The problem: the autopilot that runs at full authority until it cannot

Modern flight guidance systems operate as a binary. The autopilot is engaged, holding the aircraft at full authority, or it is disconnected, with the human flying. The transition between those two states is abrupt and, from the flight deck, frequently a surprise. When sensor inputs become inconsistent, when an aerodynamic regime falls outside the certified envelope, or when the control law detects conditions it was never designed to handle, the system disengages and an aural and visual warning fires. Control reverts instantly and completely to a crew that, in cruise or in a high-workload approach, may have had no graduated indication that the automation's competence was decaying.

This failure mode has a name in human-factors literature: automation surprise. It is a recurring contributor to loss-of-control-in-flight and controlled-flight-into-terrain accidents. The crew is handed a degraded, often unusual aircraft state at the precise moment they have the least situational context, because the automation said nothing while it was still nominally in control and degrading.

The certification and advisory stack that governs these systems is built around the assumption that the human is the ultimate adaptive controller and the autopilot is a high-authority but brittle servant. FAA Part 25 and EASA CS-25 airworthiness rules, FAA Advisory Circular 25.1329 for flight guidance system approval, ICAO Annex 8, RTCA DO-178C for airborne software, RTCA DO-254 for complex airborne hardware, SAE ARP4754A for system development, and MIL-STD-882E for system safety on military variants all presume a clean handoff at the boundary of the automation's competence. None of them presumes that the automation can know, in advance and continuously, that it is approaching that boundary and can warn the crew accordingly. That continuous self-knowledge is exactly what Confidence Governance supplies.

The inventive step: execution as a revocable permission

This application is rooted in Confidence Governance, the confidence governor of the cognition platform disclosed as Chapter 5 of United States Patent Application 19/647,395. It draws on two sibling primitives in the same disclosure: the capability envelope (Chapter 6), which the confidence computation queries to determine whether the system possesses what the current task demands, and the integrity engine (Chapter 3), which feeds the confidence computation a signal of behavioral coherence.

The core idea Confidence Governance contributes is that control authority is a revocable permission, not a default state interrupted only by failure. In a conventional autopilot, engagement is assumed until something breaks. In a confidence-governed autopilot, the right to hold authority is continuously re-earned. The disclosure defines a confidence governor that treats execution as a conditional privilege, continuously re-evaluated against the system's own computed sufficiency, and that withdraws authorization the moment the conditions under which it was granted no longer hold. Critically, the governor is a hard gate, not an advisory: the system cannot override a withdrawal of authority through urgency, intent priority, or self-assessment. There is no alternative pathway to execution that bypasses the gate.

Mapped to the flight deck, this inverts the failure model. The autopilot does not hold full authority until it abruptly cannot. It holds authority only while its computed confidence remains above the authorization threshold, and it surrenders authority in a structured, observable way as that confidence decays.

Confidence as a first-class computed state variable

In the disclosed architecture, confidence is not a heuristic score or a probability annotation. It is a first-class, continuously computed state variable occupying a designated field in the system's data structure, written by a deterministic evaluation function over a structured input vector, and recorded in lineage so that every change is auditable. The evaluation function produces two outputs: a confidence value, a continuous scalar where the lower bound is complete assessed insufficiency and the upper bound is complete assessed sufficiency, and a confidence rate of change, the derivative of that value over time.

The disclosure enumerates the inputs to that function, and each maps cleanly onto an avionics signal already present on a modern aircraft:

  • Capability sufficiency compares the system's capability envelope against the task's requirements. In flight: does the current control law cover the aerodynamic regime the aircraft is actually in, given configuration, Mach, and angle of attack?
  • Resource availability measures whether the resources execution depends on are present and projected to remain present. In flight: sensor health and redundancy, valid air-data and inertial sources, actuator authority margin, and electrical and hydraulic state.
  • Internal integrity state feeds the integrity-field value into confidence. In flight: cross-channel consistency between redundant sources, and detection of sensor disagreement before a single channel is trusted.
  • Memory and experiential state weighs accumulated history of similar conditions. In flight: prior behavior of the control law under comparable turbulence, icing, or upset onset.

On the task side the disclosure adds task requirements specification, temporal constraints, uncertainty magnitude, and forecasted execution cost. In flight these correspond to the precision the current phase demands, the time available before a regime boundary is reached, the degree of unresolved disagreement among inputs, and the projected cost and risk of continuing to hold authority. Confidence is independent of intent in the disclosure: an eager agent does not thereby become a confident one. The flight-deck analogue is that the system's drive to keep flying the profile never inflates its assessment of whether it should.

Trajectory projection: warning the crew before the boundary

The feature that most directly defeats automation surprise is trajectory projection. The disclosed governor does not gate on the absolute confidence value alone. It performs differential rate analysis, computing the difference between the confidence decay rate and the confidence recovery rate at each evaluation cycle, and it maintains a confidence trajectory projection that extrapolates the current value forward using the differential rate and, optionally, its second derivative. From that projection it computes an estimated time-to-threshold: the projected duration until confidence crosses the authorization boundary on the current trajectory.

When that estimated time-to-threshold falls below a configured safety margin, the governor initiates a graceful suspension sequence regardless of the current absolute value. This is the architectural answer to abrupt disconnection. Long before confidence actually crosses the boundary, the system can see that it is heading there and can begin a pre-announced, orderly transfer of authority. The disclosure also defines differential-rate alarm conditions, a decay-rate spike indicating a sudden adverse event, a recovery-rate collapse indicating that ameliorative processes have stalled, and a sustained negative differential indicating chronic deterioration, each triggering a calibrated response from increased evaluation frequency through to immediate suspension. On the flight deck, a decay-rate spike maps to a sudden sensor failure or upset onset, a sustained negative differential to a slowly worsening icing or system condition.

