Providing safe configuration parameters for wind turbines

Abstract

A method of providing security configuration parameters for a wind turbine is provided. The method includes receiving a security configuration file at a location of the wind turbine, and comparing a turbine ID associated with the security configuration file with a turbine ID of a wind turbine stored at the location of the wind turbine. A tamper check is performed on the security configuration file to determine if data in the security configuration file has been modified. If the turbine ID associated with the security configuration file matches the turbine ID of the wind turbine, and if the tamper check determines that the data has not been modified, security configuration parameters associated with a safety system of the wind turbine are extracted from the file and stored.

Description

Technical Field

[0001] The present invention relates to wind turbines and, in particular, to safety systems for wind turbines. Background Art

[0002] Wind turbines typically include a number of safety systems that, in contrast to control systems, are used to ensure safe operation of the wind turbine. For example, safety systems may limit the operation of the wind turbine to prevent the rotor speed, blade loads, or pitch from reaching dangerous levels that could damage the wind turbine. These safety systems limit the operation of the turbine based on safety configuration parameters (which are typically stored locally on the wind turbine). For example, safety configuration parameters may include a maximum rotor speed or blade load.

[0003] In conventional wind turbines, safety configuration parameters are often selected from a small number of pre-established fixed configurations during the construction of the wind turbine. Due to the sensitive nature of turbine safety configurations, relevant national / international standards require that all hardware and software configurations be tested before they are deployed, and that there be determinism during the deployment process so that only the correct safety configuration is deployed on the correct wind turbine (see, e.g., EN 62061, IEC 61508, ISO 13849-1). As a result, the safety configuration parameters of a given wind turbine often remain the same throughout the lifetime of the turbine, or are changed only when absolutely necessary.

[0004] As wind turbine fleets become larger and more global, updating the safety parameters of individual wind turbines becomes increasingly difficult. The potential for errors, such as human error in selecting the correct configuration for a given turbine, the potential for attempted sabotage by intentionally uploading incorrect safety configuration parameters, and the potential for cyberattacks attempting to modify safety parameters also increases.

[0005] Together, these factors provide inertia that prevents updating the safety configuration parameters of existing wind turbines, even if those safety configuration parameters unnecessarily limit the performance of the wind turbines. Summary of the invention

[0006] A first aspect of the invention provides a method for providing safety configuration parameters for a wind turbine, the method comprising:

[0007] receiving a security profile at a location of a wind turbine;

[0008] comparing the turbine ID associated with the security profile to turbine IDs of wind turbines stored at the location of the wind turbine;

[0009] performing a tamper check on the security configuration file to determine whether data in the security configuration file has been modified; and

[0010] If the turbine ID associated with the security profile matches the turbine ID of the wind turbine, and the tamper check determines that the data has not been modified:

[0011] extracting safety configuration parameters associated with a safety system of the wind turbine from the safety configuration file; and

[0012] Stores security configuration parameters.

[0013] In some implementations, performing a tamper check may include comparing an aspect of the data in the security profile to an expected result.

[0014] In some implementations, performing a tamper check may include comparing a data structure of a security profile to an expected data structure.

[0015] In some implementations, at least a portion of the security profile may be encrypted. Performing the tamper check may include decrypting the encrypted portion of the security profile.

[0016] In some embodiments, the encrypted portion of the security profile may include an encrypted form of a turbine ID associated with the security profile. In such embodiments, the method may further include, after decrypting the encrypted portion, comparing the turbine ID in the decrypted portion with the turbine ID stored at the location of the wind turbine.

[0017] In some embodiments, the security configuration file may be received by a control system of the wind turbine, and wherein the step of performing a tamper check is performed by the or a security system of the wind turbine.

[0018] In some embodiments, the method may further include requesting, by the security system, updated security configuration parameters. In response to the request for updated security configuration parameters, a security configuration file is received.

[0019] In some embodiments, the method may further include:

[0020] providing default safety configuration parameters for the safety system to use during initial operation of the wind turbine; and

[0021] Requests an update to security configuration parameters for use after an initial operation period.

[0022] In some embodiments, the security configuration parameters included in the security profile may be specific to a wind turbine, a wind turbine model, and / or a location of a wind turbine.

[0023] In some embodiments, the security configuration file may be received from a remote security configuration database via a network. Alternatively, the security configuration file may be received from a portable storage device.

[0024] In some embodiments, if the turbine ID associated with the security profile does not match the turbine ID of the wind turbine; or the tamper check determines that the data has been modified, the method may include:

[0025] Opt out of data profiling; and

[0026] The existing security configuration parameters of the security system are retained.

