As I found out during my FLOSS Weekly interview with the Mars Rover Drivers, a giant Perl script validates every rover command uplink, to verify that they don't attempt known bad behavior. And as they find new bad things to do, they add it to the script.

Yes, it's on the ground, but it's absolutely mission critical.