EP4090586A1

EP4090586A1 - Military watercraft with sensors

Info

Publication number: EP4090586A1
Application number: EP21700516.4A
Authority: EP
Inventors: Bastian Ebeling; Axel Rasch
Original assignee: ThyssenKrupp AG; ThyssenKrupp Marine Systems GmbH
Current assignee: ThyssenKrupp AG; ThyssenKrupp Marine Systems GmbH
Priority date: 2020-01-16
Filing date: 2021-01-11
Publication date: 2022-11-23
Also published as: BR112022014068A2; WO2021144206A1; DE102020200471B4; KR20220109474A; DE102020200471A1

Abstract

The invention relates to a military watercraft (100) containing: - multiple vehicle components (104-110), each of which includes one or more sensors (112-120), wherein at least some of the vehicle components are part of a weapon system (102), a propulsion unit (104), and a navigation system (106), and the sensors are designed to detect measurement values, which indicate operating states of the vehicle components that include the sensors detecting the measurement values and/or states of the watercraft or the surroundings thereof; - a database (122), said database storing a history of measurement values of the sensors in a persistent and protected manner in connection with a time stamp; and - an electronic automation system (124), said automation system being designed to automatically and/or semi-automatically control at least one of the vehicle components in real-time on the basis of the measurement values and/or on the basis of an input of a user, said input being entered via a user interface in response to an output of the measurement values.

Description

Military watercraft with sensors

Description

area

The invention relates to a military watercraft, in particular a military watercraft with sensors for acquiring measured values.

background

Military watercraft are often highly complex systems that have been developed for specific purposes and have a large number of components, some from different manufacturers. Compared to civilly used watercraft, military watercraft are often characterized by a comparatively small number, high complexity, high number of vehicle components used and high need for protection of vehicle-related data. The composition of the vehicle components is therefore often very heterogeneous and, given the large number and integration density of components and manufacturers, it is not always possible to comprehensively test the interaction of the individual components for every conceivable application scenario. In addition, there is the tendency of the manufacturers of the vehicle components to keep the measured values recorded by the component-internal sensors secret in order to prevent third parties from using this knowledge to replicate or “hack” the vehicle component. These circumstances therefore represent considerable technical obstacles to the integration of the vehicle components of military watercraft.

The German patent application DE 102008025803 A1 describes a ship's internal combustion engine with a control device for controlling and / or Rege development of the operation of the ship's internal combustion engine. The control device determines target operating parameters for the ship's internal combustion engine based on the position of the ship.

The German patent application DE 102011 086355 A1 describes a weapon system for object defense, in particular for use on merchant ships, comprising: at least one barrel weapon, a firing device, a sensor system for recording data, in particular environmental and / or target data, and a Authorization system. The authorization system is set up to enable or disable the firing device depending on the receipt of a release signal.

The German patent application DE 31 50 895 A1 describes a combat ship with systems connected via electronic control devices. In the combat ship with controlling and controlled systems, electronic control devices are provided which form control signals for the assigned controlled systems from raw information coming from the assigned controlling system. For each assigned controlled system, the electronic control devices have a correction stage for modifying the control signals formed as a function of a bedding error in the relevant controlled system and / or the controlling system acting on the control device. There are also memories for the bedding error values depending on the horizontal angular position of the controlled system and / or the controlling system.

The US patent application US 2008/0 120 620 A1 describes the use of an “open software architecture” for the Navy fleet.

The US patent application US2018 / 0304969A1 describes a ship with a propeller mounted on a rotatable shaft and a method for converting the Power of a rotating shaft in thrust to drive the ship across the water. The method comprises the acquisition of measured values that are descriptive of the shaft power, an estimate of two excess shaft powers caused by soiling of the propeller and by soiling of the ship's hull, and output of an indication of propeller cleaning and / or hull cleaning depending on the estimated excess Wave power.

The US patent application US2019 / 0176945A1 describes a movement control of a ship in a manner that optimally balances performance and noise emissions.

The US patent application US 2006/0058929 A1 describes a method for verifying a control system of a ship, in which the control system receives sensor signals from sensors in its operating state and sends control signals to actuators in response to a desired position, speed, course or to keep other things.

The US patent application US 2018/0356826 A1 describes a system and method to facilitate decisions on a watercraft. The method includes: acquisition of environmental data of the environment in which the watercraft is located; Generation of a large number of digital models, each of which model an impact of the environment on a corresponding ability of the watercraft; using the environmental data and the digital models, modeling an impact of the environment on the capabilities of the watercraft and creating a risk assessment for a selected action.

The publication ANDO, Hideyuki: Smart ship application platform project (SSAP Project). In: Sea Japan 2014, Environmental Technology Seminar, April 11, 2014, 11 p. URL: https://www.mlit.go.jp/common/001039009.pdf accessed on 2020-07-20] describes application services in the context of a “Smart Ships” to achieve optimal ship operation in terms of safety and energy efficiency. Summary

The invention has for its object to provide an improved military water vehicle available.

The objects on which the invention is based are each achieved with the features of the independent patent claims. Embodiments of the invention are given in the dependent claims. The embodiments listed below can be freely combined with one another, provided they are not mutually exclusive.

In one aspect, the invention relates to a military watercraft.

The military watercraft includes several vehicle components, each of which includes one or more sensors. At least some of the vehicle components belong to a weapon system, a drive unit and a navigation system. The sensors are designed to record measured values, where the measured values indicate operating states of the vehicle component that contains the sensor that records the measured values, and / or states of the watercraft or its surroundings.

The military watercraft also includes a database. A history of measured values from the sensors in conjunction with a time stamp is stored in the database in a persistent and protected manner.

The military watercraft contains an electronic automation system. The automation system is designed for automatic and / or semi-automatic control of at least one of the vehicle components in real time as a function of the measured values and / or as a function of a user input from a user, which in response to a The measured values are output via a user interface.

This can be advantageous because a watercraft designed in this way uses the measurement data recorded by the sensors in two ways: on the one hand, the measurement data are used for this purpose, the automation system directly or indirectly, and thus influencing its control over individual vehicle components. For example, the recorded measured values can be forwarded directly to the automation system as input. Additionally or alternatively, the measured values or at least some of them can be displayed to a user so that the user can decide on the basis of these measured values how the automation system must be operated. The first use of the currently valid measurement data is to influence the control of the watercraft components in real time. On the other hand, the measurement data are also stored in a database. This is done in such a way that the time course of the generation of the measurement data (the "history" of the measurement values) can be taken from the database, e.g. B. on the basis of the time stamp (preferably UTC or location-independent and unambiguous), each of which indicates the time at which a measured value was recorded. The fact that the measurement data is persistently stored in a database allows a database to be created automatically over time, through the analysis of which complex dependencies and interactions between several vehicle components or their states (engine temperature, turbine speed, vibration of a rudder) are taken into account Environmental parameters (temperature, humidity, pressure, depth, geographical position) can be found out. For example, the content of the database can be used as a training data set in order to train a machine learning algorithm on the basis of this data. As a result, hidden, non-obvious or technically indirectly recognizable relationships and interactions can be determined, and in principle in a way that is individual for each vehicle, which is particularly relevant in the military sector with small numbers of items and many custom-made products.

The measured values are stored securely in the database, which means that they are protected against unauthorized access by means of security measures, e.g. through encryption or the prevention of anonymous access by granting access rights.

It is thus possible, in principle, to digitally record all measured values occurring on a watercraft that can come from different vehicle components and from different manufacturers and both for the control of the To use the vehicle in real time as well as for the subsequent analysis of a history of the digital measured values recorded by the sensors (whether available in the automation or not) of a watercraft. The operators of the watercraft therefore have the option of gaining valuable knowledge about an individual watercraft based on the history stored in the database and optionally using their own analysis tools, even if the data from a complex, heterogeneous environment made up of vehicle components and sensors is different Manufacturer originate. Since the measured values of various sensors from various vehicle components were stored in a single database, they are accessible to a wide variety of multivariate analyzes, such as those used in the context of big data. The time stamp, which can be designed as a UTC time stamp, allows the various measured values to be clearly related to one another and optionally also to the times at which control commands were sent to vehicle components or sub-components.

Embodiments of the invention thus enable a uniform use and analysis of all accumulating / recordable digital data that arise or can be recorded with the increasingly complex platforms, installations and systems on board a military watercraft, and thereby enable smooth integration, installation, Commissioning and long-term operation of the vehicle and its components.

Embodiments of the invention can be particularly helpful in the military sector, since the detailed knowledge of the users of individual vehicle components is often poor or cannot be reliably accessed in military stressful situations. There is a tendency for vehicles and components to become more and more complex and the number of crews ever smaller (down to a crew size of zero, which corresponds to completely autonomous vehicle control). The acquisition and storage of the sensor data in the database can compensate for these disadvantages. According to embodiments of the invention, the watercraft comprises several (at least two) computers networked with one another to form a computer network, which work together as a host in such a way that at least one instance of the database is provided. It is also possible for some or all of the data in the database to be stored in a redundant manner on the multiple computer systems, for example by generating multiple instances of the database including some or all of the data in the database on the multiple computers.

According to embodiments, the watercraft comprises container management software that is configured for the automated provision, scaling and management (“orchestration”) of at least one container on at least one of the computers in such a way that this at least one computer serves as the host system for the at least one container, the at least one container isolating programs that run inside this container from programs that run outside of this container. The container management software preferably orchestrates multiple containers on one or more computers.

According to embodiments of the invention, the watercraft comprises several computers networked with one another to form a computer network and container management software. The container management software is configured for the automated provision, scaling and management (“orchestration”) of several (at least two) containers on the several computers in such a way that the computers each serve as a host system for one or more containers, whereby the containers (of the same host Computer system as well as different host computer systems) are isolated from one another.

This can be advantageous because the integration of several computers into one computer and the use of container management software to orchestrate several containers hosted on the computers can make the system and the provision of the database and / or individual analysis modules high-performance and also very high is fail-safe. For example, the containers can be orchestrated in such a way that they provide the database or parts of the database and / or one or more analysis modules multiple times, so that a parallel free access to identical copies of the data or analysis modules is possible. With regard to the database, this increases the speed of read and write access to the measured values stored in the database and increases the reliability. With regard to the analysis modules provided redundantly according to some embodiments, this also increases the availability (possibly parallel execution of the same type of analysis) and reliability of the corresponding analysis modules. Both are of great importance in the context of a military watercraft, because a failure of the database and / or of software programs that are instantiated in the containers can lead to critical data loss, data inconsistencies or the failure of forecast and warning functions on the basis of current information In addition, the use of containers and the container management software for orchestrating the containers enables the system to be easily scaled, e.g. if a significantly larger amount of (measured) data is stored and / or analyzed over time should and / or if the number of software programs to be instantiated on the computer network is currently increasing.

The use of containers for the provision and isolation of software applications ensures the separation and management of the resources used on a computer. The use of containers makes it possible to instantiate an application on different computers and environments (for example different computers in a computer network, but also on computers of different types such as development, QA, production). Updates are also simplified.

According to embodiments, each of the containers is access-restricted in that it can only access a specific memory area of the main memory that is allocated to it alone, as well as access to native applications (e.g. native databases).

According to some embodiments, only the analysis modules are hosted within containers, while the database is hosted as a native database on one of the Computer is operated. Corresponding embodiments of the invention can have the advantage that access to the data stored in the database can be facilitated by the analysis modules instantiated in the containers.

According to other embodiments, at least some of the containers are configured in such a way that there is a virtual network between some of the containers, so that the analysis modules instantiated in a container access the content of a database that is instantiated within a container networked with its own container, can access. Corresponding embodiments can have the advantage that a user, e.g. via the container management software, can determine very precisely and in a fine-grained manner which analysis modules within which container can access the contents of other containers. For example, it is possible that a first container contains a first database with the measured values from sensors S1, S12 and S37 and a second container contains a second database with the measured values from sensors S17 and S35. The sensors S1, S12 and S37 come from sensors from manufacturer H1, while the measured values from sensors S17 and S35 come from manufacturer H2. It is now possible to configure the computer network or the container so that the analysis software A1 from the manufacturer H1 runs in a third container that is allowed to selectively access the first database in the first container, but not the data from the sensors of the Manufacturer H2 in the second container. Analogously, the configuration can include the fact that the analysis software A2 from the manufacturer H2 runs in a fourth container, which is allowed to selectively access the second database in the second container, but not the data from the sensors from the manufacturer H1 in the first container.

