initial contingency plan as a current contingency plan in a memory;
• carrying out the mission plan;
• when the mission plan is being carried out, processing at least one condition input, and generating a new contingency plan based on said condition input, said new contingency plan having an associated safety-critical decision point;
• when the new contingency plan satisfies a safety criterion and the safety-critical decision point associated with the new contingency plan will occur later in time than the safety-critical decision point associated with the current contingency plan, storing the new contingency plan;
• and
• selecting the new contingency plan as the current contingency plan.

A non-transitory computer-readable medium comprising instructions that, when executed by a processor, cause the processor to carry out a method of mission planning for an aerospace application, the method comprising:

• generating or receiving a mission plan;
• generating an initial contingency plan having an associated safety-critical decision point;
• storing the initial contingency plan as a current contingency plan in a memory;
• carrying out the mission plan;
• when the mission plan is being carried out, processing at least one condition input, and generating a new contingency plan based on said condition input, said new contingency plan having an associated safety-critical decision point;
• when the new contingency plan satisfies a safety criterion and the safety-critical decision point associated with the new contingency plan will occur later in time than the safety-critical decision point associated with the current contingency plan, storing the new contingency plan;
• and
• selecting the new contingency plan as the current contingency plan.