An aircraft control system comprising: an aircraft control module comprising a memory storing a machine learning model adapted, based on received live aircraft operating inputs (102a to 102f), to generate live aircraft control outputs (104a-104b), to perform aircraft control; a test module comprising: a memory storing input data representing test aircraft operating inputs (102a'-102f') and respective output data representing expected aircraft control outputs (114a, 114b) that are expected to be generated by the aircraft control module in response to an input of the respective test aircraft operating inputs (102a'-102f'); a monitor configured to monitor an operating status of the aircraft control module, wherein, the test module is adapted to: determine, using the monitor, whether the aircraft control module is performing aircraft control; when it is determined that the aircraft control module is not performing aircraft control, write test aircraft operating inputs (102a'-102f') to the aircraft control module; read test aircraft control outputs (104a'-104b') of the aircraft control module generated based on the respective test aircraft operating inputs (102a'-102f'); and selectively remove the authority of the aircraft control module to perform aircraft control if the test aircraft control outputs (104a'-104b') do not conform to the respective expected aircraft control outputs (114a, 114b); and a backup system to replace the aircraft control module when the authority of the aircraft control module is selectively removed. an aircraft control module comprising a memory storing a machine learning model adapted, based on received live aircraft operating inputs (102a to 102f), to generate live aircraft control outputs (104a-104b), to perform aircraft control; a test module comprising: a memory storing input data representing test aircraft operating inputs (102a'-102f') and respective output data representing expected aircraft control outputs (114a, 114b) that are expected to be generated by the aircraft control module in response to an input of the respective test aircraft operating inputs (102a'-102f'); a monitor configured to monitor an operating status of the aircraft control module, a memory storing input data representing test aircraft operating inputs (102a'-102f') and respective output data representing expected aircraft control outputs (114a, 114b) that are expected to be generated by the aircraft control module in response to an input of the respective test aircraft operating inputs (102a'-102f'); a monitor configured to monitor an operating status of the aircraft control module, wherein, the test module is adapted to: determine, using the monitor, whether the aircraft control module is performing aircraft control; when it is determined that the aircraft control module is not performing aircraft control, write test aircraft operating inputs (102a'-102f') to the aircraft control module; read test aircraft control outputs (104a'-104b') of the aircraft control module generated based on the respective test aircraft operating inputs (102a'-102f'); and selectively remove the authority of the aircraft control module to perform aircraft control if the test aircraft control outputs (104a'-104b') do not conform to the respective expected aircraft control outputs (114a, 114b); and determine, using the monitor, whether the aircraft control module is performing aircraft control; when it is determined that the aircraft control module is not performing aircraft control, write test aircraft operating inputs (102a'-102f') to the aircraft control module; read test aircraft control outputs (104a'-104b') of the aircraft control module generated based on the respective test aircraft operating inputs (102a'-102f'); and selectively remove the authority of the aircraft control module to perform aircraft control if the test aircraft control outputs (104a'-104b') do not conform to the respective expected aircraft control outputs (114a, 114b); and a backup system to replace the aircraft control module when the authority of the aircraft control module is selectively removed.