According to embodiments of the invention, the computers can be servers, i.e. computers that transfer one or more programs or functions (e.g. analysis modules, databases, etc.) to external entities (e.g. other servers, analysis modules that are instantiated on other servers, Users, etc.). Server computers are often characterized by above-average computing capacities and / or above-average amounts of available main memory. According to embodiments of the invention, the military watercraft further comprises one or more analysis modules which are each designed to carry out an analysis of at least some of the measured values stored in the database.

According to embodiments, the automation system, on the one hand, and the one or more analysis modules, on the other hand, are operatively decoupled from one another. In addition or as an alternative to this, the one or more analysis modules are designed to carry out their respective analysis function without using an Internet connection. According to embodiments, both the automation system and the one or more analysis modules are designed to perform their respective control or analysis functions without using an Internet connection.

For example, the analysis modules are designed to analyze the history of the measured values stored in the database and, on the basis of the analysis, make predictions regarding the current and / or future condition of the watercraft or its components and / or a technical or tactical point of view Calculate action. In particular, according to the embodiments, treatment recommendations are first calculated, which are then implemented manually, semi-automatically or fully automatically.

At least some of the analysis modules are preferably designed to take the measured values from two or more sensors from two or more different vehicle components and optionally also one or more environmental parameters (air pressure, water temperature, depth, geographical position of the vehicle, flow strength of the surrounding water, etc.) to evaluate. This has the advantage that interactions that exist between the vehicle components and / or environmental parameters can also be recorded by retrospective analysis of the history of these measurement parameters and can be used to predict future states and actions.

The execution of the control and / or analysis function without using an internet connection can be advantageous since an internet connection is on the high seas is often not reliably available and, even if it is available, is switched off in the military sector in some cases and for some systems in order to increase the security of the system and to reduce the probability of detection.

The analysis is carried out on the data in the database and the analysis modules are operationally separate from the automation system. This means that the automation system is not affected by operations for reading and processing the measurement data by the analysis modules. This is advantageous because the automation system is a real-time system that is protected by the operational separation from the reaction speed and / or responsiveness of the automation system being impaired by the execution of the analysis modules. In a military context, it is of great importance that the automation system can react immediately and in real time to current conditions, e.g. to automatically initiate the right steps in combat situations to turn, brake, accelerate and / or defensive or accelerate the watercraft implement aggressive measures.

According to embodiments of the invention, the operative decoupling is implemented by an asynchronous mode of operation of the automation system on the one hand and the one or more analysis modules on the other.

For example, the operational decoupling can include the automation system and the analysis modules being programmed in such a way that they work independently of one another, i.e. the automation system does not require data at any point and / or wait for data provided by the analysis module.

Additionally or alternatively, the operational decoupling can be implemented in the form of asynchronous write or read access to the database by the automation system or by a service operatively connected to the automation system on the one hand and by the one or more analysis modules on the other. For example, the operational decoupling can include the automation system receiving current measurement data from the sensors directly via a first communication channel without the need for prior to or during the data transfer. Transmission via the first channel, the measurement data are written to the database. This means that the automation system receives the current measurement data from the sensors directly and immediately after they have been recorded by the respective sensors and thus without any delay that can occur when the measurement data is written to a data memory. Asynchronously to this, the measurement data are written into the database in order to update the histories of the measurement parameters. The data channel via which this writing process takes place can also be referred to as the second communication channel and, for example, be designed as a multiplicity of database connections that are established by the sensors with regard to the database. The use of the first communication channel and the one or more second communication channels means that even if bottlenecks or delays should occur when writing the measurement data to the database, this does not lead to a delay in the forwarding of the measurement data to the automation system, since the data transmission the measurement data to the automation system is temporally and operationally decoupled from the storage of the measurement data in the database. In a further embodiment, the watercraft contains a service via which the automation system reads out data from the database and / or writes data generated by the automation system into the database. In this case, the read and / or write access of this service is operationally decoupled from the read / write accesses by the analysis modules.

Additionally or alternatively, the operative decoupling can be implemented by instantiating the automation system on the one hand and the one or more analysis modules on the other hand on different computers. For example, the asynchronous mode of operation can be implemented in that the automation system is hosted on one or more first computers and the database and the analysis modules on one or more second computers. As an alternative to this, it is also possible for the automation system on the one hand and the database and the analysis modules on the other to be assigned different CPU and / or working memory resources of a distributed computer network, so that the automation system does not compete with the analysis modules for resources. All of these measures can be advantageous because they ensure that the automation system or the real-time capability of the automation system is not impaired by the storage and analysis of the history of the measurement data.

According to embodiments of the invention, the watercraft comprises several analysis modules, which are carried out in several different containers and thus isolated from one another.

This can be advantageous because it improves the reliability, maintainability and performance of the analysis methods carried out by the analysis modules. For example, there are powerful programs for managing containers on several computers, which make it possible, through the redundant creation of several instances of an analysis module within several different containers, to ensure that certain analyzes can be carried out in parallel on different partial data sets of the database data and thus particularly quickly. In addition, the generation of several instances of the same analysis module ensures that, even if a computer in the computer network fails or cannot be reached, it is possible to switch immediately to another existing instance of the same analysis module that is running on another computer, and / or that in a short time this other instance can be created in a new container on the other computer. In addition, it is possible, please include to increase or decrease the number and distribution of the instances generated by one or more analysis modules very quickly and flexibly, depending on what the particular situation requires.

In a security-critical military operation, for example, it is of secondary importance whether an analysis module, which predicts the next routine service appointment for the watercraft based on the distance covered, has sufficient CPU and RAM capacity for its work, or whether this module at all is instantiated. However, in the case of a critical turning maneuver, for example, it can be of great importance that another analysis module correctly calculates the measured values on the rudder, turbine and other vehicle components based on various material and flow-related measured values whether material load limits are exceeded or the stability of the ship is endangered, has all the necessary CPU and memory resources available to carry out his calculations correctly and quickly.

According to embodiments of the invention, a maximum of one instance of a maximum of one of the analysis modules is executed in each of the containers.

This can be advantageous because it ensures that each instance of an analysis module is executed in its own container. This enables a very fine-grained orchestration of the analysis modules at the level of individual instances of the same with the aid of the container management program.

The fact that the individual analysis modules are operatively isolated from one another thanks to their execution in separate containers is particularly advantageous in the context of a military watercraft: for example, the analysis modules can come from different manufacturers of vehicle components. For example, a first analysis module can be provided by the manufacturer of a turbine and designed to analyze measured values with regard to the speed, temperature and vibration behavior of a turbine from the same manufacturer with sensors for speed, temperature and vibration status of the turbine. The analysis can serve various purposes: for example, to determine whether critical system states have been reached that would invalidate the manufacturer's guarantee and / or that require an inspection or overhaul of the turbine. The analysis can also be used to examine how the individual measured values depend on one another, i.e. whether the turbine shows different vibration patterns within different speed ranges, for example. A second analysis module can, for example, be provided by the manufacturer of an engine and can be designed to analyze measured values with regard to the current engine temperature, the current energy consumption of the engine or other engine-related measured values. The analysis can also serve various purposes, such as determining whether a critical engine condition has been reached or exceeded, which can void the manufacturer's guarantee and / or which require an inspection or overhaul of the engine could. The analysis can also be used to examine how the individual measured values depend on one another, i.e. whether the engine shows different vibration patterns and / or performance curves within different temperature ranges, for example. Both the manufacturer of the turbine and the manufacturer of the engine, as well as the operator of the watercraft himself, benefit from the fact that the analysis modules of the various manufacturers are separated from one another, because this prevents software programs from third parties from being intentionally or unintentionally using a specific analysis module interact and cause it to crash or lead to an incorrect function execution. In the military sector in particular, it must always be expected that supposedly trustworthy software actually contains malware that is intended to disrupt the operation of vehicles or vehicle components and / or to gain unauthorized information on how the vehicle components work. Certain persons or organizations could be interested in learning how a certain vehicle component works and / or causing a vehicle component to work unreliably or incorrectly and thereby, for example, switch off important functions of the watercraft for a short time or permanently. According to embodiments of the invention, this can be prevented in that the individual analysis modules are carried out separately from one another within their own container.

In addition, the execution of exactly one instance of an analysis module per container facilitates the orchestration of the container, e.g. for the purpose of load balancing, upscaling or downscaling, since the resource consumption of a container is largely identical or strongly correlated with the resource consumption of the one instantiated in this container Analysis module.

According to embodiments of the invention, the container management software is configured to orchestrate the creation of containers, the instantiation and the termination of the analysis modules (within these containers) in such a way that one or more of the following effects occur: - in the event of failure or unavailability of one of the computers, the containers and analysis modules are automatically started on another of the computers, which are no longer available or accessible due to the failure or the inaccessibility of one computer; as a result, the robustness of the analysis functionality of a watercraft can be increased against failure of individual computers; In the military sector in particular, it must be expected that, in combat situations, components of the watercraft, such as individual computers and / or network connections within a computer network, will be destroyed or damaged or at least fail for a short time; the ability of the container management software to generate a new instance of the failed analysis module in such situations is therefore particularly advantageous; and or

- if a maximum number of instances of one of the analysis modules currently running on the computers is exceeded, automatically terminate one of these instances and / or delete one of the containers containing an instance of this analysis module or move it to another computer; this can be advantageous because it ensures that CPU and memory resources that are not required are automatically released when they are currently no longer required for analytical activities; the faster these free resources can be made available for vital systems in an emergency; the "maximum number" can be, for example, a number that was specified manually or automatically in a configuration of the container management software. Maximum means that exceeding this value is viewed as undesirable and induces a certain consequence or action, which is preferably suitable for reducing the number of instances; and or

- if a predefined maximum computing load is exceeded on one of the computers, to automatically migrate at least one container hosted on this computer, including the analysis module instance running in it, to another of the computers; the container management software can therefore perform load balancing functions; and or - If one of the computers falls below a predefined minimum computational load, automatically migrate at least one container hosted on another of the computers, including the analysis module instance running therein, to this computer; the container management software can therefore perform load balancing functions; in some embodiments, that one computer can be disabled or put to sleep to conserve power; and or

- if a predefined maximum computing load is exceeded on one of the computers to automatically identify at least one container hosted on this computer including the analysis module instance running in it (e.g. container with the highest CPU / memory consumption or container containing an instance of a certain analysis module), a copy of this identified To instantiate the container, including the analysis module running therein, on at least one other of the computers; and to carry out analyzes in parallel with the inclusion of at least the analysis module instance in the identified container and the further instantiated analysis module instance; the container management software can therefore perform upscaling functions; and or

- If one of the computers falls below a predefined minimum computing load, automatically identify at least one container hosted on another computer including the analysis module instance running in it (e.g. container with the highest CPU / memory consumption), a copy of this identified container including the analysis module running in it on this one computer to instantiate; and to carry out analyzes in parallel with the inclusion of at least the analysis module entity in the identified container and the further instantiated analysis module entity; the container management software can therefore perform load balancing functions; and or

- If one of the computers falls below a predefined minimum computational load, automatically delete at least one of the containers hosted on this one computer; the container management software can therefore perform downscaling functions. This can be advantageous, since the consumption of CPU and main memory resources can be better distributed among the computers of the computer network and a better response time can be achieved. In addition, a needs-based scaling of the containers and the analysis modules instantiated in them can be achieved.

According to embodiments, a part of the data in the database is specifically assigned to at least some of the analysis modules. The parts of the data are stored in a protected manner so that only the analysis module that is assigned to this part of the data can read and / or write access to them.

