A command control system of a commanded system commanded via a graphic interface by an operator, the commanded system operating in a critical environment, the control system comprising: - a first control subsystem comprising a first computing module able to acquire interaction data describing the interactions of the operator related to the graphic interface, associate these interaction data with a command, and generate a command signal corresponding to this command; - a second control subsystem comprising a first computing module able to acquire the command signal, verify the compatibility of the command corresponding to the command signal with an operational context defining the operation of the critical environment and, when the command is compatible with the operational context, generate a confirmation signal corresponding to this command; and - a third control subsystem able to acquire the command signal and the confirmation signal, and to consolidate the signals in order to generate a resultant command signal intended to command the commanded system, characterized in that the first control subsystem further comprises one or several second computing modules, the or each second computing module being able to acquire said interaction data, associate these interaction data with a command, and generate another command signal corresponding to this command; and in that the first computing module of the second control subsystem is able to acquire all of the command signals generated by the first control subsystem, and when these command signals correspond to a same command, to verify the compatibility of this command with the operational context. - a first control subsystem comprising a first computing module able to acquire interaction data describing the interactions of the operator related to the graphic interface, associate these interaction data with a command, and generate a command signal corresponding to this command; - a second control subsystem comprising a first computing module able to acquire the command signal, verify the compatibility of the command corresponding to the command signal with an operational context defining the operation of the critical environment and, when the command is compatible with the operational context, generate a confirmation signal corresponding to this command; and - a third control subsystem able to acquire the command signal and the confirmation signal, and to consolidate the signals in order to generate a resultant command signal intended to command the commanded system, characterized in that the first control subsystem further comprises one or several second computing modules, the or each second computing module being able to acquire said interaction data, associate these interaction data with a command, and generate another command signal corresponding to this command; and in that the first computing module of the second control subsystem is able to acquire all of the command signals generated by the first control subsystem, and when these command signals correspond to a same command, to verify the compatibility of this command with the operational context. characterized in that the first control subsystem further comprises one or several second computing modules, the or each second computing module being able to acquire said interaction data, associate these interaction data with a command, and generate another command signal corresponding to this command; and in that the first computing module of the second control subsystem is able to acquire all of the command signals generated by the first control subsystem, and when these command signals correspond to a same command, to verify the compatibility of this command with the operational context.