FR3116783A1 - Electronic device for decision support on board a vehicle, system for monitoring a fleet of vehicles and associated method for decision support - Google Patents

Abstract

Electronic decision support device embedded in a vehicle, system for monitoring a fleet of vehicles and associated decision support method The invention relates to an electronic decision support device (14) embedded in a vehicle (10) comprising a plurality of systems (12) able to operate according to at least one operating parameter and to emit an alert when this operating parameter is outside an associated predetermined safety domain. The device includes: an acquisition module (16) configured to acquire at least two alerts from at least two systems, a processing module (18) configured to determine a threat based on the alerts; a generation module (20) configured to generate an instruction according to each threat; and an explanation module (22) configured to display a message comprising information intended for a user. Figure for abstract: Figure 1

Description

Electronic decision support device on board a vehicle, system for monitoring a fleet of vehicles and associated decision support method

The present invention relates to an electronic decision support device on board a vehicle.

The vehicle is in particular a maritime vehicle such as a ship, an aeronautical vehicle such as a drone, a motor vehicle such as an autonomous vehicle or a railway vehicle.

The vehicle includes a plurality of systems. For example, a ship includes mechanical systems such as engines, pumps, propeller, etc. and electronic systems such as control, security, communication systems etc.

For each system taken individually, the experts of this system have important knowledge in terms of operation, maintenance, prevention, correction and optimization of this system. However, the combination and combined exploitation of this knowledge for each system at the vehicle level is problematic. Indeed, all this knowledge is compartmentalized in each of the domains associated with each system and their pooling is complicated.

For example, if a drop in pressure is detected in the compression chamber of a pump, only the designer or the expert of this pump is able to diagnose, with business data such as flow rate, temperature , etc. whether the pump is working well or to determine the actions that need to be taken to correct this drop in pressure at the level of the pump.

However, this pump expert is not competent to detect whether this drop in pressure is in fact rather due to a more global problem such as a failure or a computer attack against the vehicle that only a computer expert is competent to detect. . Conversely, this computer expert is not competent to judge the proper functioning of the pump.

Thus, in the presence of a malfunction alert, it is complicated to define an overall instruction at the level of the vehicle in response to this alert, taking into account all the particularities of each system as well as the context of use of the vehicle.

There is therefore a need for a decision support device on board the vehicle allowing the determination of a setpoint in response that is faster and more effective with respect to the safety of the vehicle while allowing detailed monitoring of the instructions established for each user of the vehicle.

To this end, the subject of the invention is an electronic decision-aid device on board a vehicle comprising a plurality of systems, each system being able to operate according to at least one operating parameter and to emit an alert when this parameter operation is outside an associated predetermined security domain, the security of the vehicle being likely to be affected by a predetermined list of threats, each threat being associated with a predetermined group of alerts according to a predetermined rule, the electronic device d decision aid comprising:a first acquisition module configured to acquire at least two alerts from at least two different systems, a first processing module configured to determine a threat from among the predetermined list of threats as a function of the acquired alerts ; a first generation module configured to generate an instruction to be implemented by at least one of the systems according to each determined threat; and a first explanation module configured to display on a display screen on board the vehicle at least one text message comprising information intended for a user of the vehicle concerning the alerts, the threat and/or the instruction.

According to other advantageous aspects of the invention, the electronic decision support device comprises one or more of the following characteristics, taken in isolation or in all technically possible combinations:

• each threat is chosen from the list consisting of: a hardware failure, a software failure, and a computer attack;
• the first generation module is configured to generate the instruction as a further function of a current context defined by the detected threat and by at least one of: the level of probability of the threat; the impact of the threat on the security of the vehicle; and the imminence of the threat to the safety of the vehicle;
• the device further comprises at least one module from among: a first display module configured to display the instruction intended for a user of the vehicle, and a first transmission module configured to transmit the instruction to at least one of the systems for the implementation of the instruction;
• the device further comprises a first alarm module configured to generate an alarm signal according to each threat determined by the first processing module, the alarm signal comprising an alarm relating to said threat;
• the first generation module is configured to implement an automatic learning method trained on a reference database for the generation of the setpoint; And
• the first processing module is configured to calculate a probability level of the threat at least according to the comparison between the acquired alerts and each predetermined group of alerts.

