KR20220109474A - military ship with sensors - Google Patents

Abstract

The present invention relates to a military vessel (100) comprising:
- a plurality of vehicle components (104-110) each comprising one or more sensors (112-120), wherein at least some of the vehicle components are a weapon system (102), a drive unit (104) and a navigation system (106) . representing the plurality of vehicle components (104-110);
- a database (122), said database (122) storing in a persistent and protected manner a history of the measurement values of said sensors together with a time stamp; and
- an electronic automation system (124), said automation system comprising at least one of said vehicle components based on said measurement values and/or based on input from a user entered via a user interface in response to an output of said measurement values The electronic automation system (124), designed to automatically and/or semi-automatically control in real time.

Description

military ship with sensors

technical field

The present invention relates to a military vessel, in particular a military vessel having sensors for detecting measured values.

background

Military ships are often very complex systems developed for specific applications, sometimes with multiple components from different manufacturers. Compared to civilian ships, military ships are often distinguished by a relatively small number of units, a high complexity, a large number of vehicle components used, and a high demand for protection of vehicle-related data. The construction of vehicle components is also often very heterogeneous, and in terms of manufacturers and components of multiple and integrated densities, it is not always possible to comprehensively test the interaction of individual components for every conceivable usage scenario. Also, manufacturers of vehicle components tend to keep the measurement values detected by the sensors inside the components secret, in order to prevent a third party from being able to utilize this knowledge to duplicate or "hack" the vehicle components. There is this. Accordingly, these circumstances constitute significant technical obstacles to the integration of vehicle components of a military vessel.

German patent application DE 102008025803 A1 describes a ship's combustion engine with a control device for controlling and/or regulating the operation of the ship's combustion engine. The control device determines nominal operating parameters for the combustion engine of the vessel based on the position of the vessel.

German patent application DE 102011 086355 A1 discloses at least one gun, a trigger device, a sensor system for detecting data, in particular environmental and/or target data, and an authorization system, for the defense of a target, in particular for commercial use. Describes a weapon system for use on ships. The authorization system is configured to release or block the trigger device upon receipt of the released signal.

German patent application DE 31 50 895 A1 describes a warship with systems connected via electronic control units. In warships with control and controlled systems, electronic control devices are provided which form, from raw data coming from the assigned control systems, control signals for the assigned controlled systems. The electronic control devices have a correction step for each assigned controlled system in order to correct the formed control signals according to a bedding error of the control system and/or the controlled system activating the control device. Also provided are memories for bedding error values according to the horizontal angular position of the controlled system and/or the control system.

US patent application US 2008/0 120 620 A1 describes the use of an “open software architecture” for a naval fleet.

US patent application US2018/0304969A1 describes a ship equipped with a propeller on a rotatable shaft, and a method of converting the power of the rotating shaft into thrust to drive the ship on water. This method includes measuring values describing shaft power, an estimate of two excess shaft power levels caused by contamination of the propeller and by contamination of the hull, and cleaning the propeller and/or the hull according to the estimated excess shaft power levels. Contains the output of the command for cleaning.

US patent application US2019/0176945A1 describes the movement control of a vessel in a way that optimally balances power and noise emissions.

U.S. patent application US 2006/058 929 A1 describes a method for verifying a control system of a ship, wherein, in its operating state, the control system receives sensor signals from sensors, and in response thereto a desired position , sends control signals to the actuator to maintain speed, course or something else.

US patent application US 2018/0 356 826 A1 describes a system and method for facilitating decisions for a vessel. The method includes detecting environmental data from the environment in which the vessel is placed; generating a plurality of digital models each modeling an effect of an environment on a corresponding capability of the vessel; using the environmental data and digital models to model the impact of the environment on the capabilities of the vessel; and generating a risk assessment for the selected action.

Publication ANDO, Hideyuki: Smart ship application platform project (SSAP Project). In: Sea Japan 2014, Environmental Technology Seminar, 11 April 2014, 11 S. URL: https://www.mlit.go.jp/common/001039009.pdf [Download July 20, 2020] in Safety and Energy Efficiency It describes application services in the context of "smart ship" to achieve optimal ship operation in relation to

summary

The present invention is based on the object of providing an improved military vessel.

The objects on which the invention is based are achieved with the features of the independent claims. Embodiments of the invention are indicated in the dependent claims. The embodiments listed below may be freely combined as long as they are not mutually exclusive.

In one aspect, the present invention relates to a military vessel.

A military vessel includes a number of vehicle components, each of which includes one or more sensors. At least some of the vehicle components form part of the weapon system, drive unit and navigation system. Sensors are designed to detect measured values, wherein the measured values are indicative of operating conditions of the vehicle component comprising the sensor detecting the measured values, and/or conditions of the vessel or its environment.

The military vessel further includes a database. The database stores the history of the sensor's measurement values together with a time stamp in a persistent and protected manner.

Military ships contain electronic automation systems. The automation system is designed to automatically and/or semi-automatically control in real time at least one of the vehicle components based on the measurement values and/or based on input from a user entered through a user interface in response to an output of the measurement values. .

This may be advantageous because a vessel configured in this way uses the measurement data detected by the sensors in two ways: first, the measurement data is directly or indirectly dependent on its control of the automation system and thus of the individual vehicle components. used to influence For example, detected measurement values may be passed directly as input to an automated system. Additionally or alternatively, the measurement values, or at least some of them, may be displayed to the user, such that the latter can determine, based on these measurement values, how the automated system should operate. Accordingly, the first use of each currently valid measurement data involves influencing the control of vessel components in real time. Second, the measurement data is also stored in the database. This is the temporal evolution of the generation of the measurement data (“history” of the measurement values), for example using a timestamp (preferably UTC or location independent and unambiguous) indicating the time of detection of the measurement value. ) to be taken from the database. Persistent storage of measurement data in a database enables automatic creation of the database over time, the analysis of which is a complex dependence of several vehicle components or their states (engine temperature, turbine rotation, key vibration). Allows fields and interactions to be learned taking into account environmental parameters (temperature, relative humidity, pressure, depth, geographic location). For example, the contents of a database may be used as training data records for training machine learning algorithms based on these data. As a result, covert correlations and interactions that are obscure or can only be identified technically indirectly can be determined and, in principle, determined in a manner specific to each vessel, especially for military units with small unit quantities and many products. There is a lot of correlation in the sector.

Measured values are stored in the database in a protected manner, which means that they are protected from access by unauthorized parties by means of security measures, for example by encryption or prevention of anonymous access by assignment of access rights. it means.

Thus, in principle, it is possible to digitally detect all measurement values occurring on the vessel, which may originate from different vehicle components and from different manufacturers, and use them for control of the vessel in real time and also (in automation). available for both) for subsequent analysis of the history of digital measurement values detected by the ship's sensors. Thus, the ship's operators, based on the history stored in the database and optionally using their own analytical tools, can individually It has the potential to acquire valuable knowledge about ships. Because measurement values from different sensors of different vehicle components are stored in a single database, they have access to widely varying multi-variant analyses, as used, for example, in the context of big data. It is possible. For example, a timestamp, which may be configured as UTC, allows different measurement values to be established in unambiguous relationships with each other, optionally also along with the times at which control commands were sent to vehicle components or subcomponents. allow it to be set.

Accordingly, embodiments of the present invention enable the uniform use and analysis of all occurring/detectable digital data that may originate or be detected from even more complex platforms, equipment and systems aboard a military vessel, thereby enables seamless integration, installation, commissioning and long-term operation of the vehicle and its components.

Embodiments of the present invention may be particularly useful in the military field, as a user's detailed knowledge of individual vehicle components often cannot be reliably retrieved in mild or stressful military situations. Vehicles and components are becoming more and more complex, and the number of crew members is decreasing (crew intensity reduced to zero, which corresponds to fully autonomous vehicle control). The detection of sensor data and its storage in a database may compensate for the advantages.

In embodiments of the present invention, a military vessel comprises multiple (at least two) computers networked together into a computer network and cooperating in the network as hosts so that at least one instance of the database is provided. It is also possible for some or all data of a database to be stored in a redundant manner on multiple computer systems, for example, in that several instances of a database containing some or all data of the database are created on multiple computers. .

In embodiments of the present invention, a vessel comprises container management software configured for automatic provisioning, scaling and management (“orchestration”) of at least one container on at least one of the computers, such The at least one computer functions as a host system for the at least one container, and the at least one container isolates programs running inside the container from programs running outside the container. Preferably, the container management software orchestrates multiple containers on one or more computers.

In embodiments of the present invention, a vessel comprises a number of computers networked in a computer network, and container management software. Container management software provides for automatic provisioning, scaling and management (“coordination”) of multiple (at least two) containers on multiple computers in such a way that the computers each function as a host system for one or more containers. configured, wherein containers (of the same host computer system and also of different host computer systems) are isolated from each other.

This allows the integration of multiple computers within a computer network, and the use of container management software to coordinate multiple containers hosted on the computers, to perform at a high level the provisioning of the system and database and/or individual analysis modules, and It can also be advantageous because it makes it very safe against failure. For example, containers may be coordinated such that they provide a database or portions of a database and/or one or more analysis modules to multiple instances, such that parallel access to identical copies of data or analysis modules is possible. For the database, this increases the speed of read and write access to the measurement values stored in the database and increases the safety against failure. With respect to analysis modules provided in a redundant manner in some embodiments, this also increases the availability (in some cases, parallel performance of the same analysis type) and safety against failure of the corresponding analysis module. Both military applications, as failure of database and/or software programs instantiated within containers may result in significant data loss, data inconsistencies or failure of prognostic and warning functions based on currently stored measurement data and past stored data. It is very important in relation to ships. Furthermore, the use of containers and container management software to coordinate containers is, for example, when significantly larger amounts of (measurement) data have to be stored and/or analyzed over time, and/or over a computer network. This allows for simple scaling of the system, if the number of software programs to be instanced on the .

The use of containers for provisioning and isolation of software applications ensures segregation and management of the resources used by the computer. The use of containers allows instancing of an application on different computers and environments (eg, different computers in a computer network, but also different types of computers, eg, development, QA, production). Updates are also simplified.

In some embodiments, access to each of the containers is that access is allowed only for native applications (eg, native databases) and to a specific, specifically and exclusively allocated, memory area of main memory. limited in terms of

According to some embodiments, only the analytics modules are hosted in containers, while the database operates as a native database on one of the computers. Corresponding embodiments of the present invention may take advantage of easier access to data stored in a database by analysis modules instanced in containers.

According to other embodiments, at least some of the containers are configured such that virtual networking exists between some of the containers, such that analytics modules instantiated within the container can access the contents of a database instanced within the container networked with the first container. have access to Corresponding embodiments may have the advantage that the user can very precisely and precisely set up analysis modules through which containers may access the content of other containers, for example via container management software. For example, it is possible that the first container contains a first database with measurement values of sensors S1, S12 and S37, and the second container contains a second database with measurement values of sensors S17 and S35 . The sensors S1 , S12 , S37 are sensors of the manufacturer H1 , but the measured values of the sensors S17 , S35 are of the manufacturer H2 . Now, a computer network or container such that the analysis software A1 from the manufacturer H1 runs in a third container with selective access to the database in the first container but not to the data of the sensors of the manufacturer H2 in the second container. It is possible to construct Similarly, the configuration is that the manufacturer H2's analytics software A2 may selectively access a second database in the second container but run in a fourth container that does not have access to the data of the manufacturers H1's sensors in the first container. may include

In embodiments of the present invention, computers have one or more programs or functions on servers, ie external entities (eg, other servers, analysis modules instanced on other servers, users, etc.). It may be computers that provide tools (eg, analysis modules, databases, etc.). Often, server computers feature higher than average computing capacity and/or higher than average available amount of RAM memory.

