What the autonomy co-pilot actually does, and what it is not allowed to do

Every ship Halcyon delivers today includes an onboard autonomy system we call the co-pilot. It runs on hardened flight computers, it is certified to the same standard as the flight controls, and it has flown more than 400 million kilometres across the fleet. It is also, by design, not in charge. I want to explain what it does and why we drew the line where we did.

The co-pilot's job is workload. On an Atlas Heavy Freighter, three pilots manage a 612-metre ship carrying 52,000 tonnes. Without automation they would spend most of their time monitoring drive temperatures, recomputing trajectories and checking hundreds of system parameters. The co-pilot does all of that continuously and surfaces only what matters, so a three-person flight crew can do work that once needed six.

Concretely, the co-pilot can:

• Hold a planned trajectory and make small course corrections within a pre-approved envelope.
• Monitor every subsystem and predict faults hours before they become alarms.
• Plan rendezvous and docking approaches and fly them under pilot supervision.
• Keep a single-pilot ship like the Aurora Mk II on course while its pilot sleeps.

What it cannot do is equally important. It cannot change destination, it cannot accept or abandon cargo, it cannot override a pilot command, and it cannot initiate any burn larger than its certified envelope without a human confirming. If it detects a situation outside its training, it wakes the crew and explains, in plain language, what it sees and what options it recommends.

We chose this boundary deliberately. Fully autonomous ships are technically possible, and some operators have asked for them. But our safety data is clear: the combination of an attentive human and a capable co-pilot outperforms either alone, especially in unusual situations. In 2186, co-pilot alerts helped crews avoid 31 incidents that would otherwise have required emergency response, while pilots overrode co-pilot recommendations 212 times, and in every reviewed case the human was right or the outcome was neutral.

Training is where this philosophy starts. On the Sparrow Trainer, the co-pilot is configured as a strict instructor rather than an assistant: it explains what it would do but never does it, so students learn to fly the ship themselves before they learn to delegate.

We publish the co-pilot's decision logs from test flights through our open data program, and we welcome scrutiny. If people are going to trust machines with their lives in deep space, they deserve to see how those machines think.