The invention also relates to a system for monitoring a fleet of vehicles, each vehicle comprising an electronic decision support device as defined above, the safety of the fleet of vehicles being likely to be affected by a predetermined list of hazards, each hazard affecting at least two different vehicles, the monitoring system comprising:

• a second acquisition module configured to acquire at least two threats from at least two different vehicles,
• a second processing module configured to determine a hazard from the predetermined list of hazards based on the acquired threats; And
• a second generation module configured to generate an instruction according to each determined danger.

The invention also relates to a decision support method implemented by a decision support device on board a vehicle comprising a plurality of systems, each system being able to operate according to at least one operating parameter and to issuing an alert when one of the operating parameters is outside of an associated predetermined security domain, the security of the vehicle being likely to be affected by a predetermined list of threats, each threat being associated with a predetermined group of alerts, the decision support process comprising at least the following steps:

• acquisition of at least two alerts from at least two different systems,
• determination of a threat from the predetermined list of threats based on the alerts acquired;
• generation of an instruction according to each determined threat; And
• display on a display screen on board the vehicle at least one text message comprising information intended for a user of the vehicle concerning the alerts, the threat and/or the instruction.

The invention also relates to a computer program product comprising software instructions which, when executed by a computer, implement a method as defined above.

These characteristics and advantages of the invention will appear more clearly on reading the following description, given solely by way of non-limiting example, and made with reference to the appended drawings, in which:

there is a schematic representation of a fleet of vehicles monitored by a monitoring system according to the invention;

there is a schematic representation of an electronic decision support device on board one of the vehicles of the , And

there is a schematic representation of the monitoring system of the , And

there is a flowchart of a method, according to the invention, for decision support according to the invention, the method being implemented by an electronic decision support device and the monitoring system.

A fleet of vehicles 10 is represented on the .

Each vehicle 10 is a maritime, aeronautical, automobile or railway vehicle.

As seen on the , each vehicle 10 is in particular a ship. By ship is meant any civil or military machine moving on the surface of the seas such as a boat or below this surface such as a submarine.

Those skilled in the art will understand that the fleet of vehicles 10 possibly extends over a wide geographical area and that the vehicles 10 are not necessarily close to each other.

The fleet of vehicles 10 is monitored by a monitoring system 11 which will be described later.

Each vehicle 10 comprises a plurality of systems 12, an electronic decision support device 14 and advantageously a display screen 15.

Each system 12 is in particular a mechanical system such as, for example, a motorization or propulsion system of the vehicle 10, or an electronic system such as, for example, a control or communication system.

Each system 12 is capable of operating according to at least one operating parameter.

Each operating parameter is a data characteristic of the operation of said system 12, in particular one of the input data and/or one of the output data of the system 12.

By way of example, when the system 12 is a pump, the operating parameters are the pressure, the power, the flow, etc. When the system 12 is a command system, the operating parameters are for example the frequency of sending the commands, the value of the commands, etc.

Each operating parameter is associated with a predetermined security domain. This security domain is defined upstream of the operation of the vehicle 10, in particular by experts of the system 12. During normal operation of the vehicle 10, that is to say without malfunction or external attack, the domain of security is dimensioned in such a way that the values of the operating parameter remain in this security domain. A value outside this security domain is an indication of a malfunction or an attack against this system 12.

Each system 12 is configured to issue an alert when at least one of the associated operating parameters is outside the predetermined security domain associated with said operating parameter.

The electronic decision support device 14 is configured to generate an instruction according to the current context and to inform at least one user of the vehicle 10 thereof. The current context is defined in particular by the operating parameters of the various systems 12 of the vehicle 10.

The current context makes it possible to determine the environment and the constraints encountered by the vehicle 10 at the present time. When the vehicle 10 is a ship, the context makes it possible to determine for example a context among: a ship on a combat mission, a ship in training mode, a ship carrying out a delicate maneuver in a port, etc.

For this purpose and as it is visible on the , the electronic decision support device 14 comprises a first acquisition module 16, a first processing module 18, a first generation module 20 and a first explanation module 22.

The electronic decision support device 14 also advantageously comprises a first display module 24, a first transmission module 26 and a first alarm module 28.

The first acquisition module 16 is configured to acquire at least two alerts from at least two different systems 12.

