Patent Description:
Aircraft typically comprise control systems, which are developed by devising rules to govern the operation of the aircraft control system in a range of scenarios and coding these rules into the aircraft control system. Developing these control systems generally involves a considerable amount of time and planning. While techniques involving artificial intelligence may be employed and may decrease the time taken to develop such systems, sufficient trust has to be afforded to such techniques before they are considered to be safe.

<CIT>) discusses a system including a machine learning engine. The machine learning engine is configured to receive training data including a plurality of first input conditions and a plurality of first response manoeuvres associated with the first input conditions. The machine learning engine is configured to train a learning system using the training data to generate a second response manoeuvre based on a second input condition.

<CIT> discusses a method that comprises disposing a selectively severable I/O channel between an electromechanical actuator controller, EMAC, and an aircraft component.

<CIT> discusses an aircrew automation system that provides a pilot with high-fidelity knowledge of an aircraft's physical state, and notifies that pilot of any deviations in expected state based on predictive models.

<CIT> discusses a method for determining whether to perform aircraft maintenance. The method comprises selecting groupings of sensors and/or parameters associated with an aircraft type. The method comprises receiving feature data that corresponds to each grouping of sensors and/or parameters. The method comprises determining, from the feature data, values for predetermined operational metrics. The method comprises comparing the values to values for predetermined operational metrics that correspond to at least one other flight of the aircraft. The method comprises determining, based on comparing the values for the predetermined operational metrics, values of additional operational metrics. The method comprises training a machine learning model using at least the values for the additional operational metrics. The method comprises providing, based on an output of the machine learning model, an instruction to perform maintenance on one or more of the plurality of portions of the aircraft or another aircraft.

A first aspect of the present invention provides an aircraft control system comprising: an aircraft control module comprising a memory storing a machine learning model adapted, based on received live aircraft operating inputs, to generate live aircraft control outputs, to perform aircraft control; a test module comprising: a memory storing input data representing test aircraft operating inputs and respective output data representing expected aircraft control outputs that are expected to be generated by the aircraft control module in response to an input of the respective test aircraft operating inputs; and a monitor configured to monitor an operating status of the aircraft control module, wherein, the test module is adapted to: determine, using the monitor whether the aircraft control module is performing aircraft control; when it is determined that the aircraft control module the aircraft control module is not performing aircraft control, write test aircraft operating inputs to the aircraft control module; read test aircraft control outputs of the aircraft control module generated based on the respective test aircraft operating inputs; and selectively remove the authority of the aircraft control module to perform aircraft control if the test aircraft control outputs do not conform to the respective expected aircraft control outputs; and a backup system to replace the aircraft control module when the authority of the aircraft control module is selectively removed.

Optionally, the authority of the aircraft control module is selectively removed by powering off the aircraft control module.

Powering off the aircraft control module may provide an effective way to selectively remove the authority of the aircraft control module and ensure that no erroneous aircraft control is transmitted to the aircraft.

Optionally, the aircraft control module is part of any of: an avionics system, a flight control system, a braking control system, an instrumentation and recording system, a landing gear control system and a fuel system.

This may provide an effective way to ensure that no erroneous control data is transmitted to other systems of the aircraft.

The aircraft control system comprises a backup system to replace the aircraft control module when the authority of the aircraft control module is selectively removed.

In this way, non-erroneous aircraft controls can be sent to the aircraft to control other systems of the aircraft, for example, while ensuring the control of these systems. The backup system may be used to replace the aircraft control module for the rest of the duration the flight/journey when the authority of the aircraft control module has been removed.

Optionally, the backup system is a manual system operable to perform aircraft control or a backup aircraft control module storing a second machine learning model adapted to generate live aircraft control outputs to perform aircraft control.

In this way, the pilots of the aircraft may operate the manual system (for example, the brakes of the plane) for the rest of the duration of a current flight or an alternative control module storing a second neural network which may be the same as the first neural network may be used to generate the aircraft controls. Alternatively, the manual system may be a manually-defined, rules-based set of logic for aircraft control.

Alternatively, any second neural network may be different from the first neural network. The second neural network may also be tested to ensure that it is not corrupted and that the aircraft controls are reliable.

Optionally, the test module writes test aircraft operating inputs to the aircraft control module while the aircraft control module is not performing aircraft control for a predefined duration.

