Electronic decision-making support device embedded in a power plant, monitoring system for a fleet of power plants and associated decision-making support method

Abstract

Electronic decision support device embedded in an electrical power generation plant, system for monitoring a fleet of power generation plants and associated decision support method The invention relates to an electronic decision support device (14) embedded in an electrical power generation plant (10) comprising a plurality of systems (12) capable of operating according to at least one operating parameter and of issuing an alert when this operating parameter is outside an associated predetermined safety domain.The device comprises an acquisition module (16) configured to acquire at least two alerts from at least two systems; a processing module (18) configured to determine a threat based on the alerts; a generation module (20) configured to generate an instruction based on each threat; and an explanation module (22) configured to display a message comprising information intended for an operator of the power plant. Figure for the abstract: Figure 1.

Description

Title of the invention: Electronic decision-making support device embedded in an energy production plant, monitoring system for a fleet of energy production plants and associated decision-making support method

[0001] The present invention relates to an electronic decision-making support device installed in an electrical energy production plant.

[0002] The electrical energy production plant is in particular an electrical power plant such as a photovoltaic power plant; a thermal power plant, such as a biomass power plant, a thermal power plant operating on gas, fuel oil or diesel; or even a nuclear power plant.

[0003] The electric power generation plant comprises a plurality of systems. For example, a diesel-powered thermal power plant comprises mechanical systems, such as diesel engines, electric generators, pumps, etc.; and electronic systems, such as regulation, control, safety, communication systems, etc.

[0004] For each system taken individually, the experts of this system have significant knowledge in terms of operation, maintenance, prevention, correction and optimization of this system. However, the combination and combined exploitation of this knowledge for each system at the plant level poses a problem. Indeed, all this knowledge is compartmentalized in each of the domains associated with each system and its pooling is complicated. It is also compartmentalized in space, from one electrical power plant to another: a system identical to a system A in another electrical power plant will perhaps not benefit from the knowledge of system A.

[0005] Furthermore, there are regulatory procedures that impose reactions to events that may occur. These procedures are generally fixed and can only be modified after extensive verification and certification work. Indeed, a failure at an electrical power plant can have dramatic consequences on the balance of the electricity network.

[0006] For example, if a drop in temperature is detected in the combustion chamber of a cylinder of a diesel engine, only the diesel technician at the power station is able to diagnose, with professional data such as the intake temperature, the engine speed, the cooling water temperature, etc., whether the engine cylinder is working properly or to determine, among the standard procedures the actions that need to be taken to correct this drop in temperature in the cylinder combustion chamber. In parallel, the diesel engine control system will try in real time to overcome this defect, for example by limiting the load coefficient of the diesel engine.

[0007] However, this diesel technician is not competent to detect whether this drop in temperature would in fact be due to a more global problem such as a failure or a computer attack against the thermal power plant that only a computer scientist is competent to detect. Conversely, this computer scientist is not competent to judge the proper functioning of the diesel engine. In addition, this type of problem is potentially not provided for in the regulatory procedures.

[0008] Thus, recourse to the diesel technician and the IT specialist who can be assumed to be part of the thermal power plant operating team is not sufficient. The anomaly encountered is, for example, new or very different from the anomalies usually encountered on this type of system and provided for by the regulatory procedures. In this type of case, it may be advantageous to benefit from the opinion of a diesel expert who would be responsible for a group of thermal power plants. It is easy to understand that this opinion cannot be given immediately, but perhaps only after several hours, or even several days. Thus, even if the expert's opinion allows for feedback from a group of thermal power plants to be benefited from, it is not immediate.This imposes a notion of duration, between a short time which corresponds to the reaction of the diesel engine regulation system (of the order of a second or less), an average time which corresponds to the analysis of the diesel technician (of the order of ten minutes), and a long time which corresponds to the opinion of the diesel expert (of the order of several hours) and the updating of regulatory procedures.

[0009] Thus, in the presence of a malfunction alert, it is complicated to define a global instruction at the level of an electrical energy production plant in reaction to this alert taking into account all the particularities of each system as well as the context of use of the electrical energy production plant, and to integrate it into the regulatory procedures.

[0010] There is therefore a need for a decision support device embedded in the electrical power generation plant allowing the determination of a response instruction more quickly and more effectively with regard to the safety of the electrical power generation plant while allowing detailed monitoring of the instructions established for each operator of the electrical power generation plant and the updating of regulatory procedures.

