Method and system for protecting an aircraft against an incoherent command instruction

A method and system for protecting an aircraft against an incoherent command instruction. The system has a generation unit generating a command instruction transmitted to an evaluation unit that evaluates whether or not the command instruction is incoherent and generates and transmits a validation order if the command instruction is coherent or an arbitration request if not, the arbitration request being transmitted by an arbitration unit, where applicable, to an operator who sends a confirmation response or a cancellation response. The arbitration unit generates and transmits a validation order to an execution unit in the event of receiving a confirmation response and a cancellation order in the event of receiving a cancellation response, the system allowing the execution unit to execute only the command instructions evaluated and confirmed as not being incoherent.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority to French patent application 18 72298 filed on Dec. 4, 2018, the entire disclosure of which is incorporated by reference herein.

TECHNICAL FIELD

The disclosure herein relates to a method and to a system for protecting an aircraft against an incoherent command instruction.

BACKGROUND

In order to control complex systems of an aircraft, in particular of a transport plane, the flight crew of the aircraft often use predetermined lists of commands (checklists). Such lists of commands comprise a sequence of commands (or procedures) comprising actions that the pilot has to perform, in particular by acting on actuation elements. In the context of the disclosure herein, “actuation element” is understood to mean any unit, button, lever or control or any tactile element present on the aircraft and able to be actuated (touched, pressed, pulled, etc.) by a pilot of the aircraft in order to command the implementation of a particular action.

On commercial transport planes piloted by at least two pilots, in order to implement such a list of commands, in general, one of the pilots, specifically the pilot PM (for pilot monitoring) who is monitoring the flight, progressively reads through the various commands (or procedural steps) in the list of commands, and the other pilot, specifically the pilot PF (for pilot flying) who is piloting the aircraft, performs the actions required for each of these commands or procedural steps. The pilot PM who reads the actions at the same time monitors the actions performed by the pilot PF, and thus makes it possible to prevent actuation errors such as actuating an incorrect system not involved in the current procedure or an incoherent command or positioning of a correct actuation element.

In spite of this check by the pilot PM, actuation errors and/or malfunctions of the control elements are not ruled out.

In addition, centralized systems on board aircraft may automatically send configuration or reconfiguration command instructions to other systems of the aircraft. Incoherent behaviour of these centralized systems could in particular lead to an incorrect reconfiguration of the other systems of the aircraft.

There are specialist monitoring devices for monitoring actions of a pilot. These devices generally emit a warning before the command instruction is generated, but are not able to prevent execution thereof.

Despite these monitoring devices, actuation errors by a pilot, malfunctions of a control element or even incoherent behaviour of the centralized systems may lead to the execution of one or more incorrect command instructions. This solution is therefore not entirely satisfactory.

SUMMARY

The aim of the disclosure herein is to rectify this drawback.

To this end, it relates to a method for protecting an aircraft against an incoherent command instruction.

According to the disclosure herein, the method comprising a generation step, implemented by a generation unit, consisting in or comprising generating a command instruction, additionally comprises the sequence of following steps:a first transmission step, implemented by a first transmission link, consisting in or comprising transmitting the command instruction generated by the generation unit to an evaluation unit;an evaluation step, implemented by the evaluation unit, consisting in or comprising evaluating whether or not the command instruction is incoherent and in generating and transmitting an arbitration request if the command instruction is incoherent and a first command instruction validation order if not;an arbitration step, implemented by an arbitration unit, consisting of or comprising:

transmitting, where applicable, the arbitration request received from the evaluation unit to an operator by way of a communication system;receiving a confirmation response or a cancellation response from the operator by way of the communication system; andgenerating and transmitting a second command instruction validation order to an execution unit in the event of receiving a confirmation response and a command instruction cancellation order in the event of receiving a cancellation response; andan execution step, implemented by the execution unit, consisting in or comprising executing the command instruction in the event of receiving a first or a second command instruction validation order.

A command instruction is thus evaluated by virtue of the disclosure herein. If the command instruction is evaluated as being incoherent, arbitration is performed, during which an operator has to confirm or cancel this incoherent command instruction before execution thereof. An incoherent command instruction is understood to mean a command instruction whose execution results in the aircraft being placed in danger. Therefore, only command instructions whose execution does not present any danger for the aircraft are executed.