[0027] A second aspect of the present invention provides a wind turbine comprising:

[0028] a control system for controlling the operation of a wind turbine; and

[0029] one or more safety systems, each safety system configured to: limit an aspect of the operation of the wind turbine based on one or more safety control parameters;

[0030] Therein, the wind turbine is configured to: receive a safety configuration file according to the method of the first aspect, and update the one or more safety control parameters of the one or more safety systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Embodiments of the present invention will now be described with reference to the accompanying drawings, in which:

[0032] Figure 1 is a schematic representation of a wind turbine;

[0033] Figure 2 schematically illustrates a control and safety system for a wind turbine; and

[0034] Figure 3 A method of providing security configuration parameters to a wind turbine is shown. DETAILED DESCRIPTION

[0035] As previously mentioned, the critical nature of the safety configuration parameters and the requirements of relevant standards and regulations limit the scope for updating the safety configuration parameters after a wind turbine is built; and means that the safety configuration settings are selected from a small number of tested options. However, each wind turbine experiences different conditions, depending on the location of the turbine and the design of the turbine. These factors may mean that a first turbine requires relatively stringent safety parameters due to the conditions experienced, while a second turbine of the same type but in a different location does not require such stringent parameters. However, the nature of the safety parameters selected from the small pool is that they must be set for the worst case scenario - therefore, the more stringent requirements will still be used for the second turbine, even if they limit the performance of the turbine more than necessary. Furthermore, the difficulty in updating the safety configuration parameters means that even if the operating conditions of a particular turbine become better understood over time, the safety configuration parameters are not adapted to match.

[0036] The method discussed herein allows for simpler and more frequent updating of safety parameters, in a way that ensures the integrity of the parameters and thus meets the requirements of the relevant standards. Thus, safety configuration parameters more suitable for an individual turbine can be easily implemented as an update, allowing for better performance of the wind turbine.

[0037] Figure 1 An example of a wind turbine 100 is shown in a schematic perspective view. The wind turbine 100 includes a tower 102, a nacelle 103 at the apex of the tower, and a rotor 104 operably coupled to a generator housed inside the nacelle 103. In addition to the generator, the nacelle also houses various components required to convert wind energy into electrical energy and various components required to operate, control and optimize the performance of the wind turbine 100. The rotor 104 of the wind turbine includes a central hub 105 and a plurality of blades 106 protruding outward from the central hub 105. In the illustrated embodiment, the rotor 104 includes three blades 106, but the number may vary. In addition, the wind turbine includes a control system. The control system may be placed inside the nacelle or distributed at many locations inside the turbine and is communicatively connected.

[0038] Wind turbine 100 may be included in a collection of other wind turbines belonging to a wind power plant (also referred to as a wind farm or wind farm) that functions as a power plant connected to an electrical grid via transmission lines. An electrical grid often consists of a network of power generating stations, transmission circuits, and substations coupled by a network of transmission lines that deliver power to loads in the form of end users and other customers of the electric utility.

[0039] Figure 2 1 shows the control and safety systems of a wind turbine 100. The wind turbine 100 includes a control system 201 and one or more safety systems 202 (only one is shown in FIG. Figure 2The control system 201 includes components that direct the production of electricity by the wind turbine by controlling the pitch of the blades 106 and the amount of electricity extracted to the grid. The safety system 202 includes a number of safety nodes, each safety node being associated with a respective safety mechanism or control. For example, the safety mechanism may be an emergency brake or an emergency pitch control on the rotor. The control system 201 and the safety system communicate with each other (e.g., Figure 2 ), but are different systems within the wind turbine 100.

[0040] Each of safety systems 202 limits an aspect of the operation of wind turbine 100 based on respective safety configuration parameters. These safety configuration parameters may generally be stored in non-volatile memory within wind turbine 100.

[0041] In the present invention, non-volatile memory in or associated with turbine 100 (e.g., adjacent or proximate to turbine 100 at the turbine location) is also used to store a unique turbine identification number ("turbine ID"). The turbine ID is set during commissioning of turbine 100, and can be used to uniquely identify turbine 100 throughout a fleet of wind turbines 100 around the world. Because the turbine ID will be used as a validation check in the method of updating security configuration parameters discussed below, it may preferably be checked by multiple people when entered; or may be used for other purposes within the wind turbine so that errors in the turbine ID stored on turbine 100 can be identified before attempting a security configuration update.

[0042] exist Figure 2 In the illustrated embodiment, the control system 201 of the turbine 100 is connected to a remote safety configuration database 204 via a network connection 205 (which may be a wired or wireless network connection, and may be a dedicated network connection or the connection may be via the Internet). The remote safety configuration database 204 stores complete, individual safety configuration parameters for a plurality of wind turbines 100 (e.g., all wind turbines in a fleet, or all wind turbines in a region). These individual safety configuration parameters may be updated to improve the operation of an individual turbine, for example in response to performance data reported by the wind turbine 100. The updated remote safety configuration parameters may then be communicated to the individual wind turbines 100 using the method 300 described below. The data in the safety configuration database 204 may be encrypted.