[0011] To this end, the invention relates to an electronic decision-making aid device embedded in an electrical energy production plant comprising a plurality of systems, each system being capable of operating according to at least one operating parameter and of issuing an alert when this operating parameter is outside an associated predetermined security domain, the security of the electrical power generation plant being likely to be affected by a predetermined list of threats, each threat being associated with a predetermined group of alerts according to a predetermined rule included in at least one operating procedure of the plant, the electronic decision-making support device comprising: a first acquisition module configured to acquire at least two alerts from at least two different systems; a first processing module configured to determine a threat from the predetermined list of threats based on the acquired alerts;a first generation module configured to generate an instruction to be implemented by at least one of the systems according to each determined threat; and a first explanation module configured to display on a display screen, embedded in the power generation plant, at least one text message comprising information intended for the operator of the electrical power generation plant concerning the alerts, the threat and / or the instruction.;

[0012] According to other advantageous aspects of the invention, the electronic decision-making aid device comprises one or more of the following characteristics, taken in isolation or in all technically possible combinations:

[0013] - each threat is chosen from the list consisting of: a hardware failure, a software failure, intrusion, and computer attack;

[0014] - the first generation module is configured to generate the instruction according to in addition to a current context defined by the detected threat and by at least one of: the level of probability of the threat, the impact of the threat on the security of the electric power generation plant, and the imminence of the threat on the security of the electric power generation plant;

[0015] the instruction being selected from a provided set of approved instructions and forming part of the at least one operating procedure of the electric power generation plant;

[0016] - the device further comprises at least one module from among: a first module display module configured to display the instruction to an operator of the electrical power generation plant, and a first transmission module configured to transmit the instruction to at least one of the systems for implementing the instruction;

[0017] - the device further comprises a first alarm module configured to generate an alarm signal based on each threat determined by the first processing module, the alarm signal comprising an alarm relating to said threat;

[0018] - the first generation module is configured to implement a method machine learning trained on a reference database for generating the instruction; and

[0019] - the first processing module is configured to calculate a probability level of the threat at least based on the comparison between the acquired alerts and each predetermined group of alerts.

[0020] The invention also relates to a system for monitoring a fleet of electrical power generation plants, each electrical power generation plant comprising an electronic decision-making aid device as defined above, the safety of the fleet of electrical power generation plants being likely to be affected by a predetermined list of hazards, each hazard affecting at least two different electrical power generation plants, the monitoring system comprising:

[0021] - a second acquisition module configured to acquire at least two threats from at least two different electrical power plants,

[0022] - a second processing module configured to determine a hazard among the predetermined list of hazards based on acquired threats; and

[0023] - a second generation module configured to generate an instruction in function of each determined danger;

[0024] the second processing module and the second generation module preferably being implemented asynchronously with respect to the electronic decision support devices.

[0025] The invention also relates to a decision-making aid method implemented by a decision-making aid device embedded in an energy production plant comprising a plurality of systems, each system being capable of operating according to at least one operating parameter and of issuing an alert when one of the operating parameters is outside an associated predetermined security domain, the security of the energy production plant being likely to be affected by a predetermined list of threats, each threat being associated with a predetermined group of alerts, the decision-making aid method comprising at least the following steps:

[0026] - acquisition of at least two alerts from at least two different systems,

[0027] - determining a threat from the predetermined list of threats based on acquired alerts;

[0028] - generation of an instruction based on each determined threat; and

[0029] - display, on a display screen embedded in the production plant energy, at least one text message including information intended for an operator of the energy production plant concerning alerts, the threat and / or the instruction.

[0030] The invention also relates to a computer program product comprising software instructions which, when executed by a computer, implement a method as defined above.

[0031] These characteristics and advantages of the invention will appear more clearly on reading the description which follows, given solely by way of non-limiting example, and made with reference to the appended drawings, in which:

[0032] [Fig-1] [Fig.l] is a schematic representation of a park of power plants energy production monitored by a monitoring system according to the invention,

[0033] [Fig.2] [Fig.2] is a schematic representation of an electronic decision support device embedded in one of the power generation plants of [Fig.l], and

[0034] [Fig.3] [Fig.3] is a schematic representation of the monitoring system of [Fig.l], and

[0035] [Fig.4] [Fig.4] is a flowchart of a method, according to the invention, for decision support according to the invention, the method being implemented by the electronic decision support device and the monitoring system.

[0036] A park of power generation plants 10 is shown in [Fig.l].

[0037] Each power generation plant 10 is a photovoltaic plant; a thermal plant, such as a biomass plant; a thermal plant operating on gas, fuel oil or diesel; or even a nuclear plant.

[0038] As visible in [Fig.l], each energy production plant 10 is in particular a thermal power plant.

[0039] Those skilled in the art will understand that the fleet of power generation plants 10 possibly extends over a large geographical area, such as a country, and that the power generation plants 10 are not necessarily in close proximity to one another.