This way, systems such as, for example, a flight control system or a navigation system which are operating intermittently during flights may be tested while operating.

Optionally, the test aircraft operating inputs comprise multiple different sets of test aircraft operating inputs, and the test module is adapted to write each set of test aircraft operating inputs to the aircraft control module, read test aircraft control outputs of the aircraft control module generated based on each set of the respective test aircraft operating inputs, and selectively remove the authority of the aircraft control module to perform aircraft control if at least one of the test aircraft control outputs do not conform to the respective expected aircraft control outputs for the respective test aircraft operating input set.

Optionally, the multiple sets of test aircraft operating inputs are arranged to use each weight, bias and activation function of the machine learning model.

This way, every part of the machine learning model may be tested and corruption to any bit in any part of the machine learning model may be identified.

A second aspect of the present invention provides a method for controlling an aircraft, the method comprising performing aircraft control by receiving live aircraft operating inputs and generating live aircraft control outputs, based on the received live aircraft operating inputs, at an aircraft control module comprising a memory storing a machine learning model; monitoring an operating status of the aircraft control module (<NUM>) to determine whether the aircraft control module (<NUM>) is performing aircraft control; when it is determined that the aircraft control module (<NUM>) is not performing aircraft control, writing test aircraft operating inputs to the aircraft control module while the aircraft control module is not performing aircraft control; reading test aircraft control outputs of the aircraft control module generated based on the respective test aircraft operating inputs; selectively removing the authority of the aircraft control module to perform aircraft control if the test aircraft control outputs do not conform to the respective expected aircraft control outputs; and replacing the aircraft control module with a backup system when the authority of the aircraft control module is selectively removed.

Optionally, selectively removing the authority of the aircraft control module comprises powering off the aircraft control module.

Powering off the aircraft control module may provide an effective way to selectively remove the authority of the aircraft control module and ensure that no erroneous aircraft control is transmitted to other systems of the aircraft.

Optionally, the aircraft control module is part of: an avionics system, a flight control system, a braking control system, an instrumentation and recording system, a landing gear control system and a fuel system.

The method comprises replacing the aircraft control module with a backup system when the authority of the aircraft control module is selectively removed.

In this way, non-erroneous aircraft controls can be sent to the aircraft to control systems of the aircraft, for example, while ensuring the control of these systems. The backup system may be used to replace the aircraft control module for the rest of the duration the flight/journey when the authority of the aircraft control module has been removed.

Optionally, the backup system is a manual system or a backup aircraft control module storing a backup aircraft control module storing a second machine learning model adapted to generate live aircraft control outputs to perform aircraft control.

In this way, the pilots of the aircraft may operate the manual system (for example, the brakes of the plane) for the remainder of a current flight or an alternative control module storing a second neural network which may be the same as the first neural network may be use to generate the aircraft controls. Alternatively, the manual system may be a manually-defined, rules-based set of logic for aircraft control.

Alternatively, any second network may be different from the first network. The second neural network may also be tested to ensure that it is not corrupted and that the aircraft controls are reliable.

Optionally, the writing test aircraft operating inputs to the aircraft control module occurs while the aircraft control module is not performing aircraft control for a predefined duration.

In this way, systems such as, for example, a flight control system or a navigation system which are operating intermittently during flights may be tested while operating.

Optionally, the test aircraft operating inputs comprise multiple different sets of test aircraft operating inputs, and the method comprises writing each set of test aircraft operating inputs to the aircraft control module, reading test aircraft control outputs of the aircraft control module generated based on each set of the respective test aircraft operating inputs, and selectively removing the authority of the aircraft control module to perform aircraft control if at least one of the test aircraft control outputs do not conform to the respective expected aircraft control outputs for the respective test aircraft operating input set.

A third aspect of the present invention provides an aircraft comprising the aircraft control system described above for controlling an aircraft.

Aircraft systems are becoming increasingly complex. As aircraft systems have grown in complexity, automation has been used, for example 'fly-by-wire', to alleviate an increasing burden on pilots of these aircraft. However, developing systems to provide the automation is commensurately complex.