Advantageously, in a first embodiment, the evaluation step comprises the sequence of following sub-steps:an acquisition sub-step, implemented by an acquisition module, consisting in or comprising acquiring parameter data of the aircraft, the acquired data defining a current state of the aircraft;a selection sub-step, implemented by a selection module, consisting in or comprising selecting a list from among a plurality of lists in a database, each of the lists being associated with the execution of a particular command instruction and comprising a set of predetermined states and technical consequences if the particular command instruction is executed, the selected list being associated with the execution of the command instruction received from the generation unit;a checking sub-step, implemented by a checking module, consisting in or comprising checking a lack of conformity or conformity of the current state with a predetermined state defined for the selected list, the conformity of the current state with the predetermined state being representative of an incoherent command instruction;a generation sub-step, implemented by a generation module, consisting in or comprising:generating an arbitration request if the command instruction is incoherent; andgenerating the first command instruction validation order if not.

Furthermore, in a second embodiment, the evaluation step comprises:an acquisition sub-step, implemented by an acquisition module, consisting in or comprising acquiring parameter data of the aircraft;a modelling sub-step, implemented by a modelling module, consisting in or comprising modelling a state of the aircraft and a protective envelope around the state of the aircraft, based on the acquired parameter data, the protective envelope surrounding the state of the aircraft representing the modelled state of the aircraft;a simulation sub-step, implemented by a simulation module, consisting in or comprising simulating a state of the aircraft if a particular command instruction is executed; anda decision sub-step, implemented by a decision module, consisting in or comprising comparing at least one value of parameters defining the modelled state and at least one value of parameters defining the simulated state, in deducing the coherence or incoherence of the command instruction therefrom according to predetermined rules, and then in generating the first validation order if the command instruction is coherent or an arbitration request if the command instruction is incoherent.

Moreover, advantageously, the evaluation step also comprises a warning sub-step, consisting in or comprising sending a warning signal, in the event that the evaluation unit is incapable of evaluating the command instruction.

Moreover, advantageously, the arbitration request comprises at least the following information:a command instruction to be arbitrated;the identity of the generation unit that generated the command instruction;at least one technical consequence in the event that the command instruction is executed;a request to confirm or to cancel the command instruction.

Furthermore, advantageously, the method also comprises a second transmission step, implemented by a second transmission link, consisting in or comprising transmitting the command instruction generated by the generation unit to the execution unit.

In a first embodiment, the first transmission step and the second transmission step are implemented simultaneously.

In a second embodiment, the second transmission step is implemented only if the evaluation unit generates the first command instruction validation order or if the arbitration unit generates the second command instruction validation order.

Advantageously, the execution step also consists in or comprises executing the command instruction received from the generation unit in the event of receiving a warning signal sent by the evaluation unit and in the event of a lack of reception, within a predetermined time interval, of a first command instruction validation order, of a second command instruction validation order and of a command instruction cancellation order.

The disclosure herein also relates to a system for protecting an aircraft against an incoherent command instruction.

According to the disclosure herein, the system having a generation unit, configured so as to generate a command instruction, also has:a first transmission link configured so as to transmit the command instruction generated by the generation unit to an evaluation unit;the evaluation unit, configured so as to evaluate whether or not the command instruction is incoherent and to generate and transmit an arbitration request if the command instruction is incoherent and a first command instruction validation order if not;an arbitration unit configured so as:to transmit, where applicable, the arbitration request received from the evaluation unit to an operator by way of a communication system;to receive a confirmation response or a cancellation response from the operator by way of the communication system; andto generate and to transmit a second command instruction validation order to an execution unit in the event of receiving a confirmation response and a command instruction cancellation order in the event of receiving a cancellation response; andthe execution unit, configured so as to execute the command instruction in the event of receiving a first or a second command instruction validation order.

Advantageously, in a first embodiment, the evaluation unit has:a database comprising a plurality of lists, each of the lists being associated with the execution of a particular command instruction and comprising a set of predetermined states and technical consequences if the particular command instruction is executed;an acquisition module configured so as to acquire parameter data of the aircraft, the acquired data defining a current state of the aircraft;a selection module configured so as to select a list from among the plurality of lists in the database, the selected list being associated with the execution of the command instruction received from the generation unit;a checking module configured so as to check a lack of conformity or conformity of the current state with a predetermined state defined for the selected list, the conformity of the current state with the predetermined state being representative of an incoherent command instruction;a generation module configured so as to:generate an arbitration request if the command instruction is incoherent; andgenerate the first command instruction validation order if not.