Thus, the first acquisition module 16, also called “case manager” (or “case manager” in French), is suitable for receiving all the alerts sent by the various systems 12 of the vehicle 10.

Advantageously, for each alert raised by one of the systems 12, the first acquisition module 16 is configured to determine a reaction instruction intended for the system 12 in order to respond to the alert.

This reaction setpoint is determined in particular by the experts of the system 12 upstream of the operation of the vehicle 10. By way of example, if an excessive pump flow rate is detected, the reaction setpoint will be a setpoint for reducing this debit.

However, as explained above, this reaction setpoint, which is a localized reaction and only takes into account the alerts due to a single system 12, does not make it possible to react to more global problems such as a computer attack or a more serious hardware malfunction. overall.

To this end, the first processing module 18 is configured to determine a threat from the predetermined list of threats according to the alerts acquired by the first acquisition module 16.

A threat is an event likely to affect the security of the vehicle 10. In particular, each threat is chosen from the list consisting of a hardware failure, a software failure and a computer attack.

In particular, the security of the vehicle 10 is likely to be affected by a predetermined list of threats. These threats are thus studied upstream of the operation of the vehicle 10 by a group of experts from the various systems 12 of the vehicle 10.

Thus, each threat is associated with a predetermined group of alerts according to a predetermined rule.

The pre-determined rule is used to associate a set of alerts with an associated threat.

By way of example, a computer attack threat against the vehicle's propulsion systems 10 is associated with an engine power drop alert, a propeller rotation drop alert, a control system alert.

Also by way of example, a malicious code insertion type threat on a system is associated with a USB key insertion alert, detection of an unknown computer process or an integrity fault.

Also by way of example, a malfunction such as a refrigerator insulation fault is associated with an abnormal electricity consumption alert and a variation of the PID profile (proportional/integral/derivative).

Thus, the first processing module 18 is able to receive the various alerts acquired by the first acquisition module 16 and to deduce therefrom a threat against the security of the vehicle 10 according to the predetermined rule.

In an advantageous embodiment, the first processing module 18 is configured to calculate a probability level of the threat at least according to the comparison between the acquired alerts and each predetermined group of alerts.

In particular, if a threat is associated with N alerts, the acquisition of a number less than N of alerts allows the first processing module 18 to deduce a threat risk with a certain level of probability. Thus, the detection of N-1 alerts associated with a threat allows the deduction of this threat with a high level of probability. Conversely, if only half of the alerts associated with a threat have been detected, the associated probability level will be low. Those skilled in the art will understand that the threshold making it possible to detect the level of probability is a dynamic parameter, varying according to the context of use of the system 12.

The first processing module 18 is able to send the threat or threats detected, as well as advantageously the level of probability associated with each threat, to the first generation module 20 and to the first alarm module 28.

The first generation module 20 is configured to generate an instruction to be implemented by at least one of the systems 12 according to each determined threat.

The setpoint is an operation to be carried out by the associated system 12. The instruction is in particular a curative operation making it possible to eliminate the threat, a preventive operation making it possible to limit the impacts of the possible threat, an operation confirming the presence of the threat, or even a combination of these operations.

The instruction may apply to a system 12 that has not raised an alert but which has been diagnosed as the source of the malfunctions that caused the alerts in the other neighboring systems 12.

The first generation module 20 is advantageously configured to generate the instruction as a further function of the context defined by at least one of: the level of probability of the threat, the impact of the threat on the safety of the vehicle 10 and the imminence of the threat to the safety of vehicle 10.

Thus, the first generation module 20 is configured to find a compromise between the effectiveness of the reaction, the risk of applying the reaction and in particular the secondary effects that the setpoint could cause and the time required to carry out the setpoint.

In other words, the first generation module 20 is configured to determine the reaction defined by the setpoint taking into account as criteria: the effectiveness of the reaction, the risk of applying the reaction according to the possible side effects, the time required to carry out the reaction and the nature of the reaction which can be a curative treatment, a preventive treatment or even a confirmatory diagnosis.

For example, when a ship operator has to carry out a delicate operation such as entering a port, if a threat is detected, the instruction to be applied depends on the immediate context. If the threat is not proven with certainty, for example if it is in particular a simple anticipation, the threat can possibly be ignored or the instruction can be only a preventive instruction, and thus let the operator carry out the maneuver that requires a lot of attention on his part. Conversely, if the detected threat is almost certain and serious, it is urgent to apply a curative instruction immediately and interrupt the maneuver in progress.