Designers of aircraft control systems, which are used to provide the automation, are considering the inclusion of machine learning models such as neural networks in aircraft control systems. The use of artificial intelligence in aircraft control systems may be beneficial, for example, to operate an aircraft efficiently even in scenarios that may not have been foreseen in design specifications. Further, aircraft control systems employing artificial intelligence may not be bound by the experience of designers of these systems and so may be capable of identifying and operating the aircraft in more efficient ways than other aircraft control systems which are designed to a fixed specification. This is particularly the case when a new aircraft is being designed, since design parameters associated with existing fleets of aircraft may not apply to a new aircraft design.

Machine learning models in the present context may be considered to be the output of a machine learning training process that typically employs a machine learning algorithm that learns from a training dataset. A machine learning model typically comprises both data and procedures that employ the data to process inputs and produce outputs. One kind of machine learning model, which is used in the illustrations herein, is an artificial neural network or simply 'neural network'. A neural network comprises data in the form of weights and biases and procedures in the form of activation functions. Although the illustrations herein focus on neural networks, the principles apply equally to other machine learning models (such as Random Forest and Support Vector Machines) that can be impacted in aircraft systems in the manner that will now be described.

Neural networks that may be deployed in the aviation industry may be large, complex and multi-layered and may control systems. Such neural networks may comprise a vast array of constants defining weights and biases of neurons and their connections. It has been appreciated that one potential issue that may be encountered when using systems comprising neural networks at high altitude is the corruption of the neural network due to electromagnetic radiation, such as gamma radiation. In particular, it has been appreciated that gamma radiation may cause single event upsets or multi-event upsets in data, stored in random access memory (RAM), which defines the neural network or, indeed, any other kind of machine learning model). Even small changes in data, for example even a change in one bit of data, would have the potential to modify weights and biases in a neural network and change the behaviour thereof. In this way, a neural network that was well-designed and robust, and previously capable of safely controlling an aircraft, may become unreliable.

Certain examples described herein relate to an aircraft control system comprising an aircraft control module of known kind comprising a neural network, wherein the aircraft control system controls the aircraft based on outputs from the aircraft control module. A test module may be used to determine whether the neural network is corrupted by comparing test aircraft control outputs generated by the neural network of the aircraft module with respective excepted aircraft control outputs. Beneficially, in case of corruption, for example, if the aircraft control outputs do not conform to the respective excepted aircraft control outputs, the test module selectively removes the authority of the aircraft control module in case of corruption. A backup system, such as a manual system or another neural network may be used to replace the aircraft control module for the rest of the duration of the current flight.

<FIG> shows an aircraft control system <NUM> comprising an aircraft control module <NUM> and a test module <NUM>. The aircraft control system <NUM> may be implemented in any appropriate combination of hardware and software components including, for example, at least one processor, at least one memory, and one or more interfaces for interfacing with equipment in the aircraft. The at least one memory includes any suitable combination of transitory and non-transitory storage and stores computer-readable instructions for implementing the aircraft control module <NUM> and the test module <NUM>.

The aircraft control module <NUM> of the aircraft control system <NUM> is adapted to receive live aircraft operating inputs, 102a-102f, and to generate live aircraft control outputs, 104a- 104b, which are used to control an aircraft.

The test module <NUM> is adapted to write test aircraft operating inputs, 102a'-102f', to the aircraft control module <NUM> and read test aircraft control outputs, 104a'-104b', of the aircraft control module <NUM> generated based on the respective test aircraft operating inputs. The test module <NUM> uses these test aircraft control outputs, 104a'-104b', to determine whether they conform to respective expected aircraft control outputs, 114a-114b. It will be appreciated that while in this example the neural network has six inputs and two outputs, in other examples there can be any appropriate number of inputs and outputs.