For example, the assignment can be made in such a way that an analysis module that has been developed by a specific company that has also manufactured a vehicle component or has a contractual relationship with the Fierstellern has access to measurement data that is recorded and stored by sensors of this vehicle component but not the measurement data from the sensors of other vehicle components.

According to a further example, the assignment takes place in such a way that an analysis module that was developed by a specific company that has also manufactured several vehicle components or that has a contractual relationship with the Fierstellern these components has access to the measurement data from sensors these several vehicle components were recorded and saved. The analysis module has no access to the measurement data from the sensors of other vehicle components.

According to a further example, the assignment takes place in such a way that an analysis module that was developed by a specific company that has also manufactured one or more vehicle components or has a contractual relationship with the operators of these one or more vehicle components has access to the measurement data that have been recorded and stored by the sensors of these one or more vehicle components and also has access to measurement data that has been stored in the database as generally accessible (for each analysis module of the watercraft). The analysis modules of watercraft according to embodiments of the invention can be the measurement data of the database according to any combination of the examples described here.

The various forms of specific assignment of measurement data and analysis modules can be advantageous, since the manufacturers of vehicle components can ensure that only analysis modules that the manufacturer trusts have access to the measurement data generated by the sensors for this vehicle component. The installation of sensors of different types on and / or in vehicle components of a military watercraft by the manufacturer of the respective component has the advantage that important status parameters of the vehicle components such as temperature, vibration behavior, load parameters, environmental parameters, etc. are made available . This measurement data is relevant for the manufacturer of the vehicle components, for example for test, development and repair purposes and to determine warranty cases. However, the measurement data are also relevant for the operator of the watercraft (for a better understanding of how the vehicle components work and / or for a better understanding of the interactions between the vehicle components and other components or environmental parameters).

For the manufacturer of a vehicle component and / or the operator of the vehicle, the problem arises that the disclosure of all measured values may provide information about the mode of operation and internal component states, which should remain in-house, for example to make replication more difficult for competitors and / or to prevent attackers from manipulating the vehicle components in a targeted manner. A manufacturer of vehicle components therefore has no interest per se in the measurement data relating to this vehicle component being disclosed. This currently prevents the measurement data from the sensors from being integrated into various vehicle components, which is a disadvantage for the operator of military watercraft in terms of safety, because many technically relevant effects, such as a certain behavior of a rudder, a turbine or another complex component of the watercraft, arise only from the complex interaction of several rer vehicle components, each of which can have different internal states.

The IT architecture described, according to which certain parts of the measurement data of the database are assigned to individual analysis modules in such a way that the modules can selectively only access the parts explicitly assigned to them, but not generally all measurement data stored in the database, can be advantageous because on On the basis of this IT architecture, the operator of the military watercraft can assure the suppliers or manufacturers of the respective vehicle components (including their sensors) that the measurement data recorded by the sensors are only accessible to certain analysis modules that are viewed and accepted as trustworthy by both sides . An IT architecture will therefore be created that enables the manufacturers of military vehicle components to make sensitive measurement data available in a secure manner only to certain analysis modules. The risk that a competitor or attacker uses the measurement data to replicate or attack a vehicle component can thus be ruled out.

The operator of the military watercraft benefits from the fact that the measurement data of a large number of vehicle components according to embodiments of the invention are only provided to selected, trustworthy analysis modules: manufacturers of vehicle components in the military sector have so far tended to collect measurement data from sensors of the vehicle components produced by these manufacturers at best to be recorded internally and only to analyze internal computing units of vehicle components without disclosing the measurement data to the outside world or even storing them over a longer period of time. Thanks to the IT architecture of watercraft according to embodiments of the invention, manufacturers of vehicle components can now dispense with the component-internal computing units for the secret analysis of the measurement data, since the measurement data from several sensors and vehicle components are stored centrally in a database, nevertheless but not every analysis module can access this data at will. Some currently available automation systems for military watercraft also offer access to sensor data from several sensors, but only to the respectively valid actual values of individual systems, which contain historical profiles and trends of the measured values over a longer period of time that are not or only rarely usable. Due to the real-time requirements for such automation systems, it had previously been refrained from burdening the scarce resources of the automation system of watercraft with computationally intensive analyzes of extensive historical databases. Thanks to the distributed provision of the analysis modules in several containers in a computer network detached from the automation system, however, according to embodiments of the invention, it is also possible to carry out complex analyzes, sometimes also in real time, and to provide them without the real-time capability of the automation system being impaired. The problem that manufacturers of vehicle components with integrated sensors do not want to or cannot disclose the measured values recorded by them for various reasons has been overcome by an IT architecture that ensures that only selected analysis modules with the appropriate rights can access the measured values . Thus, an IT architecture was created that is particularly advantageous in the context of the specific conditions of military watercraft.

According to embodiments of the invention, several of the analysis modules are each specifically assigned to one of the vehicle components and are configured to directly or indirectly (via the database) at least the measured values that are recorded by the one or more sensors of this one vehicle component to which they are assigned. to receive, analyze and output the result of the analysis. Indirect reception via the database means that the measured values recorded by the sensors are first written to the database and, in a second step, the analysis module then accesses the measured values stored in the database. This indirect reception via the database has the advantage that the analysis modules do not have to have an interface in order to be able to receive measurement data from a specific sensor. According to one embodiment, the one or more sensors have write rights to the database and are designed to store the measured values in the database in a suitable format. For example, the sensors can have a network interface and be configured in such a way that they continuously write the recorded measured values to the database.

According to other embodiments, the sensors are configured to initially store the measured values recorded by them in a local volatile or non-volatile data memory of the sensor. Another component of the watercraft (e.g. the automation system, one of the analysis modules or other software) reads the locally stored measurement data and writes it to the database so that the analysis modules can now access the measurement values via the database.

According to embodiments of the invention, at least one of the plurality of analysis modules that is assigned to one of the vehicle components is designed to carry out an analysis that includes:

- A recognition of current or future critical states of a vehicle component; and or

a prediction of the time of occurrence of a critical state of the one vehicle component; and or

the automatic identification of one or more environmental parameters and / or vehicle component parameters which are the cause of a critical state of one vehicle component; and or

a calculation of a treatment recommendation to a person with regard to the one vehicle component; and or

- A calculation of a control command to the one vehicle component for automatic implementation of the control command.

This can be advantageous because the one or more analysis modules can be used for this purpose, not just retrospectively individual correlations and combinations. to detect slopes, but based on the history of measurement data from several sensors stored in the database can also be used to predict technically and / or tactically critical situations in or on the watercraft as well as to predict instructions and control commands that can help avoid or mitigate the critical situation. The analysis modules can thus take over functions that were previously only perceived by the automation system. While the automation system is typically not very flexible, since it typically integrates measured values from a predefined number of sensors of a predefined set of vehicle components, the use of analysis modules in addition to the automation system is advantageous, since the analysis modules according to embodiments of the invention are within an IT architecture are instantiated, which is highly available, robust and easily scalable on the basis of container virtualization and automatic container orchestration and which protects the measurement data of the vehicle components in a secure manner against access by unauthorized third parties.

According to embodiments of the invention, the sensors of at least one of the vehicle components contain at least one cryptographic encryption key. One of the analysis modules is assigned to the at least one vehicle component and contains a decryption key corresponding to this cryptographic encryption key. The two "corresponding" keys of the sensor and the analysis module can be a secret, "symmetrical" cryptographic key that is used both for encrypting and decrypting the measured values. Alternatively, the two corresponding keys can be an asymmetric cryptographic key pair, the key managed and stored by the sensor being a public cryptographic key (encryption key) and the securely stored key managed by the analysis module being a private cryptographic key Key (decryption key) is. The sensors of the at least one vehicle component are designed to store at least some of the measured values recorded by them in encrypted form in the database and / or to transmit them directly to the analysis module assigned to the at least one vehicle component. The at least one analysis module is configured to decrypt the at least some measured values with the decryption key and to analyze the decrypted data.

According to embodiments of the invention, all sensors that are mounted in or on the same vehicle component have the same public encryption key. According to other embodiments of the invention, all sensors of at least one of the vehicle components of the vehicle have their own public key, which is different from the public key of the other sensors of this vehicle component.

This can be advantageous because the use of encryption methods offers a particularly high level of security that the measurement data from sensors of a specific vehicle component can only be read and interpreted by authorized analysis modules.

According to embodiments of the invention, the sensors of at least one of the vehicle components contain a signature key. The signing key preferably belongs to a PKI of a Fierstellers this vehicle component. One of the analysis modules is assigned to the at least one vehicle component and contains a signature verification key that corresponds to this signature key. The sensors of the at least one vehicle component are designed to sign at least some of the measured values recorded by them with the signature key and to save them in signed form in the database and / or to transmit them directly to the analysis module assigned to the at least one vehicle component. The at least one analysis module is configured to check the at least some measured values with the signature verification key and to analyze the signed data only if the signature verification shows that the signature is valid.

This can be advantageous because it protects the operator of the watercraft from an attack on the stability and integrity of the military watercraft resulting from a manipulated vehicle component and / or manipulated sensors generating incorrect analyzes and prognoses. Especially In particular, if these analyzes and forecasts are automatically converted into corresponding control commands, there is a risk that the watercraft will be damaged in the short or long term or made unusable as a result of such manipulation. For example, a specific analysis module can normally be used to predict the future course for the next 5 km based on GPS position data, the current number of rotations of the turbine and a current angle of the rudder. A manipulated angle sensor on the rudder can provide incorrect angle data, which can lead to the course of the watercraft being calculated incorrectly. This can lead to the fact that the ship is actually on a different course than the one predicted and runs aground or collides with rocks. This risk can be eliminated by having the sensors sign the measurement data you have generated, with the signature referring to a trustworthy entity, for example a specific manufacturer. Because the analysis module checks the signature of the measurement data before using it, it can be ruled out that manipulated sensors and / or manipulated vehicle components threaten the vehicle and crew.

According to embodiments of the invention, one or more of the analysis modules are each configured to output their result of the analysis to a user and / or to the analysis system and / or to store them in the database.

For example, the results can be displayed on a screen, printed out by means of a printer and / or output via loudspeaker. Additionally or alternatively, the results can be output to a software or hardware component, for example to the automation system.

This can be advantageous because the results can integrate the data from a large number of sensors from a large number of vehicle components and / or environmental parameters and can take into account not only current measured values, but also the history of the measured values. Since the analysis modules are implemented as individual, isolated software modules, the number and composition of the analysis modules can easily change over the life of the vehicle. The changing composition of the vehicle components can be adapted. The analysis results of the analysis modules thus represent a source for system diagnostics and control commands, which supplement the functions of the automation system in a particularly flexible manner. Depending on the type of analysis result and implementation, the analysis results can be recommendations for action to be given to a user, the actions having to be carried out by the user or manually. It can also be a matter of handling recommendations that can be carried out automatically by the vehicle components and whose execution only needs to be manually confirmed again by the user. It can also be control commands that are given directly by the analysis modules to the automation system without involving the user and cause the automation system to automatically carry out the action specified in the commands, e.g. to open an exhaust flap or to correct the angle of a rudder , Etc.

According to embodiments of the invention, at least one of the analysis modules is designed to carry out an analysis (e.g. correlation analysis, machine learning (ML) -based prediction, rule-based prediction, etc.) on the measured values of several (at least two) different sensors from several different vehicle components . The analysis includes:

- A prediction of the time when a critical condition of a vehicle component will occur; and or

the automatic identification of one or more environmental parameters and / or vehicle component parameters which are the cause of a critical state of one of the vehicle components; and or

- a calculation of a recommended action to a person; and or

a calculation of a control command to one of the vehicle components for the automatic implementation of the control command. This can be advantageous because ML-based methods and various other forms of correlation analysis are particularly suitable for recognizing complex, cross-component, linear and non-linear dependencies and interactions from historical measured values of several different parameters and making predictions on the basis of these recognized dependencies to calculate current and future system states.