The generation of the instructions by the first generation module 20 is for example carried out from a predetermined correspondence table between the various threats and the associated instructions. This table is produced in particular by experts in the various systems 12 of the vehicle 10.

As a variant, the first generation module 20 is configured to implement an automatic learning method trained on a reference database for the generation of the setpoint. The reference database includes in particular a history of the threats recorded on other similar vehicles, the instructions then determined and the associated results. The database is advantageously regularly updated taking into account feedback from the various vehicles 10 in the fleet.

The first generation module 20 is configured to send the instruction(s) to the first explanation module 22 and advantageously to the display module 24 and/or to the transmission module 26.

The first display module 24 is configured to display the instruction intended for a user of the vehicle 10. The instruction is for example displayed on the display screen 15 disposed in the control cabin of the vehicle 10. The user is then informed of the setpoint recommended by the decision aid device 14 and can apply it if it deems it necessary in view of the context.

The first transmission module 26 is configured to transmit the setpoint to at least one of the systems 12 for the implementation of the setpoint. In this case, the instruction is implemented automatically without the user validating it or not.

Advantageously, the first generation module 20 is configured to send the instruction to the first display module 24 or to the first transmission module 26 depending on the current context and in particular the level of probability of the threat, the impact of the threat on safety of vehicle 10 and the imminence of the threat to the safety of vehicle 10.

The first display module 24 is advantageously capable of displaying on the display screen 15 a button allowing the user to validate the instruction and to send it to the first transmission module 26.

The first explanation module 22 is configured to display on the display screen 15 at least one text message comprising information intended for a user of the vehicle 10 concerning the alerts, the threat and/or the instruction.

In particular, the first explanation module 22 is configured to display the logical link between the alerts which led to the detection of the threat and then of the instruction.

The first explanation module 22 is further configured to display the level of probability of the threat.

By way of example, the first explanation module 22 displays information relating to two alerts, namely the detection of an unknown process on a computer machine of the vehicle 10 and an increase in network traffic. The first explanation module 22 also displays the detection of the associated threat, namely a malicious code present in the machine performing a port scan. Finally, the first explanation module 22 displays the instruction to restore the machine. The first explanation module 22 also possibly displays the probability of this threat and information relating to the effectiveness and speed of the determined instruction. The user thus has a complete and precise vision of the threats on the vehicle 10 and of the operations to be carried out.

In an advantageous embodiment, the first explanation module 22 is configured to receive requests from the user sent in particular via the display screen 15 and to display additional information in response to these requests. These requests are in particular requests for additional information on the alerts, the threat and/or the instruction and thus allow the user to be in possession of all the necessary information.

The first alarm module 28 is configured to generate an alarm signal according to each threat determined by the first processing module 18.

The alarm signal comprises an alarm relating to said threat.

The first alarm module 28 is in particular configured to send the alarm signal to the first display module 24 so that the alarm is displayed on the display screen 15.

The user is thus directly notified of the detection of a threat, possibly before the first generation module 20 has had time to generate an associated instruction.

Thus, the decision aid device 14 according to the invention allows the determination of a setpoint in response that is faster and more effective with regard to the safety of the vehicle 10, allowing all of the systems 12 and their interactions.

The invention therefore allows detection of computer attacks against vehicles or can be applied to the predictive maintenance of the vehicle 10 by detecting possible global hardware or software failures affecting different systems 12.

The decision support device 14 also allows detailed monitoring of the instructions established for each user of the vehicle 10 by means of the explanations displayed on the display screen 15.

Thus, the decision support device 14 adopts a so-called “automatic explanatory” method. The first generation module 20 is able to determine a single instruction proposal based on the detected threats and the first explanation module 22 is able to explain the reasoning leading to the automatic generation of this instruction.

In order to better understand the invention, an analogy can be made with the medical field. Indeed, the various alerts of the systems 12 are analogous to the symptoms felt by a person at the level of his various organs.

Generally a person has the possibility of treating the symptoms they feel, such as headache, body aches, watery eyes, toothache, etc. The treatment of a symptom such as a headache is done via an aspirin. This self-medication does not generally allow treatment but it avoids too rapid a runaway deterioration in health which may be due to a much more serious problem but which the person cannot deduce because of a lack of knowledge, tools or expertise.