It will be appreciated that a neural network according to examples herein may, in practice, be subjected to a vast array of different arrangements or combinations of live aircraft operating inputs, 102a-102f. Any individual set of live aircraft operating inputs, 102a-102f, may produce respective aircraft control outputs by using only a portion of the neural network. Put another way, only a subset of the weights, biases and activation functions of a neural network may be brought to bear (i.e. used) to process any one individual set of aircraft operating inputs. Consequently, it will be appreciated that multiple sets of test aircraft operating inputs, 102a'-102f', may be selected and adapted to ensure that every weight, bias and activation function of a respective neural network dominates, or is 'used', at least once in performing a test operation comprising use of the multiple sets of test aircraft operating inputs. In the present example, for instance, each set of test aircraft operating inputs 102a'-102f' may comprise a different arrangement of six inputs. In particular, each input may be defined to result in a known output (the expected aircraft control outputs, 114a-114b) and thereby each bias and each weight of the neural network <NUM> may be tested. Alternatively, the test aircraft operating inputs, 102a'-102f', may include values of hidden neurons of the neural network <NUM> and the test module <NUM> may, during testing, override values of the hidden neurons in order to test one layer of the neural network <NUM> at a time. In this way, it can be assured that corruption to any bit in any part of the neural network can be identified by at least one set of test aircraft operating inputs. When testing neural networks which maintain state, i.e. include state memory, as in those which process sequences of inputs rather than individual inputs, it will be appreciated that each individual test may involve multiple sets of test aircraft operating inputs. In such examples, multiple tests, each comprising multiple sets of test aircraft operating inputs, may be required to assure that every weight, bias and activation function of a respective neural network dominates, or is 'used', at least once in performing a test operation.

The aircraft control module <NUM> comprises a memory <NUM> storing a neural network <NUM>. At least a portion of the memory <NUM> includes volatile memory that may suffer from data corruption, for example due to gamma radiation as explained hereinbefore, and so may include random-access memory (RAM), synchronous dynamic random-access memory (SDRAM), or any other type of memory where respective bit values may be corrupted. In particular, the weights and biases of the neural network <NUM> may suffer from data corruption. The neural network <NUM> may be, for example, any known type of neural network that can be trained and deployed as an element in an aircraft control system. For example, the neural network <NUM> may be a fully connected neural network <NUM>, a convolutional neural network, or a recurrent neural network. The neural network <NUM> in the aircraft control module <NUM> has been trained in a known way, for example by reference to training data relating to the operation and behaviour of a known aircraft system. Training may be performed using a large data set comprising historic data from known aircraft systems, or by being installed on an aircraft in a purely passive role, for period of time, to record and train using live data.

The test module <NUM> comprises a memory <NUM> storing input data representing test aircraft operating inputs, 102a'-102f', and a memory <NUM> storing respective output data representing expected aircraft control outputs, 114a-114b. The memories <NUM>, <NUM> may comprise any suitable combination of volatile and non-volatile memories. The test module <NUM> also comprises a monitor <NUM>, to monitor an operating status of the control module <NUM> via a sense line <NUM>, and select, via a control line <NUM>, which inputs to send to the aircraft control module <NUM>. The test module also comprises a memory <NUM> storing test aircraft control outputs, 104a'-104b' from the aircraft control module <NUM>. The test module <NUM> also comprises a comparison module <NUM> for comparing the test aircraft control outputs, 104a'-104b' and respective output data representing expected aircraft control outputs, 114a-114b.

According to the present example, the aircraft control system <NUM> comprises a selector <NUM> for selecting inputs to be sent to the aircraft control module <NUM>. The selector <NUM>, which may comprise a multiplexor or a switch device, may select live aircraft operating inputs, 102a-102f, or test aircraft operating inputs, 102a'-102f', to be sent to the aircraft control module <NUM>. In other examples, the aircraft control system <NUM> may also comprise a second selector module (not shown in <FIG>) for selecting the outputs to be sent to the aircraft or to the test module <NUM>. For example, such a second selector module may select live aircraft control outputs, 104a-104b, to be sent to the aircraft (to perform aircraft control), or test aircraft control outputs, 104a'-104b', to be sent to the test module <NUM>, based on a status of the control module <NUM> determined by the monitor <NUM>.

Certain examples described herein provide a method for controlling an aircraft using an aircraft control module <NUM> comprising a neural network <NUM> and a test module <NUM> for removing the authority of the aircraft control module <NUM> if test the aircraft control outputs 104a'-10b' generated by the aircraft control module <NUM> do not conform to respective expected aircraft control outputs 114a-114b stored in the test module <NUM>.

<FIG> shows a method <NUM> which is implemented by the aircraft control system <NUM>, in the form of a flow chart, <NUM> to <NUM>. The method <NUM> comprises, at a first block <NUM>, receiving live aircraft operating inputs, 102a-102f, and generating live aircraft control outputs, 104a-104b, based on the received live aircraft operating inputs, 102a-102f, at an aircraft control module <NUM> comprising a memory <NUM> storing a neural network <NUM>.