[0040] The power plant park 10 is monitored by a monitoring system 11 which will be described later.

[0041] Each power generation plant 10 comprises a plurality of systems 12, an electronic decision support device 14 and advantageously a display screen 15.

[0042] Each system 12 is in particular a mechanical system such as, for example, a diesel engine, an electric generator, a pump; or an electronic system such as, for example, a regulation, control, safety or communication system.

[0043] Each system 12 is capable of operating according to at least one operating parameter.

[0044] Each operating parameter is a characteristic data of the func operation of said system 12, in particular one of the input data and / or one of the output data of the system 12.

[0045] For example, when the system 12 is a pump, the operating parameters are the pressure, the power, the flow rate, etc. When the system 12 is a control system, the operating parameters are for example the frequency of sending the commands, the value of the commands, etc.

[0046] Each operating parameter is associated with a predetermined security domain. This security domain is defined upstream of the operation of the power generation plant 10, in particular by experts of the system 12. During normal operation of the plant 10, that is to say without malfunction or external attack, the security domain is dimensioned such that the values ​​of the operating parameter remain within this security domain. A value outside this security domain is an indication of a malfunction or an attack against this system 12.

[0047] Each system 12 is configured to issue an alert when at least one of the associated operating parameters is outside the predetermined security domain associated with said operating parameter.

[0048] The electronic decision-making aid device 14 is configured to generate an instruction based on the current context and to inform at least one operator of the power plant 10. The current context is defined in particular by the operating parameters of the different systems 12 of the energy production plant 10.

[0049] The current context makes it possible to determine the environment and the constraints encountered by the energy production plant 10 at the present moment. When the energy production plant 10 is a thermal power plant, the context makes it possible to determine, for example, a context from among: a thermal power plant in production, a thermal power plant being commissioned, a thermal power plant undergoing maintenance, etc.

[0050] For this purpose and as can be seen in [Fig.2], the electronic decision support device 14 comprises a first acquisition module 16, a first processing module 18, a first generation module 20 and a first explanation module 22.

[0051] The electronic decision-making aid device 14 further advantageously comprises a first display module 24, a first transmission module 26 and a first alarm module 28.

[0052] The first acquisition module 16 is configured to acquire at least two alerts from at least two different systems 12.

[0053] Thus, the first acquisition module 16, also called “case manager” (or “case manager” in French), is capable of receiving all of the alerts fed back by the various systems 12 of the energy production plant 10.

[0054] Advantageously, for each alert sent by one of the systems 12, the first acquisition module 16 is configured to determine a reaction instruction intended for the system 12 in order to respond to the alert.

[0055] This reaction instruction is determined in particular by the experts of the system 12 upstream of the operation of the energy production plant 10. For example, if an excessively high pump flow rate is detected, the reaction instruction will be an instruction to reduce this flow rate.

[0056] However, as explained above, this reaction instruction, which is a localized reaction and only takes into account alerts due to a single system 12, does not allow for a reaction to more global problems such as a computer attack or a more global hardware malfunction. However, it does allow for an instant response to the problem encountered.

[0057] For this purpose, the first processing module 18 is configured to determine a threat from the predetermined list of threats based on the alerts acquired by the first acquisition module 16.

[0058] A threat is an event likely to affect the security of the power generation plant 10. In particular, each threat is chosen from the list consisting of a hardware failure, a software failure and a computer attack.

[0059] In particular, the security of the power generation plant 10 is likely to be affected by a predetermined list of threats. These threats are thus studied upstream of the operation of the power generation plant 10 by a group of experts of the different systems 12 of the power generation plant 10.

[0060] Thus, each threat is associated with a predetermined group of alerts according to a predetermined rule included in at least one operating procedure of the power plant, and for example in several operating procedures of the power plant. The set of predetermined rules making it possible to associate all the alerts with all the potential threats is preferably included in all the operating procedures of the power production plant 10.

[0061] At least one operating procedure of the plant is for example a regulatory procedure. Preferably, each operating procedure of the plant is a regulatory procedure.

[0062] The predetermined rule makes it possible to associate a set of alerts with an associated threat. Each predetermined rule is advantageously included in at least one operating procedure of the power generation plant 10, i.e. in one or more operating procedures of said plant 10.

[0063] For example, a threat of a computer attack against cooling systems The operation of the power generation plant 10 is associated with an engine temperature increase alert, a thermal efficiency drop alert, and a control system alert.

[0064] Also by way of example, a threat of the insertion of malicious code on a system is associated with an alert of insertion of a USB key, detection of an unknown computer process or an integrity fault.