Advantageously, in a second embodiment, the evaluation unit has:an acquisition module configured so as to acquire parameter data of the aircraft;a modelling module configured so as to model a state of the aircraft and a protective envelope around the state of the aircraft, based on the acquired parameter data, the protective envelope surrounding the state of the aircraft representing the modelled state of the aircraft;a simulation module, configured so as to simulate a state of the aircraft if a particular command instruction is executed; anda decision module, configured so as to compare at least one value of parameters defining the modelled state and at least one value of parameters defining the simulated state, to deduce the coherence or incoherence of the command instruction therefrom according to predetermined rules, and then to generate the first validation order if the command instruction is coherent or an arbitration request if the command instruction is incoherent.

Moreover, advantageously, the system also has a second transmission link, configured so as to transmit the command instruction generated by the generation unit to the execution unit.

Moreover, preferably, the evaluation unit is also configured so as to send a warning signal, in the event that the evaluation unit is incapable of evaluating the command instruction.

Furthermore, advantageously, the execution unit is also configured so as to execute the command instruction received from the generation unit in the event of receiving a warning signal sent by the evaluation unit and in the event of a lack of reception, within a predetermined time interval, of a first command instruction validation order, of a second command instruction validation order or of a command instruction cancellation order.

The disclosure herein additionally relates to an aircraft, in particular a transport plane, comprising a system for protecting against an incoherent command instruction for an aircraft such as the one specified above.

DETAILED DESCRIPTION

The protection system1(hereinafter “system1”), shown schematically in one particular embodiment inFIG. 1, is intended to protect an aircraft AC, in particular a transport plane, on which it is installed (FIG. 3) against an incoherent command instruction.

In the context of the disclosure herein, an incoherent command instruction is understood to mean any command instruction whose execution may lead to a drop in the performance and/or capabilities of the aircraft AC, or even generate a situation deemed to be dangerous for the aircraft AC. By analogy, a coherent command instruction is a command instruction whose execution does not lead to any drop in performance and/or capabilities of the aircraft AC, or to situations deemed to be dangerous for the aircraft AC.

As shown inFIG. 1, the system1comprises at least one generation unit2that is able to generate a command instruction.

In one preferred embodiment, the generation unit2is a control that is able to be actuated (touched, pressed, pulled, etc.) by one of the pilots of the aircraft AC. In one particular implementation of this embodiment, this control is a button (rotary button, pushbutton, etc.), a unit or a lever. In another implementation of this embodiment, the control is a human-machine interface system. Such a human-machine interface system may comprise a function for viewing and monitoring the avionic systems generating a command instruction based on at least one action of one of the pilots on a tactile element (touchscreen, tactile controller, etc.). Moreover, the actuation of the human-machine interface system may also be voice-based or gesture-based.

In another embodiment, the generation unit2is a system for automatically managing the configuration and/or reconfiguration of avionic systems. By way of example, an automatic management system may be an FWS (flight warning system) system configured so as to send configuration and reconfiguration command instructions to the other avionic systems of the aircraft.

A command instruction therefore results from the actuation of a control by one of the pilots or of an automatic management system of the aircraft AC. It relates to the configuration and reconfiguration of one or more avionic systems. An avionic system is generally a system on board the aircraft AC, such as an engine management system, an electrical system, etc.

Moreover, each command instruction generated by the generation unit2is transmitted to an evaluation unit3by way of a transmission link T1.

Furthermore, each command instruction generated by the generation unit2is also transmitted to an execution unit12by way of a transmission link T2.

The evaluation unit3preferably evaluates whether or not the received command instruction is incoherent. The evaluation unit3generates and transmits an arbitration request R if the command instruction is evaluated as being incoherent and a command instruction validation order V1if not, that is to say if the command instruction is evaluated as being coherent.

In one preferred embodiment, the evaluation unit3has a database4. This database4comprises a plurality of lists Li, where i=1, . . . , M, M being an integer. Each list Li in the database4is associated with the execution of a particular command instruction that is able to be generated by the generation unit2. A list Li associated with the execution of a particular command instruction comprises a sequence of predetermined states Sij and of technical consequences Cij relating to each predetermined state Sij, where j=1, . . . , N, N being an integer. The total number of predetermined states Sij and of technical consequences Cij may be different from one list to another.

By way of example, a command instruction may be an instruction asking to “Turn off the engine 2” in the case of an aircraft AC comprising two engines, the engine 1 possibly being on fire. In this example, predetermined states Sij defined for a list Li associated with this command instruction may be “Engine 1 on fire and Aircraft flying”, “Thrust of the engine 1 degraded and Aircraft in take-off phase”, etc.

