The present invention relates to an open world communication device. 5
The present invention further relates to a communication system and a communication method associated with the open world communication device.
The invention is applicable in particular to an avionics system with a flight management system.
In the field of aeronautics, a flight management system, known by the term 10 "FMS", is an important aircraft system through which the pilot can enter flight data to be followed, such as e.g. a flight plan, a point of arrival, waypoints, etc.
Thus, such an FMS can be used, as is known per se, for planning a flight and in particular for predicting a trajectory to be followed by the aircraft, and all the data associated with the trajectory such as e.g. flight time, consumption, etc. 15
In this way, e.g. an autopilot system can control the trajectory defined by the FMS in order to automatically guide the aircraft along the trajectory.
An FMS is generally associated with a display screen and with entering means allowing the pilot to enter data into such system. The data resulting from the calculations performed by the FMS can then be displayed on the screen and/or 20 sent to other systems.
The FMS is a part of avionics systems and has a so-called closed world system for this purpose.
Often, to enter data into the FMS, the pilot uses other electronic devices which are not part of the closed world. By contrast, such devices are thus called 25 open world devices.
This means in particular that such devices do not follow the same certification rules as closed world devices and, hence that same do not have the same level of integrity and of security as the closed world devices.
Among the open world devices the pilot can use, an electronic device called 30 "Electronic Flight Bag" or "EFB", is known in particular.
Such a device is e.g. in the form of an electronic tablet or any other portable electronic device, and allows the pilot in particular to perform a certain number of calculations relating to the flight plan to be followed. 2
The EFB system can be further used for keeping flight procedures and other useful information.
In order to avoid any interaction of open world devices with avionics systems, pilots generally manually enter data coming from e.g. the EFB device, into the FMS or more generally into any other avionics system. 5
However, in order to make a pilot work fluid, to reduce workload for pilots and to reduce the risk of errors, it is desirable to be able to directly connect at least some of the open world devices to avionics systems such as, in particular, the flight management system (FMS).
In the prior art, a few solutions can already be used for at least partially 10 providing a connection between open world devices and avionics systems such as, in particular, the FMS.
Such solutions in particular use many filtering systems making it possible to filter each request sent by an open world device to the FMS.
However, existing systems do not give full satisfaction because same have 15 relatively complex structures to set up and because same do not make it possible to completely avoid requests which could possibly be malicious.
The purpose of the present invention is to overcome such drawbacks and thus to propose an open-world device for communicating directly with an avionics system without the need to introduce a complex structure, while at the same time 20 providing a high level of safety.
To this end, the subject matter of the invention is an open world communication device with an avionics system of an aircraft, comprising an application component able to send requests to the avionics system and to receive data from the avionics system. 25
The device is characterized in that same further comprises an interfacing component comprising a communication module able to intercept each request sent by the application component and a clone of the avionics system able to test each request intercepted by the communication module in order to determine a status of the request between a conforming and a non-conforming status. 30
the communication module being able to send to the avionics system, only the requests having the conforming status. 3
According to other advantageous aspects of the invention, the open world device method comprises one or more of the following characteristics, taken individually or according to all technically possible combinations:
- the communication module being further able to send to the application component, an error message for each request having the non-conforming status; 5
- the interfacing component further comprising an authentication module able to authenticate the application component so as to authorize same to send requests to the avionics system;
- the data emitted by the avionics system being in the form of a data stream which is broadcast by such system and wherein the interfacing component is able 10 to directly send said data stream to the application component;
- the communication module being able to send to the avionics system, the corresponding requests in an encrypted form;
- the interfacing component being the only component of the device connected to the avionics system; 15
- the interfacing component being in the form of an application;
- the clone being in the form of a software-clone of the avionics system;
- the clone determining the status of a request as non-conforming when at least one of the conditions selected from the group consists of:
- the number of requests sent in a predetermined time interval not 20 being compatible with the processing capacity of the clone;
- the format of the request not corresponding to an expected format;
- the execution of the request leading to unexpected data;
- the request not being allowed to be executed by the aircraft avionics system without endangering the passengers thereof; 25
is met;
- the communication module being able to block the application component when at least one request sent by the component has the non-conforming status;
- the device comprising a plurality of application components, each application component being able to send requests to the avionics system via the 30 interfacing component and to receive data from the avionics system;
- the avionics system being a flight management system.
The invention further relating to a communication system for an aircraft, comprising:
4
- an avionics system;
- an open world device for communicating with the avionics system, the device being as defined above.
According to other advantageous aspects of the invention, the communication system further comprises an interface connecting the open world 5 device to the avionics system.