[0065] Also by way of example, a malfunction of the insulation defect type of an electric actuator (pump for example) is associated with an alert of abnormal electricity consumption and a variation of the PID profile (proportional / integral / derivative).

[0066] Thus, the first processing module 18 is capable of receiving the various alerts acquired by the first acquisition module 16 and of deducing therefrom a threat against the security of the energy production plant 10 according to the predetermined rule.

[0067] In an advantageous embodiment, the first processing module 18 is configured to calculate a level of probability of the threat at least as a function of the comparison between the acquired alerts and each predetermined group of alerts.

[0068] In particular, if a threat is associated with N alerts, N being an integer greater than or equal to 3, the acquisition of a number less than N alerts allows the first processing module 18 to deduce a threat risk with a certain level of probability. Thus, the detection of N1 alerts associated with a threat allows the deduction of this threat with a significant level of probability. Conversely, if only half of the alerts associated with a threat have been detected, the associated level of probability will be low. Those skilled in the art will understand that the threshold for detecting the level of probability is a dynamic parameter, varying according to the context of use of the system 12.

[0069] The first processing module 18 is capable of sending the detected threat(s), as well as advantageously the probability level associated with each threat, to the first generation module 20 and to the first alarm module 28.

[0070] The first generation module 20 is configured to generate a setpoint to be implemented by at least one of the systems 12 according to each determined threat.

[0071] The setpoint is an operation to be carried out by the associated system 12. The setpoint is in particular a corrective operation for eliminating the threat, a preventive operation for limiting the impacts of the possible threat, an operation for confirming the presence of the threat, or a combination of these operations.

[0072] The setpoint is optionally applied to a system 12 which has not raised an alert but which has been diagnosed as the source of the malfunctions which have generated the alerts in the other neighbouring systems 12.

[0073] The first generation module 20 is advantageously configured to generate the instruction as a function, in addition, of the context defined by at least one of: the level of probability of the threat, the impact of the threat on the security of the power plant 10 and the imminence of the threat on the security of the energy production plant 10.

[0074] Thus, the first generation module 20 is configured to find a compromise between the efficiency of the reaction, the risk of applying the reaction and in particular the side effects that the instruction could generate and the duration necessary to carry out the instruction.

[0075] In other words, the first generation module 20 is configured to determine the reaction defined by the instruction by taking into account as criteria: the effectiveness of the reaction, the risk of applying the reaction depending on the possible side effects, the time required to carry out the reaction and the nature of the reaction which can be a curative treatment, a preventive treatment or even a confirmatory diagnosis.

[0076] For example, when an operator of a power plant has to carry out a delicate operation, such as coupling to an electrical distribution network, if a threat is detected, the instruction to be applied depends on the immediate context. If the threat is not proven with certainty, for example if it is in particular a simple anticipation, the threat can possibly be ignored or the instruction can be only a preventive instruction, and thus leave the operator to carry out the procedure which requires a lot of attention on his part. Conversely, if the detected threat is almost certain and serious, it is urgent to apply a curative instruction immediately and interrupt the procedure in progress.

[0077] At least one instruction is for example selected from a planned set of approved instructions and forming part of the at least one operating procedure of the electrical energy production plant.

[0078] Advantageously, each instruction is selected from said provided set of approved instructions forming part of at least one operating procedure of the electrical power generation plant.

[0079] The generation of the instructions by the first generation module 20 is for example carried out from a predetermined correspondence table between the different threats and the associated instructions. This table is notably produced by experts of the different systems 12 of the energy production plant 10.

[0080] Alternatively, the first generation module 20 is configured to implement a machine learning method trained on a reference database for generating the instruction. The reference database includes in particular a history of threats recorded on other similar energy production plants 10, instructions then determined and associated results. The database is advantageously regularly updated, taking into account feedback from the various energy production plants 10 in the park.

[0081] The first generation module 20 is configured to send the instruction(s) to the first explanation module 22 and advantageously to the display module 24 and / or to the transmission module 26.

[0082] The first display module 24 is configured to display the instruction for an operator of the energy production plant 10. The instruction is for example displayed on the display screen 15 arranged in a control station of the energy production plant 10. The operator is then informed of the instruction recommended by the decision support device 14 and can apply it if he deems it necessary in view of the context.

[0083] The first transmission module 26 is configured to transmit the instruction to at least one of the systems 12 for the implementation of the instruction. In this case, the instruction is implemented automatically without the user validating it or not.

[0084] Advantageously, the first generation module 20 is configured to send the instruction to the first display module 24 or to the first transmission module 26 depending on the current context and in particular the level of probability of the threat, the impact of the threat on the security of the energy production plant 10 and the imminence of the threat on the security of the energy production plant 10.

