Applying run-time monitoring to the Deep-Impact fault protection engine

Run-time monitoring is a lightweight verification method whereby the correctness of a programs' execution is verified at run-time using executable specifications. This paper describes the verification of the fault protection engine of the Deep-Impact spacecraft flight software using a temporal logic based run-time monitoring tool.