Three authorization states and graduated transfer

The disclosed gating operates in exactly three states, and they translate directly into a graduated-authority autopilot:

  • Authorized. Confidence is above the authorization threshold and the trajectory triggers no alarm. The autopilot holds full authority and flies the profile.
  • Suspended. Confidence has fallen below the threshold, or the trajectory has triggered preemptive suspension, so high-authority execution is prohibited, but cognition continues. The crucial property here is the structural separation of execution from cognition: an autopilot in the suspended state stops committing high-authority control actions while its forecasting, monitoring, and inquiry functions keep running. It can keep computing the situation, keep projecting, and keep advising the crew rather than going dark.
  • Locked. Reserved for severe conditions, a catastrophic resource failure or a governance-mandated halt, where continued high-authority operation is restricted pending external, in this case crew, intervention. The disclosure makes the transition into locked non-self-reversible: recovery requires external authorization.

Between authorized and suspended sits the graduated transfer that the binary autopilot lacks. The suspended state is not a disconnect; it is a structurally governed pause in which the system relinquishes high-authority commitment but continues to think and to communicate. The crew receives progressive awareness of declining confidence and a staged handback rather than a single startle event.

Task-class differentiation: the right kind of degradation

The disclosure does not apply one interruption protocol to every situation. Its task-class differentiation recognizes at least three structurally distinct classes and applies a different protocol to each, and this maps usefully onto flight phases that differ in reversibility and tolerance for partial execution:

  • Terminal-class tasks have high irreversibility and low tolerance for state corruption. The protocol prioritizes state preservation: halt at the earliest safe point and protect partial progress in a durable checkpoint. In flight this is the high-irreversibility phase, late approach near terrain, where the correct degraded behavior is to hold the aircraft in a known-safe trim and hand the crew a stable, recoverable state rather than experiment.
  • Exploratory-class tasks have low irreversibility and high tolerance for redirection; the protocol broadens the search across alternatives. In flight this is the high-altitude cruise regime, where there is room and time to evaluate alternative sources and reconfiguration before any authority change is forced.
  • Generative-class tasks have creative objectives and high commitment-timing sensitivity; the protocol shifts to lower-commitment, tentative output. In flight this is a reconfiguration or recovery maneuver where the system proposes a graded set of candidate responses rather than committing irreversibly to one.

Task-class assignment in the disclosure is performed by a classifier over the task's structural properties, may be a hybrid inheriting the most conservative constraints of each contributing class, and is recorded in lineage and auditable. Auditable lineage is itself a certification asset: the recorded confidence trajectory and authorization-state history provide exactly the kind of deterministic, reconstructable evidence trail that DO-178C and ARP4754A processes demand.

Hysteresis: no oscillation at the boundary

A naive confidence gate would chatter, repeatedly re-engaging and disengaging as confidence fluctuates near the threshold, which on the flight deck would be its own hazard. The disclosure forecloses this. The transition from suspended back to authorized requires the confidence value to exceed the authorization threshold by a configurable hysteresis margin, so the system does not oscillate between holding and releasing authority when confidence hovers at the boundary. A confidence-governed autopilot therefore recovers authority deliberately, only once its computed sufficiency has cleared the threshold with margin, never in a flapping cycle.

Deployment embodiments

This pattern is not a single point design. The disclosure's gating, trajectory projection, three states, and task-class protocols admit a range of implementations across the airborne fleet:

  • Transport-category flight guidance, where the governor sits alongside the existing flight guidance computer and converts the binary engage/disconnect into authorized, suspended, and locked with pre-announced graduated handback under CS-25 and Part 25.
  • Military and rotorcraft variants, where MIL-STD-882E system-safety severity classes map onto the configured safety margin and the locked-state triggers.
  • Optionally piloted and uncrewed platforms, where the suspended state, with cognition continuing while high-authority execution is withheld, becomes the principal safe-degradation mode and the inquiry function escalates to a remote operator rather than an onboard crew.
  • Advanced air mobility and eVTOL, where the graduated-authority model and trajectory projection support certification of novel control regimes that have no long human-factors baseline to fall back on.
  • Retrofit advisory layer, a non-authority-bearing embodiment in which the governor computes confidence and trajectory and drives crew advisories only, providing the early-warning benefit without altering the certified control path.

A skilled implementer building any of these wires the confidence inputs to existing avionics signals (air data, inertial, sensor-health, actuator-margin, configuration), implements the deterministic evaluation function and differential-rate analysis described above, gates the high-authority control output through the three-state mechanism with the hysteresis margin on recovery, and routes the suspended-state cognition into the crew advisory and inquiry channel.

Why this is defensible

The shift from binary engagement to confidence-governed, graduated authority transfer is what makes this safe-degradation behavior possible, and it is the disclosed inventive step that supplies it: confidence as a first-class computed gate, trajectory projection with pre-emptive suspension, three authorization states with hysteresis, and task-class-differentiated interruption. The avionics framing here, the mapping to certification standards, sensor signals, and flight phases, is an enabling implementation of that disclosed technology, not new technology dressed as a use case.

Disclosure Scope

The confidence governance technology underlying this application, including confidence as a first-class computed state variable, execution as a revocable permission enforced by a hard gate, confidence trajectory projection with pre-emptive suspension, the authorized, suspended, and locked authorization states, hysteresis on recovery, and task-class-differentiated interruption, is disclosed in United States Patent Application 19/647,395. The aviation deployment scenarios, certification-standard mappings, and flight-phase embodiments described above are application-specific framing and are not themselves claims of that application. This article is published as a dated, enabling public disclosure tied to that application.