[0085] The first display module 24 is advantageously capable of displaying on the display screen 15 a button allowing the operator to validate the instruction and send it to the first transmission module 26.

[0086] The first explanation module 22 is configured to display on the display screen 15 at least one text message comprising information intended for an operator of the plant 10 concerning the alerts, the threat and / or the instruction.

[0087] In particular, the first explanation module 22 is configured to display the logical link between the alerts which led to the detection of the threat, then of the instruction.

[0088] The first explanation module 22 is further configured to display the probability level of the threat.

[0089] As an example, the first explanation module 22 displays information relating to two alerts, namely the detection of an unknown process on a PLC of the power generation plant 10 and an increase in network traffic. The first explanation module 22 also displays the detection of the associated threat, namely malicious code present in the PLC performing a port scan. Finally, the first explanation module 22 displays the instruction to restore the PLC. The first explanation module 22 also optionally displays the probability of this threat and information relating to the effectiveness and speed of the determined instruction. The operator thus has a complete and precise vision of the threats on the power plant. 10 energy production and operations to be carried out.

[0090] In an advantageous embodiment, the first explanation module 22 is configured to receive requests from the operator sent in particular via the display screen 15 and to display additional information in response to these requests. These requests are in particular requests for additional information on the alerts, the threat and / or the instruction and thus allow the user to be in possession of all the necessary information.

[0091] The first alarm module 28 is configured to generate an alarm signal based on each threat determined by the first processing module 18.

[0092] The alarm signal includes an alarm relating to said threat.

[0093] The first alarm module 28 is in particular configured to send the signal alarm to the first display module 24 so that the alarm is displayed on the display screen 15.

[0094] The operator is thus directly warned of the detection of a threat, possibly before the first generation module 20 has had time to generate an associated instruction.

[0095] Thus, the decision-making aid device 14 according to the invention allows the determination of a faster and more effective response instruction with regard to the safety of the energy production plant 10, allowing all of the systems 12 and their interactions to be taken into account.

[0096] The invention therefore allows detection of computer attacks against energy production plants or can be applied to the predictive maintenance of the energy production plant 10 by detecting possible global hardware or software failures affecting different systems 12.

[0097] The decision support device 14 also allows detailed monitoring of the instructions established for each operator of the energy production plant 10 by means of the explanations displayed on the display screen 15.

[0098] Thus, the decision support device 14 adopts a method called “explanatory automatic”. The first generation module 20 is capable of determining a single instruction proposal based on the threats detected and the first explanation module 22 is capable of explaining the reasoning which leads to the automatic generation of this instruction.

[0099] In order to better understand the invention, an analogy can be made with the medical field. Indeed, the different alerts of the systems 12 are analogous to symptoms felt by a person at the level of their different organs.

[0100] Generally a person has the ability to treat the symptoms they experience, such as headache, body aches, watery eyes, toothache, etc. The treatment of a symptom such as headache is done via aspirin. This self-medication This indication does not generally provide a cure, but it prevents a rapid deterioration in health which may be due to a much more serious problem, but which the person cannot deduce due to a lack of knowledge, tools or expertise.

[0101] Treating the symptom will allow you to wait until you see a doctor who has the knowledge and techniques necessary for diagnosis. Correlating all the symptoms will allow you to deduce a syndrome. For example, in the case of a coronavirus-type syndrome, the associated symptoms are headache, high fever, respiratory problems, etc. Obviously, it is not necessary to have all the symptoms to suspect a syndrome. Knowing the syndrome then allows you to determine a treatment prescription. Indeed, in medicine, for each syndrome described, we generally associate a protocol allowing a cure. Thus, the doctor has the opportunity to justify his treatment by explaining the different symptoms he has detected.

[0102] However, the safety of the power generation plant fleet 10 is also likely to be threatened by a hazard affecting at least two different power generation plants 10.

[0103] A danger is for example a computer attack against the entire fleet of energy production plants 10 or a generic fault potentially affecting all of the energy production plants 10, such as a hardware or software design fault.

[0104] For this purpose, with reference to [Fig. 3], the monitoring system 11 of the power plant park 10 comprises a second acquisition module 30, a second processing module 32 and a second generation module 34.

[0105] The monitoring system 11 further advantageously comprises a second explanation module 36, a second display module 38, a second transmission module 40 and a second alarm module 42.

[0106] The monitoring system 11 is for example integrated into a monitoring center 50 arranged far from the park of energy production plants 10. When the energy production plants 10 are thermal power plants, the monitoring center 50 is for example a regional supervision center.

[0107] The monitoring center 50 comprises in particular a display screen 52 intended for an operator monitoring the fleet of energy production plants.