According to embodiments of the invention, the data in the database are distributed in the several computers and / or stored redundantly.

This can be advantageous because the reliability is increased if one of the computers fails or cannot be reached. In addition, redundant storage allows parallel access to copies of the same data, thus accelerating the query.

According to embodiments of the invention, the data of the database are stored distributed in different containers of different computers (the containers are thus instantiated on different computers, with several containers also being able to be instantiated on some computers). The container management software is configured to orchestrate the creation of containers and the storage, replication and deletion of the data in the containers in such a way that:

- In normal operation, the data in the database are stored in a redundant manner in the meh eral computers so that they can be reconstructed from the data stored in the other computers in the event of failure of one or more of the computers; and or

- If one of the computers fails, another one of the computers is automatically identified on wel chem a copy of those parts of the data that were stored in the failed computer, and the data contained on this other computer are provided to the analysis modules and the automation system (eg by starting this other computer, releasing access to the partial data, etc.); and or - In the event of failure of one of the computers, automatically redistribution of at least part of the data stored redundantly and distributed in several containers in such a way that the previous degree of redundancy of the data in the database is restored; and or

- When a predefined maximum memory requirement in one of the computers is exceeded, at least parts of the data of the database stored on this computer are automatically migrated or copied to another of the computers; Load balancing functions such as those already included in the Kubernetes software can be used for this.

This can be advantageous for analogous reasons such as the redundant instantiation of the analysis modules on several computers. In particular, availability and reliability are increased and access times are shortened through parallel access.

According to embodiments of the invention, at least some of the computers of the computer network are each contained in a separate security container that is fire-proof and / or pressure-wave-robust and / or watertight.

For example, the safety container can consist of a single-walled or preferably multi-walled body. The body can be made of steel, for example, and a door can be provided with its own locking mechanism or lock for each body. The safety container is preferably watertight and / or resistant to pressure waves. For example, the body can contain cable feed-through openings on the rear and an integrated cooling system, on the one hand to prevent water and / or pressure from penetrating and on the other hand to prevent overheating. While the "containers" are software or runtime environments for programs that are instantiated on a computer, the security containers are physical containers that can contain one or more computers.

This can be advantageous because the computers and thus also the analysis programs and containers are protected from damage in the event of a leak or detonation (pressure wave, fire). According to embodiments of the invention, the computers of the computer network include one or more first computers and one or more second computers. The first computer and the second computer are housed in different spatial areas of the watercraft, whereby the different spatial areas have different rooms, different decks, different chambers separated by watertight lock gates, the starboard side and port side of the watercraft or the bow side and stern side of the watercraft are.

This can be advantageous because the reliability of the watercraft and the analysis modules is increased: if certain areas of the ship are damaged due to a detonation or an accident, not all analysis modules are affected. Rather, the container management software can nern on the containers.

In a further aspect, the invention relates to a system comprising at least two military watercraft according to one of the embodiments or examples described here and a computer system. The computer system contains an interface for the secure import of the content of the databases of at least two watercraft. The computer system also includes fleet analysis software. The fleet analysis software is designed to analyze the measured values in the databases of the at least two watercraft. The fleet analysis software is configured to automatically recognize whether the measured values of different water vehicles were recorded by vehicle components of the same type. The analysis includes:

- A recognition of those of the watercraft whose entirety of vehicle components is in the best or worst condition with regard to at least one technical evaluation criterion (e.g. fill level of the tank, availability of energy resources, time until the next maintenance, indicator of failure safety, indicator of suitability of the Watercraft for a specific application scenario;); and or - A detection of critical states of a vehicle component in one or more of the watercraft; For example, by analyzing historical measurement data in the databases of the multiple vessels, it can be recognized that in a few vessels a combination of the angle of attack of the rudder and the speed of the turbine, which was unproblematic in the majority of vessels, causes the vessel to become unstable that required manual intervention so that those few vehicles should be brought for inspection; Certain vibration patterns can show that a vehicle component of a certain watercraft is suffering from material fatigue or is negatively influenced by vibrations and movements of neighboring components, so that an inspection seems to be recommended for this too; and or

- A prediction of the time of the occurrence of a critical condition of a vehicle component in one or more of the watercraft; For example, the time at which, in view of the material fatigue that can be derived from the vibration values and / or in view of the usual maintenance intervals, each of the watercraft has the next inspection date, so that the vehicle whose predicted inspection date is furthest in the future than the most suitable for a current, longer one Use can be viewed; and or

the automatic identification of one or more environmental parameters and / or vehicle component parameters which are the cause of a critical condition of one of the vehicle components in one or more of the watercraft; For example, the fleet analysis software can recognize that only those ships that were sailing in waters with a water temperature of below 6 ° C had problems triggering a movement in a certain component, so that the assumption is that the material contraction occurs at low temperatures Temperatures was the trigger for the problem and the component is not suitable for use at low temperatures. The analysis of several watercraft can make it possible here, if necessary, Bl

Uncover causes which, without evaluating the data from several vehicles, would not or probably not have been recognized.

The fleet analysis software can be a single, complex application program or a combination of several individual analysis programs that perform different types of analyzes on the histories of measured values recorded by the sensors of several vessels over a period of several hours, days, weeks, Months or years.

According to some execution systems, the computer system that hosts the fleet analysis software also includes a decryption key and / or signature verification key, these keys being provided by the manufacturer (s) of the vehicle components or the watercraft, if the manufacturer (s) provide these keys for the customer, i.e. the operator of the watercraft.

A “military watercraft” is understood here to mean a watercraft that is trained to be used by armed forces to carry out their tasks. Vehicles for military purposes often have specific adaptations, for example reinforced walls or floors to protect against mines, camouflage, weapons and / or defense systems. Watercraft are vehicles that are designed to move on or in the water. In particular, it can be a wind-powered or a machine-powered water vehicle, e.g. sailing ships, air cushion boats, hydrofoils, submarines, frigates, aircraft carriers, supply ships, etc. be trained or equipped on your own ship or the association. Supply ships are trained to support naval action groups, which can be composed of different ships and boats depending on their task. The main logistical task of a supply ship is the supply of operating materials, consumables, provisions and ammunition. A supply ship can can also be equipped with a weapon system, e.g. to repel enemy attacks.

A “vehicle component” is understood here to be a part of the watercraft which in its entirety fulfills at least one specific function. A vehicle component can be a component, i.e. an individual part of a technical complex, or a system made up of several components that fulfill this function in their entirety. Typically, all parts of a certain vehicle component are installed as a unit in a vehicle. For example, a steering system, a radar system, a weapon system, a motor unit, a control unit, etc. can each represent a vehicle component.

A "sensor", also known as a detector, (measured variable or measuring) transducer or (measuring) sensor, is a technical component that has certain physical or chemical properties (physical e.g. amount of heat, temperature, Moisture, pressure, sound field sizes, brightness, acceleration or chemically e.g. pFI value, ionic strength, electrochemical potential) and / or the material nature of its environment qualitatively or quantitatively as a measured variable. These variables are recorded using physical or chemical effects and converted into an electrical signal that can be further processed. The electrical signal that can be further processed can in particular comprise data that can be processed by data technology and that represents a representation of the variable. The electrical signal that can be further processed does not necessarily have to be generated in the detector itself, but can also be generated from the output signal of the detector by electronics connected to the detector.

A “weapon system” is understood here to be a (often complex) technical defense material, in particular large-scale military equipment. The actual weapon is part of the weapon system. For example, a warship can contain weapons in the form of anti-aircraft missiles in a weapon system designed as a close-range defense system. In particular, a weapon system can be a combination of individual technical elements, which interact with each other and through this combination achieve an improved weapon effect or even make it possible in the first place.

For example, the “Common Remotely Operated Weapon Station” (CROWS) is a weapon system. Another example of a weapon system is a gun on a self-propelled gun or a ship deck. Depending on the embodiment, the engine power of the watercraft is used both for propelling the watercraft and for aiming the gun, or the weapon system includes its own, independent motor for aiming the gun. An air defense missile system is another example of a weapon system. The various elements such as sensors (e.g. a radar system), control station and launch system of the anti-aircraft missile system can record various measurement data that are processed for monitoring, status control and correct alignment of the radar system and / or the missiles.

A "drive unit" here refers to the structural unit that moves a machine, e.g. a ship's turbine, by means of energy conversion. Often this is a motor with a possibly necessary gear. The drive unit can contain a rotary drive or a linear drive. The drive unit can draw its energy from fossil sources (especially oil, natural gas, coal), atomic energy (nuclear fission), battery power and other energy sources.

A “navigation system” is understood here to mean a technical system that uses position determination (satellite, radio, GSM or inert or autonomous system) and geographic information (topology, road, air or sea maps) to guide you to a selected destination Place or route, taking into account the desired criteria.

A "measured value" is the value of a measured variable that is supplied by a sensor. Examples of measured values are, for example, a temperature in ° C, a position in the form of GPS coordinates, a rotation speed in revolutions per minute, etc. “Measured values” are also referred to as “measured data”. A “database” is understood here as a data structure for the structured storage of data. A database can be a directory tree or a file. A database is preferably a data structure managed by a database management system (DBMS). A DBMS is a system for electronic data management that is designed to store large amounts of data efficiently, consistently and permanently, and to provide required subsets in different, needs-based forms of representation for users and application programs. A database system offers a database language for querying and managing the data. The database can be a relational database. The structure of the data is determined by a database model.

A “history of measured values” is understood here to mean a volume of data which specifies the course over time of several measured values.

A "time stamp" is understood here as a data value that specifies a certain point in time, e.g. the point in time (date and time) when a certain measured value was recorded. Time stamps are preferably specified in the coordinated universal time UTC or with reference to this. This can prevent possible misunderstandings due to the globally different time zones.

The term “persistently stored” is understood here to mean the storage of data on a non-volatile storage medium.

The term “protected stored” is understood here to mean the storage of data, which technically ensures that only a certain selection of users and / or applications that can identify themselves as authorized to access the protected data can read and / or write to the protected data. For example, protection can consist of storing the data in an access-protected area and / or storing the data in encrypted form so that they can only be read by a program that has a suitable decryption key

A "real-time-capable" system, for example a real-time-capable automation system, is a system that is designed to carry out a task in "real-time". That means that the system is able to perform this task continuously within a predefined maximum duration. Typically, this means that the hardware and / or software system mentioned is subject to a "real-time restriction", for example from event to system reaction. Real-time programs have to guarantee the reaction within certain time limits, which are often referred to as "deadlines". Real-time responses are often understood in the order of milliseconds and sometimes microseconds or seconds. A system that is not specified as real-time operation can usually not guarantee a response within a time frame, although typical or expected response times can be given.

A “host” or “host computer” is understood here to mean a computer which alone or in interoperation with one or more other computers provides a certain software program (guest software program), ie makes it available for other programs and / or users . The guest program can be a database, an application program, a service or other programs and program modules.

A “container” is understood here to mean a runtime environment for software programs which contains and provides all of the system components required for the execution of these software programs and which isolates the software programs running within this container from programs outside the container. A container can be a virtual machine that is created and managed by a hypervisor (program for managing the virtual machines). A container is preferably a runtime environment that can be managed by means of a container virtualization program. Containers according to these embodiments typically require fewer resources than virtual machines, since they do not have to start their own operating system and instead run in the context of the host operating system. Nevertheless, the containers are sealed off from each other and from the host system, although not as strongly as with virtualization. For example, the free software “Docker” can be used to define containers and isolate applications from one another using container virtualization. Docker simplifies the provision of applications because containers that contain all the necessary packages can be easily transported and installed as files. Docker packs the application and all system components required for its execution in a single file, the so-called "container". Docker containers ensure that the application runs reliably after being moved from one environment to another. This not only simplifies the deployment of complex applications on different computers, but also a more flexible application infrastructure that is easier to change, expand and scale.