The treatment of the symptom will make it possible to wait until the visit of a doctor benefiting from the knowledge and techniques necessary for the diagnosis. The correlation of all the symptoms will make it possible to deduce a syndrome. For example, in the case of a coronavirus-like syndrome, the associated symptoms are headache, high fever, respiratory problem, etc. Of course, it is not necessary to have all the symptoms to suspect a syndrome. Knowing the syndrome then makes it possible to determine a treatment prescription. Indeed, in medicine for each syndrome described, we generally associate a protocol allowing the cure. Thus, the doctor has the possibility of justifying his treatment by explaining the various symptoms he has detected.

However, the safety of the fleet of 10 vehicles is also likely to be threatened by a hazard affecting at least two different 10 vehicles.

A danger is for example a computer attack against the entire fleet of vehicles 10 or a generic defect potentially affecting all of the vehicles 10 such as a hardware or software design defect.

To this end, with reference to the , the monitoring system 11 of the fleet of vehicles 10 comprises a second acquisition module 30, a second processing module 32 and a second generation module 34.

The monitoring system 11 also advantageously comprises a second explanation module 36, a second display module 38, a second transmission module 40 and a second alarm module 42.

The monitoring system 11 is for example integrated into a monitoring center 50 arranged away from the vehicles 10. When the vehicles 10 are ships, the monitoring center 50 is for example a land building remotely monitoring the fleet of ships. .

The monitoring center 50 comprises in particular a display screen 52 intended for an operator monitoring the fleet.

The operation of each second module 30, 32, 34, 36, 38, 40, 42 is similar to the operation of each associated first module 16, 18, 20, 22, 24, 26, 28, only the input data and the varying output data.

The second acquisition module 30 is configured to acquire at least two threats from at least two different vehicles 10.

The second processing module 32 is configured to determine a danger from a predetermined list of dangers according to the acquired threats.

For example, if several vehicles 10 report the same threat affecting the same electronic systems 12 at the same time, the second processing module 30 determines that a computer attack against the fleet of vehicles 10 is in progress.

The second generation module 34 is then configured to generate an instruction according to each determined danger.

The deposit is an operation to be carried out by at least one vehicle 10 of the fleet.

The second generation module 34 is advantageously configured to generate the instruction as a further function of the context defined by at least one of: the level of probability of the danger, the impact of the danger on the safety of the fleet and the imminence of the danger to the safety of the fleet. Thus, the second generation module 34 is configured to find a compromise between the effectiveness of the reaction, the risk of applying the reaction and in particular the secondary effects that the setpoint could cause and the time required to carry out the setpoint.

The second generation module 34 is configured to send the instruction(s) to the second explanation module 36 and advantageously to the second display module 38 and/or to the second transmission module 40.

The second display module 38 is configured to display the setpoint intended for an operator of the monitoring center 50. The setpoint is for example displayed on the display screen 52 arranged in the monitoring center 50.

The second transmission module 40 is configured to transmit the instruction to at least one of the vehicles 10 for the implementation of the instruction. In this case, the instruction is implemented automatically without the operator validating it or not.

Advantageously, the second generation module 34 is configured to send the instruction to the second display module 38 or to the second transmission module 40 depending on the current context and in particular the level of probability of the danger, the impact of the danger on safety of the fleet and the imminence of the danger on the safety of the fleet.

The second explanation module 36 is configured to display on the display screen 52 arranged in the monitoring center 50 at least one text message comprising information intended for an operator concerning the threats, the danger and/or the order.

In particular, the second explanation module 36 is configured to display the logical link between the threats which led to the detection of the danger then of the instruction.

In an advantageous embodiment, the second explanation module 36 is configured to receive requests from the operator sent in particular via the display screen 52 and to display additional information in response to these requests. These requests are in particular requests for additional information on the threats, the danger and/or the instruction and thus allow the operator to be in possession of all the necessary information.

The second alarm module 42 is configured to generate an alarm signal according to each danger determined by the second processing module 32.

The alarm signal includes an alarm relating to said danger.

The second alarm module 42 is in particular configured to send the alarm signal to the second display module 38 so that the alarm is displayed on the display screen 52.