[0108] The operation of each second module 30, 32, 34, 36, 38, 40, 42 is similar to the operation of each associated first module 16, 18, 20, 22, 24, 26, 28, only the input data and the output data varying.

[0109] The second acquisition module 30 is configured to acquire at least two threats from at least two different power generation plants 10.

[0110] The second processing module 32 is configured to determine a danger from a predetermined list of dangers based on the acquired threats.

[0111] For example, if several power generation plants 10 report the same threat affecting the same electronic systems 12 at the same time, the second processing module 30 determines that a computer attack against the fleet of power generation plants 10 is in progress.

[0112] The second generation module 34 is then configured to generate an instruction based on each determined danger.

[0113] The instruction is an operation to be carried out by at least one energy production plant 10 of the park.

[0114] The second generation module 34 is advantageously configured to generate the instruction as a function, in addition, of the context defined by at least one of: the level of probability of the danger, the impact of the danger on the safety of the fleet and the imminence of the danger on the safety of the energy production plant fleet. Thus, the second generation module 34 is configured to find a compromise between the effectiveness of the reaction, the risk of applying the reaction and in particular the side effects that the instruction could generate and the duration necessary to carry out the instruction.

[0115] The second generation module 34 is configured to send the instruction(s) to the second explanation module 36, and advantageously to the second display module 38 and / or to the second transmission module 40.

[0116] The second display module 38 is configured to display the instruction to an operator of the monitoring center 50. The instruction is for example displayed on the display screen 52 arranged in the monitoring center 50.

[0117] The second transmission module 40 is configured to transmit the instruction to at least one of the power generation plants 10 for the implementation of the instruction. In this case, the instruction is implemented automatically, without the operator validating it or not.

[0118] Advantageously, the second generation module 34 is configured to send the instruction to the second display module 38 or to the second transmission module 40 depending on the current context and in particular the level of probability of the danger, the impact of the danger on the safety of the energy production plant fleet and the imminence of the danger on the safety of the fleet.

[0119] Advantageously again, the second processing module 32 and the second generation module 34 are each implemented asynchronously with respect to the respective electronic decision support device 14 included in each energy production plant 10. In other words, the second processing module 32 is preferentially implemented asynchronously with respect to the electronic decision support devices 14 included in the energy production plants. 10. Similarly, the second generation module 34 is preferably implemented asynchronously with respect to the electronic decision support devices 14 included in the energy production plants 10.

[0120] According to this advantageous aspect, a symptom appearing at an electronic system 12 of a respective power plant 10 will be processed in a short time, i.e. in the short term, or with a reaction implemented in a short duration. A symptom appearing at the power plant 10 will be processed in an average time, longer than the short time, i.e. in the medium term, or with a reaction implemented in an average duration, greater than the short duration. Finally, a symptom appearing at the power plant park 10 will be processed by the monitoring system 11, and in particular by the second processing module 32 and the second generation module 34, in a long time, longer than the average time, i.e. in the long term, or with a reaction implemented in a long duration, greater than the average duration.

[0121] Those skilled in the art will therefore understand that the second processing module 32 and the second generation module 34 are implemented according to the long time, whereas the electronic decision support device 14 included in a respective energy production plant 10 is implemented according to the short time or the average time, which explains the asynchronism of implementation between the electronic decision support devices 14 included in the energy production plants 10 on the one hand, and the second processing module 32 and generation module 34 on the other hand.

[0122] The second explanation module 36 is configured to display on the display screen 52 arranged in the monitoring center 50 at least one text message comprising information intended for an operator concerning the threats, the danger and / or the instruction.

[0123] In particular, the second explanation module 36 is configured to display the logical link between the threats which led to the detection of the danger, then of the instruction.

[0124] In an advantageous embodiment, the second explanation module 36 is configured to receive requests from the operator, sent in particular via the display screen 52, and to display additional information in response to these requests. These requests are in particular requests for additional information on the threats, the danger and / or the instruction and thus allow the operator to be in possession of all the necessary information.

[0125] The second alarm module 42 is configured to generate an alarm signal based on each danger determined by the second processing module 32.

[0126] The alarm signal includes an alarm relating to said danger.

[0127] The second alarm module 42 is in particular configured to send the alarm signal to the second display module 38 so that the alarm is displayed on the display screen 52.

[0128] In the example of [Fig.2], the electronic decision-making aid device 14 comprises an information processing unit 60 formed for example by a memory 62 and a processor 64 associated with the memory 62. The different modules are each produced in the form of software, or a software brick, executable by the processor 64 and stored in the memory 62. The processor 64 is then able to execute each of these software programs.