Container virtualization is a method to operate several instances of an operating system (as so-called "guests") isolated from each other on a host system. In contrast to virtualization using a hypervisor on the basis of several virtual machines, container virtualization has some restrictions in terms of the type of guests, but is considered to be particularly resource-efficient. Container virtualization is based on several principles that are implemented differently in individual software products for container virtualization. However, one core of these is always similar: several containers share a kernel and isolate at least some of the operating system resources used from one another.

For example, the open source program Kubernetes can be used as a container management program. Kubernetes is container orchestration software that enables applications to be orchestrated easily and efficiently across multiple hosts. Kubernetes enables simplified or even fully automated deployment, operation, maintenance and scaling of container-based applications. Groups of hosts on which the containers run are combined in clusters of physical or virtual machines and managed as a unit. Kubernetes defines a container runtime interface (CRI) that container platforms must implement in order to be orchestrated using Kubernetes. These implementations are also known as “shims”. What makes the Kubernetes platform agnostic: in addition to or instead of Docker, other platforms with appropriate shims, such as B. CRI-0 or KataContainers can be used.

“Container management software” is understood here to mean software that is configured for the automated provision, scaling and management (“orchestration”) of several (at least two) containers on several computers in such a way that the computers each act as a host system for one or more Containers are used, the containers (of the same host computer system as well as different host computer systems) being isolated from one another. In the case of the multiple containers, complex vehicles can be several hundred containers. For example, Kubernetes can be used as container management software.

An “analysis module” is understood here as meaning software that is designed to process measurement data from one or more sensors using one or more different computational methods in such a way that an answer to an analytical question is generated. The software can be a script, a complex application program, a program library or a combination of two or more of the aforementioned options. The computational technical method can be a heuristic, a rule explicitly specified by a programmer, a mathematical and, in particular, statistical algorithm, for example a correlation analysis method, or some other explicitly formulated computation method. The computational method can also be a method which is only formulated implicitly, for example in the form of the mathematical model of a machine learning program created in the course of a training process. For example, the model can be specified in the network architecture and the weights of network nodes in a neural network. The analytical question can concern various questions, e.g. a question about the current or future predicted condition of a vehicle component (parameters for vibration, conductivity, elasticity, etc. indicate critical wear condition?), Or a question about which measurement parameter values coincide a critical condition The system status has been reached or is likely to be reached in the future, the question of the current and future availability of fuel or Wear parts, or a question about a recommended measure to prevent or mitigate a current or future critical condition of the vehicle or a vehicle component.

An “encryption key” is understood here to be a cryptographic key that is designed to be used to encrypt data. With symmetrical procedures, i.e. with all classic methods of cryptography and also with modern algorithms such as the Data Encryption Standard (DES) or its successor, the Advanced Encryption Standard (AES), both communication partners use the same (secret) key both for encryption and encryption also for decryption. Asymmetrical methods, such as the RSA cryptosystem, use key pairs that consist of a public key and a private key. The public key is not secret; it is at least made known to the party who is to send data in encrypted form to the owner of the secret key. The public key can be used to encrypt data. It is important that a public key can be clearly assigned to a specific entity, e.g. a user or an analysis module. In order to decrypt a secret text again, the private key is required. In contrast to symmetrical procedures, in which several parties share a secret key, in asymmetrical procedures only one party has the private (secret) key. It is therefore essential that the private key cannot be derived from the public key.

An “automation system” is understood here to mean a system for fully automatic or semi-automatic control of a watercraft. The control takes place by means of defined rules based on current measured values from one or more sensors, which are converted into control commands by the automation system, and / or takes place on the basis of control commands that a user enters via a user interface. The automation system is preferably a real-time capable automation system. According to embodiments of the invention, the automation system is designed to not only have current measured values and / or to receive manually entered control commands as input and to control the vehicle accordingly, but also results of the analyzes from one or more of the analysis modules, the automation system interpreting and implementing the results as control commands.

A “computer network” or computer cluster, usually simply called a cluster, is understood here to mean a number of networked computers. The network can be configured in such a way that the computing capacity and / or the availability of the computers or the services provided by them is increased. The computers (also called “nodes”) in a computer network are often referred to as servers. According to embodiments of the invention, the computers in the network of computers each host one or more containers, the distribution of which on the computers is orchestrated by container management software. Analysis modules or other programs can be run in the containers, which can be implemented as a service, for example, and the results of which can be made available to specific vehicle components. Because of this function of providing analysis results, the computers can also be referred to as “servers”.

Brief description of the drawing

Embodiments of the invention will be described with reference to the drawing voltage. In the drawing shows

1A shows a block diagram of a military watercraft with several vehicle components equipped with sensors;

1B shows a system comprising several military watercraft and a computer with a fleet analysis software;

Figure 2 is a block diagram of a distributed computer system that can be used to store and analyze sensor measurement data;

3 shows several analysis module-specific asymmetric cryptographic key pairs and their use; Fig. 4 components of a military watercraft with several databases and analysis modules.

FIG. 1A illustrates a block diagram of a military watercraft 100 with several vehicle components equipped with sensors. For example, the vehicle components include a propulsion system 104 which includes, for example, a diesel powered marine engine with a transmission coupled to the engine. The drive system contains several sensors for measuring various parameters of the engine and the transmission, including a sensor 112 for the speed of a shaft that is mechanically coupled to the transmission.

The vehicle components of the watercraft also include a navigation system 106 with a GPS sensor 114 for determining the current position of the vehicle and a rudder 108 with a position or angle sensor for determining the current angle of the rudder relative to the longitudinal axis of the watercraft. In addition, an electronic monitoring unit 110 with a plurality of sensors is installed in the vehicle as a further vehicle component which contains a plurality of sensors 118, 120. The sensors of component 110 automatically and preferably continuously or repeatedly determine vehicle and environmental parameters. These parameters include, for example, air pressure, air humidity, air temperature, water temperature, flow strength of the water and / or other parameters.

All or some of the recorded parameters are forwarded to an automation system 124 immediately after they have been recorded. The automation system is a fully automatic or semi-automatic system for monitoring and controlling internal states of the watercraft and for controlling the movement or other actions of the vehicle or its components. The automation system is a real-time system that is designed to use the measured values received from the sensors and inputs from users via a user interface in order to control the watercraft as a function of these. Over time, a large amount of measurement data accumulates during ongoing operation of the ship, which is provided with a time stamp, which reflects the time at which the measurement data was generated. The measurement data and their time stamp are stored in a database 122 and thus form a history of the parameter values recorded for one or more measurement parameters. The database is, for example, a relational database, e.g. PostgreSQL or MySQL database, or e.g. to a NoSQL database.

The database and several analysis modules for analyzing the data are stored and instantiated in a computer system 126. The computer system 126 can be a standalone, monolithic computer system. However, it is preferably a computer network that comprises several computers that are connected to form a functional unit. Such a computer network is described in more detail, for example, with regard to FIG.

The watercraft also includes a weapon system 102 which also includes sensors (not shown). Since the watercraft is also important as a target for opposing forces due to the weapon system and also represents a potential danger for its own crew as well as for uninvolved third parties in the event of a malfunction, safe operation of the automation system is particularly important. "Safe operation" here means that the automation system as well as the data on the basis of which it makes its decisions must be protected from manipulation by third parties.

Example 1: Improved supervision and control of a steering gear

For example, the watercraft can be an overseas water vehicle with a rudder system, in particular a double rudder system. The steering system has a control system that is designed to monitor the position of the rudder and to control it via an adjustment system.

In the state of the art, such systems are only monitored in accordance with SOLAS (International Convention for the Savety of Life At Sea) and thus only rudimentary (collective alarm). For military watercraft, the precision of the monitoring control is often not sufficient: With the currently available double rudder systems, it can happen that the rudders do not react synchronously to rudder angle control commands: For example, the starboard rudder reaches a rudder angle to the control command faster than a rudder angle control command corresponding to it the port. Rudder reached. Even if the commands arrive at the same time, one side of the steering gear may not be able to implement the command as quickly as the other side. This asynchronicity impairs the performance of the rudder platform and makes precise control of other system components, such as the weapon system, more difficult. The causes for an asynchronous command forwarding and / or implementation could be manifold and interact in complex ways: different sliding properties of the rudder shafts, aging potentiometers in corresponding circuits, different control pressures and much more.

Embodiments of the invention counter this problem as follows: A rudder system is used which contains a large number of sensors for several different rudder system-specific parameters, referred to here as “rudder system parameters”. The steering gear parameters include two or more of the following parameters: pressures of oil circuits in the steering gear, voltages of the electrical control system of the steering gear, currents of the electrical control system of the steering gear, position of the rudders and / or accelerations (especially vibrations) occurring on the rudder shafts. The sensors of the steering gear are configured to regularly measure a steering gear parameter within comparatively short time intervals (e.g. at least once per minute, preferably at least 10 times per second), to optionally encrypt and / or sign this measured value and in a database to save in association with a timestamp. In some embodiments, the recording frequency of the sensor can also be dynamically adapted to the circumstances, for example increasing the measurement frequency when one or more relevant parameters change above a predefined limit value. The time stamp can, for example, indicate the point in time when a measured value is stored in the database, where this point in time is very close to the point in time when the measured value was recorded and therefore also at least approximately represents this point in time. The positive On-board data from the steering gear's rudders is recorded by sensors as “steering gear parameters”, allowing the control system to determine whether the rudder system's rudder has reached the positions that the control commands should assume.

In addition to these "steering gear parameters", several other sensors inside or outside the steering gear record environmental parameter values, e.g. speed of the ship, water temperature and / or water depth and / or the operating status of other vehicle components, e.g. a pumping system. If, for example, the speed of the ship (e.g. measured in meters of covered distance per second) is not available, the drive power and / or turbine speed can be used as an indicator of the speed.

Embodiments implicitly record the times that a steering gear needs until the oars implement the given control commands under given environmental conditions and the given condition of the steering gear and have reached the desired positions, because the measurement data and preferably also the control commands are provided with time stamps and in stored in the database.

By analyzing the history of these measured values or commands by an analysis module, measured values and rudder gear states can be related in a simple manner to the times at which the control system sent control commands to the actuating system.

According to embodiments, an analysis module is provided which, on the basis of the measured values of steering gear parameters, ambient parameters and steering gear control commands stored in the database and linked with time stamps, determines the times until a control command under the respective prevailing conditions completely differs from the one given by the command affected rowing has been implemented. The times determined are used by the analysis module to adapt the sending of the control commands and / or the content of the control commands so that the synchronization of the rudders of the steering gear is improved. According to embodiments, the analysis module is configured, for example, to detect correlations between measured rudder lay times and value ranges of rudder system parameters and environmental parameters. A large number of factors are therefore taken into account, not just a current deviation of the rudder position from the target position, in order to determine whether and when a rudder will assume a desired position. Any asynchronicities between the rudders on the backboard side and on the control board side can thus be detected early and reliably and make it possible to react early and to adapt the control commands to individual rudders quickly and dynamically, according to preferred embodiments in real time. A prediction of asynchronicities also makes it possible to predict necessary maintenance work and simplifies the relevant planning.

The analysis module for improved control of the steering gear can, for example, use the acceleration or vibration data to identify possible causes for asynchrony and output them to a user. However, not only the acceleration data (vibrations), but also the other steering gear parameter values and environmental parameter values are taken into account in the analysis. This can be advantageous because the oscillations and vibrations that occur depend heavily on the water depth, rudder position, swell, vegetation, switching states of the steering gear and the ship's speed. Without taking the context into account, the acceleration data are therefore often insufficient to enable precise control of the steering gear or an exact prediction of the date for the next required maintenance. An analysis of the acceleration data in combination with the other steering gear parameters and environmental parameters, on the other hand, makes it possible to identify vibration states that say something about the current deviation of an actual rudder position from a target rudder position or the current state of material fatigue of the steering gear .