The live aircraft operating inputs, 102a- 102f, represent an operating state of the aircraft and include, for example, signals from sensors and signals resulting from user operations and inputs. Signals from user inputs include control signals generated at interfaces such as switches, levers, buttons, inputs from touch screens, and the like. These input control signals are received from any suitable interfaces in the aircraft, for example, flight controls, cabin environment controls, communication controls, and others. The specific nature and origin of the user inputs depends on the systems in the aircraft which the aircraft control system <NUM> is adapted to control. Signals from sensor outputs include signals from any suitable sensors in the aircraft. These sensors can include environmental sensors, which monitor the environmental conditions of the aircraft, and equipment sensors, which monitor the operational states of equipment in the aircraft. For example, the live aircraft operating inputs, 102a-102f, may indicate live operational states of one or more hydraulic systems which are configured to operate the brakes, as well as the status of one or more alternative (e.g. electrical) motors and respective power sources for operating the brakes in the event of hydraulic failure. The live aircraft operating inputs, 102a-102f, may also comprise other relevant information, for example, a live operational state of the engines of the aircraft, an indication of whether there is weight-on-wheels, and indications of environmental conditions such as wind speed and direction, and outside temperature and humidity, derived from one or more aircraft sensors. The live aircraft operating inputs 102a to 102f may represent states of equipment comprised in other aircraft systems. The live aircraft operating inputs, 102a-102f, may be received or sampled in a time period or may be time-varying, and may be analogue or digital in nature. Analogue signals are converted, for example via an appropriate analogue-to-digital convertor (not shown), before being input to the aircraft control module <NUM>.

The live aircraft control outputs, 104a-104b, generated by the aircraft control module <NUM> are used to perform aircraft control. The aircraft control module <NUM> is part of an aircraft system. For example, the aircraft control module <NUM> may be part of any of: an avionics system, a flight control system, a braking control system or other partly or fully hydraulic control system, an instrumentation and recording system, a landing gear control system and a fuel system. For example, where the aircraft control module <NUM> is part of a braking control system, the aircraft control module <NUM> may be adapted to receive live aircraft operating inputs, 102a-102f, relating to wheel speed, aircraft speed, and an amount of braking specified at a brake pedal by the pilot. The aircraft control module <NUM> may process these inputs and determine an amount of braking to be applied. The aircraft control module <NUM> may then operate the brakes in a manner dictated by outputs of the aircraft control module <NUM> according to the received live aircraft operating inputs, 102a-102f. As with the inputs, the live aircraft control outputs, 104a-104b, may be conditioned or converted in any way that is necessary for a required downstream control.

The method <NUM> then comprises, at a second block <NUM>, writing test aircraft operating inputs, 102a'-102f', to the aircraft control module <NUM> while the aircraft control module <NUM> is not performing aircraft control, for example, as determined by the monitor <NUM>. The test aircraft operating inputs, 102a'-102f', represent an operating state of the aircraft that may otherwise have been received as live aircraft operating inputs, 102a-102f. For example, test aircraft operating inputs, 102a'-102f', may reflecting a possible operational state of at least one operating component of the aircraft. For example, a possible operational state of the at least one component of the aircraft may comprise a possible control input. The possible control input may be due to aircrew such as a pilot operating or actuating a device, apparatus or system. The possible control input may include a value of a control input, for example, a value representing the position of a throttle, a braking actuator, and/or other control inputs. Alternatively or additionally, the possible control input may comprise a rate of change rather than a value. In some examples, the possible control input may be a multivariate quantity indicating both an instantaneous value (e.g. a position) and a rate and/or direction of change. The possible control input may be represented by a plurality of values or a plurality of multivariate quantities expressing an operation of a device, apparatus or system over a defined period. In another example, the at least one component associated with the aircraft control system <NUM> may be the brakes of an aircraft, and the test aircraft operating inputs, 102a'-102f', may indicate whether there is weight-on-wheels, environmental conditions such as wind speed and direction, and outside temperature and humidity.

