A run-time assurance module (6) comprises a contingency planner (26) arranged to generate an initial contingency plan having an associated safety-critical decision point, where the initial contingency plan (ICP) is stored as a current contingency plan in a memory (30). The assurance module (6) receives a mission plan (MP) from a mission planner (4). When the mission plan (MP) is being carried out, the contingency planner (26) processes at least one condition input, and generates a new contingency plan (NCP) based on the condition input. When the new contingency plan (NCP) satisfies a safety criterion and the safety-critical decision point associated with the new contingency plan (NCP) will occur later in time than the safety-critical decision point associated with the current contingency plan (CCP), the new contingency plan (NCP) is stored in the memory (30) as the current contingency plan (CCP).