[0129] In the example of [Fig.3], the monitoring system 11 comprises an information processing unit 70 formed for example by a memory 72 and a processor 74 associated with the memory 72. The different modules are each produced in the form of software, or a software brick, executable by the processor 64 and stored in the memory 72. The processor 74 is then able to execute each of these software programs.

[0130] In a variant not shown, the different modules are each produced in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array) or in the form of a dedicated integrated circuit, such as an ASIC (Application Specific Integrated Circuit).

[0131] When the electronic decision-making aid device 14 and / or the monitoring system 11 is produced in the form of one or more software programs, i.e. in the form of a computer program, it is also capable of being recorded on a medium, not shown, that is readable by a computer. The computer-readable medium is, for example, a medium capable of storing electronic instructions and of being coupled to a bus of a computer system. By way of example, the readable medium is an optical disk, a magneto-optical disk, a ROM memory, a RAM memory, any type of non-volatile memory (for example EPROM, EEPROM, FLASH, NVRAM), a magnetic card or an optical card. A computer program comprising software instructions is then stored on the readable medium.

[0132] The operation of the electronic decision-making aid device 14 and of the monitoring system 11 according to the invention will now be explained with the aid of [Fig. 3] representing a flowchart of the decision-making aid method according to the invention.

[0133] Subsequently, an example of implementation of the method will be described for a thermal power station, and those skilled in the art will understand that this method applies more generally to any energy production station 10.

[0134] Initially, as seen in [Fig.l], a fleet of thermal power plants is in production, each thermal power plant operating without malfunction.

[0135] Then, in at least one thermal power plant, several systems 12 emit alerts on their operation. In particular, at least one operating parameter operation of each system 12 is outside an associated predetermined security domain.

[0136] For example, a pump has too low a pressure and a computer machine has too much traffic.

[0137] During a step 100, the first acquisition module 16 then acquires at least two alerts from at least two different systems 12.

[0138] Then, during a step 110, the first processing module 16 determines a threat from the predetermined list of threats based on the alerts acquired.

[0139] For example, the detected threat is a computer attack against the pump control system.

[0140] Advantageously, the first processing module 16 sends the detected threat to the surveillance system 11.

[0141] During a step 120, the first generation module 18 generates an instruction based on the determined threat.

[0142] For example, the instruction is to stop the pumps, restore the computer machine and search for viruses in the rest of the computer system of the thermiqelO power plant.

[0143] Then, the display module 24 displays on the display screen 15 of the thermal power plant at least one text message comprising information intended for an operator of the thermal power plant, such as the shift manager, concerning the alerts, the threat and / or the instruction.

[0144] In particular, the text message indicates the nature of the alerts acquired, the detected threat associated with a probability level of this threat and the instruction determined in response.

[0145] During a step 130, the first display module 24 displays the instruction intended for an operator of the thermal power plant on the display screen 15 arranged in the control station of the thermal power plant.

[0146] Alternatively or in addition, during a step 140, the first transmission module 26 transmits the instruction to at least one of the systems 14 for the implementation of the instruction.

[0147] For example, the first transmission module 26 transmits the stop instruction to the pump and the restore instruction to the computer machine.

[0148] At least one other thermal power plant in the park implements steps 100 to 140.

[0149] For example, this other thermal power station also reports a threat of a computer attack against the pump control system.

[0150] During a step 150, the second acquisition module 30 acquires at least two threats from the at least two different thermal power plants.

[0151] The second processing module 32 determines, during a step 160, a danger from a predetermined list of dangers based on acquired threats.

[0152] For example, the danger here is a cyber attack against the entire park.

[0153] The second generation module 34 then generates an instruction based on each danger determined in step 170.

[0154] The instruction is, for example, a virus search in the pump control system sent to all the thermal power plants in the park.

[0155] Then, in step 180, the second display module 38 displays the instruction for an operator of the monitoring center 50 on the display screen 52.

[0156] As a supplement or a variant, in step 190, the second transmission module 40 transmits the instruction to at least one of the thermal power plants 10 for implementing the instruction.

[0157] Finally, during a step 200, the second explanation module 42 displays on the display screen 52 arranged in the monitoring center 50 at least one text message comprising information intended for an operator concerning the threats, the danger and / or the instruction.

[0158] It is understood that the invention has a certain number of advantages.

[0159] Indeed, the invention makes it possible to determine a setpoint quickly and efficiently. The contextualization of the events detected in the environment of use of the different systems 12 of the thermal power plant 10 makes it possible to understand more precisely the different malfunctions affecting the thermal power plant 10. By better understanding what is happening in the thermal power plant 10 by pooling the alerts reported, it is possible to respond to them more effectively.