The expected aircraft control outputs, 114a-114b, are generated by inputting the test aircraft operating inputs, 102a'-102f', into a neural network when operating under controlled or test conditions, which are designed to mirror a real operation of the aircraft and aircraft control module <NUM>. Before and after the generation of the expected aircraft control outputs, 114a-114b, the values of the constants of the neural network are checked to establish that no unexpected changes have occurred and thereby confirm that the expected aircraft control outputs, 114a-114b, are correct. Once confirmed, the expected aircraft control outputs, 114a-114b, are stored in the test module <NUM>. The expected aircraft control outputs 114a, 114b may be generated by a neural network being the same as the neural network <NUM> of the aircraft control module <NUM>. For example, if a component to be controlled comprises the brakes of an aircraft, the test aircraft operating inputs, 102a'-102f', may indicate whether there is weight-on-wheels, environmental conditions such as wind speed and direction, and outside temperature and humidity. The excepted aircraft control outputs, 114a-114b, may then represent the control of the brakes based on the weight-on-wheels, environmental conditions, and outside temperature and humidity inputs.

The test module <NUM> is adapted to write the test aircraft operating inputs, 102a'-102f', to the aircraft control module <NUM> while the aircraft control module <NUM> is not performing aircraft control, so that the operation of the aircraft control module is not disturbed. For example, if the aircraft control module <NUM> is adapted to perform aircraft control of the brakes, the test module <NUM> may write the test aircraft operating inputs, 102a'-102f', to the aircraft control module <NUM> at any time of the flight other than while landing.

In the test module <NUM>, the monitor <NUM> determines whether the aircraft control module <NUM> is performing aircraft control and controls the selector <NUM> to communicate to the aircraft control module <NUM> either:.

live aircraft operating inputs, 102a-102f, when the aircraft control module <NUM> is performing aircraft control, or
test aircraft operating inputs, 102a'-102f', when the aircraft control module <NUM> is not performing aircraft control.

For example, consider a scenario in which the aircraft control system <NUM> is adapted to control the brakes of an aircraft. The monitor <NUM> of the test module <NUM> is adapted to determine whether the aircraft control module <NUM> is performing brake control. This may be determined in this example by checking the status of the aircraft control system <NUM>. If the monitor <NUM> determines that the control module <NUM> is not performing brake control, the test module <NUM> writes test aircraft operation inputs, 102a'-102f', related to brake operations (for example, information related to whether there is weight-on-wheels, environmental conditions such as wind speed and direction, and outside temperature and humidity) to the selector <NUM> and controls the selector <NUM> to select and transmit the test aircraft operating inputs, 102a'-102f', to the aircraft control module <NUM>. At all other times, for instance when the aircraft control module <NUM> is performing aircraft (e.g. brake) control, the selector <NUM> is arranged to transmit live aircraft operating inputs, 102a-102f, to the aircraft control module <NUM>.

In another example, the test module <NUM> may write test aircraft operating inputs, 102a'-102f', to the aircraft control module <NUM> while the aircraft control module <NUM> is not performing aircraft control and based on certain criteria. For example, in respect of an aircraft braking system, the test module <NUM> may be responsive to the passing of a predetermined period of time after take-off (i.e. when it is known that braking is not required). In another example, in which the aircraft control system <NUM> may be adapted to control a navigation system of an aircraft. The navigation system may be operating intermittently during flight and, therefore, the monitor <NUM> of the test module <NUM> may be adapted to determine whether the aircraft control module <NUM> is not performing navigation control for at least a predefined duration of time. The predefined duration of time may be, for example, <NUM>, <NUM>, or <NUM>.

The method <NUM> also comprises, at a third block <NUM>, reading test aircraft control outputs, 104a'-104b', of the aircraft control module <NUM> generated based on the respective test aircraft operating inputs, 102a'-102f'.

The aircraft control module <NUM> generates test aircraft control outputs, 104a'-104b', based on the received test aircraft operating inputs, 102a'-102f'. For example, according the previous example, if the test aircraft operation inputs, 102a'-102f', represent information related to whether there is weight-on-wheels, environmental conditions such as wind speed and direction, and outside temperature and humidity, the aircraft control module <NUM> generates test aircraft control outputs, 104a'-104b', that relate to the operation of the brakes of the aircraft based on the received information related to whether there is weight-on-wheels, environmental conditions such as wind speed and direction, and outside temperature and humidity.

The aircraft control module <NUM> outputs the test aircraft control outputs, <NUM>'-104b' and the test module <NUM> is adapted to read the test aircraft control outputs, <NUM>'-104b', generated by the aircraft module <NUM>. The test module <NUM> comprises a comparison module <NUM> adapted to perform a comparison function between the test aircraft control outputs, <NUM>'-104b', and the respective expected aircraft control outputs, 114a-114b.