According to one embodiment of the invention, the vehicle components of the watercraft comprise a steering system with a control unit, one or more starboard-side and one or more port-side oars. The tax income unit is designed to coordinate, in particular to synchronize, the position and movement of the starboard and port rudders by sending control commands to the starboard rudder on the one hand and to the port rudder on the other. The steering gear contains several sensors designed to record steering gear parameter values, the steering gear parameters including two or more of the following measurement parameter values: current position of the oars, vibrations of the oars, fouling of the oars (e.g. by means of an optical sensor or with a force sensor , which measures the force in the direction of the flow), vibrations of components of the steering gear, switching states of the steering gear.

One or more of the other vehicle components and / or the steering system also contain several sensors that are designed to detect environmental parameter values, the environmental parameters including two or more of the following measurement parameter values: water depth, sea state, ship speed.

One of the analysis modules is an analysis module for the improved control of the steering gear and is designed to analyze the steering gear parameter values, the ambient parameter values and the time between sending the control commands from the control unit to the respective rudder until the control commands are implemented in order to identify correlations between the time periods, the steering gear parameter values, and the environmental parameter values and / or to improve the coordination of the oars of the steering gear.

For example, the analysis module for improved control of the rudder system can be designed to automatically determine that, given the sea state and vegetation, the command to the starboard rudder must be sent 400 milliseconds earlier than the corresponding control command to the port rudder. The analysis module sends a corresponding control command to the control unit of the steering gear, thereby causing the control unit to send the command to the starboard rudder only after the said delay to the port rudder. According to embodiments of the invention, the analysis module for the improved control of the steering gear is designed to measure the steering gear parameter values, the environmental parameter values, the time periods between sending the control commands from the control unit to the respective rudder to the implementation of the control commands and, in addition, status and / or to analyze vibration parameter values that have been recorded by sensors of other vehicle components, in particular the engine and / or the transmission and / or a radar system, in order to establish correlations between the time periods, the steering gear parameter values, the ambient parameter values and to recognize the state and / or vibration parameter values of the other vehicle components and / or to improve the coordination of the rudders of the steering gear.

These features are based on the observation that vehicle components can also influence the behavior and controllability of the steering gear that are not explicitly related to the steering gear. So could z. B. a radar system can be excited by the frequency generated by a drive diesel engine at a certain speed, which leads to a ne negative influence on the steering gear.

For example, the control can be implemented in the form of logic rules. In addition to the control of the steering gear described here, these rules can also be used to control other watercraft components. For example, one of the logic rules can include that an internal combustion engine can only be started when at least one exhaust gas path is open. This rule is carried out every time this engine is started and, depending on the result of the test as to whether an exhaust path is open, either such an exhaust path is opened automatically or the start process is aborted - possibly accompanied by a message to the user.

Example 2: Improved detection and prediction of consumption and conditions

Environmental parameters and condition-related parameters of vehicle components depend on one another in a complex manner. For example, when the sea water temperature is higher, the cooling systems that use sea water for cooling work differently than when the sea water is cold. The power consumption increases and the diesel engines used to generate electricity are more heavily loaded. This in turn has an impact on the maintenance and wear of the units, which are not only subjected to higher loads due to a higher seawater temperature because more energy has to be used for cooling, but are also less able to implement their own cooling because the machines and capsules are in are usually cooled with seawater just like the engine itself. The performance characteristics of seawater-cooled vehicle components are therefore often difficult to compare and the predictions regarding their energy consumption are subject to uncertainties.

According to embodiments of the invention, one of the analysis modules is configured to calculate the current or future energy consumption and / or the current or future degree of wear of a vehicle component as a function of the temperature of the ambient water used as cooling water.

With this data base, for example, similar operating modes of the entire watercraft can be found automatically, e.g. operating modes that are defined by the temperature of the surrounding water in order to take into account the evaluation of measurement data and / or other performance parameters of the entire watercraft so that only comparable operating modes of the vehicle can be compared with each other.

According to embodiments, the one analysis module is configured to use the temperature measured at different times to automatically identify similar operating modes of the entire watercraft that are defined by a specific temperature or a specific temperature range of the surrounding water. The analysis module is configured to analyze measurement data and / or other performance parameters of the entire watercraft in such a way that only comparable operating modes of the vehicle are compared with one another, in particular to determine the future energy consumption, the current maximum times possible range and / or to calculate the current or future degree of wear.

Furthermore, by analyzing performance and condition measured values that were recorded by sensors of a large number of vehicle components and stored in the database, as well as by recording and analyzing the usage profiles of the individual vehicle components (which e.g. specify how often which possibly redundant vehicle components in which situations can be used and / or how high the utilization of various vehicle components is with different readiness and use states), both the commissioning and the use phase of various vehicle components can be improved. These findings can make it possible to automatically or manually optimize the operating modes of individual vehicle components or to improve the technical properties of a (new) vehicle component.

Example 3: Cross-vehicle analyzes

The acquisition and storage of a large number of measured values over long periods of time (measured value history) according to embodiments of the invention already has considerable advantages at the application level.

Further significant advantages result for systems according to which the measured value histories of several parameters, which were recorded by several watercraft, are analyzed by a fleet analysis software. For example, a detection system and analysis module can be developed as described for example 1 at least for the steering system of the vehicles. The steering systems of the different vehicles can, but do not have to, be of the same type (e.g. come from the same Fiersteller). Because even if the steering systems differ slightly, at least subsystems such as the individual sensors of the steering system or the control unit can be of the same type or comparable. Often times, different brakes for certain vehicle components use the same components provided by a supplier. By importing the databases with the measured value histories of several watercraft into a central and specially protected database, eg within the secure infrastructure of a home port, cross-platform evaluations can be carried out. For example, at least some of the historical data can be imported into the central database in the course of a watercraft's stay in the home port and deleted from the watercraft's database. This increases data security and reduces the storage requirements of the watercraft's database.

The different data sets can be useful in several ways. The fleet analysis software can, for example, by analyzing various environmental parameters such as air and water temperature, flow conditions, etc. determine whether the vehicles or vehicle components were operated under comparable conditions or identify those vehicles and components that were operated under comparable, ie sufficiently similar, conditions . In the next step, the fleet analysis software can then analyze and recognize whether vehicle components of a certain type or manufacturer are better or worse in terms of one or more performance parameters than functionally equivalent vehicle components of a different type or manufacturer. In this way, a problem that has already occurred on one vehicle component can be prevented, if necessary, on another. Furthermore, it can be determined across all vehicles how a certain vehicle component can be operated better or should not be operated in order to avoid certain damage.

The recommendations for action calculated by the fleet analysis software can be output to a user in order to induce him to make improvements for a specific vehicle component as well as components of the same or similar type. According to some embodiments, individual analysis modules and / or the fleet analysis software can be configured to also calculate and output tactical recommendations based on the data in the database (s). FIG. 1B shows a system 150 with a plurality of military watercraft 100, 130, 132. Each of the watercraft can be designed as a watercraft of the embodiments described here. Preferably, the What servehicles all belong to the same or a similar type of vehicle. However, it is also possible that the watercraft belong to different vehicle types; in this case too, an evaluation of the sensor data histories for several watercraft can be advantageous, e.g. if the vehicles of different types contain some or more vehicle components of the same type, so that a comparison can be made the component-related measured values makes sense at least for these vehicle components.

The system 150 also contain a computer system 134, which can be designed, for example, as an individual computer or a group of computers. The computer system contains an interface 136 for the secure import of the content of the databases of the watercraft 100, 130, 132. Depending on the implementation variant, the interface 136 can be implemented differently. It can be done, for example, via a wired interface, for example based on fiber optic technology, which allows large amounts of data to be transmitted quickly. In some cases, however, it can also be a contactless interface, for example via an interface of a radio link, or a USB interface for importing data on a portable drive via USB. In any case, several technical and / or organizational security precautions are taken to ensure that the data cannot be read out or manipulated during transmission. For example, the transmission can only take place in encrypted form via an end-to-end encrypted data transmission channel. Or authentication of the user who initiated the data transmission may be required, for example via password-based and / or biometric authentication methods. For example, the computer system 134 and the interface 136 for secure data transmission can be part of the IT infrastructure of a home port, which can be used to import and collectively evaluate the measurement data automatically generated by the watercraft during their operations. The evaluation of the data from several watercraft is carried out by fleet analysis software 138, which is instantiated on the computer system 134. The fleet analysis software analyzes the imported measured values from the databases of the watercraft. The imported data can, for example, be stored in a central relational database on the computer system 134 and analyzed there. In the course of the analysis, the fleet analysis software automatically detects whether the measured values of different water vehicles have been recorded by vehicle components of the same type. This information can be helpful in ensuring that the correct readings are being compared. An engine temperature sensor measures the engine temperature, a temperature sensor on the outside of the vehicle below the water level measures the water temperature. During the analysis, it is important to take into account which sensor or vehicle component a parameter value “temperature” originates from, because a comparison is usually only useful if the measured values from sensors and components are of the same or a similar type originate, so for example only the temperature values for the component "engine" are compared with each other. Preferably, the speed dial is also included in the analysis. For example, it may be that different brakes of the same type of vehicle component (engine) attach the sensor to slightly different positions or use different types of sensors. In this case, taking into account the different Fierstel ler or other relevant circumstances can contribute to incorrect analysis results due to an incorrect interpretation of smaller manufacturer-related measured value deviations.

In the course of the analysis, the fleet analysis software uses the imported measurement data to identify which of the watercrafts are optimal or worst in terms of at least one specific target criterion. The target criterion is a technical evaluation criterion such as the vehicle with the best level of energy and spare parts reserves, the vehicle with the lowest maintenance backlog and / or with the longest time until the next inspection is due. Additionally or alternatively, the fleet analysis software recognizes critical states of vehicle components in one or more of the watercraft ge. For example, the fleet analysis software can identify all those vehicles in which vibration parameters indicate that temperatures and / or speed values have been measured in an engine within the last 6 months, e.g. due to material fatigue or other unfavorable factors, that are dangerous for the vehicle components and / or the crew must be viewed.

In some embodiments, the fleet analysis software is designed to predict the point in time of the occurrence of a critical condition of a vehicle component in one or more of the watercraft. That could be the point in time at which energy, oxygen gas or food supplies run out, at which failure of an essential component due to wear and tear is to be expected, or the like.

In some embodiments, the fleet analysis software is also designed to automatically identify one or more environmental parameters and / or vehicle component parameters and their corresponding parameter value ranges that are the cause of a critical condition of one of the vehicle components in one or more of the watercraft. This is a particularly advantageous aspect, especially in the context of highly complex military water vehicles: vehicle components and parts are sometimes defective well before the expected normal end of life without a clear cause being identified. Sometimes it can also be observed that a certain component in a certain watercraft fails again and again, while the same component lasts significantly longer in other watercraft of the same type and with the same components. In view of the highly complex interaction of various components and environmental factors, it is regularly assumed that the cause of the problem is an interaction of the component with its environment, although it is not exactly known which cause is specifically responsible for the failure of the component. The mechanical loads on components depend on a wide variety of factors, for example the vibration behavior of spatially adjacent components, the swell, wind and flow conditions to which the vehicle is exposed during its use last but not least also from manually entered control commands of the crew. In view of this complexity, it is often not possible to identify specific causes for the failure of components by carefully inspecting a particular vehicle. Only by analyzing a large number of measured values that have been recorded and stored by the sensors of a large number of watercraft over a long period of time is it possible to correlate the failure of certain components with the interaction of several other factors, for example a certain one Driving style, a certain air temperature, a certain salt content, certain flow conditions and the use of certain further components and vehicle components from other manufacturers. The fleet diagnosis thus enables an improved fault diagnosis on the basis of a broader data base including the detection of faults which are caused in a highly complex, often non-linear manner by the interaction of several specific factors.

FIG. 2 shows a block diagram of a distributed computer system 126 that can be used to store and analyze sensor measurement data. The computer system shown here includes 5 computers 202, 204, 206, 208, which are functionally connected to a network of computers via a network 280, for example an intranet, and on each of which several containers 212-230 are instantiated. Each of the computers has one or more processors 240, 242, 244, 246, main memory 248, 250, 252, 254 and optionally also one or more non-volatile data memories.