According to embodiments of the present invention, the military vessel further comprises one or more analysis modules, each configured to perform an analysis of at least a portion of the measurement values stored in the database.

According to embodiments of the present invention, the automated system on one side and one or more analysis modules on the other side are operatively decoupled from each other. Additionally or alternatively, the one or more analysis modules are configured to execute their respective analysis function without the use of an internet connection. In some embodiments, both the automated system and one or more analysis modules are configured to execute their respective control or analysis functions without the use of an internet connection.

For example, the analysis modules may analyze a history of measurement values stored in a database and, based on this analysis, make predictions about the current and/or future state of the vessel or its components, and/or actions sensitive from a technical or tactical point of view. configured to calculate. In particular, according to embodiments, first action recommendations are calculated, which are then implemented manually, semi-automatically or fully automatically.

Preferably, at least some of the analysis modules include measurement values from two or more sensors from two or more different vehicle components, and optionally also one or more environmental parameters (air pressure, water temperature, depth, geographic location of the vehicle). location, flow strength of surrounding water, etc.). This has the advantage that interactions that may exist between vehicle components and/or environmental parameters can also be detected by retrospective analysis of the history of these measurement parameters and used for prediction of future states and actions. .

Performance of control and/or analysis functions without the use of an internet connection is, in some cases, on high seas, to increase the security of the system and reduce the probability of detection, even when internet connections are often not reliably available and are available. And it may be advantageous because it is disabled for some systems in the military sector.

Analysis is performed on the data in the database, and the analysis modules are operatively separated from the automation system. This means that the automated system is not adversely affected by operations for the reading and processing of the measurement data by the analysis modules. This is advantageous because the automated system is a real-time system that, by operational separation, is protected from adverse effects on the responsiveness and/or responsiveness of the automated system caused by the performance of the analysis modules. In a military situation, to enable an automated system to automatically take precise steps to turn, slow down or accelerate a vessel and/or to implement defensive or offensive measures directly and in real time in current situations, for example in a combat situation Being able to react is very important.

According to embodiments of the present invention, operative decoupling is implemented on the one hand by an asynchronous working method of an automated system and on the other hand by one or more analysis modules.

For example, operational decoupling may involve the automation system and analysis modules being programmed to operate independently of each other, ie there is no point in time when the automation system needs and/or waits for data provided by the analysis module. .

Additionally or alternatively, the operational decoupling is implemented in the form of asynchronous write or read access to the database by the automation system or by a service operatively connected to the automation system on the one hand and by one or more analysis modules on the other side. it might be For example, operational decoupling may prevent the automated system from receiving current measurement data from sensors directly via the first communication channel without measurement data being recorded in the database prior to or during data transmission via the first communication channel. may include This means that the automation system receives the current measurement data directly from the sensors immediately after detection by the respective sensors, and thus without any delay that may occur due to the writing of the measurement data to the data memory. Asynchronously, measurement data is recorded in a database to maintain a history of measurement parameters. The data channel on which this writing process takes place may also be described as a second communication channel and may be configured, for example, as a plurality of database connections made by sensors to a database. The use of the first communication channel and one or more second communication channels ensures that the transfer of the measurement data to the automation system is temporally from the storage of the measurement data in the database, even if a stenosis or delay occurs while recording the measurement data in the database. Because it is decoupled in time and operatively, it means that there is no delay in the transmission of measurement data to the automation system. In a further embodiment, the vessel comprises a service in which the automated system reads data from the database and/or writes data generated by the automated system to the database. In this case, the read and/or write access of this service is operatively decoupled from the read/write access by the analysis modules.

Additionally or alternatively, operational decoupling may be implemented by instancing an automated system on one side and one or more analysis modules on the other side on different computers. For example, an asynchronous working method may be implemented in which the automation system is hosted on one or more first computers and the database and analysis modules are hosted on one or more second computers. Alternatively, different CPU and/or RAM memory resources of the distributed computer network may be allocated to the automation system on one side and to the database and analysis modules on the other side, thereby precluding the automation system from competing with the analysis modules for resources. It is also possible to be

All of these measures may be advantageous as they ensure that the automated system or the real-time capabilities of the automated system are not adversely affected by the storage and analysis of the history of measurement data.

In embodiments of the present invention, a military vessel comprises a number of analysis modules running in a number of different containers and thus isolated from one another.

This may be advantageous as it improves safety, maintainability and performance against failure of analysis processes executed by analysis modules. For example, powerful programs exist for managing containers on multiple computers, which, by redundant creation of multiple instances of an analytic module in multiple different containers, allow certain analyzes of different partial data of data in a database. Allows to be executed in parallel on sets and thus to be executed particularly quickly. Moreover, the creation of multiple instances of the same analysis module can immediately switch to another existing instance of the same analysis module, where the system is running on another computer, even in the event of failure or inaccessibility of a computer in the computer network, and/or ensure that, within a short time, this other instance can be created in a new container on another computer. Furthermore, it is or is possible to increase or decrease the number and distribution of instances generated by one or more analysis modules very quickly and flexibly according to the requirements of the respective situation.

For example, in a safety-critical military operation, an analysis module that predicts the next routine service time for a ship based on the covered distance has sufficient CPU or RAM memory capacity for its task, or even if this module does not Whether or not it is instantiated is of secondary importance. However, for example, in critical turning operations, based on different material and flow related measurements in the rudder, turbine and other vehicle components, it is not possible to accurately calculate whether material load limits have been exceeded or whether the stability of the vessel is at risk. It may be very important to have all necessary CPU and memory resources available so that other analysis modules capable of performing those calculations accurately and quickly.

In some embodiments of the invention, at most one instance of at most one analysis module runs in each of the containers.

This may be advantageous as it ensures that each instance of the analysis module runs in its own container. This enables very fine tuning of the analysis modules at the level of individual instances of the analysis module by the container management program.

The fact that the individual analysis modules are operatively isolated from each other, thanks to their execution in separate containers, is particularly advantageous in the context of a military vessel: for example, analysis modules come from different manufacturers of vehicle components. may originate Thus, for example, the first analysis module may be provided by the manufacturer of the turbine and the rotational speed, temperature and vibration of the turbine originating from the same manufacturer having sensors for the rotational speed, temperature and vibration condition of the turbine. It may be configured to analyze measured values relating to behavior. The analysis may serve a variety of purposes: for example, to establish whether a manufacturer's warranty has been voided or critical system conditions have been reached that require the turbine to be inspected or overhauled. However, the analysis may also serve to examine how the individual measurements depend on each other, ie whether, for example, a turbine exhibits different vibration patterns within different rotational speed ranges. The second analysis module may be provided, for example, by the manufacturer of the engine and may be configured to analyze the measured values relating to the current engine temperature, the current energy consumption of the engine or other engine related measured values. The analysis may also serve various purposes, such as, for example, establishing when a critical engine condition is reached or exceeded that may void a manufacturer's warranty and/or require inspection or maintenance of the engine. . However, the analysis may also serve to examine how the individual measured values depend on each other, ie whether, for example, the engine exhibits different vibration patterns and/or power curves within different temperature ranges. Turbine manufacturers and also engine manufacturers, and finally also ship operators alike will benefit from the separation of analysis modules from different manufacturers, which intentionally or unintentionally interacts with certain analysis modules to cause them to crash or malfunction. This is because it excludes the possibility of third party software programs leading to execution. Especially in the military field, it should always be expected that presumably trusted software actually contains harmful software for interfering with the operation of vehicles or vehicle components and/or for obtaining information about the functioning of vehicle components without authorization. Certain people or organizations may learn how certain vehicle components function, and/or cause the vehicle components to operate unreliably and ineffectively, thereby temporarily disabling, for example, key functions of a vessel that are important in the long run. Or you might be interested in permanently disabling it. According to embodiments of the present invention, this may be avoided if the individual analysis modules each run in isolation from each other in their own container.

Also, the execution of exactly one instance of an analytics module per container is important because, for example, load balancing, upscaling or It facilitates the coordination of containers for the purpose of downscaling.

In embodiments of the present invention, the container management software is configured to coordinate the creation of containers and the instancing and termination of analysis modules (within these containers) such that one or more of the following effects occur:

- If one of the computers fails or is inaccessible, containers and analysis modules that no longer exist or are inaccessible due to the failure and inaccessibility of one computer are automatically started on the other of the computers; In this way, the robustness of the ship's analysis function against failures of individual computers can be increased; Especially in the military field, it should be expected that, in combat situations, components of the ship, for example individual computers and/or network connections within a computer network, will be destroyed, damaged or at least temporarily fail; The ability of container management software to create a new instance of a failed analysis module is particularly advantageous in such situations; and/or

- If the number of instances of one of the analysis modules currently running on the computers exceeds the maximum, one of these instances is automatically terminated and/or one of the containers containing an instance of this analysis module is deleted or another computer is converted to; This may be advantageous as it ensures that CPU and memory resources that are not needed are automatically released when they are no longer currently needed for analysis activities; This free resource can all be provided faster for critical systems in emergency cases; The "maximum number" may be, for example, a number specified manually or automatically in the configuration of the container management software. A maximum value means that exceeding this value is considered undesirable and leads to a particular result or action that is preferably suitable for reducing the number of instances; and/or

- when the computing load of one of the computers exceeds a predefined maximum, the at least one container hosted on this computer and the analysis module instance running therein are automatically migrated to the other of the computers; Container management software can thus perform load balancing functions; and/or

- when the computing load of one of the computers falls below a predefined minimum value, automatically at least one container hosted on the other of those computers and the analysis module instance running therein is migrated to this computer; Thus the computer management software may perform load balancing functions; In some embodiments, this one computer may be deactivated or put into sleep mode to conserve energy; and/or

- If the computing load of one of the computers exceeds a predefined maximum, then at least one container hosted on that computer and an analysis module instance running therein are automatically identified (eg, the highest CPU/ a container with memory consumption, or a container containing an instance of a particular analysis module), this identified container, and a copy of the analysis module executing therein are instanced in at least one further computer of the computers; the analyzes comprising at least the analysis module instance in the identified container and the additional instanced analysis module instance are executed in parallel; The container management software may execute upscaling functions; and/or

- When the computing load of one of the computers falls below a predefined minimum, at least one container hosted on the other computer and an instance of the analysis module running therein are automatically identified (e.g., the highest CPU /container with memory consumption), this identified container and a copy of the analysis module running in it are instanced on this one computer; the analyzes comprising at least the analysis module instance in the identified container and the additional instanced analysis module instance are executed in parallel; The container management software may thus perform load balancing functions; and/or

- when the computing load of one of the computers falls below a predefined minimum value, the at least one container hosted on this one computer is automatically deleted; Thus, the container management software can perform downscaling functions.

This may be advantageous because, in this way, the consumption of CPU and RAM memory resources is better distributed across the computers of the computer network and a better response time can be achieved. It is also possible to achieve scaling suitable to the demands of the containers and analysis modules therein.

In some embodiments, a portion of the data of the database is specifically assigned to at least some of the analysis modules. Portions of data are stored in a protected manner so that only analysis modules assigned to this portion of data can access them for reading and/or writing.

For example, an assignment may be such that an analysis module developed by a particular company that has also produced a vehicle component or has a contractual relationship with manufacturers accesses the measurement data detected and stored by the sensors of the vehicle component, but not another vehicle. It may be made not to access the measurement data of the sensors of the components.