The method also comprises at a fourth block <NUM>, selectively removing the authority of the aircraft control module to perform aircraft control if the test aircraft control outputs do not conform to the respective expected aircraft control outputs. If the comparison module <NUM> determines that the test aircraft control outputs, <NUM>'-104b', conform to the respective excepted aircraft control outputs, 114a-114b, no action is taken. However, if the comparison module <NUM> determines that the test aircraft control outputs, <NUM>'-104b', do not conform to the respective excepted aircraft control outputs, 114a-114b, the test module <NUM> is adapted to selectively remove the authority of the control module <NUM>. For example, the test module <NUM> may selectively remove the authority of the control module <NUM> for at least the duration of a current journey/flight. That way, the aircraft control module is prevented from performing potentially erroneous aircraft control due to, for example, a corruption of the neural network. The test module <NUM> may selectively remove the authority of the aircraft control module <NUM>, for example, by powering-off, or in some other way, disabling the aircraft control module <NUM>. Additionally, a pilot of the aircraft may be notified that the aircraft control module <NUM> has been de-authorised and/or disabled.

In another embodiment, the aircraft control system <NUM> may comprise a backup system to replace the aircraft control module <NUM> when the authority of the aircraft control module <NUM> is selectively removed. The backup system may be a manual system operable to perform aircraft control. For example, the aircraft control module <NUM> may be part of the braking control system. If the test module <NUM> determines that the test aircraft control outputs, 104a'-104b', do not conform to the respective expected aircraft control outputs, 114a-114b, the test module <NUM> selectively removes the authority of the aircraft control module <NUM>. The pilots of the aircraft may operate the brakes for the rest of the duration of a current flight. Alternatively, the manual system may be a manually-defined, rules-based set of logic for aircraft control. Alternatively, the backup system may be a backup aircraft control module comprising a second neural network adapted to generate live aircraft control outputs to perform aircraft control. The second neural network may be the same as the neural network <NUM> of the aircraft control module <NUM> which may be used for the rest of the duration of the current flight. Alternatively, the second neural network may be different from the neural network <NUM>.

<FIG> shows an example of an aircraft control system <NUM> according to an example. The aircraft control system <NUM> comprises all the features discussed above in relation to <FIG> and <FIG>, and also comprises a backup aircraft control module <NUM>'. The backup aircraft control module <NUM>', according to this example, comprises a memory <NUM>' storing a neural network <NUM>'. The memory <NUM>' may be the same as the memory <NUM> of the aircraft control module <NUM>, and the neural network <NUM>' may be the same as the neural network <NUM> of the aircraft control module <NUM>. In other examples, the aircraft control module <NUM>' may not include a neural network. In any case, the backup aircraft control module <NUM>' is adapted to replace the aircraft control module when the authority of the first aircraft control module <NUM> is selectively removed.

As explained above, the comparison module <NUM> is adapted to determine whether the test aircraft control outputs, <NUM>'-104b', do not conform to the respective excepted aircraft control outputs, 114a-114b, and the test module <NUM> is adapted to selectively remove the authority of the control module <NUM> if the test aircraft control outputs, <NUM>'-104b', do not conform to the respective excepted aircraft control outputs, 114a-114b.

The test module <NUM> is adapted to authorise the operation of the backup aircraft control module <NUM>' via a control line <NUM>. When the test module <NUM> authorises the operation of the backup aircraft control module <NUM>', the selector <NUM> is adapted to select the live aircraft operating inputs, 102a-102f, to be sent to the aircraft control module <NUM>'. The backup aircraft control module <NUM>' is adapted to receive the live aircraft operating inputs, 102a-102f, and generate the live aircraft control outputs, 104a- 104b.

For example, consider a scenario in which the aircraft control system <NUM> is adapted to control the brakes of an aircraft. In case of corruption of the neural network <NUM>, the comparison module <NUM> of the test module <NUM> determines that the test aircraft control outputs, <NUM>'-104b', do not conform to the respective excepted aircraft control outputs, 114a-114b. The test module <NUM> selectively removes the authority of the control module <NUM> for the remainder of the current flight. The test module <NUM> authorises the operation of the backup aircraft control module <NUM>' for the remainder of the current flight. The backup aircraft control module <NUM>' receives the live aircraft operating inputs, 102a-102f, related, for example, to an indication of whether there is weight-on-wheels, and indications of environmental conditions such as wind speed and direction, and outside temperature and humidity. The backup aircraft control module <NUM>' generates the live aircraft control outputs, 104a- 104b, which are used to control the brakes of the aircraft.