Each technical consequence Cij is representative of a result, on the execution units12, if the aircraft AC is in the predetermined state Sij defined for the list Li and the particular command instruction is executed. The technical consequences Cij are often deemed to be dangerous. They lead to a loss of performance and/or capabilities of the aircraft AC that is dangerous for the aircraft AC.

The technical consequences Cij associated with the predetermined states Sij set out in the example above if the command instruction is “Turn off the engine 2” may comprise “Total loss of thrust”, “Risk of loss of enough thrust to avoid surrounding obstacles”, etc.

The evaluation unit3also has an acquisition module5that acquires (current) parameter data of the aircraft AC. The acquisition module5preferably comprises a set of sensors and avionic systems able to supply data in relation to the command instruction received by the evaluation unit3. The (current) parameter data of the aircraft AC are for example altitude values, velocity values, the state of an engine, etc. These (current) parameter data define what is called a current state of the aircraft AC.

In the preferred embodiment, the evaluation unit3comprises a selection module6that selects the list Lk, from among the plurality of lists L1to LM in the database4, that is associated with the execution of the command instruction generated by the generation unit2.

The evaluation unit3additionally comprises a checking module7that checks whether the current state of the aircraft AC defined by the acquisition module5matches or does not match one of the predetermined states Skl in the selected list Lk, l ranging from 1 to N.

A current state matching a predetermined state Skl defined for the list Lk means that the command instruction is incoherent. Execution thereof may lead to technical consequences Ckl corresponding to the predetermined state Skl matching the current state of the aircraft AC. These technical consequences Cij are deemed to be dangerous for the aircraft AC.

By contrast, a current state that does not match a predetermined state Skl defined for the list Lk means that the command instruction is coherent. Execution thereof does not lead to technical consequences that may be dangerous for the aircraft AC.

The evaluation unit3furthermore has a generation module8that:generates an arbitration request R if the command instruction is evaluated as being incoherent by the checking module7; andgenerates the command instruction validation order V1if not.

In another embodiment, the evaluation unit3comprises, as shown inFIG. 2:an acquisition module13that is identical for example to the acquisition module5and that acquires parameter data of the aircraft AC;a modelling module14that models a state of the aircraft AC and a protective envelope around the state of the aircraft AC, based on the acquired parameter data, the protective envelope surrounding the state of the aircraft AC representing the modelled state of the aircraft. The state of the aircraft AC is represented for example by Petri nets each node of which is an execution unit12and each link of which is an interaction between the execution units12;a simulation module15that is able to simulate a state of the aircraft AC if a particular command instruction is executed; anda decision module16that compares at least one value of parameters defining the modelled state and at least one value of parameters defining the simulated state, and deduces the coherence or incoherence of the command instruction therefrom according to predetermined rules, and then generates the validation order V1if the command instruction is coherent or an arbitration request R if the command instruction is incoherent.

Predetermined rules are understood to mean a set of rules for determining whether or not the execution of a command instruction causes one of the parameters defining the simulated state to stray in comparison with the protective envelope defining the modelled state of the aircraft AC. The protective envelope represents maximum permissible values for the parameter values of the simulated state of the aircraft AC.

The validation order V1, generated by the evaluation unit3in the first or the second embodiment, is transmitted to an execution unit12by way of a transmission link T3shown inFIG. 1. The arbitration request R is transmitted to an arbitration unit9by way of a transmission link T4that is also shown inFIG. 1.

In one particular embodiment, the evaluation unit3is configured so as to send a warning signal in the event that the evaluation unit3is incapable of evaluating the command instruction.

In one preferred embodiment, the arbitration unit9is a human-machine interface hosted by a human-machine interface system. In one particular embodiment, the arbitration unit9is hosted by the same human-machine interface system as the generation unit2.

Moreover, the arbitration unit9transmits the arbitration request R, received from the evaluation unit3in the event that the command instruction is incoherent, to a communication system10, which communicates it to an operator O.

The communication system10comprises a transmission link T5and a communication device11, for example a display screen that may be a touchscreen, a camera or a microphone. The communication system10sends the arbitration request R to the communication device11, which displays it on the screen or which emits it in voice form to the operator O.