According to a further example, the assignment is that an analysis module developed by a particular company that has also produced a number of vehicle components or has a contractual relationship with manufacturers of these components is detected by the sensors of the plurality of vehicle components and It is made to have access to the stored measurement data. The analysis module does not have access to the measurement data of the sensors of other vehicle components.

According to a further example, the assignment is that an analysis module developed by a particular company that also produces one or more vehicle components or has a contractual relationship with manufacturers of these one or more vehicle components is assigned to the sensors of the one or more vehicle components. having access to the measurement data detected and stored by the ship, and also to the measurement data stored in the database in a generally freely accessible manner (for each analysis module of the ship).

In some embodiments of the present invention, the analysis modules of the vessel may access measurement data in the database according to any combination of examples described herein.

The various forms of measurement data and specific assignment of analysis modules allow manufacturers of vehicle components to thereby ensure that only analysis modules that the manufacturer trusts have access to measurement data generated by the sensors of these vehicle components. It may be advantageous. The arrangement of different types of sensors on and/or within the vehicle components of a military vessel by the manufacturer of each component is an important state parameter of the vehicle components, such as, for example, temperature, vibration behavior, load parameters, environmental parameters, etc. have the advantage that they become available. This measurement data is relevant for the manufacturer of the vehicle component to establish test, development and repair purposes and warranty cases. However, the measurement data is also relevant to the operator of the vessel (for a better understanding of how the vehicle components work and/or for a better understanding of the interactions of vehicle components with other components or environmental parameters).

For the manufacturer of the vehicle component and/or the operator of the vehicle, the disclosure of all measurements may also, for example, make it more difficult for competitors to copy and/or allow adversaries to manipulate the vehicle components in a targeted manner. To prevent this, the problem arises of allowing conclusions about internal component states and working methods that must remain within the organization. Accordingly, manufacturers of vehicle components are not interested in the disclosure of measurement data relating to these vehicle components. Currently, this prevents the integration of measurement data from sensors in different vehicle components, which means that many technically relevant effects, such as, for example, the rudder of a ship, the specific behavior of a turbine or other complex component, each have a different internal state. It is a disadvantage for the operator of a military vessel with respect to security, as it only occurs because of the complex interaction of the multiple vehicle components that may have them.

The described IT architecture provides general access to all measurement data stored in the database, while certain portions of the measurement data of the database are assigned to individual analysis modules so that the modules can selectively access only those portions specifically assigned to it. As not having, based on this IT architecture, the operator of the military vessel informs the suppliers or manufacturers of the respective vehicle components (including their sensors) that the measurement data detected by the sensors are reliable. It can also be advantageous because it can guarantee that it is accessible only to certain analysis modules that it considers possible and accepts. Thus, an IT architecture is created that allows manufacturers of military vehicle components to provide sensitive measurement data only to specific analysis modules in a secure manner. Thus, the risk of a competitor or adversary using the measurement data to copy or attack the vehicle component can be excluded.

In some embodiments of the present invention, a military ship operator benefits from the fact that measurement data from a plurality of vehicle components is provided only to selected reliable analysis modules: Always internally detect the measurement data from the sensors of the vehicle components manufactured by these manufacturers, do not publish the measurement data externally or store it for even longer periods of time, and store them using only computer units inside the vehicle component. tended to analyze. Thanks to the ship's IT architecture in accordance with embodiments of the present invention, manufacturers of vehicle components may now omit component-internal computing units for confidential analysis of measurement data, which can be obtained from multiple sensors and vehicle components. This is because, although the measurement data of data is actually stored centrally in the database, not all analysis modules have arbitrary access to these data.

However, some currently available automation systems for military vessels also provide access to sensor data from multiple sensors, but do not include historical profiles and trends of measurement values over a longer period of time, or are merely practical It provides access only to the actual values currently valid for the individual systems that contain them, to the extent of their use. Because of the real-time requirements for these automation systems, it has been decided not to load the scarce resources of the ship's automation system into computationally intensive analysis of previously comprehensive historical data records. However, thanks to the distributed provision of analysis modules in multiple containers within a computer network that is separate from the automation system, in embodiments of the present invention, in part also to perform complex analyzes in real time, reducing the real-time capability of the automation system. It is also possible to provide them without having to do so. The problem for manufacturers of vehicle components with integrated sensors that cannot or cannot disclose detected measurement data for various reasons is an IT architecture that ensures that only selected analysis modules with corresponding rights can access measurement values. was overcome by Thus, an IT architecture has been created, which is particularly advantageous in the context of certain situations on a military vessel.

In embodiments of the present invention, some of the analysis modules are each specifically assigned to one of the vehicle components, to which they are assigned, directly at least measured values detected by one or more sensors of that one vehicle component to which they are assigned. or indirectly (via a database) and receive and analyze, and output analysis results. Indirect reception through the database means that the measured values detected by the sensors are initially recorded in the database, and in the second step, the analysis module accesses the measured values stored in the database. This indirect reception via the database has the advantage that the analysis modules do not need to have an interface to receive measurement data from a particular sensor.

According to one embodiment, the one or more sensors have write rights to the database and are configured to store the measurement values in the database in a suitable format. For example, sensors may have a network interface, and they may be configured to continuously write detected data to a database.

According to other embodiments, the sensors are initially configured to store their detected measurement values in a local volatile or non-volatile data memory of the sensor. A further component of the vessel (eg automation system, one of the analysis modules or other software) reads the locally stored measurement data and writes them to a database, so that the analysis modules can now access the measurement values via the database .

According to embodiments of the present invention, at least one of the plurality of analysis modules assigned to one of the vehicle components is configured to perform an analysis comprising:

- detection of current or future critical states of one vehicle component; and/or

- prediction of the time of occurrence of a critical state of one vehicle component; and/or

- automatic identification of one or more environmental parameters and/or vehicle component parameters that are the cause of a critical state of one vehicle component; and/or

- calculation of action recommendations for a person for one vehicle component; and/or

- Calculation of control commands for one vehicle component for automatic execution of control commands.

This means that one or more analysis modules may be used to retrospectively detect individual correlations and connections, but also based on a history of measurement data from multiple sensors stored in a database, technically and on-board or on-board. It may be advantageous as it may be used to tactically predict critical situations and also predict handling commands and control commands that may contribute to avoiding or mitigating critical situations.

Accordingly, the analysis modules may perform functions previously performed exclusively by the automated system. Automated systems typically have little flexibility because they incorporate measurement values from a predefined number of sensors of a predefined amount of vehicle components, whereas the use of an analysis module to complement the automated system is the practice of the present invention. Since the analytics modules in an aspect are highly available, robust and easily scalable due to container virtualization and automatic container reconciliation, and are instanced within an IT architecture that secures the measurement data of vehicle components from access by unauthorized third parties. It is advantageous.

In embodiments of the invention, the sensors of at least one of the vehicle components comprise at least one cryptographic encryption key. One of the analysis modules is assigned to the at least one vehicle component and includes a decryption key corresponding to the encryption encryption key. The two “corresponding” keys of the sensor and analysis module may be a private “symmetric” cryptographic key used for both encryption and decryption of measurement values. Alternatively, the two corresponding keys may be an asymmetric encryption key pair, the key managed and stored by the sensor is a public encryption key (encryption key), and the key securely stored and managed by the analysis module is a private encryption key (decryption key). key) is The sensors of the at least one vehicle component are configured to store at least a portion of their detected measurement values in encrypted form in a database and/or transmit them directly to an analysis module assigned to the at least one vehicle component. The at least one analysis module is configured to decrypt at least some values using the decryption key and analyze the decrypted data.

According to embodiments of the present invention, all sensors arranged in or on the same vehicle component have the same public encryption key. According to other embodiments of the present invention, all sensors of at least one of the vehicle components of a vehicle have their own public key different from the public key of other sensors of this vehicle component.

This may be advantageous because the use of cryptographic processes provides a particularly high degree of security in which measurement data from sensors on a particular vehicle component can be exclusively read and interpreted by authorized analysis modules.

In embodiments of the invention, the sensors of at least one of the vehicle components comprise a signing key. The signing key preferably belongs to the PKI of the manufacturer of this vehicle component. One of the parsing modules is assigned to at least one vehicle component and includes a signature check key corresponding to this signing key. The sensors of the at least one vehicle component use the signing key to sign at least some of their detected measurement values, store them in a signed form in a database and/or directly to the analysis module assigned to the at least one vehicle component configured to transmit. The at least one analysis module is configured to check at least some measurement values using the signature check key and analyze the signed data only when the signature check indicates that the signature is valid.

This may be advantageous because, in this way, the operator of the ship is protected from attacks on the stability and integrity of the military ship, as engineered vehicle components and/or manipulated sensors produce erroneous analyzes and prognostics. In particular, if these analyzes and prognosis are automatically implemented with the corresponding control commands, there is a risk that such manipulation may temporarily or permanently damage or render the vessel out of service. For example, a particular analysis module could normally be used to predict a future course for the next 5 km based on GPS position data, the current rotational speed of the turbine and the current angle of the steering keys. A manipulated angle sensor on the steering key may provide erroneous angle data indicating that the vessel's course was calculated incorrectly. This could result in the ship actually being on a different course than predicted, which could result in a stranded or colliding boulder. This risk can be eliminated when sensors sign the measurement data they generate, where the signature refers to a trusted instance, eg a specific manufacturer. Because the analysis module checks the signature of the measurement data before using it, it can be excluded that tampered sensors and/or crafted vehicle components endanger the vessel and crew.

In embodiments of the present invention, one or more of the analysis modules are configured to output and/or store the results of the analysis to the user and/or to the analysis system and/or store them in a database.

For example, results may be displayed on a screen, printed by a printer, and/or output by a loudspeaker. Additionally or alternatively, the results may be output to a software or hardware component, for example an automated system.

This can be advantageous because the results incorporate data from multiple sensors from multiple vehicle components and/or environmental parameters, and may also take into account current measurements as well as a history of measurements. Because the analysis modules are implemented as separate separate software modules, the number and configuration of analysis modules can be easily adapted to the configuration of vehicle components that may change over the life of the vehicle. The analysis results of the analysis modules thus constitute a source for system diagnostics and control commands that complement the functions of the automation system in a particularly flexible manner. Depending on the type and implementation of the analysis results, the analysis results may be action recommendations for the user, where the actions must be performed by the user or manually. These may also be action recommendations that can be performed automatically by vehicle components, whose performance only needs to be manually confirmed once by the user. These may also be control commands, which may be given directly to the automation system by the analysis modules, without involving the user, which are the actions specified in the commands, for example opening the exhaust flap, correcting the angle of the key. Let the action be performed automatically.

In some embodiments of the invention, at least one of the analysis modules is an analysis (eg, correlation analysis, machine learning (ML) based analysis of measurement values of several (at least two) different sensors from several different vehicle components. prediction, rule-based prediction, etc.). The analysis includes:

- detection of current or future critical states of the vehicle component; and/or

- prediction of the time of occurrence of a critical state of a vehicle component; and/or

- automatic identification of vehicle component parameters and/or one or more environmental parameters that are responsible for the critical state of one of the vehicle components; and/or

- Calculation of action recommendations for people; and/or

- Calculation of a control command to one of the vehicle components for automatic execution of the control command.

This means that ML-based methods and various other forms of correlation analysis detect complex, inter-component, linear and non-linear dependencies and interactions from historical measurements of a number of different parameters, and based on these detected dependencies This may be advantageous because it is particularly suitable for calculating predictions of current and future system states.

In some embodiments of the invention, data in a database is stored on multiple computers in a distributed and/or redundant manner.