Each of the containers contains a maximum of one instance of an analysis module and is executed there. For example, the analysis modules can each be implemented as a so-called microservice.

Some analysis modules are only represented in a single instance. For example, the analysis module AM2 runs only in the form of a single instance 262 within the container 214, the analysis module AM3 only in the form of a single instance 264 in the container 216, and the analysis module AM4 only in the form of a single instance 268 in the container 222 but also in several instances within half of a corresponding number of containers are executed. For example, analysis module AM1 is instantiated in the form of the two instances 260, 266 in containers 212 and 220, respectively.

How many instances of the individual analysis modules are instantiated and / or closed and on which computer this happens is controlled by the container management software 256. The software 256 orchestrates the instantiation, migration and closing of containers and the analysis modules contained therein dynamically according to various optimization criteria, which can preferably be configured by a user. Optimization criteria can, for example, be load balancing, upscaling and downscaling criteria that ensure that the computing load is evenly distributed among the computers, that some frequently required analysis modules can be executed in parallel in several instances, and that a fast response time and / or high reliability is guaranteed .

The measurement data recorded by the sensors of the various vehicle components of the watercraft 100 are stored in a database 122. In order to increase the reliability of the database, the contents of the database are stored in a redundant manner on the various computers 202-208. Various methods for distributed, redundant storage of data are known in the prior art, for example storage by means of error correction methods using error correction bits. In some embodiments, some of the containers 224-230 can also be used to store parts of the data in the database.

The automation system 124 also includes one or more processors 282, main memory 284 and automation software 286. The automation software is configured to dynamically receive currently recorded measurement data from at least some of the sensors and, if necessary, together with commands entered by a user, to be used as an input in order to derive one or more control commands from this input and to automatically control the behavior of the one or more vehicle components 102, 104, 106, 108, 110 on the basis of the control commands. The computer system 290 with the automation system 124 is connected to the computer network 126 via a data communication channel 292. In some embodiments, the automation system can send a request to an access service 288 via the data connection 292 in order to use this data to read from the distributed database 122 and to use it for the calculation of control commands. The automation system is operationally decoupled from the analysis modules, that is, it preferably runs on a different computer and, if it uses the measured values stored in the database, accesses the measured values asynchronously to the analysis modules.

FIG. 3 shows several analysis module-specific asymmetric cryptographic key pairs which can be used for the secure transmission and storage of measurement data.

For example, the drive system 104 can be produced by a first manufacturer H1. The manufacturer H1 is also developing an analysis module AM4 that is designed to analyze measured values that are recorded by one or more sensors 112 of the drive in order to automatically predict the current and / or future state of the drive system 104. Before or during the development of the analysis module AM4, the manufacturer H1 generates a first asymmetrical cryptographic key pair with a first secret decryption key 344 and a corresponding public encryption key 332. Before the analysis module AM4 is delivered to the operator or manufacturer of the military watercraft 100 the secret cryptographic decryption key 344 is integrated in the analysis module AM4 in such a way that it cannot be read out by unauthorized third parties. In addition, the speed sensor 112 of the drive system 104 is provided with the public encryption key 332.

The public keys, all shown here with thick outlines, can be created specifically for each individual sensor of a vehicle component together with their corresponding private keys. In other embodiments, however, it is also possible that all sensors of a vehicle components share the same cryptographic key pair or the public key of this pair and use the public key to encrypt the measurement data recorded by the sensors. A sensor-specific generation of key pairs has the advantage of a very fine-grained control of the access rights. A vehicle component-specific generation of key pairs and the use of the same public key by the sensors of the same vehicle component has the advantage of simplified key management, because usually, if not always, the measurement data recorded by different sensors of a vehicle are identical or similar requirements for their confidentiality.

All measured values that the sensor 112 records in order to store them in the database 122 are encrypted with the public key 332. This means that all of the other analysis modules AM1, AM2 and AM3 cannot decrypt the data recorded by the rotational speed sensor 112 and encrypted with the key 332.

In one embodiment, however, the speed sensor 112 is configured to encrypt copies of the measured values recorded by it with a public key 330 that is assigned to an analysis module AM3 of another Fierstellers H2, so that this analysis module AM3 the copies with its corresponding private cryptographic Can decrypt key 342. For example, there can be contractual relationships of trust between the lowering actuator FH 1 and the lowering actuator FH2 of the rudder 108, so that the sensor 112 of the drive system encrypts the measured values recorded by it not only with the public key 332, but also as a copy with the public key 330, so that not only analysis module AM4 but also analysis module AM3 can access and decode these measured values.

In an analogous manner, the vehicle component 110, which contains a temperature sensor 120 and a pressure sensor 118, can be manufactured by a third Fierstelle FH3. The Fiersteller FH3 also develops the analysis modules AM5 and AM6, which can be instantiated in several copies on the computer system 126. nen. Modules AM5 and AM6 each evaluate both temperature data and pressure data, but with regard to different analysis purposes or questions. The sensor 120 generates its measurement data in the form of two copies of measurement data that are encrypted with different public keys 324, 322. The sensor 118 also generates its measurement data in the form of two copies of measurement data that are encrypted with the public keys 324, 322. Data that have been encrypted with the key 322 can be decrypted and processed by any analysis module that contains the associated private key 334. Data that have been encrypted with the key 324 can be decrypted and processed by any analysis module that contains the associated private key 336. Each of the multiple instances 306-312 of the analysis module AM5 contains the private key 334. Each of the multiple instances 314-318 of the analysis module AM6 contains the private key 336.

In the example shown, the rudder 108 includes three sensors of different types, including the angle sensor 114. Each of the sensors is assigned a public key 326-330, which forms an asymmetrical cryptographic key pair with a corresponding private key 338-342. The measured values recorded by the sensors are encrypted in triplicate and stored in the database with a different public key. Analysis module AM1 can only decrypt data that has been encrypted with the public key 326. Analysis module AM2 can only decrypt those data that were encrypted with the public key 328. The analysis module AM3, however, has two private keys 340, 342 and can therefore decrypt data that has been encrypted with the public key 328 or with the public key 330.

This precise control of access rights is particularly advantageous in the field of military water vehicles, because often only a combination of certain data is critical to security, not individual data values. For example, GPS position data is always critical to safety, as it allows opposing units to initiate an attack on the watercraft. The position of the watercraft below the water level (if it is a submarine) Usually not critical on its own, provided no further position data is known. The same applies to data such as water temperature or flow conditions. However, a combination of the position of the watercraft under water with current and temperature data allows at least an approximate determination of the current position of the watercraft in some cases.

The use of different encryption keys for different types of measurement data according to embodiments of the invention allows a fine-grained control of the access to these measurement data. Analysis modules have only one or only a few private keys and can therefore only access and process those measurement data that were recorded by a sensor that used a public key corresponding to this private key for encryption.

According to embodiments, a single particularly trustworthy software has a copy of all the private keys of the analysis modules. For example, the particularly trustworthy software can be a further analysis module with extended authorization that was developed by the operator of the vehicle. Additionally or alternatively, the fleet analysis software can have a copy of all private keys of the analysis modules in order to be able to analyze the data from all sensors of all watercraft in a fleet.

FIG. 3 shows the assignment of private decryption keys to the individual analysis modules and the assignment of public encryption keys to the sensors (or vehicle components containing these sensors). The sensors collect measurement data and encrypt them with the public keys assigned to them.

According to embodiments of the invention, further asymmetrical cryptographic key pairs are assigned to the sensors and analysis modules, but for the purpose of signature verification (not shown here). In this case, the private signing key is assigned to the individual sensors or to the vehicle components containing these sensors. The sensors or vehicle components use the signing key to transfer the recorded and optionally encrypted rarely to sign measurement data. The individual analysis modules have access to public signature verification keys, which each form an asymmetrical cryptographic key pair with one of the signing keys. For example, the public signature verification keys can be part of individual analysis modules.

The analysis modules are configured to check the validity of the signatures of the measurement data with signature verification keys and to process the measurement data only if their signature is valid.

FIG. 4 shows, by way of example, some components of a military watercraft with several analysis modules (“AMs”) and a database 122. The database 122 is implemented here in the form of two different databases, each of which contains different parts of the data. Database 122.1 contains measurement data with a normal security level, which are available in whole or in part in unencrypted form. Database 122.2, on the other hand, contains sensitive measurement data, which are also referred to as "red data" in the military sector, and which are preferably encrypted with one or more different cryptographic keys, e.g. according to an encryption method described with reference to FIG. The box 406 represents a large number of different measured values from different sensors of various vehicle components. For example, the measured values can come from the following vehicle components and sub-systems: various internal measured data (e.g. condition-related measured values of various vehicle components), SBM (damage-related measured data, e.g. regarding damage after flavarias and / or combat operations), EBM (energy-related measured data, e.g. status data of a diesel unit) , ONA (own noise analysis) and vibration data. The vibration data in particular are important in order to be able to estimate current and future system states, since these data make it possible in most cases to identify mechanical operating problems of rotating machines, in particular aging processes in steel structures.

The output interface 404 can be, for example, a screen or a loudspeaker or a machine-to-machine interface. For example, the interface can be a GUI that provides the user 424 with the result of the analysis of the individual analyzes. semodule to enable the user to take appropriate measures.

For example, the analysis module 410 can generate an analysis result, according to which the energy supplies will be exhausted in three days with constant consumption. The result is displayed to the user on the screen so that they can take appropriate measures themselves, e.g. head for a port in good time or reduce energy consumption. The analysis module for 112 can predict the probable range of the energy supplies for the next few days by analyzing several measured values such as currently available energy supplies, flow conditions, wind conditions in combination with data specified by the user, such as the route selected for the next few days. In the event that the calculation shows that the currently selected route does not have enough energy, and if a possible alternative route is selected, the reserves would be sufficient, the module can suggest the alternative route so that the user only confirms the alternative route has to cause the vehicle's automation system to automatically steer the vehicle onto the alternative route. Some analysis modules can also output their analysis results directly to individual vehicle components. For example, in the event that an energy emergency has occurred on the watercraft, the module 410 can automatically switch off all energy consumers on the watercraft that are not considered to be essential for the operation of the watercraft or terminate the provision of energy to these energy consumers.

At least some of the vehicle components can have an interface 402 in order to also transmit recorded measurement data directly to one or more of the analysis modules 410-422. This can be particularly with regard to measurement data, which are important for fast reactions of individual analysis modules in real time, since this avoids delays caused by writing the measurement data in a database; if necessary, the measurement data can also be written in the background or asynchronously in the database become. The analysis modules shown here are grouped according to application fields, for example in modules of the energy generation system EES, the maintenance system, or the "service" system). The service system comprises various services, for example with regard to the recording and / or reporting of various faults in components of the watercraft.

According to some embodiments, various external systems have access to the analysis modules and their results, for example via an external interface 408. The interface 408 can be used, for example, to export the data from the database 122 in the home port, so that a fleet analysis software can evaluate the exported data can.

List of reference symbols

100 military watercraft

102 weapon system

104 drive system

106 Navigation system

108 rowing system

110 Vehicle Components

112 speed sensor

114 GPS sensor

116 Angle / position sensor

118 pressure sensor

120 temperature sensor

122 database

124 automation system

126 distributed computer system

130 military watercraft

132 military watercraft

134 computer system

136 Import Interface

138 Fleet Analysis Software

140 screen

202-208 computer system

212-230 containers

260-268 analysis module instances

260, 266 instances of the analysis module AM1

270-278 parts of the data in database 122

240-246 CPUs

248-254 memory

256 container management software

280 network connection (intranet) 282 CPUs

284 RAM

286 automation software

288 Database Access Service

290 computer system

292 data connection

302, 304 instances of the analysis module AM2 306-312 instances of the analysis module AM5 314-318 instances of the analysis module AM6 322-332 public encryption keys for the secure exchange of data with certain analysis modules

334-344 private decryption keys, specific to certain analysis modules

402 input interface

404 output interface

406 readings

408 external interface

410-422 analysis modules

Claims

Patent claims

1. Military watercraft (100), including:

- Several vehicle components (104-110) each containing one or more sensors (112-120), at least some of the vehicle components belonging to a weapon system (102), a drive unit (104) and a navigation system (106), wherein the sensors are designed to acquire measured values, the measured values indicating operating states of the vehicle component that contains the sensor acquiring the measured values and / or states of the watercraft or its surroundings;

- A database (122), a history of measured values of the sensors in connection with a time stamp being permanently and securely stored in the database; and

- An electronic automation system (124), the automation system being designed for the automatic and / or semi-automatic control of at least one of the vehicle components in real time as a function of the measured values and / or as a function of a user input from a user, which in response to the measured values are output via a user interface.