In the example of the , the electronic decision support device 14 comprises an information processing unit 60 formed for example of a memory 62 and a processor 64 associated with the memory 62. The different modules are each made in the form of a piece of software, or a piece of software, executable by the processor 64 and stored in the memory 62. The processor 64 is then capable of executing each of these pieces of software.

In the example of the , the monitoring system 11 comprises an information processing unit 70 formed for example of a memory 72 and a processor 74 associated with the memory 72. The different modules are each produced in the form of software, or a software brick, executable by the processor 64 and stored in the memory 72. The processor 74 is then capable of executing each of these software.

In a variant not shown, the various modules are each made in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array), or even in the form of a dedicated integrated circuit, such as an ASIC (Application Specific Integrated Circuit).

When the electronic decision aid device 14 and/or the monitoring system 11 is produced in the form of one or more software, that is to say in the form of a computer program, it is in further suitable for being recorded on a support, not shown, readable by computer. The computer-readable medium is, for example, a medium capable of storing electronic instructions and of being coupled to a bus of a computer system. By way of example, the readable medium is an optical disc, a magneto-optical disc, a ROM memory, a RAM memory, any type of non-volatile memory (for example EPROM, EEPROM, FLASH, NVRAM), a magnetic card or an optical card. On the readable medium is then stored a computer program comprising software instructions.

The operation of the electronic decision support device 14 and of the monitoring system 11 according to the invention will now be explained using the representing a flowchart of the process, according to the invention, for decision support.

Subsequently, an example of implementation of the method will be described for a ship, and those skilled in the art will understand that this method applies more generally to any vehicle 10.

Initially, as seen on the , a fleet of ships sails, each ship functioning without malfunction.

Then, on board at least one ship, several systems 12 issue alerts on their operation. In particular, at least one operating parameter of each system 12 is outside an associated predetermined security domain.

For example, a pump has too low pressure and a computer machine has too much traffic.

During a step 100, the first acquisition module 16 then acquires at least two alerts from at least two different systems 12.

Then, during a step 110, the first processing module 16 determines a threat from the predetermined list of threats based on the alerts acquired.

For example, the detected threat is a computer attack against the pump control system.

Advantageously, the first processing module 16 sends the detected threat to the surveillance system 11.

During a step 120, the first generation module 18 generates an instruction according to the determined threat.

For example, the instruction is to stop the pumps, restore the computer machine and search for viruses in the rest of the vehicle 10.

Then, the display module 24 displays on the display screen 15 on board the ship at least one text message comprising information intended for a user of the ship, such as the pilot, concerning the alerts, the threat and /or the instruction.

In particular, the text message indicates the nature of the alerts acquired, the detected threat associated with a level of probability of this threat and the instruction determined in response.

During a step 130, the first display module 24 displays the instruction intended for a user of the vessel on the display screen 15 arranged in the control cabin of the vessel.

As a variant or in addition, during a step 140, the first transmission module 26 transmits the instruction to at least one of the systems 14 for the implementation of the instruction.

For example, the first transmission module 26 transmits the stop instruction to the pump and the restoration instruction to the computer machine.

At least one other ship in the fleet is implementing steps 100-140.

For example, this other ship also reports a threat of computer attack against the pump control system.

During a step 150, the second acquisition module 30 acquires at least two threats from at least two different ships.

The second processing module 32 determines, during a step 160, a danger from a predetermined list of dangers according to the acquired threats.

For example, the danger here is a computer attack against the entire fleet.

The second generation module 34 is then generates an instruction according to each hazard determined during a step 170.

The instruction is for example a search for viruses in the pump control system sent to all the ships of the fleet.

Then, during a step 180, the second display module 38 displays the instruction intended for an operator of the monitoring center 50 on the display screen 52.

In addition or as a variant, during a step 190, the second transmission module 40 transmits the instruction to at least one of the vehicles 10 for the implementation of the instruction.

Finally, during a step 200, the second explanation module 42 displays on the display screen 52 disposed in the monitoring center 50 at least one text message comprising information intended for an operator concerning the threats, the danger and/or the instruction.

It is understood that the invention has a certain number of advantages.

Indeed, the invention makes it possible to determine a set point quickly and efficiently. The contextualization of the events detected in the environment of use of the various systems 12 of the vehicle 10 makes it possible to be able to understand more precisely the various malfunctions affecting the vehicle 10. By better understanding what is happening in the vehicle 10 by pooling the alerts feedback, it is possible to respond to them more effectively.