This may be advantageous as it increases safety against failure if one of the computers fails or one of the computers becomes inaccessible. The redundancy store also allows parallel access to copies of the same data and thus acceleration of queries.

In some embodiments of the invention, data from the database is stored in a distributed manner in different containers on different computers (thus containers are instanced on different computers, and multiple containers are also on some computers) may be instanced). The container management software is configured to coordinate the creation of containers and the storage, replication and deletion of data within the containers:

- In normal operation, the data in the database is stored in a distributed and redundant manner across multiple computers such that data can be recovered from data stored on other computers in the event of a failure of one or more of the computers: and/or

- Upon failure of one of the computers, automatically, another one of the computers is identified that contains copies of these portions of data stored on the failed computer, and the data contained in the other computer is (e.g., this other computer by initiating , releasing access to partial data, etc.) provided to the analysis modules and the automation system; and/or

- in the event of a failure of one of the computers, at least part of the data stored in a redundant and distributed manner in several containers is automatically redistributed so that the previous degree of redundancy of the data in the database is restored; and/or

- automatically migrated or copied at least some of the data of the database stored on one of the computers to the other computer when a predefined maximum storage requirement is exceeded; For this, load balancing functions may be used, for example, as already included in the Kubernetes software.

This may be advantageous for reasons similar to redundant instancing of analysis modules on multiple computers. In particular, the safety and availability against failure are increased and access times are shortened through parallel access.

In embodiments of the present invention, at least some of the computers in the computer network are contained in a separate security enclosure that is fire and/or blast-resistant and/or watertight.

For example, the safety enclosure may consist of a single-walled or preferably multi-walled body. The body may, for example, be made of steel and may have its own locking mechanism or a door for the body with a lock. Preferably, the safety enclosure is waterproof and/or explosion-proof. For example, the body may have cable passage openings on the rear and integrated cooling system to primarily prevent ingress of water and/or pressure and secondary to avoid overheating. "Containers" are software or runtime environments of programs instanced on a computer, whereas secure enclosures are physical containers that may contain one or more computers.

This may be advantageous because computers and thus analysis programs and containers are protected from damage in case of leakage or deformation (explosion, fire).

In embodiments of the invention, the computers of the computer network include one or more first computers and one or more second computers. The first computers and the second computers are housed in different spatial regions of the vessel, the different spatial regions being different rooms, different decks, different chambers separated by watertight lock chamber doors, the vessel of the starboard side and port side, or the bow end and stern end of the vessel.

This increases the safety against failure of the vessel and the analysis modules; If certain areas of the ship are damaged by an explosion or accident, it may be advantageous because not all analysis modules are affected. Rather, container management software may access containers.

In a further aspect, the present invention relates to a system comprising at least two military vessels according to one of the embodiments or examples described herein, and to a computer system. The computer system comprises an interface for secure import of the contents of databases of at least two ships. The computer system also includes fleet analysis software. The fleet analysis software is configured to analyze the measured values of databases of the at least two ships. The fleet analysis software is configured to automatically detect whether measurement values of different vessels have been detected from vehicle components of the same type. The analysis includes:

- Vehicle components with respect to at least one technical evaluation criterion (eg tank fill level, availability of energy resources, time to next service, indicator of failsafety, indicator of suitability of the vessel for a particular use scenario) detection of vessels in overall best or worst condition; and/or

- detection of critical conditions of a vehicle component in one or more vessels; For example, by analysis of historical measurement data in databases of multiple vessels, in some vessels the combination of the angle of attack of the rudder and the rotational speed of the turbine, which has not been an issue for multiple vessels, requires manual intervention. It can be detected that some of these ships have to be brought for inspection, causing an unstable condition of the ships; Certain vibration patterns may be detected that cause a vehicle component of a particular vessel to suffer material fatigue or be negatively affected by vibrations and movements of adjacent components, such that inspection also appears to be recommended herein; and/or

- prediction of the time of occurrence of a critical state of a vehicle component in one or more vessels; For example, in terms of material fatigue that may result from vibration values and/or in terms of typical service intervals, such that the vehicle with the farthest predicted service time in the future may be considered best suited for the present long mission. prediction of the time remaining for each vessel before the next service in; and/or

- automatic identification of one or more environmental parameters and/or vehicle component parameters that are the cause of a critical state of one of the vehicle components in the one or more vessels; For example, fleet analysis software may detect that only ships that were moving in waters with water temperatures below 6°C face problems triggering movement in certain components, so the obvious conclusion is material shrinkage at low temperatures. It was the cause of this problem and the component was not suitable for use at low temperatures. Analysis of multiple vessels here may allow undetected or possibly undetectable causes to be discovered without possibly analyzing data from multiple vehicles.

The fleet analysis software may be an individual composite application program or a combination of several individual analysis programs, which may be the histories of measured values detected by the sensors of multiple ships over a period of hours, days, weeks, months or years. Different types of analysis can be performed on

According to some system embodiments, the computer system hosting the fleet analysis software also includes a decryption key and/or a signature check key, which keys the manufacturer releases these keys for the customer, ie the operator of the ship. provided by the manufacturer(s) of the vehicle components or the vessel, if any.

As used herein, "military watercraft" means a vessel configured for use by the armed forces to perform their missions. Often vehicles for military purposes have specific adaptations, such as reinforced walls or floors, for example, for protection against land mines, camouflage coatings, weapons and/or defense systems. Vessels are vehicles for moving on or in water. In particular, they may be wind or machine-powered ships, for example sailboats, hovercraft, hydrofoils, submarines, frigates, aircraft carriers, supply ships and the like. For example, some frigates are constructed or equipped for maritime surveillance of their own ships or convoys, submarine hunting, combat surface units, and defense against air attack. A supply ship is configured to support a naval task force, which may consist of a variety of ships and ships depending on their mission. The main logistical purpose of a supply ship is to provide fuel, consumables, supplies and munitions. The supply ship may also be equipped with a weapon system, for example for defense against enemy attacks.

Herein, "vehicle component" means a part of a ship that performs at least one specific function as a whole. A vehicle component may be a component, ie, a part of a technical complex, or may be a system of several components that perform this function as a whole. Typically, all components of a particular vehicle component are fitted as a unit within the vehicle. For example, a rudder system, a radar system, a weapon system, a motor unit, a control unit, etc. may each constitute a vehicle component.

A “sensor”, also known as a detector (measured value or measurement) recorder or (measurement) probe, is a parameter, specific physical or chemical property (physical, eg, calorific value, temperature, moisture, pressure, sound field parameters, brightness, acceleration or chemical, eg pH value, ionic strength, electrochemical potential) and/or a technical component that can be detected qualitatively or quantitatively as a material composition of its environment. These values are detected by physical or chemical effects and converted into electrical signals for further processing. The electrical signal for further processing may in particular comprise data for data processing constituting the expression of the variable. The electrical signal for further processing is not necessarily generated by the detector itself, but may be generated by electronics coupled to the detector based on an output signal from the detector.

A "weapon system" here is a (often complex) technical munitions, especially large military equipment. Part of the weapon system is the weapon itself. For example, a warship may include weapons in the form of air defense missiles in a weapon system configured as a short-range defense system. In particular, the weapon system may be an association of individual technical elements that interact with each other and, by such association, achieve improved weapon effects or allow weapon effects.

For example, "CROWS (Common Remotely Operated Weapon Station)" is a weapon system. A further example of a weapon system is a self-propelled gun carriage or a gun on the deck of a ship. Depending on the embodiment, the engine power of the vessel is used to drive the vessel and also to align the gun, or the weapon system includes its own independent motor for aligning the gun. The air defense missile system is another example of a weapon system. Various elements of the air defense missile system, such as sensors (eg, radar systems), control points, and maneuvering systems, may detect various measurement data that are processed for monitoring, condition control and accurate bearing of the radar system and/or missiles. have.

As used herein, "drive unit" means a structural unit that moves a machine, such as a turbine of a ship, by energy conversion. Often, this is an engine with any necessary gear mechanism. The drive unit may comprise a rotary drive or a linear drive. The drive unit may draw energy from fossil sources (eg, oil, natural gas, coal), nuclear energy (nuclear fission), battery power or other energy carriers.

Here, "navigation system" refers to a path or selected location observing desired criteria by positioning (satellite, radio, GSM or inertial or autonomous system) and geographic information (topology, road map, air or sea chart). It means a technical system that allows guidance on

Here, “measurement value” means a value of a parameter supplied to a sensor. For example, temperature in °C, position in GPS coordinates, and rotational speed in revolutions per minute are examples of measured values. "Measured values" are also referred to as "measured data".

Here, "database" means a data structure for structured storage of data. A database may be a directory tree or a file. Preferably, the database is a data structure managed by a database management system (DBMS). DBMS is a system for electronic data management configured to efficiently, continuously and permanently store a large amount of data, and to provide the required partial amounts in the form of expression according to various requirements for users and application programs. For querying and managing data, the database system provides a database language. The database may be a relational database. The structure of the data is established by the database model.

Here, "history of measurement values" means a data amount specifying the temporal evolution of a plurality of measurement values.

Here, "time stamp" means a data value that specifies a specific time, for example, the time (date and time) at which a specific measurement value was detected. Preferably, the timestamps are given coordinated universal time UTC or reference thereto. This avoids the possibility of misunderstandings due to the different time zones around the world.

Here, the expression 'persistently stored' means storing data in a non-volatile storage medium.

The expression "securely stored" herein means that only a certain selection of users and/or applications that can prove their access authorization may have access to protected data for reading and/or writing. It means the storage of data that is technically guaranteed. For example, protection may include storing the data in an access-protected area, and/or storing the data in an encrypted form so that it can only be read by a program having an appropriate decryption key.

A “real-time capable” system, such as a real-time capable automated system, is a system configured to perform tasks in “real time”. This means that the system can continue to do this within a predefined maximum duration. Typically, this means that the hardware and/or software system is subject to “real-time constraints,” for example from events to system reactions. Real-time programs must guarantee a response within specific time limits, which are often described as "periods". Real-time responses are often on the order of milliseconds, sometimes on the order of microseconds or seconds. Systems not specified for real-time operation generally cannot guarantee a response within a time frame, but typical or expected response times may be indicated.

As used herein, “host” or “host computer” alone or in interaction with one or more additional computers provides a particular software program (guest software program), ie makes it available to additional programs and/or users. A computer that makes Guest programs may be databases, application programs, services to other programs, and program modules.

Herein, "container" means a runtime environment for software programs that includes and provides all system components necessary for the execution of these software programs and isolates the software programs executed in this container from programs outside the container. . A container may be a virtual machine created and managed by a hypervisor (a program for managing virtual machines). Preferably, the container is a runtime environment that can be managed by a container virtualization program. Containers in these embodiments generally require fewer resources than virtual machines, since containers do not need to start their own operating system and instead run in the context of the host operating system. Despite this, although not as robust as in virtualization, containers are partitioned from each other and from the host system.

For example, free software “Docker” may be used to define containers and isolate applications from each other by container virtualization. Docker simplifies provisioning of applications by making it easy to transfer and install containers with all necessary packets as files. Docker packages an application and all system components needed to run it into a single file known as a "container". Docker containers ensure that applications run reliably after being transferred from one environment to another. This simplifies the deployment of complex applications on different computers, as well as a more flexible application infrastructure that is easier to modify, extend and scale.

Container virtualization is a method of operating multiple instances of an operating system (so-called "guests") on a host system in isolation from each other. Contrary to virtualization by a hypervisor based on a number of virtual machines, container virtualization actually has some limitations due to the nature of the guests, but is considered to save resources. Container virtualization is based on several principles that are implemented differently in individual software products for container virtualization. But the key is always the same: multiple containers share a kernel and isolate at least some of the operating system means used from each other.