<FIG> shows an aircraft control system <NUM> and an alternative aircraft control system <NUM>'. According to an example, the aircraft control system <NUM> and the alternative aircraft control system <NUM>' comprise all the features discussed above in relation to <FIG> and <FIG>. The aircraft control system <NUM> comprises a main or primary aircraft control module <NUM> whereas the alternative aircraft control system <NUM>' comprises a backup aircraft control module <NUM>'. The backup aircraft control module <NUM>' is a manual system operable to perform aircraft control. In other examples, the backup aircraft control module <NUM>' may comprise a second neural network.

For example, consider a scenario in which the aircraft control system <NUM>' is adapted to control the brakes of an aircraft. In case of corruption of the neural network <NUM>, the comparison module <NUM> of the test module <NUM> determines that the test aircraft control outputs, <NUM>'-104b', do not conform to the respective excepted aircraft control outputs, 114a-114b. The test module <NUM> selectively removes the authority of the control module <NUM> for the rest of the duration of the current flight and a handover operation is performed to replace the aircraft control system <NUM> with the alternative aircraft control system <NUM>'. For example, upon authorisation, the pilots of the aircraft may receive an alert to operate the manual system (e.g. the alternative aircraft control system <NUM>'). The pilots of the aircraft operate the brakes for the rest of the duration of a current flight.

<FIG> shows an example of an aircraft <NUM> an aircraft control system <NUM> according to the examples described above in relation to <FIG> <FIG> and <FIG>. In the present example, the aircraft <NUM> is a fully operational aircraft. The aircraft <NUM> comprises an aircraft control module <NUM> and a test module <NUM> according to any of the examples described above and at least one of the following systems: an avionics system, a flight control system, a braking control system, an instrumentation and recording system, a landing gear control system and a fuel system comprising the aircraft control module <NUM>.

Alternatively, the aircraft <NUM> may be a test aircraft <NUM> which may not be a fully operational aircraft but may be part of an aircraft. The aircraft control system <NUM> may be comprised in the test aircraft <NUM> comprising aircraft systems which the control system <NUM> is adapted to control. For example, the test aircraft <NUM> may be missing one or more aircraft systems, such as an avionic system, and may be confined to a test station at which tests are performed on specific aircraft systems which are comprised in the test aircraft <NUM>, such as those controlled by the aircraft control system <NUM>.

Additionally or alternatively, the aircraft <NUM> may comprise the aircraft control system <NUM>' according to the examples described above in relation to <FIG>.

Claim 1:
An aircraft control system (<NUM>) comprising:
an aircraft control module (<NUM>) comprising a memory storing a machine learning model adapted, based on received live aircraft operating inputs (102a to 102f), to generate live aircraft control outputs (104a-104b), to perform aircraft control;
a test module (<NUM>) comprising:
a memory storing input data representing test aircraft operating inputs (102a'-102f') and respective output data representing expected aircraft control outputs (114a, 114b) that are expected to be generated by the aircraft control module (<NUM>) in response to an input of the respective test aircraft operating inputs (102a'-102f');
a monitor (<NUM>) configured to monitor an operating status of the aircraft control module (<NUM>),
wherein, the test module (<NUM>) is adapted to:
determine, using the monitor (<NUM>), whether the aircraft control module (<NUM>) is performing aircraft control;
when it is determined that the aircraft control module (<NUM>) is not performing aircraft control, write test aircraft operating inputs (102a'-102f') to the aircraft control module (<NUM>);
read test aircraft control outputs (104a'-104b') of the aircraft control module (<NUM>) generated based on the respective test aircraft operating inputs (102a'-102f'); and
selectively remove the authority of the aircraft control module (<NUM>) to perform aircraft control if the test aircraft control outputs (104a'-104b') do not conform to the respective expected aircraft control outputs (114a, 114b); and
a backup system to replace the aircraft control module when the authority of the aircraft control module is selectively removed.