In one preferred embodiment, the operator O is one of the pilots who has actuated the generation unit2or any other member of the flight crew. In this preferred embodiment, the communication device11is arranged in the cockpit and the data link is wired or wireless T5. In one variant (not shown), the operator O is a person who is not present in the aircraft AC. The communication device11is arranged outside of the aircraft AC, for example in the airline operations centre, or is portable. In this variant embodiment, the data link T5is a wireless link.

The communication system10is also configured so as to receive a response from the operator O. This is either a response confirming the command instruction or a response cancelling the command instruction. The operator O acts on the communication device11in order to send his response. As shown inFIG. 1, the arbitration unit9transmits a validation order V2if the response from the operator O is a confirmation response, and a cancellation order A if the response from the operator O is a cancellation response. The arbitration unit9transmits either the validation order V2or the cancellation order A to the execution unit12by way of a transmission link T6.

The execution unit12furthermore represents one or more avionic systems. This avionic system or these avionic systems is or are on-board systems, for example an engine management system, an electrical system, etc. The execution unit12executes the command instruction received from the generation unit2if a validation order V1, V2has been transmitted thereto either by the evaluation unit3or by the arbitration unit9. If the arbitration unit9transmits a cancellation order A thereto, the execution unit12does not execute the command instruction.

In one particular embodiment, the execution unit12is also configured so as to execute the command instruction if, after a predetermined time interval, no command instruction validation order V1, V2or no command instruction cancellation order A has been transmitted thereto. The predetermined time interval starts when the execution unit12receives the command instruction generated by the generation unit2. In one variant, the execution unit12is also configured so as to ignore the command instruction if, after a predetermined time interval, no command instruction validation order V1, V2or no command instruction cancellation order A has been transmitted thereto. By way of example, the predetermined time interval lasts three minutes.

In one variant, the execution unit12executes the command instruction if the execution unit12receives the warning signal sent by the evaluation unit3. This warning signal informs the execution unit12that the evaluation unit3is faulty and is not able to evaluate the command instruction.

The system1as described above is able to implement a method for protecting the performance and/or capabilities of an aircraft AC on which it is installed against an incoherent command instruction. The method comprises several particular implementations, as shown inFIGS. 4A, 4B and 4C.

The method comprises a generation step E1, implemented by the generation unit2, consisting in or comprising generating a command instruction, either automatically by way of an automatic management system or following the actuation of a control by a pilot. The generated command instruction is then transmitted to the evaluation unit3in a first transmission step E2A.

In order to evaluate whether the command instruction is incoherent or is not incoherent, the method comprises an evaluation step E3containing the sequence of following sub-steps E3A, E3B, E3C and E3D.

In the acquisition sub-step E3A, sensors and/or avionic systems that form part of the acquisition module5acquire a plurality of parameter data of the aircraft AC. This set of parameter data defines a current state of the aircraft AC. By way of example, one of the engines of the aircraft is on fire during a flight. A current state of the aircraft AC is “Engine 1 on fire, aircraft AC flying”.

In parallel, the selection sub-step E3B makes it possible to select the list Lk associated with the execution of the command instruction generated by the generation unit2from among the lists L1to LM in the database4. The selected list Lk comprises predetermined states Skl and technical consequences Ckl relating to these predetermined states Skl if the generated command instruction is executed. The predetermined states Skl defined for the list Lk form a non-exhaustive set of situations in which executing the command instruction leads to a loss of performance and/or capabilities of the aircraft AC. The technical consequences Ckl relating to these predetermined states Skl form a set of additional information about this loss of performance and/or capabilities of the aircraft AC that may lead to the aircraft being placed in danger.

When the list Lk is selected, the current state of the aircraft AC is compared to each of the predetermined states Skl defined for the selected list Lk. The checking sub-step E3C, following the sub-steps E3A and E3B, checks whether the current state matches or does not match one of the predetermined states Skl.

As shown inFIG. 4A, if the current state does not match, that is to say if the current state does not correspond to any of the predetermined states Skl defined for the list Lk, the command instruction received from the generation unit2is evaluated by the checking module7as being coherent. A validation order V1is then generated by the generation module8in the generation sub-step E3D and transmitted to the execution unit12.

By contrast, if the current state of the aircraft AC matches one of the predetermined states Skl, that is to say if the current state corresponds to at least one of the predetermined states Skl defined for the selected list Lk, the command instruction is evaluated as being incoherent by the checking module7. As shown inFIGS. 4B and 4C, the generation sub-step E3D then consists in or comprises generating an arbitration request R that is transmitted to the arbitration unit9.