For example, an open source program may be used as a container management program. Kubernetes is software for container orchestration that allows the orchestration of applications across multiple hosts in a simple and efficient way. Kubernetes makes the deployment, operation, maintenance and scaling of container-based applications simple or completely automatic. A group of hosts on which containers run is combined into clusters of physical or virtual machines and managed as a single unit. Kubernetes defines a container run-time interface (CRI) that must implement container platforms to be handled by Kubernetes. These implementations are also known as “shims”. This makes Kubernetes platform-agnostic: not only docker but also other platforms with corresponding shims may be used, eg CRI-O or KataContainers.

As used herein, “container management software” refers to the automatic provisioning, scaling and means software configured for administration ("coordination"), wherein containers (of the same host computer system and also of different host computer systems) are isolated from one another. In the case of complex vehicles, the number of containers may be hundreds of containers. For example, Kubernetes may be used as container management software.

By “analysis module” herein is meant software configured to process measurement data from one or more sensors by one or more different computing processes such that a response to an analysis question is generated. The software may be a script, a complex application program, a program library, or a combination of two or more of the above possibilities. A computing process may be a heuristic, a rule explicitly specified by a programmer, a mathematical and particularly statistical algorithm, eg a correlation analysis process, or other explicitly formulated computing process. A computing process may also be a process formulated only implicitly, for example in the form of mathematical modules created during the training process of a machine-learning program. For example, the model may be specified in the network architecture and weights of network nodes of a neural network. Analytical questions may include a variety of questions, such as questions about the current state or predicted state for the future of the vehicle component (asking whether parameters for vibration, conductivity, elasticity, etc. are indicative of a critical wear state), or which measurement parameters Questions about whether a combination of values has led or likely will lead to a critical system state in the future, questions about the present and future availability of fuel or consumable parts, or for preventing or mitigating a current or future critical state of a vehicle or vehicle component It may also be about questions about recommended actions.

Here, "encryption key" means an encryption key designed to be used for data encryption. Symmetrical processes, ie in all conventional cryptography methods, and also, for example, Data Encryption Standard (DES) or its successor, Advanced Encryption Standard (AES). In modern algorithms, both communication partners use the same (private) key for both encryption and decryption. For example, asymmetric processes such as the RSA cryptosystem use key pairs consisting of a public key and a private key. The public key is not secret; At least the holder of the private key is disclosed to the party sending the data in encrypted form. Data may also be encrypted with a public key. It is important that the public key can be explicitly assigned to a specific entity, for example a user or an analytics module. To decrypt the secret text again, you need the private key. Unlike symmetric processes, where multiple parties share a private key, in asymmetric processes only one party holds the private key. Therefore, it is fundamental that the private key cannot be derived from the public key.

Here, "automation system" means a system for fully or semi-automatically controlling a vessel. Control is made based on current measurement values of one or more sensors that the automation system converts into control commands, based on established rules, and/or based on control commands input by a user through a user interface. Preferably, the automation system is a real-time capable automation system. According to embodiments of the present invention, the automated system receives as inputs current measurement values and/or manually entered control commands, as well as results of analyzes from one or more of the analysis modules, to steer the vehicle accordingly. configured, wherein the automation system interprets the results as control commands and implements them.

A computer cluster, referred to as a “computer network” or simply simply a cluster, means a number of networked computers. A network may be configured to increase the computing capacity and/or availability of computers or the services they provide. Computers in a computer network (also known as "nodes:") are often referred to as servers. According to embodiments of the invention, the computers in the computer network each host one or more containers, and the distribution of containers across the computers is a container. Coordinated by management software.In containers, analysis modules or other programs may be executed, which may for example be implemented as services, and the results may be provided to specific vehicle components.Provide analysis results Because of this function they perform, the computers may also be known as "servers".

BRIEF DESCRIPTION OF THE DRAWINGS
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described with reference to the drawings. The drawing shows:
1A shows a block diagram of a military vessel having multiple sensor-mounted vehicle components.
1B shows a system comprising a computer with multiple military vessels and fleet analysis software.
2 shows a block diagram of a distributed computer system that may be used for storage and analysis of sensor measurement data.
3 shows a number of analysis module-specific, asymmetric, cryptographic key pairs and their use.
4 shows components of a military vessel with multiple databases and analysis modules.

1A shows a block diagram of a military vessel 100 having multiple sensor-mounted vehicle components. For example, the vehicle components include a drive system 104 that includes, for example, an engine of a diesel powered vessel having a gear mechanism coupled to the engine. The drive system includes a number of sensors for measuring various parameters of the engine and gear mechanism, including a sensor 112 for the rotational speed of a shaft mechanically coupled to the gear mechanism.

The vehicle's vehicle components also include a navigation system 106 with a GPS sensor 114 for determining the current position of the vehicle, and a rudder 108 with a position or angle sensor for determining the current angle of the rudder with respect to the longitudinal axis of the vessel. ) is included. The vessel also includes an electronic monitoring unit 110 having several sensors as an additional vehicle component comprising a number of sensors 118 , 120 . Sensors in component 110 determine vehicle and environmental parameter values automatically, preferably continuously or repeatedly. These parameters include, for example, air pressure, relative humidity, air temperature, water temperature, flow strength of water and/or other parameters.

All or some of the detected parameters are sent to the automation system 124 immediately after detection. An automated system is a fully automatic or semi-automated system for monitoring and controlling the internal conditions of a vessel and for controlling movement or other operations of a vehicle or its components. An automated system is a real-time system for controlling a vessel using measurement values received from sensors and inputs from users via a user interface and depending thereon.

Over time, in the continuous operation of the vessel, a large number of measurement data is generated which is provided with a time stamp reflecting the time of generation of the measurement data. Measurement data and their time stamps are stored in database 122 , thus forming a history of detected parameter values for one or more measurement parameters. The database is for example a relational database, for example a PostgreSQL or MySQL database, or for example a NoSQL database.

A database for analysis of the data and a number of analysis modules are stored and instanced in the computer system 126 . Computer system 126 may be a standalone monolithic computer system. Preferably, however, it is a computer network comprising a number of computers connected as functional units. Such a computer network is described in more detail with reference to, for example, FIG. 2 .

The vessel also includes a weapon system 102 that also includes sensors (not shown). The safe operation of automated systems is particularly important because ships are important targets of enemy forces, and because of their weapon systems, and because, if miscontrolled, constitutes a potential hazard to their own crew and uninvolved third parties. By “safe operation” we mean here that the automated system and the data it makes on the basis of the decisions it makes must be protected from manipulation by third parties.

Example 1: Improved monitoring and control of the rudder system

For example, the vessel may be a water vessel having a rudder system, in particular a twin-rudder system. The rudder system has a control system configured to monitor the positions of the keys and control them via an adjustment system.

Such systems in the prior art are only monitored according to the International Convention for the Safety Of Life At Sea (SOLAS) and are therefore only monitored in a rudimentary manner (group alert). Surveillance precision is often insufficient for military vessels: with twin-rudder systems currently available, it may occur that the keys do not respond synchronously to key position control commands: for example, according to a control command, the starboard key. reaches the key position faster than the control command corresponding to this key position reaches the port key. Even if the arrival times of the commands are the same, one side of the rudder system may not be able to implement the commands as quickly as the other. This lack of synchronization adversely affects the performance of the key platform and prevents precise control of additional system components, for example the weapon system. Reasons for asynchronous command transmission and/or implementation may vary, and may have complex interactions: different slip characteristics of key shafts, aging potentiometers in corresponding circuits, different control pressures, and many more. those.

Embodiments of the present invention address this problem as follows: comprising a plurality of sensors for a number of different parameters specific to a rudder system, known herein as "rudder system parameters" A rudder system is used. The rudder system parameters include two or more of the following parameters: pressures of the oil circuits of the rudder system, voltages of the electronic control system of the rudder system, currents of the electrical control system of the rudder system, position of keys, and/or Any accelerations (especially vibrations) occurring in the key shafts. The sensors of the rudder system regularly perform measurements of the rudder system parameter within relatively short time intervals (eg at least once per minute, preferably at least 10 times per second), optionally encrypting and/or It is configured to sign and store it in a database with a timestamp. In some embodiments, the recording frequency of the sensor may also be dynamically adapted to circumstances, eg, there may be an increase in the measurement frequency for a change in one or more related parameters above a predefined limit value. The time stamp may, for example, indicate the time at which the measurement value is stored in the database, which time is very close to the measurement value detection time, and thus also approximates at least this time. The position data of the keys of the rudder system are also detected by the sensors as “rudder system parameters” so that the control system can set whether the keys of the rudder system have reached the positions they should assume according to control commands. .

In addition to these “rudder system parameters”, some additional sensors inside or outside the rudder system can be used to determine environmental parameter values, such as the speed of the vessel, water temperature and/or depth and/or additional vehicle components, such as of the pump system. Detect operating states. Alternatively, if the speed of the vessel (eg, measured in meters moved per second) is no longer available, for example, the driving power and/or the turbine rotation speed may be used as an indicator of the speed.

Some embodiments implicitly detect, for given environmental conditions and a given state of the rudder system, the times the rudder system needs for the keys to implement each assigned control command and reach desired positions, The reason is that the measurement data and preferably also the control commands are provided together with the time stamps and stored in the database. By means of the analysis of the history of these measured values or commands by the analysis module, thus in a simple manner the measured values and already functional states can be correlated with the times at which the control system has issued a control command to the coordination system.

Keys that receive a command under respective prevailing conditions, from detected measured values, stored in a database and linked to timestamps of rudder system parameters, environmental parameters and rudder system control commands, according to some embodiments An analysis module is provided for determining the times until the control command is fully implemented by The determined times are used by the analysis module to adapt the content of the control commands and/or the transmission of the control commands to improve the synchronization of the keys of the rudder system.

In some embodiments, the analysis module is configured to detect, for example, correlations between measured key travel times and value ranges of rudder system parameters and environmental parameters. Accordingly, a number of factors are considered as well as the current deviation of the key position from the nominal position to determine whether and when the key assumed the desired position. Thus, any asynchrony occurring between the keys on the port side and the starboard side can be detected early and reliably, and in preferred embodiments rapid response of control commands to individual keys in real time, and rapid and dynamic adaptation. can allow Prediction of asynchrony also makes it possible to anticipate the maintenance work required and facilitates planning in this respect.

For improved control of the rudder system, the analysis module may identify possible causes for asynchrony, for example from acceleration or vibration data, and output them to the user. Acceleration data (oscillations/vibrations) as well as other rudder system parameter values and environmental parameter values are taken into account in the analysis here. This may be advantageous because the oscillations and vibrations that occur are highly dependent on the depth, rudder position, swell, fouling, switching conditions of the rudder system and the speed of the vessel. Thus, without taking the context into account, the acceleration data is often not sufficient to allow accurate control of the rudder system or accurate prediction of the time for the next necessary maintenance. However, analysis of acceleration data combined with additional rudder system parameters and environmental parameters allows identification of vibration conditions which provide some information about the current material fatigue state of the rudder system or the current deviation of the actual key position from the nominal key position. allow

According to one embodiment of the invention, the vehicle components of the ship comprise a control unit, a rudder system with one or more starboard and one or more port keys. The control unit is configured to adjust, in particular synchronize, the position and movement of the starboard and port keys by sending control commands to the starboard key on the one hand and the port key on the other. The rudder system includes several sensors configured to detect rudder system parameter values, the rudder system parameters being the following measurement parameter values: a current position of the key, vibrations of the key, fouling of the key (eg, an optical sensor or by a force sensor that measures a force in the contact flow direction), vibrations of components of the rudder system, and switching states of the rudder system.