[0160] In the presence of a malfunction alert reported by a system 12, it will be processed at different levels. The first level corresponds to a reflex reaction, manual, automatic or preferably provided for in the operating procedures, which has the main objective of preventing the accident from getting worse. For example, when a pump stops working, whatever the reason, the first reaction is to cut off the valve that supplies it, which is provided for by the regulatory procedure. The other levels have the objective of contextualizing this alert in a higher-level environment. Thus, there are as many levels as there are skills required to process the alert. Once the problem is understood in its entirety, action is taken at the level of the thermal power plant10 while the first-level reflex reaction only targets the system 12 that reported the alert. The operating procedures for the entire fleet can then be updated.

[0161] The response to the various malfunctions encountered by the thermal power plant 10 is therefore more effective and the safety of the thermal power plant 10 is thus reinforced.

Claims

Claims

1. Electronic decision-making device (14) integrated in an electrical power generation plant (10) comprising a plurality of systems (12), each system (12) being capable of operating according to at least one operating parameter and of issuing an alert when this operating parameter is outside an associated predetermined security domain, the security of the plant (10) being likely to be affected by a predetermined list of threats, each threat being associated with a predetermined group of alerts according to a predetermined rule included in at least one operating procedure of the plant, the electronic decision-making device (14) comprising: - a first acquisition module (16) configured to acquire at least two alerts from at least two different systems (12),- a first processing module (18) configured to determine a threat from the predetermined list of threats based on the acquired alerts; - a first generation module (20) configured to generate an instruction to be implemented by at least one of the systems (12) based on each determined threat; and - a first explanation module (22) configured to display on a display screen (15) embedded in the electrical power generation plant (10) at least one text message comprising information intended for an operator of the electrical power generation plant (10) concerning the alerts, the threat and / or the instruction.,

2. The device (14) of claim 2, wherein each threat is selected from the list consisting of: a hardware failure, a software failure, and a computer attack.

3. Device (14) according to claim 1 or 2, in which the first generation module (16) is configured to generate the instruction as a function further of a current context defined by the detected threat and by at least one of: - the level of probability of the threat; - the impact of the threat on the security of the power plant; and - the imminence of the threat on the security of the power plant, the instruction being selected from a planned set of instructions approved and forming part of at least one operating procedure of the electric power generation plant.

4. Device (14) according to any one of the preceding claims, further comprising at least one module among: - a first display module (24) configured to display the instruction intended for an operator of the electrical power production plant (10), and - a first transmission module (26) configured to transmit the instruction to at least one of the systems (12) for the implementation of the instruction.

5. Device (14) according to any one of the preceding claims, further comprising a first alarm module (28) configured to generate an alarm signal as a function of each threat determined by the first processing module (18), the alarm signal comprising an alarm relating to said threat.

6. Device (14) according to any one of the preceding claims, in which the first generation module (20) is configured to implement a machine learning method trained on a reference database for the generation of the instruction.

7. Device (14) according to any one of the preceding claims, wherein the first processing module (18) is configured to calculate a level of probability of the threat at least as a function of the comparison between the acquired alerts and each predetermined group of alerts.

8. A monitoring system (11) for a fleet of electrical power plants (10), each electrical power plant (10) comprising an electronic decision support device (14) according to any one of the preceding claims, the safety of the fleet of electrical power plants (10) being likely to be affected by a predetermined list of hazards, each hazard affecting at least two different electrical power plants (10), the monitoring system (11) comprising: - a second acquisition module (30) configured to acquire at least two threats from at least two different electrical power plants, - a second processing module (32) configured to determine a hazard from the predetermined list of hazards based on the threats acquired; and - a second generation module (34) configured to generate an instruction based on each determined danger; the second processing module and the second generation module preferably being implemented asynchronously with respect to the electronic decision support devices.

9. Decision support method implemented by a decision support device (14) embedded in an electrical power generation plant (10) comprising a plurality of systems (12), each system (12) being able to operate according to at least one operating parameter and to issue an alert when one of the operating parameters is outside an associated predetermined security domain, the security of the electrical power generation plant (10) being likely to be affected by a predetermined list of threats, each threat being associated with a predetermined group of alerts, the decision support method comprising at least the following steps: - acquisition of at least two alerts from at least two different systems (12), - determination of a threat from the predetermined list of threats based on the acquired alerts; - generation of an instruction based on each determined threat;and - display, on a display screen (15) embedded in the electrical power generation plant (10), of at least one text message comprising information intended for an operator of the electrical power generation plant (10) concerning the alerts, the threat and / or the instruction.;

10. Computer program product comprising software instructions, which when executed by a computer, implement a decision-making method according to the preceding claim.

Images