In the presence of a malfunction alert reported by a system 12, this will be processed at different levels. The first level corresponds to a reflex reaction, manual or automatic, the main objective of which is to prevent the accident from getting worse. For example, when a pump stops working, for whatever reason, the first reaction is to turn off the valve that supplies it. The other levels aim to contextualize this alert in a higher level environment. Thus, there are as many levels as skills needed to process the alert. Once the problem has been understood in its entirety, action is taken at the level of the vehicle 10 whereas the first level reflex reaction only targets the system 12 having raised the alert.

The response to the various malfunctions encountered by the vehicle 10 is therefore more effective and the safety of the vehicle 10 is thus enhanced.

Claims (10)

Electronic decision support device (14) on board a vehicle (10) comprising a plurality of systems (12), each system (12) being able to operate according to at least one operating parameter and to emit an alert when this operating parameter is outside an associated predetermined security domain, the security of the vehicle (10) being likely to be affected by a predetermined list of threats, each threat being associated with a predetermined group of alerts according to a predetermined rule,
the electronic decision support device (14) comprising:

• a first acquisition module (16) configured to acquire at least two alerts from at least two different systems (12),
• a first processing module (18) configured to determine a threat from the predetermined list of threats based on the acquired alerts;
• a first generation module (20) configured to generate an instruction to be implemented by at least one of the systems (12) according to each determined threat; And
• a first explanation module (22) configured to display on a display screen (15) on board the vehicle (10) at least one text message comprising information intended for a user of the vehicle (10) concerning the alerts , the threat and/or the instruction.

Device (14) according to claim 1, in which each threat is chosen from the list consisting of:

• hardware failure,
• a software failure, and
• a computer attack.

Device (14) according to claim 1 or 2, in which the first generation module (16) is configured to generate the setpoint according also to a current context defined by the detected threat and by at least one of:

• the level of probability of the threat;
• the impact of the threat on the security of the vehicle; And
• the imminence of the threat to the safety of the vehicle.

Device (14) according to any one of the preceding claims, further comprising at least one module among:
- a first display module (24) configured to display the instruction intended for a user of the vehicle (10), and
- a first transmission module (26) configured to transmit the instruction to at least one of the systems (12) for the implementation of the instruction. A device (14) according to any preceding claim, further comprising a first alarm module (28) configured to generate an alarm signal based on each threat determined by the first processing module (18), the alarm signal comprising an alarm relating to said threat. Device (14) according to any one of the preceding claims, in which the first generation module (20) is configured to implement an automatic learning method trained on a reference database for the generation of the setpoint. Device (14) according to any one of the preceding claims, in which the first processing module (18) is configured to calculate a level of probability of the threat at least according to the comparison between the acquired alerts and each predetermined group of alerts. A system (11) for monitoring a fleet of vehicles (10), each vehicle (10) comprising an electronic decision support device (14) according to any one of the preceding claims, the safety of the fleet of vehicles (10) being likely to be affected by a predetermined list of dangers, each danger affecting at least two different vehicles (10), the monitoring system (11) comprising:

• a second acquisition module (30) configured to acquire at least two threats from at least two different vehicles,
• a second processing module (32) configured to determine a hazard from the predetermined list of hazards based on the acquired threats; And
• a second generation module (34) configured to generate an instruction according to each determined danger.

Decision support method implemented by a decision support device (14) on board a vehicle (10) comprising a plurality of systems (12), each system (12) being capable of operating according to at least an operating parameter and emitting an alert when one of the operating parameters falls outside an associated predetermined security domain, the security of the vehicle (10) being likely to be affected by a predetermined list of threats, each threat being associated with a predetermined group of alerts,
the decision support process comprising at least the following steps:

• acquisition of at least two alerts from at least two different systems (12),
• determining a threat from the predetermined list of threats based on the alerts acquired;
• generation of an instruction according to each determined threat; And
• display on a display screen (15) on board the vehicle (10) at least one text message comprising information intended for a user of the vehicle (10) concerning the alerts, the threat and/or the instruction.

Computer program product comprising software instructions which, when executed by a computer, implement a decision-making aid method according to the preceding claim.