One or more of the other vehicle component and/or rudder system also includes several sensors configured to detect environmental parameter values, the environmental parameters measuring two or more of the following measurement parameter values: depth, swell, and speed of the vessel. include

One of the analysis modules is an analysis module for improved control of the rudder system, to detect correlations between durations, rudder system parameter values and environmental parameter values, and/or to improve the adjustment of keys of the rudder system to analyze the rudder system parameter values, environmental parameter values and durations between the transmission of control commands to each key by the control units and the implementation of the control commands.

For example, for improved control of a rudder system, the analysis module could be configured to automatically set that, for a given swell and fouling, a command to the starboard key should be sent 400 ms earlier than the corresponding control command to the port key. may be The analysis module sends a corresponding control command to the control unit of the rudder system, thereby causing the control unit to send the command to the starboard key, and also to send the command to the port key only after said delay.

According to embodiments of the present invention, for improved control of the rudder system, the analysis module is configured to: transmit rudder system parameter values, environmental parameter values, control commands to the respective keys by the control unit and implement the control commands by analyzing the durations between and further state and/or vibration parameter values detected by sensors of other vehicle components, in particular of the engine and/or gear mechanism and/or radar system, the durations, the and detect correlations between rudder system parameter values, the environmental parameter values and state and/or vibration parameter values of the other vehicle components, and/or improve the adjustment of keys of the rudder system.

These characteristics are based on the observation that vehicle components that do not have an explicit control relationship with the rudder system can also affect the behavior and controllability of the rudder system. Thus, for example, a radar system may be excited by a frequency generated by a propulsion diesel engine at a certain speed, which has a negative effect on the rudder system.

For example, control may be implemented in the form of logical rules. These rules may be used for the described control of the rudder system as well as for the control of other ship components as well. For example, one of the logical rules may include that a combustion engine can be started only when at least one exhaust path is open. This rule is executed in each starting process of this engine, and depending on the result of checking whether the exhaust path is open, this exhaust path is automatically opened or the starting process is interrupted, possibly accompanied by a message to the user.

Example 2: Improved Detection and Prediction of Consumption and Conditions

The environment parameters and state-related parameters of vehicle components have complex interdependencies:

For example, when the seawater is hot, a cooling system that uses seawater for cooling behaves differently than when the seawater is cold. Power consumption increases, and diesel engines used to generate power are under greater load. This, in turn, may affect the maintenance and wear of the assemblies, which is not only more loaded by higher sea temperatures because more energy must be used for cooling, but also the machinery and encapsulation, such as the engine itself. Also, because they are cooled by seawater, they can only achieve their own cooling to a worse level. Therefore, the power characteristic values of sea-water-cooled vehicle components are often difficult to compare, and the predictions of energy consumption are accompanied by uncertainties.

According to embodiments of the present invention, one of the analysis modules is configured to calculate a current or future energy consumption and/or a current or future wear level of the vehicle component as a function of the temperature of the ambient water used as coolant.

From this data basis, for example, also automatically, an evaluation of the measurement data and/or other performance parameters of the entire vessel is made such that only identical operating modes of the entire vessel, eg comparable operating modes of the vehicle, are compared with each other. For consideration, modes of operation defined by the temperature of the surrounding water may be found.

According to embodiments, one analysis module is configured to use the temperature measured at different times to also identify automatically identical modes of operation of the entire vessel defined by a specific temperature or a specific temperature range of the surrounding water. The analysis module is configured to provide measurement data and/or other performance of the entire vessel such that only comparable modes of operation of the vehicle are compared with each other, in particular to calculate future energy consumption, present maximum possible range and/or present or future wear levels. configured to analyze the parameters.

Also, by analysis of performance and health measurements detected by sensors of the plurality of vehicle components and stored in a database, and (e.g., how often in what situations possibly redundant vehicle components are used, and Both the commissioning and also the use phase of different vehicle components can be improved by detection and analysis of usage profiles of individual vehicle components (which specify the degree of usage of different vehicle components in different standby and usage conditions). Such knowledge may allow automatic or manual optimization of the operating mode of individual vehicle components, or improvement of the technical characteristics of a (new) vehicle component.

Example 3: Inter-Vehicle Assays

In some embodiments of the invention the detection and storage of multiple measurement values over longer periods of time (measurement value history) has significant advantages even at the application level.

Additional significant advantages arise for systems in which the measured value histories of multiple parameters detected from multiple ships are analyzed by fleet analysis software. For example, at least for the rudder system of vehicles, a detection system and an analysis module may be developed as described with respect to embodiment 1. The rudder systems of different vehicles may but need not be of the same type (ie, eg, from the same manufacturer). Although the rudder systems are slightly different, at least the subsystems, for example individual sensors of the rudder system or control unit, may be of the same type or comparable. Often, different manufacturers of specific vehicle components use the same components provided by sub-suppliers.

Thus, cross-platform assessments may be performed by importing databases with measurement value histories of multiple ships into a central, in particular protected database, ie within the home port's secure infrastructure. For example, while the vessel is staying at the home port, at least a portion of the historical data may be imported into the central database or deleted from the vessel's database. This improves data security and reduces the memory requirements of the ship's database.

Various data sets may be useful in many ways. The fleet analysis software establishes whether the vehicles or vehicle components have operated under comparable conditions, or comparable, ie sufficiently similar conditions, for example by analysis of different environmental parameters such as air and water temperature, flow conditions, etc. It is also possible to identify the vehicles and components operated under. In a next step, the fleet analysis software then analyzes whether vehicle components of a particular type or manufacturer are better or worse for one or more performance parameters than vehicle components of another type or manufacturer with similar functionality. and may be detected. Accordingly, a problem that has already occurred in one vehicle component may be prevented in another vehicle component. It is also possible to set across vehicles how a particular vehicle component may or may not work better to avoid certain types of damage.

Action recommendations calculated by the fleet analysis software may be output to the user to make improvements to a particular vehicle component and components of the same or similar type. According to some embodiments, the individual analysis modules and/or fleet analysis software may also be configured to calculate and output tactical recommendations based on data from the database(s).

Figure 1b is A system 150 is shown with several military vessels 100 , 130 , 132 . Each vessel may be configured as a vessel of the embodiments described herein. Preferably, the vessels all belong to the same or similar vehicle type. However, it is also possible for a vessel to belong to different vehicle types, and even in this case analysis of the sensor data histories for multiple vessels indicates that, for example, different types of vehicles contain some or more vehicle components of the same type. It may be advantageous when

System 150 also includes computer system 134, which may be configured, for example, as a separate computer or computer network. The computer system includes an interface 136 for securely importing the contents of the databases of the vessel 100 , 130 , 132 . Depending on implementation variations, interface 136 may be implemented differently. This may be a hard-wired interface, for example based on glass fiber technology, allowing for the rapid transfer of large amounts of data, for example. However, in some cases it may also be a contactless interface, for example via an interface of a wireless connection, or a USB interface for import of data on a portable drive via USB. In either case, several technical and/or organizational security precautions are taken to ensure that data cannot be read or manipulated in transit. For example, a transmission may be encrypted only over an end-to-end encrypted data transmission channel. Alternatively, authentication of the user may be required to trigger data transmission, for example via password-based and/or biometric authentication methods. For example, the computer system 134 and interface 136 for secure data transmission may be used to obtain and collectively evaluate measurement data automatically generated by the vessel during use of the home port's IT infrastructure. may be part of

Analysis of the data of multiple ships is performed by fleet analysis software 138 instantiated on computer system 134 . The fleet analysis software analyzes the imported measurements of the ship's database. The imported data may be stored, for example, in a central relational database on computer system 134 and analyzed there. The fleet analysis software automatically detects during analysis whether measurements from different vessels were detected by the same type of vehicle components. This information may be useful to ensure that accurate measurements are compared. The engine temperature sensor measures the engine temperature, and the temperature sensor outside the vehicle below the water level measures the water temperature. Since, for example, only temperature values for a component "engine" are compared with each other, since the comparison is generally valid only if the measured values come from sensors and components of the same or similar type, during analysis which sensor or It is important to consider which vehicle component supplies the “temperature” parameter value. Preferably, the manufacturer is included in the analysis. For example, it may occur that different manufacturers of the same type of vehicle component (engine) mount the sensor in slightly different positions or use different sensor types. In this case, considering each manufacturer or related circumstances may contribute to avoidance of inaccurate analysis results caused by a flaw in the interpretation of minor manufacturer-related measurement value deviations.

During analysis, from the imported measurement data, the fleet analysis software identifies which of the vessels are performing optimally or worst for at least one target criterion. Target criteria are technical evaluation criteria, eg, the vehicle with the highest energy storage level and spare parts reserve, the vehicle with the most favorable maintenance situation and/or the vehicle with the longest time to next service. Additionally or alternatively, the fleet analysis software identifies critical conditions of vehicle components in one or more vessels. For example, fleet analysis software may indicate that vibration parameters, within the last 6 months, temperature and/or rotation in the engine, for example, due to material fatigue or other adverse factors, should be considered hazardous to vehicle components and/or crew. All vehicles indicating that velocity values have been measured can be identified.

In some embodiments, the fleet analysis software is configured to predict the time of occurrence of a critical condition of a vehicle component in one or more vessels. This may be the time the stores of energy, oxygen gas, food, etc. arrive to the point where failure of essential components is expected due to wear or the like.

In some cases, the fleet analysis software is also configured to automatically identify one or more environmental parameters and/or vehicle component parameters and their corresponding parameter value ranges that cause a critical condition of one of the vehicle components in the one or more vessels. is composed This is precisely a particularly advantageous aspect in the context of a very complex military vessel: sometimes vehicle components and parts fail severely before the end of their expected normal service life without a clear cause identified. Sometimes it is also observed that certain components fail repeatedly in certain vessels, while the same components last significantly longer in other ships having the same components of the same type. In view of the highly complex interaction of different components and environmental factors, it is regularly assumed that the cause of the problem lies in the interaction of the component with its environment, where it is not known exactly what the cause of the failure of the component is in reality. Mechanical loads on components depend on widely varying factors, such as the vibratory behavior of physically adjacent components, swell to which the vehicle is exposed during its use, wind and flow conditions, and at least manually entered control commands from the crew. It is also somewhat dependent on Considering this complexity, it is often impossible to identify specific causes of component failure through detailed inspection of a specific vehicle. Failure of certain components can be attributed to a number of other factors, such as certain modes of movement, certain air temperatures, It is possible to correlate with the interaction of specific salt content, specific flow conditions and the use of specific other parts and vehicle components from different manufacturers. Fleet diagnostics thus enable improved fault diagnosis due to a broader database that is very complex and often includes the identification of faults caused by the interaction of a number of specific factors in a non-linear manner.

2 shows a block diagram of a distributed computer system 126 that may be used for storage and analysis of sensor measurement data. The computer system shown here is functionally coupled together to a computer network via a network 280, eg, an intranet, with five computers 202, 204 each instanced with a number of containers 212-230. , 206, 208). Each computer includes one or more processors 240 , 242 , 244 , 246 , RAM memories 248 , 250 , 252 , 254 and optionally also one or more non-volatile data memories.

Each container contains at most one analytic module instance running in that container. For example, analysis modules may be implemented as so-called microservices.

