Argus

Until the Pilot Returns

THE SYSTEM THEY COULD AGREE TO BUILD

The disputed part of the proposal was what Argus would be allowed to do after the pilot stopped answering.

Recovering an aircraft from a dive was easy to defend. So was keeping it level while an injured pilot struggled to breathe. The difficulty began with a different question: what if someone was still trying to shoot the aircraft down?

The engineers could give Argus the ability to respond. Giving it permission required a separate decision.

Argus was being developed by an independent defense contractor for a future seventh-generation fighter. Its brain-computer interface was intended to help the aircraft respond to its pilot with less delay. The system would learn patterns associated with that individual’s intended actions and monitor signs that the demands of flight were exceeding their ability to respond.

The pilot would still have ordinary controls. A poor signal could not be treated as an order, and a disconnected sensor could not be allowed to leave the fighter helpless. Argus needed its own understanding of the aircraft’s condition, built from the instruments and sensors available to it.

Its other responsibility began when the pilot could no longer fly.

High acceleration could cause a blackout. Injury could prevent movement. A pilot might remain conscious and still be unable to recover an aircraft in time. In those circumstances, waiting for another command could cost the life Argus had been built to protect.

The program’s central promise was simple: bring the pilot home.

The arguments over that promise continued through the project’s reviews. Supporters wanted a system capable of surviving the emergency it had inherited. Critics asked who would be responsible for force used while the person in the cockpit was unconscious. Calling an action defensive would not make every possible response acceptable. Nor would a short period of autonomy undo a mistaken attack.

The agreement that allowed development to continue gave Argus temporary emergency authority. It could assume flight control when defined evidence showed that the pilot was incapable of flying. Stabilization, escape from immediate danger, and recovery took priority. Defensive force was permitted only within the restrictions approved for the system and its use. The emergency did not authorize Argus to invent a new mission or pursue an enemy after a safe withdrawal became possible.

The pilot’s survival remained its overriding mission objective within those boundaries. Independent safeguards were supposed to enforce the boundaries even when Argus judged that a different action would improve its chances.

Returning control mattered as much as taking it. Argus would have to establish that the pilot could safely resume command, complete an authorized handover, or bring the aircraft through recovery. A brief sign of responsiveness would not necessarily be enough. Neither would the system be allowed to retain emergency authority merely because it preferred its own decisions.

Those conditions shaped the architecture. Pilot-state monitoring, flight control, permitted action, and supervision had different jobs. The protection of the pilot could not depend on every part of the system working perfectly at once.

LEARNING A PILOT

Argus learned through simulation and laboratory testing while the aircraft itself remained in development.

Its training included situations in which the pilot’s next action arrived too late, situations in which the interface supplied unreliable information, and situations in which no useful human input arrived at all. The controller needed to distinguish those failures without assuming that silence meant the same thing every time.

The operator model gave it a continuing reference. An individual pilot’s timing, responses, and decisions helped it interpret later signals. That adaptation was useful because people differed.

Argus could fly autonomously during an emergency without being independent of the pilot in every other respect. Parts of its higher-level reasoning still expected an operator: someone whose intentions helped resolve priorities and whose recovery gave the emergency a direction.

Its developers were building a system for an occupied cockpit. They expected the pilot to be a living person, connected to the aircraft through a defined interface. The safeguards, tests, and return-of-control requirements were designed around that relationship.