2. The military watercraft of claim 1, wherein the watercraft comprises:

- A plurality of computers (202-208) networked with one another to form a computer network (126), which cooperate in the network as a flost so that at least one instance of the database is provided; and

- A container management software, wherein the container management software is configured for the automated provision, scaling and management of multiple containers (212-230) on the multiple computers in a manner that the computers each as Serve host system for one or more containers, the Contai ner are isolated from each other.

3. The military watercraft according to one of the preceding claims, further comprising:

- One or more analysis modules (260-268) which are each designed to carry out an analysis of at least some of the measured values stored in the database (122).

4. The military watercraft according to claim 3,

- The automation system (124) on the one hand and the one or more analysis modules (260-268) on the other hand being operatively decoupled from one another; and or

- Both the automation system and the one or more analysis modules are designed to carry out their respective control or analysis functions without using an Internet connection.

5. The military watercraft according to claim 4, wherein the operative decoupling is realized by:

- Asynchronous operation of the automation system on the one hand and the one or more analysis modules (260-268) on the other hand; and or

- Asynchronous write or read access to the database (122) by the automation system or by a service (288) operatively connected to the automation system on the one hand and by the one or more analysis modules (260-268) on the other hand; and or

- Instantiation of the automation system on the one hand and the one or more analysis modules (260-268) on the other hand on different computers (202-208; 290).

6. The military watercraft according to one of claims 3 to 5, wherein de several analysis modules are carried out in several different containers (212-230) and thus isolated from one another.

7. The military watercraft according to one of claims 2 to 6, wherein in each of the containers (212-230) a maximum of one instance of a maximum of one analysis module (260-268) is executed.

8. The military watercraft according to one of claims 2 to 7, wherein the container management software (256) is configured to orchestrate the creation of containers (212-230) and the instantiation and termination of analysis modules (260-268) so as to that:

- If one of the computers (202-208) fails or is inaccessible, the containers and analysis modules are automatically started on another of the computers, which are no longer available or accessible due to the failure or the inaccessibility of one computer; and or

- if a maximum number of instances of one of the analysis modules currently running on the computers is exceeded, automatically terminate one of these instances and / or delete one of the containers that contains an instance of this analysis module; and or

- if a predefined maximum computing load is exceeded on one of the computers to automatically migrate at least one container hosted on this computer together with the analysis module instance running in it to another of the computers; and or

- If one of the computers falls below a predefined minimum computational load, at least one container hosted on another of the computers, including the analysis module running therein, is automatically migrated to this computer; and or

- If a predefined maximum computing load is exceeded, one of the computers automatically adds at least one container hosted on this computer, including the analysis module instance running in it identify, instantiate a copy of this identified container together with the analysis module running in it on at least one other of the computers; and to execute analyzes in parallel with the inclusion of at least the analysis module entity in the identified container and the further instantiated analysis module entity; and / or - if one of the computers falls below a predefined minimum computational load, automatically identifying at least one container hosted on another computer, including the analysis module running therein, to stamp a copy of this identified container including the analysis module running therein on this one computer; and carry out analyzes involving at least the analysis module instance in the identified container and the other analysis module instance in parallel.

9. The military watercraft according to one of the preceding claims 3 to 8, wherein at least some of the analysis modules are specifically assigned a part of the data in the database, the parts of the data being stored in a protected manner that only that analysis module reads them and / or write access which is assigned to this part of the data.

10. The military watercraft according to one of the preceding claims 3 to 9, wherein several (260, 262, 264; 306, 314) of the analysis modules (260-268) are each specifically assigned to one (108; 110) of the vehicle components and are configured to do so To receive at least the measured values that are recorded by the one or more sensors of this one vehicle component to which they are assigned, directly or indirectly via the database, to analyze them and to output the result of the analysis.

11. The military watercraft according to claim 10, wherein at least one of the plurality of analysis modules assigned to one of the vehicle components is configured to perform an analysis which includes: - A recognition of current or future critical states of the one vehicle component; and or

the automatic identification of one or more environmental parameters and / or vehicle component parameters which are causal for a critical state of the one vehicle component; and or

- A calculation of a control command to a vehicle component for the automatic implementation of the control command.

12. The military watercraft according to one of the preceding claims 3 to 11,

- wherein the sensors of at least one of the vehicle components contain at least one cryptographic encryption key (324, 322, 330, 328, 326, 332),

- One of the analysis modules being assigned to the at least one vehicle component and containing a decryption key (334, 336, 338, 340, 342, 344) corresponding to this cryptographic encryption key;

- The sensors of the at least one vehicle component being designed to store at least some of the measured values recorded by them in encrypted form in the database and / or to transmit them directly to the analysis module assigned to the at least one vehicle component;

- wherein the at least one analysis module is configured to decrypt the at least some measured values with the decryption key and to analyze the decrypted data.

13. The military watercraft according to one of the preceding claims 3 to 12, - wherein the sensors of at least one of the vehicle components contain a signing key;

- One of the analysis modules being assigned to the at least one vehicle component and containing a signature verification key corresponding to this signature key;

- The sensors of the at least one vehicle component being designed to sign at least some of the measured values recorded by them with the signing key and to save them in signed form in the database and / or to transmit them directly to the analysis module assigned to the at least one vehicle component;

- wherein the at least one analysis module is configured to check the at least some measured values with the signature verification key and to analyze the signed data only when the signature verification shows that the signature is valid.

14. The military watercraft according to one of the preceding claims 3 to 13, wherein one or more of the analysis modules are each configured to output their result of the analysis to a user and / or to the analysis system (404) and / or in the database to save.

15. The military watercraft according to one of the preceding claims 3 to 14, wherein at least one of the analysis modules is designed to carry out an analysis (eg correlation analysis, NN-based prediction, rule-based prediction, etc.) on the measured values of several different sensors from several different vehicle components to be carried out, whereby the analysis includes:

- A prediction of the time of the occurrence of a critical state of a vehicle component; and or

- the automatic identification of one or more environmental parameters and / or vehicle component parameters that are causing borrowed for a critical condition of one of the vehicle components; and or

- a calculation of a recommended action to a person; and or

- A calculation of a control command to one of the vehicle components for the automatic implementation of the control command.

16. The military watercraft according to one of the preceding claims 3 to 15,

- wherein one of the vehicle components includes a steering system with a control unit, one or more starboard side and one or more port side oars, the control unit being designed to control the position and movement of the starboard side and port side oars by sending control commands to the starboard side oars on the one hand and to coordinate, on the other hand, to the port-side rudders, in particular to synchronize them,

- The steering gear contains several sensors which are designed to detect steering gear parameter values, the steering gear parameters including two or more of the following measurement parameter values: current position of the oars, vibrations of the oars, fouling of the oars, vibrations of components of the steering gear , Switching states of the steering gear;

- wherein one or more of the vehicle components contain multiple sensors which are designed to detect environmental parameter values, the environmental parameters comprising two or more of the following measurement parameter values: water depth, swell, ship speed;

- wherein one of the analysis modules is an analysis module for the improved Steue tion of the steering gear and is designed to add the steering gear parameter values, the environmental parameter values and time periods between sending the control commands from the control unit to the respective rudder until the control commands are implemented analyze to correlations to recognize between the time periods, the steering gear parameter values, and the ambient parameter values and / or to improve the coordination of the steering gear.

17. The military watercraft according to one of the preceding claims 3 to 16,

- wherein one of the vehicle components contains at least one sensor for detecting oscillations, in particular vibrations, this one vehicle component, wherein the one vehicle component is in particular a Ra daranlage and / or the drive unit,

- One of the analysis modules being designed to analyze the vibrations of one vehicle component in order to calculate the current and / or future state of another of the vehicle components, the other vehicle component being in particular a steering gear; and or

- One of the analysis modules being designed to analyze the vibrations of one vehicle component in order to improve control of the other of the vehicle components, the other vehicle component being in particular a steering system.

18. The military watercraft according to one of the preceding claims 3 to 17, wherein one of the sensors measures the temperature of the water surrounding the watercraft and stores it in the database, one of the analysis modules being configured to track the current or future energy consumption and / or Calculate the current or future degree of wear of a vehicle component depending on the temperature of the surrounding water used as cooling water.

19. The military watercraft according to claim 18, wherein the one analysis module is configured to use the temperature measured at different times for the same operating modes of the whole To identify watercraft that are defined by a certain temperature or a certain temperature range of the surrounding water, wherein the analysis module is configured to analyze measurement data and / or other performance parameters of the entire watercraft so that only comparable operating modes of the vehicle are compared, and in particular to use the comparison results to calculate the future energy consumption, the current maximum possible range and / or the current or future degree of wear of the watercraft or of watercraft components.

20. The military watercraft according to one of the preceding claims, wherein data of the database are distributed in the plurality of computers and / or stored redundantly.

21. The military watercraft according to one of claims 2 to 20, wherein the data of the database are stored distributed in different containers of different computers, wherein the container management software is configured for the creation of containers and the storage, replication and deletion of the data in the Orchestrate containers so that:

- During normal operation, the data in the database are stored in a redundant manner in the multiple computers so that they can be reconstructed from the data stored in the other computers in the event of failure of one or more of the computers; and or

- If one of the computers fails, another computer on which a copy of those parts of the data that were stored in the failed computer is identified, and the data contained on this other computer are provided to the analysis modules and the automation system; and or

- In the event of failure of one of the computers, automatically redistribution of at least part of the data stored redundantly and distributed in several containers in such a way that the previous degree of redundancy of the data in the database is restored; and or - if a predefined maximum memory requirement is exceeded in one of the computers to automatically migrate or copy at least parts of the data of the database stored on this computer to another of the computers; and or

- if one of the computers falls below a predefined minimum computing load, automatically deleting at least one of the containers hosted on this one computer.

22. The military watercraft according to one of claims 2 to 21, wherein at least some of the computers of the computer network are each contained in a separate security container that is fireproof and / or pressure-wave-resistant and / or watertight.

23. The military watercraft according to one of claims 2 to 22, wherein the computers of the computer network comprise one or more first computers and one or more second computers, wherein the first computer and the second computer are housed in different spatial areas of the water vehicle, wherein the different spatial areas are different rooms, different decks, different chambers separated by watertight lock gates, the starboard side and port side of the watercraft or the bow and stern sides of the watercraft.

24. System (150) comprising:

- At least two military watercraft (100, 130, 132) according to one of the preceding claims;

- A computer system (134) with: o an interface (136) for the secure import of the content of the databases of the at least two watercraft; o a fleet analysis software (138), wherein the fleet analysis software is designed to analyze the measured values of the databases of the at least two watercraft, wherein the fleet analysis software is configured to automatically recognize whether the measured values of different watercraft have been recorded by vehicle components of the same type, the analysis comprising: Recognition of that of the watercraft whose totality of vehicle components is in the best or worst condition with regard to at least one technical evaluation criterion; and or

^■ Recognition of critical states of a vehicle component in one or more of the watercraft; and or

^■ a prediction of the time of the occurrence of a critical state of a vehicle component in one or more of the vessels; and / or ■ the automatic identification of one or more

Ambient parameters and / or vehicle component parameters that are the cause of a critical condition of one of the vehicle components in one or more of the watercraft.