Some analysis modules are represented only by a single instance. For example, the analysis module AM2 runs only in the form of a single instance 262 within the container 214 , the analysis module AM3 runs only in the form of a single instance 264 within the container 216 , and the analysis module (AM4) executes only in the form of a single instance 268 within the container 222 . However, some analysis modules may also run in multiple instances with a corresponding number of containers. For example, the analysis module AM1 is instantiated in the form of two instances 260 , 266 in containers 212 and 220 .

How many instances of individual analysis modules are instantiated and/or closed, and on which of the computers this occurs is controlled by the container management software 256 . The software 256 dynamically coordinates the instancing, migration and closure of the containers and the analysis modules contained therein according to various optimization criteria that may be preferably configured by the user. An optimization criterion may be, for example, a load balancing, upscaling, and downscaling criterion that ensures that the computing load is distributed in a balanced manner across computers, some frequently required analysis modules being parallelized in multiple instances. It can also be implemented as a fast response time and/or high safety against failure is ensured.

Measurement data detected by the sensors of the different vehicle components of the vessel 100 are stored in the database 122 . To increase the safety against failure of the database, the contents of the database are distributed and stored on different computers 202-208 in a redundant manner. In the prior art, various methods are described for distributed and redundant storage of data, for example by error correction processes using error correction bits. In many embodiments, some containers 224 - 230 may also be used for storage of portions of data in a database.

Automation system 124 also includes one or more processors 282 , RAM memories 284 , and automation software 286 . The automation software dynamically receives currently detected measurement data from at least some of the sensors and uses them as input to derive one or more control commands from these inputs, in some cases along with commands entered by the user. and automatically control the behavior of the one or more vehicle components 102 , 104 , 106 , 108 , 110 based on the control commands.

Computer system 290 with automation system 124 is connected to computer network 126 via data communication channel 292 . In some embodiments, the automated system may send a request to the access service 288 via the data connection 292 to read these data from the distributed stored database 122 and use them to compute control commands. The automation system is operatively decoupled from the analysis modules, ie it preferably runs on another computer and has access to the measurement values asynchronously with the analysis modules so long as it uses the measurement values stored in a database.

3 shows several analysis module specific asymmetric cryptographic key pairs that may be used for secure transmission and storage of measurement data.

For example, the drive system 104 may be produced by the first manufacturer H1 . The manufacturer H1 also has an analysis module AM4 configured to analyze a measurement value detected by one or more sensors 112 of the drive, in order to automatically predict the current and/or future state of the drive system 104 . ) to develop Before or during the development of the analysis module AM4 , the manufacturer H1 generates a first asymmetric encryption key pair having a first private decryption key 344 and a corresponding public encryption key 332 . Prior to delivering the analysis module AM4 to the operator or manufacturer of the military vessel 100 , the personal encryption and decryption key 344 is incorporated into the analysis module AM4 so that it cannot be read by an unauthorized third party. In addition, the rotational speed sensor 112 of the drive system 104 is provided with a public encryption key 332 .

The public keys, all shown here in thick outline, may be generated specifically for each individual sensor of the vehicle component, along with their respective corresponding private keys. However, in other embodiments, it is also possible for all sensors of a vehicle component to share the same cryptographic key pair or public key of this pair, and to use that public key to encrypt measurement data detected by each of the sensors. It is possible. Generating sensor-specific key pairs has the advantage of very precise control over access rights. The generation of vehicle-component-specific key pairs and the use of the same public key by sensors of the same vehicle component have the advantage of simplified key management, which is usually - though not always - detected by different sensing of the vehicle. This is because the measurement data has the same or similar requirements for confidentiality.

All measurement values that sensor 112 detects for storage in database 122 are encrypted with public key 332 . This means that all other analysis modules AM1 , AM2 , AM3 cannot decrypt the data detected by the rotation speed sensor 112 and encrypted with the key 332 .

However, in one embodiment, the rotational speed sensor 112 is configured to encrypt copies of its detected measurement values using a public key 330 that is assigned to the analysis module AM3 of another manufacturer H2, This parsing module AM3 can decrypt the copies with its corresponding private encryption key 342 . For example, there may be a contractual trust relationship between the manufacturer H1 and the manufacturer H2 of the key 108 so that the sensor 112 of the drive system not only has the public key 332 but also the public key ( 330), by encrypting the detected measurement values in copy form, so that the analysis module AM4 as well as the analysis module AM3 can access and decrypt these measurement values.

Similarly, vehicle component 110 comprising temperature sensor 120 and pressure sensor 118 may be manufactured by a third manufacturer H3 . Manufacturer H3 also develops analysis modules AM5 and AM6 that may be instanced in multiple copies on computer system 126 . Both modules AM5 and AM6 evaluate both temperature data and pressure data, but for different analysis purposes or queries. The sensor 120 generates its measurement data in the form of two copies of the measurement data encrypted with different public keys 324 , 322 . Sensor 118 also generates its measurement data in the form of two copies of the measurement data encrypted with public keys 324 , 322 . Data encrypted with key 322 may be decrypted and processed by any analysis module that includes an associated private key 334 . Data encrypted with key 324 may be decrypted and processed by any analysis module that includes an associated private key 336 . Each of the multiple instances 306-312 of analysis module AM5 includes a private key 334 . Each of the multiple instances 314 - 318 of the analysis module AM6 includes a private key 336 .

In the example shown, key 108 includes three sensors of different types, including angle sensor 114 . A public key 326-330 is assigned to each of the sensors, and together with the corresponding private key 338-342 form an asymmetric encryption key pair. The measured values detected by the sensors are encrypted into three copies each using a different public key and stored in a database. The analysis module AM1 may only decrypt data encrypted with the public key 326 . The analysis module AM2 can only decrypt data encrypted with the public key 328 . However, the analysis module AM3 has two private keys 340 , 342 , and thus can decrypt data encrypted with the public key 328 or the public key 330 .

Precise control of access rights is very advantageous, especially in the field of military ships, as often only certain combinations of data are safety-critical and not individual data values. For example, GPS position data is safety critical in any case as it allows enemy units to launch attacks on ships. The position of the vessel below water level (in the case of submarines) alone is usually not important unless no further position data is known. The same goes for data such as water temperature and flow conditions. However, the combination of the vessel's position under the water and flow and temperature data may in some cases allow at least a rough determination of the vessel's current position.

In some embodiments of the present invention, the use of different encryption keys for different types of measurement data allows precise control of access to these measurement data. The analysis modules have only one or a few private keys and are therefore only able to access and process the measurement data detected by the sensor using the public key corresponding to this private key for encryption.

In some embodiments, a single, particularly trusted software has a copy of all private keys of the analysis modules. For example, particularly reliable software may be an additional analysis module with extended authorization, developed by the operator of the vehicle. Additionally or alternatively, the fleet analysis software may have a copy of all private keys of the analysis modules, so as to be able to analyze the data of all sensors of all ships in the fleet.

3 shows the assignment of private decryption keys to individual analysis modules and assignment of public encryption keys to sensors (or vehicle components comprising sensors). Sensors collect measurement data and encrypt it using assigned public keys.

In some embodiments of the invention, other asymmetric cryptographic key pairs are assigned to sensors and analysis modules, but for the purpose of signature checking (not illustrated here). In this case, private signature keys are assigned to individual sensors or vehicle components comprising the sensors. Sensors or vehicle components use the signing key to sign their detected and optionally encrypted measurement data. The individual analysis modules each have access to the public signature check keys that together with one of the signing keys form an asymmetric cryptographic key pair. For example, the public signature check key may be part of a separate analysis module. The analysis modules are configured to check the validity of the signatures of the measurement data using the signature check keys, and further process the measurement data only if the signature is valid.

4 shows some exemplary components of a military vessel having a number of analysis modules (“AM”) and a database 122 . Here the database 122 is implemented in the form of two different databases each containing different pieces of data. The database 122.1 contains measurement data having a normal security level that is partially or wholly present in unencrypted form. However, the database 122.2, also known in the military field as “red data”, contains sensitive measurement data that is preferably encrypted with one or more different encryption keys, for example according to the encryption method described in connection with FIG. 3 . do. Box 406 represents a plurality of different measurement values from different sensors of different vehicle components. For example, measurement values may originate from the following vehicle components and subsystems: various internal measurement data (eg, state-related measurement values of different vehicle components), SBM (eg, accident and / or damage-related measurement data regarding damage from combat), EBM (energy-related measurement data, eg, state data of a diesel engine), ONA (self-noise analysis) and vibration data. In particular, vibration data are important in that they can estimate current and future system conditions, since in many cases these data allow the identification of problems in the mechanical operation of rotating machines, especially aging processes in steel structures.

The output interface 404 may be, for example, a screen or loudspeaker or a machine-to-machine interface. For example, the interface may be a GUI that shows the analysis results of individual analysis modules to the user 424 to enable the user to take appropriate actions.

For example, the analysis module 410 may generate an analysis result that the energy storage will be exhausted within 3 days at the same consumption rate. The results are shown to the user via a screen, so that the user can take appropriate action, eg return to port earlier or reduce energy consumption. The analysis module 112 may combine with data specified by the user, such as a selected route, for example, of a number of measured values such as currently available energy stores, flow conditions, wind conditions. The analysis may predict a range of possible capacities of energy stores over the next few days. If the calculation indicates that the energy storage will not be sufficient for the currently selected route, but the storage will be sufficient if an alternative possible route is selected, the module is configured to cause the vehicle's automated system to automatically steer the vehicle onto the alternative route. Alternative routes may be suggested so that the user only needs to identify alternative routes. Some analysis modules may also output their analysis results directly to individual vehicle components. For example, in the event of an emergency energy situation on the vessel, module 410 automatically disables all energy consumers on the vessel that are not considered essential to the vessel's operation, or terminates the supply of energy to these energy consumers. You may.

At least some of the vehicle components may also have an interface 402 to directly transmit the detected measurement data to one or more of the analysis modules 410 - 422 . This may be the case for measurement data that is important for the rapid response of individual analysis modules in real time, as it may avoid delays from recording the measurement data to the database, but in some cases the measurement data may also be stored in the background or asynchronously. It may also be recorded in the database.

The analysis modules shown herein are grouped by application fields, for example in modules of an energy generation system (EES), a maintenance system (or "service" system). The service system includes, for example, various services related to detecting and/or reporting various faults in components of a ship.