The invention further relates to a method for communicating with an avionics system of an aircraft, implemented by an open world communication device as defined above;
the method comprising the following steps: 10
- generating a request intended for the avionics system;
- intercepting said request;
- testing said request intercepted by the communication module so as to determine a status of such request between a conforming status and a non-conforming status; 15
- when said request has the conforming status, sending the request to the avionics system.
The characteristics and advantages of the invention will appear upon reading the following description, given only as a non-limiting example, and making reference to the drawings annexed thereto, wherein: 20
- [Fig. 1] Figure 1 is a schematic view of a communication system according to the invention, the communication system comprising in particular, an open world communication device according to the invention;
- [Fig. 2] Figure 2 is a detailed schematic view of the open world communication device shown in Figure 1; 25
- [Fig. 3] Figure 3 is a flow chart of a communication method according to the invention, the communication method being implemented by the open world communication device of Figure 2;
- [Fig. 4] Figure 4 is a schematic view illustrating the implementation of the communication method of Figure 3. 30
Figure 1 shows a communication system 10 for an aircraft.
Aircraft refers in particular to an airplane or a helicopter, or a drone, or further any other flying craft the piloting of which is performed at least partially using an avionics system as described below, by at least one pilot. Such an avionics
5
system can be directly taken aboard into the aircraft or can be remote from the aircraft. In the latter case, the piloting of the aircraft is also performed e.g. remotely.
As can be seen in Figure 1, the communication system 10 comprises an avionics system 12, an interface 14 and an open world communication device 16.
The avionics system is in particular, a flight management system 12 known 5 by the term FMS. The system 12 will hereinafter be referred to as the FMS 12.
As is known per se, the FMS 12 can be used for calculating in particular, a trajectory of the aircraft and predicting data related to the trajectory, starting from the data entered by the pilot. Such data are entered in particular, in the form of requests from the open world device 16, as will be explained hereinafter. 10
The FMS 12 can further generate data intended e.g. for another avionics system and/or for the pilot and/or for the open world communication device 16. Such data is subsequently called the flight management data.
The FMS 12 is coupled in particular, to one or a plurality of display screens and to means of entering data such as e.g. a keyboard. 15
As is also known per se, the FMS 12 can be doubled by another flight management system associated e.g. with another pilot.
The interface 14 can be used for connecting the open world communication device 16 to the FMS 12.
The interface 14 has e.g. a gateway connected by wire to the FMS 12 and 20 wirelessly to the open world communication device 16.
In some embodiments, the interface 14 further has a support serving as a base for the open world communication device 16.
Thus, in such a case, the open-world device 16 can e.g. be placed on the support e.g. for being charged and for being connected by wire to the FMS 12. 25 When the open-world device 16 is removed from such support, the device 16 can e.g. be connected to same wirelessly, using one of the wireless data transmission protocols as known per se.
The open world device 16 has e.g. a tablet or any other portable electronic device such as a e.g. a smartphone configured for being used by the pilot for 30 communicating with the FMS 12.
In general, the open-world device 16 can have the functions of an electronic device known in the prior art under the name "Electronic Flight Bag" or "EFB" . 6
In particular, the open world device 16 allows the pilot to perform at least certain calculation-related operations during the preparation of a flight plan.
The open world communication device 16 will henceforth be explained in greater detail with reference to Figure 2.
Thus, as illustrated in Figure 2, the open world device 16 comprises a 5 plurality of application components 22-1 to 22-N and an interfacing component 24 enabling each of the application components 22-1 to 22-N to be connected via the interface 14 to the FMS 12.
The open world device 16 further comprises components known per se (not shown in Figure 2) such as a processor, a memory, a screen, entering means, etc. 10
Each of the application components 22-1 to 22-N has e.g. an application which is stored in the memory of the open world device 16 and can be used for implementing at least certain functions which can be used by the pilot in relation to the FMS 12.
Thus, each of the application components 22-1 to 22-N makes it possible 15 to generate requests to be sent to the FMS 12 and to receive flight management data from this FMS 12.
To connect each of the application components 22-1 to 22-N to the FMS, the application component 24 comprises a communication module 31, an authentication module 32 and a clone 33 of the FMS 12. 20
The application component 24 is in particular in the form of one or a plurality of software programs, or at least partially in the form of a programmable logic circuit, e.g. an FPGA (Field-Programmable Gate Array).
The communication module 31 makes it possible to intercept each request coming from each application component 22-1 to 22-N in order to send same to 25 the clone 33.
The communication module 31 also makes it possible to encrypt the requests having the conforming status and to send same to the FMS module 12.
