  This paper describes the development and verification of a competitive
parachute system for Micro Air Vehicles, in particular focusing on verification
of the embedded software. We first introduce the overall solution including a
system level failure analysis, and then show how we minimized the influence of
faulty software. This paper demonstrates that with careful abstraction and
little overapproximation, the entire code running on a microprocessor can be
verified using bounded model checking, and that this is a useful approach for
resource-constrained embedded systems. he resulting Emergency Recovery System
is to our best knowledge the first of its kind that passed formal verification,
and furthermore is superior to all other existing solutions (including
commercially available ones) from an operational point of view.