In many embodiments, various external systems have access to the analysis modules and their results, for example, via external interface 408 . Interface 408 may be used to export data, for example, from database 122 in the home port, so that fleet analysis software can evaluate the exported data.

list of reference signs
100 military ships
102 weapon system
104 drive system
106 navigation system
108 rudder system
110 vehicle component
112 rotation speed sensor
114 GPS sensor
116 angle/position sensor
118 pressure sensor
120 temperature sensor
122 database
124 automation system
126 Distributed Computer Systems
130 military ships
132 military ships
134 computer system
136 Import Interface
138 Fleet Analysis Software
140 screen
202-208 computer system
212-230 container
260-268 Analysis Module Instances
260, 266 Instances of Analysis Module AM1
270-278 Portions of data in database 122
240-246 CPUs
248-254 RAM memory
256 Container Management Software
280 Network Connections (Intranet)
282 CPUs
284 RAM memory
286 Automation Software
288 Database Access Services
290 computer system
292 data connection
302, 304 Instances of Analysis Module AM2
Instances of 306-312 Analysis Module (AM5)
Instances of 314-318 Analysis Module (AM6)
322-332 Public encryption key for secure data exchange with specific analysis modules
334-344 Private decryption key applied only to specific analysis modules
402 input interface
404 output interface
406 Measured Values
408 External Interface
410-422 Analysis Modules

Claims (24)

As a military vessel (100),
- a plurality of vehicle components (104-110) each comprising one or more sensors (112-120), wherein at least some of the vehicle components are a weapon system (102), a drive unit (104) and a navigation system (106) ), wherein said sensors are designed to detect measured values, said measured values being operational states of said vehicle component comprising a sensor detecting said measured values, and/or state of said vessel or its environment the plurality of vehicle components 104-110 representing
- a database (122), said database (122) storing in a persistent and protected manner a history of the measurement values of said sensors together with a time stamp; and
- an electronic automation system (124), said automation system comprising at least one of said vehicle components based on said measurement values and/or based on input from a user entered via a user interface in response to an output of said measurement values and the electronic automation system (124) designed to automatically and/or semi-automatically control in real time. The method of claim 1,
The vessel is
- a plurality of computers 202-208 networked together into a computer network 126 and cooperating in said network as hosts such that at least one instance of said database is provided; and
- container management software, the container management software automatically provisioning, scaling and and the container management software configured for management, wherein the containers are isolated from each other. 3. The method of claim 1 or 2,
- one or more analysis modules (260-268) each configured to perform an analysis of at least a portion of the measurement values stored in the database (122). 4. The method of claim 3,
- the automation system 124 on one side and the one or more analysis modules 260-268 on the other are operatively decoupled from each other; and/or
- both the automation system and the one or more analysis modules are configured to execute their respective control or analysis functions without the use of an internet connection. 5. The method of claim 4,
Operational decoupling is
- a method of asynchronous operation of the automated system on one side and of the one or more analysis modules 260-268 on the other side, and/or
- asynchronous to the database 122 on one side by the automated system or by a service 288 operatively connected to the automated system and on the other side by the one or more analysis modules 260-268 write or read access; and/or
- instancing of the one or more analysis modules 260-268 on one side of the automation system and on other computers 202-208; 290 on the other side
Implemented by a military vessel. 6. The method according to any one of claims 3 to 5,
wherein the plurality of analysis modules are executed in a plurality of different containers (212-230) and isolated from each other. 7. The method according to any one of claims 2 to 6,
at most one instance of at most one analysis module (260-268) running in each of the containers (212-230). 8. The method according to any one of claims 2 to 7,
The container management software 256,
- if one of the computers 202-208 fails or becomes inaccessible, the containers and the analysis modules that no longer exist or are inaccessible due to the failure and inaccessibility of one computer are removed from the computer. is started automatically on the other of the computers; and/or
- if the number of instances of one of said analysis modules currently running on said computers exceeds a maximum value, one of these instances is automatically terminated and/or said containing an instance of said analysis module one of the containers is deleted; and/or
- when the computing load of one of said computers exceeds a predefined maximum, automatically at least one container hosted on this computer and an instance of the analysis module running thereon are migrated to the other of said computers; and/or
- when the computing load of one of said computers falls below a predefined minimum, automatically at least one container hosted on the other of said computers and an instance of the analysis module running thereon is migrated to this computer; and/or
- when the computing load of one of said computers exceeds a predefined maximum, automatically at least one container hosted on this computer and an instance of the analysis module running therein are identified, the identified container and running thereon a copy of the analysis module being instantiated in at least one further computer of said computers; and, analyzes comprising at least the analysis module instance and a further instanced analysis module instance in the identified container are executed in parallel; and/or
- when the computing load of one of said computers falls below a predefined minimum, automatically at least one container hosted on the other computer and an instance of the analysis module running therein are identified, the identified container and running thereon a copy of the analysis module being instantiated on this one computer; and analyzes comprising at least the analysis module instance and additional instanced analysis module instances in the identified container to be executed in parallel.
a military vessel configured to coordinate the instancing and termination of the creation and analysis modules (260-268) of containers (212-230). 9. The method according to any one of claims 3 to 8,
A portion of the data of the database is specifically assigned to at least some of the analysis modules, the portions of data such that only the analysis module assigned to this portion of the data can access it for reading and/or writing. A military vessel, stored in a protected manner. 10. The method according to any one of claims 3 to 9,
Several analysis modules 260, 262, 264; 306, 314 of the analysis modules 260-268 are each specifically assigned to one of the vehicle components 108; 110, and one or more sensors and receive and analyze at least the measurement values detected by the one or more sensors of this one vehicle component assigned directly or indirectly via the database, and output the results of the analysis. 11. The method of claim 10,
At least one of the plurality of analysis modules assigned to one of the vehicle components comprises:
- detection of present or future critical states of said one vehicle component; and/or
- prediction of the time of occurrence of a critical state of said one vehicle component; and/or
- automatic identification of one or more environmental parameters and/or vehicle component parameters that are the cause of the critical state of said one vehicle component; and/or
- calculation of an action recommendation for a person for said one vehicle component; and/or
- Calculation of control commands for the one vehicle component for automatic execution of control commands
A military vessel configured to perform an analysis comprising: 12. The method according to any one of claims 3 to 11,
- sensors of at least one of said vehicle components comprise at least one cryptographic encryption key (324, 322, 330, 328, 326, 332);
- one of said analysis modules is assigned to said at least one vehicle component and comprises a decryption key (334, 336, 338, 340, 342, 344) corresponding to this encryption encryption key;
- said sensors of said at least one vehicle component are configured to store at least some values of their detected measurement values in encrypted form in said database and/or to transmit them directly to an analysis module assigned to said at least one vehicle component become;
- the at least one analysis module is configured to decrypt the at least some values using the decryption key and analyze the decrypted data. 13. The method according to any one of claims 3 to 12,
- said sensors of at least one of said vehicle components comprise a signing key;
- one of said analysis modules is assigned to said at least one vehicle component and comprises a signature check key corresponding to this signature key;
- the sensors of the at least one vehicle component use the signing key to sign at least some of their detected measurement values, store them in the database in signed form and/or store them in the at least one vehicle component configured to transmit directly to the assigned analysis module;
- the at least one analysis module is configured to check the at least some measurement values with the signature check key and analyze the signed data only when the signature check indicates that the signature is valid. 14. The method according to any one of claims 3 to 13,
and one or more of the analysis modules are configured to output (404) a result of its analysis to a user and/or to an analysis system, and/or store it in a database. 15. The method according to any one of claims 3 to 14,
at least one of the analysis modules is configured to perform analysis (eg, correlation analysis, NN-based prediction, rule-based prediction, etc.) on measurement values of several different sensors from several different vehicle components,
The analysis is
- detection of current or future critical states of the vehicle component; and/or
- prediction of the time of occurrence of the critical state of the vehicle component; and/or
- automatic identification of one or more environmental parameters and/or vehicle component parameters that are the cause of the critical state of one of said vehicle components; and/or
- Calculation of action recommendations for people; and/or
- calculating the control command for one of the vehicle components for automatic execution of the control command
Including, military vessels. 16. The method according to any one of claims 3 to 15,
- one of said vehicle components comprises a control unit, a rudder system having one or more starboard keys and one or more port keys, said control unit being on one side to the starboard key and on the other side to the port key configured to adjust, in particular synchronize, the position and movement of the star and port keys by sending control commands;
- the rudder system comprises several sensors configured to detect rudder system parameter values, the rudder system parameters being the following measurement parameter values: a current position of the key, vibrations of the key, fouling of the key, the rudder vibrations of components of the system, two or more of the switching states of the rudder system;
- at least one of said vehicle components comprises several sensors configured to detect environmental parameter values, said environmental parameters comprising at least two of the following measurement parameter values: depth, swell, vessel speed;
- one of the analysis modules is an analysis module for improved control of the rudder system, for detecting correlations between durations, rudder system parameter values and environmental parameter values, and/or of keys of the rudder system and analyze the rudder system parameter values, the environmental parameter values and the durations between the transmission of control commands by the control unit to each key and the implementation of the control commands to improve coordination. 17. The method according to any one of claims 3 to 16,
- one of said vehicle components comprises at least one sensor for detecting oscillations, in particular vibrations, of said one vehicle component, said one vehicle component in particular being a radar system and/or a drive unit;
- one of said analysis modules is configured to analyze the oscillations of said one vehicle component to calculate a present and/or future state of another of said vehicle components, said other vehicle component being in particular a rudder system; and/or
- one of said analysis modules is configured to analyze oscillations of said one vehicle component to improve control of said other of said vehicle components, said other vehicle component being in particular a rudder system. 18. The method according to any one of claims 3 to 17,
One of the sensors measures the temperature of the water around the vessel and stores it in the database, and one of the analysis modules determines the current or future energy consumption and/or of the vehicle component based on the temperature of the surrounding water used as cooling water. A military vessel configured to calculate current or future wear and tear. 19. The method of claim 18,
The one analysis module is configured to use the temperature measured at different times to identify similar modes of operation of the entire vessel, defined by a specific temperature or a specific temperature range of the surrounding water, the analysis module comprising: to analyze the measurement data and/or other performance parameters of the entire vessel such that only comparable modes of operation of the vessel are compared with each other, and in particular future energy consumption, present maximum possible range, and/or present or future of the vessel or vehicle components A military vessel, configured to use the comparison results to calculate wear. 20. The method according to any one of claims 1 to 19,
wherein data from the database is distributed and/or stored redundantly across several computers. 21. The method according to any one of claims 2 to 20,
Data from the database is stored in a distributed manner in different containers on different computers, wherein the container management software is configured to coordinate the creation of the containers and the storage, replication and deletion of data in the containers:
- in normal operation, the data in the database is stored in a distributed and redundant manner on several computers so that data can be recovered from data stored on other computers in the event of a failure of one or more of the computers;
- upon failure of one of said computers, another one of said computers is automatically identified, comprising a copy of the corresponding portions of data stored on the failed computer, and the data contained in this other computer is divided into analysis modules and provided to the automated system; and/or
- upon failure of one of the computers, at least some of the data stored in a redundant and distributed manner in several containers are automatically redistributed to restore the previous degree of redundancy of the data in the database; and/or
- if a predefined maximum storage requirement is exceeded on one of said computers, automatically at least portions of the data of said database stored on this computer are migrated or copied to another of said computers; and/or
- when the computing load of one of said computers falls below a predefined minimum, at least one of said containers hosted on this one computer is automatically deleted. 22. The method according to any one of claims 2 to 21,
at least some of the computers of the computer network are housed in a separate safety enclosure that is fire and/or explosion-proof and/or watertight. 23. The method according to any one of claims 2 to 22,
The computers of the computer network include one or more first computers and one or more second computers, the first computers and the second computers being accommodated in different spatial regions of the vessel, the different spatial regions being different rooms, different decks, different chambers separated by watertight lock chamber doors, the starboard and port sides of the ship, or the bow and stern ends of the ship. A system 150 comprising:
The system 150 is
- at least two military vessels (100, 130, 132) according to any one of claims 1 to 23;
- computer system 134;
The computer system 134 comprises:
• an interface (136) for securely importing the contents of a database of said at least two vessels;
。 Includes fleet analysis software (138);
wherein the fleet analysis software is configured to analyze measurement values of the database of the at least two ships, the fleet analysis software is configured to automatically detect whether measurement values of other ships have been detected from vehicle components of the same type; , the analysis is:

detection of a vessel in which all of the vehicle components are in the best or worst condition with respect to at least one technical evaluation criterion; and/or

detection of critical conditions of a vehicle component in one or more of the vessels; and/or

prediction of a time of occurrence of a critical condition of a vehicle component in one or more of the vessels; and/or

Automatic identification of vehicle component parameters and/or one or more environmental parameters that are the cause of a critical state of one of the vehicle components in one or more of the vessels
comprising, a system.

Images