Finally, the communication module 31 makes it possible to reject or to send back to the corresponding application component, each request having the non-30 conforming status, as will be explained hereinafter.
The authentication module 32 authenticates each of the application components from 22-1 to 22-N so that the application component can communicate with the interface component 24. 7
To this end, the authentication module 32 comprises e.g. a database for identifying all the application components authorized to communicate with the FMS 12.
According to another example of embodiment, the authentication module 32 is able to implement a specific analysis of each application components in order 5 to either deliver or not deliver to the application component, the authorization to communicate with the FMS 12.
The clone 33 makes it possible to autonomously reproduce the operation of the FMS 12. To this end, the clone 33 is e.g. in the form of a software-clone of the FMS 12. 10
In other words, the clone 33 is able to model the operation of the FMS 12.
Furthermore, the clone 33 is able to receive each request intercepted by the communication module 31 in order to determine the conformity thereof.
In particular, the clone 33 makes it possible to determine a status of each intercepted request between a conforming status and a non-conforming status. 15
The conforming status is associated with the intercepted request when the execution thereof would lead to the normal operation of the FMS 12 according to the modeling performed by the clone 33.
The non-conforming status is associated with each intercepted request when the execution thereof would lead, according to the modeling performed by 20 the clone 33, to the abnormal operation of the FMS 12 or to at least one abnormal resultant datum.
In particular, the non-conforming status is associated with an intercepted request when at least one of the conditions selected from the group comprising:
- the number of requests sent in a predetermined time interval is not 25 compatible with the processing capacity of the clone 33;
- the format of the request does not correspond to an expected format;
- the execution of the request leads to unexpected data, in particular according to the current context of the flight of the aircraft;
- the flight plan intended to be sent to the FMS 12 cannot to be executed 30 by the aircraft without endangering the passengers thereof.
is met. 8
In particular, it is clear e.g. that when a request leads to a destabilization of the normal FMS operation according to the modeling performed by the clone 33, the non-conforming status is associated with the request.
According to yet another example, when a request leads to performance data outside the capabilities of the aircraft, the request is also associated with the 5 non-conforming status.
When a request is associated with the non-conforming status, the communication module 31 is able to send back the request to the application component which generated same, with an error message.
The error message can e.g. comprise a complete report on the request. 10
The open world communication device 16 is able to implement a communication method according to the invention which will henceforth be explained with reference to Figure 3 which shows a flowchart of the steps thereof and with reference to Figure 4 which illustrates the implementation of such steps.
The initial step 110 corresponds to a step of authenticating the application 15 components 22-1 to 22-N authorized to communicate with the FMS 12.
The step 110 may e.g. be implemented before the aircraft is flown, during the installation of the corresponding application component or during the opening thereof onto the open world communication device 16.
In particular, during this step, the corresponding application component 20 sends an authentication request to the authentication module 32.
Depending on the nature of the application component, the authentication module 32 either authorizes or does not authorize the component to communicate with the FMS 12.
Thereafter, it is considered that each of the application components 22-1 to 25 22-N is authorized to communicate with the FMS 12.
The following step 120 is implemented when an application component, e.g. the application component 22-1, sends a request to the FMS 12.
This can be performed, e.g., following a corresponding request from the pilot, e.g. during the preparation or modification of a flight plan. 30
Thus, during the step 120, the application component 22-1 sends the corresponding request to the communication module 31, as shown in Figure 4.
During the next step 130, the communication module 31 intercepts the request sent by the application component 22-1 for sending same to the clone 33.
9
In the next step 140, the clone 33 determines the conformity of the received request.
To this end, the clone 33 models the execution of the request as the FMS 12 would have done.
The clone 33 next analyzes the result of this execution. 5
When the execution has led to the normal operation of the FMS, the clone 33 concludes that same is a conforming request and sends, during step 145, the request to the communication module 31 with the conforming status. In such a case, the communication module 31 encrypts the message to be sent to the FMS module 12 and sends same, during step 150, via the interface 14. In other words, 10 the requests are sent, in encrypted form, by the communication module 31 to the FMS module 12.
When the clone 33 considers that the corresponding request has led to abnormal operation of the FMS, e.g. when one of the aforementioned conditions is met, the clone 33 sends, during the step 155, the request with a non-conforming 15 status to the communication module 31. During the next step 160, the communication module 31 then sends an error message to the application component 22-1 which sent the request. The message can be sent e.g. with the corresponding request and/or with a complete report relating to the error.
If appropriate, when the non-conforming status has been associated with a 20 request, the communication module blocks the application component 22-1 which sent the request.