In one variant, the evaluation step E3comprises:an acquisition sub-step, identical for example to the acquisition sub-step E3A, implemented by the acquisition module13, consisting in or comprising acquiring parameter data of the aircraft AC;a modelling sub-step, implemented by the modelling module14and consisting in or comprising modelling a state of the aircraft AC and a protective envelope around the state of the aircraft AC, based on the acquired parameter data, the protective envelope surrounding the state of the aircraft AC representing the modelled state of the aircraft. The state of the aircraft AC is represented for example by Petri nets each node of which is an execution unit12and each link of which is an interaction between the execution units12;a simulation sub-step, implemented by a simulation module15, consisting in or comprising or comprising simulating a state of the aircraft AC if a particular command instruction is executed; anda decision sub-step, implemented by a decision module16, consisting in or comprising comparing at least one value of parameters defining the modelled state and at least one value of parameters defining the simulated state, in deducing the coherence or incoherence of the command instruction therefrom according to predetermined rules, and then in generating the first validation order V1if the command instruction is coherent or an arbitration request R if the command instruction is incoherent.

The arbitration request R preferably comprises at least the following information:the command instruction to be arbitrated;the identity of the generation unit2that generated the command instruction;at least one technical consequence Cij in the event that the command instruction is executed; anda request to confirm or to cancel the command instruction.

By way of example, an arbitration request R may be “Command to turn off the engine 2 requested. Engine 1 on fire. Total loss of thrust if confirmed.”.

In an arbitration step E4, the arbitration request R is transmitted to the operator O by way of the communication system10. The arbitration request R may be displayed on a display screen, be uttered in voice form, etc. The operator O responds to the arbitration request R by sending a response confirming the command instruction or by contrast a response cancelling the command instruction. The response from the operator O may be in the form of gestures in front of a camera, via a screen that may be a touchscreen, voice-based via a microphone, etc. depending on the communication device11.

As shown inFIG. 4B, if the operator O sends a cancellation response, the arbitration unit9transmits a cancellation order A to the execution unit12by way of the communication device11. The command instruction is cancelled and is not executed in the execution step E5.

By contrast, if the operator O sends a confirmation response to the communication device11of the arbitration unit9, as shown inFIG. 4C, the arbitration unit9transmits a validation order V2to the execution unit12. The command instruction is then executed in the execution step E5.

In one preferred embodiment, the generation unit2transmits the command instruction simultaneously to the evaluation unit3and to the execution unit12in transmission steps E2A and E2B respectively (shown inFIGS. 4A, 4B and 4C). The execution unit12then executes the command instruction in an execution step E5as soon as a validation order V1, V2is received.

In one variant that is not shown, the step E2B of transmitting the command instruction from the generation unit2to the execution unit12takes place only if the evaluation unit3or the arbitration unit9has generated a validation order V1, V2relating to the command instruction.

In another variant that is not shown, the evaluation unit3continuously evaluates whether a command instruction received from the generation unit2is coherent or is incoherent. The evaluation unit3generates a pre-validation order for each coherent command instruction in the current context. The command instructions sent by the generation unit2and pre-validated by the validation unit3are then transmitted immediately to the execution unit12. The execution unit12executes them.

Moreover, in one particular embodiment that is not shown, the command instruction is executed in the execution step E5if no validation order V1, V2or cancellation order A is transmitted to the execution unit12by the end of a predetermined time interval. This predetermined time interval, which starts when the execution unit12receives the command instruction, may last three minutes.

In one variant that is not shown, the command instruction is executed in the execution step E5if the execution unit12receives a warning signal sent by the evaluation unit3. This warning signal informs the execution unit12that the evaluation unit3is faulty and is not able to evaluate the command instruction.

The system1thus makes it possible to protect the execution unit12from an incoherent command instruction that, if it were to be executed, would risk damaging the configuration or reconfiguration of the avionic systems. Such damage would lead to a loss of performance and/or capabilities of the aircraft AC, or even place the aircraft AC in danger.

Advantageously, the system1makes it possible to protect the aircraft AC against, inter alia:untimely or incoherent actuations of certain control by the flight crew;incoherent operation of a human-machine interface system, for example generating and transmitting a command instruction without an action from the flight crew; andincoherent operation of a system for automatically managing the configuration and reconfiguration of avionic systems.

In addition, the system1is robust to any faults with or incoherent operation of the evaluation unit3.