When a request having the conforming status is executed by the FMS 12, the system broadcasts flight management data in the form of a data stream which is e.g. received by all authorized application components. This is done e.g. directly, 25 without control by the interfacing component 24.
The present invention then has a certain number of advantages.
First of all, the invention makes it possible to connect, in a secure manner, an open world device such as e.g. a tablet, to the FMS.
This was made possible by integrating a clone of the FMS directly into the 30 open world device.
Thus, when a request sent by one of the application components of the device poses a risk, the request is intercepted and is not sent to the FMS. 10
Finally, the invention does not modify the avionics world and in particular, does not modify any component of the FMS by integrating the set of new components into the open world device.
In this way, a particularly simple and easy deployment of the invention using existing hardware components, can be performed. 5
Of course, other embodiments are further possible.
In particular, it is clear that the invention remains applicable to any avionics system other than the FMS. In such case, the clone integrated into the open world device according to the invention is able to reproduce the operation of such an avionics system. It is therefore clear that all the preceding teachings remain 10 applicable in relation to any avionics system.
15
11

I/We Claim:
1. An open world device for communicating (16) with an avionics system (12) of an aircraft, comprising an application component (22-1, …, 22-N) able to send requests to the avionics system (12) and to receive data from the 5 avionics system (12);
the device (16) being characterized in that same further comprises an interfacing component (24) comprising a communication module (31) able to intercept each request sent by the application component (22-1,..., 22-N) and a clone (33) of the avionics system (12) able to test each request 10 intercepted by the communication module (31) in order to determine the status of the request between a conforming status and a non-conforming status;
the communication module (31) being able to send to the avionics system (12), only the requests having the conforming status. 15
2. The device (16) according to claim 1, wherein the communication module (31) is further able to send to the application component (22-1,..., 22-N), an error message for each request having the non-conforming status.
20
3. The device (16) according to claim 1 or 2, wherein the interfacing component (24) further comprises an authentication module (32) able to authenticate the application component (22-1,..., 22-N) so as to authorize same to send requests to the avionics system (12).
25
4. The device (16) according to any of the preceding claim, wherein the data emitted by the avionics system (12) is in the form of a data stream which is broadcast by the system (12) and wherein the interfacing component (24) is able to directly send said data stream to the application component (22-1,..., 22-N).
30
5. The device (16) according to any of the preceding claims, wherein the communication module (31) is able to send the corresponding requests to the avionics system (12) in encrypted form.
12
6. The device (16) according to any of the preceding claims, wherein the interfacing component (24) is the only component of the device (16) connected to the avionics system (12).
7. The device (16) according to any of the preceding claims, 5 wherein the interfacing component (24) is in the form of an application.
8. The device (16) according to any of the preceding claims, wherein the clone (33) is in the form of a software-clone of the avionics system (12). 10
9. The device (16) according to any of the preceding claims, wherein the clone (33) determines the status of a request as non-conforming when at least one of the conditions selected from the group comprising:
- the number of requests sent in a predetermined time interval not being 15 compatible with the processing capacity of the clone (33);
- the format of the request not corresponding to an expected format;
- the execution of the request leading to unexpected data;
- the request not being allowed to be executed by the aircraft avionics system (12) without endangering the passengers thereof; 20
is met.
10. The device (16) according to any of the preceding claims, wherein the communication module (31) is able to block the application component (22-1,..., 22-N) when at least one request sent by the component has a non-25 conforming status.
11. The device (16) according to any of the preceding claims, comprising a plurality of application components (22-1, …, 22-N), each application component (22-1, …, 22-N) being able to send requests to the avionics system 30 (12) via the interfacing component (24) and to receive data from this avionics system (12).
13
12. The device (16) according to any of the preceding claims, wherein the avionics system (12) is a flight management system (12).
13. A communication system (10) for aircraft, comprising:
- an avionics system (12); 5
- an open world device for communicating (16) with the avionics system (12), the device (16) being according to any one of the preceding claims.
14. The communication system (10) of claim 13, further comprising an interface (14) connecting the open world device (16) to the avionics system 10 (12).
15. A method for communicating with an avionics system (12) of an aircraft, implemented by an open world communication device (16) according to any of claims 1 to 12; 15
the method comprising the following steps:
- generating (120) a request intended for the avionics system (12);
- intercepting (130) said request;
- testing (140) said request intercepted by the communication module (31) so as to determine a status of the request between a conforming status and 20 a non-conforming status;
- when said request has the conforming status, sending (150) the request to the avionics system (12).