[0043] Figure 3 A method 300 of providing security configuration parameters to a wind turbine 300 is shown.

[0044] Method 300 begins at step 301, where a security profile is received at the location of wind turbine 10, such as at wind turbine 100 itself, or at a wind farm of which turbine 100 is a part. For example, the security profile may be transmitted from remote security configuration database 204, and may be received at control system 201 of turbine 100.

[0045] The safety profile includes one or more safety configuration parameters for an individual wind turbine 100. The safety configuration parameters may relate to only one safety system / node of the turbine 100, or to multiple / all safety systems of the turbine 100. The safety configuration parameters included in the safety profile may be specific to a wind turbine, a wind turbine model, and / or a location of a wind turbine. In certain embodiments, the complete set of safety configuration parameters may be unique to a particular turbine 100, but individual parameters in the set may be common between different turbines 100.

[0046] At step 302, the turbine ID associated with the security profile is compared to the turbine ID of the wind turbine stored at the location of the wind turbine (e.g., on the non-volatile memory of the turbine 100, as described above). This step provides a first check that the parameters in the security profile are actually for that turbine 100, preventing the wrong parameters from being applied to the turbine 100.

[0047] At step 303, a tamper check is performed on the security configuration file to determine whether the data in the security configuration file has been modified. The tamper check ensures that there are no accidental or intentional changes to the security configuration parameters contained in the received file, ensuring the security of the parameters, and thus allowing the method 300 to meet the standards required for the provisioning of security configuration parameters.

[0048] The tamper check of step 303 may include a data integrity check. For example, the tamper check may include comparing an aspect of the data in the file with an expected result. The expected result may be stored only on the turbine 100, and in particular only on the associated safety system 202, ensuring the confidentiality of the expected result. If the tamper check produces the expected result, it is determined that the data has not been modified.

[0049] The tamper check may, for example, include running an algorithm on a file or a portion of the data in the file. The algorithm may be a checksum. Alternatively or additionally, the data structure of the file may be compared to an expected (secret) data format. The algorithm may be able to perform error correction on the received file to recover the original data of the file.

[0050] In some embodiments, at least a portion of the file may be encrypted. A secret decryption key is stored on the turbine 100 (and specifically on the associated security system 202, or on the "gateway" security system used to initially receive the configuration file). The tamper check of step 303 may then include decrypting the file. Based on the successful decryption of the file, it may be determined that the data has not been tampered with. Alternatively, further tamper checks / data integrity checks (similar to those described above) may then be performed on the decrypted data to ensure the integrity of the security configuration parameters received in the file. The decrypted data may also include a turbine ID. In some embodiments, this decrypted turbine ID may be compared to the turbine ID stored at the turbine 100. This may provide an additional check of the turbine ID, or may be used as a check for step 302. Note that steps 302 and 303 may be performed in any order.

[0051] If the checks of step 302 and step 303 pass, ie if the turbine ID associated with the security profile matches the turbine ID of the wind turbine, and the tamper check determines that the data has not been modified, the method 300 proceeds to step 304 .

[0052] At step 304, safety configuration parameters associated with the safety system 202 of the wind turbine 100 are extracted from the safety configuration file. The method then proceeds to step 305, where the extracted safety configuration parameters are stored on the wind turbine 100. According to the extracted parameters, the wind turbine 100 may then be operated—i.e., the relevant safety system of the turbine 100 is controlled according to the extracted parameters. In the event that the relevant safety system of the turbine 100 has existing corresponding safety parameters, the method 300 may include replacing the corresponding parameters with the extracted parameters.

[0053] If on the other hand the turbine ID associated with the security profile does not match the turbine ID of the wind turbine; or if the tamper check determines that the data has been modified, the method does not proceed to steps 304 and 305. Alternatively, the data profile may be rejected and the existing security configuration parameters of the associated security system may be retained.

[0054] Method 300 allows for efficient and robust implementation of safety configuration parameters to individual turbines 100. Multiple checks performed as part of method 300 ensure that the correct safety configuration parameters are sent to the correct turbines 100, as well as ensuring the integrity of the data sent, preventing accidental errors or deliberate sabotage.

[0055] The method 300 may be performed when a new turbine 100 is commissioned to provide the turbine 100 with security configuration parameters for the first time. The method 300 may also be performed periodically, or when security configuration parameters are updated centrally (such as on a remote security configuration database 204), and may be used to push updates to the turbine 100. Alternatively or additionally, the turbine 100 itself may request one or more security configuration parameters, such as by sending a request including the turbine ID to the remote security configuration database 204. The request may be initiated by one of the individual safety systems 202 of the wind turbine 100. In the event that the turbine 100 does not have the particular security configuration parameters, or in the event that a predetermined time has passed since the particular security configuration parameters were last received at the turbine 100, operation of the turbine 100 may be limited to ensure continued safety.

[0056] In some embodiments, such as Figure 2 In the embodiments shown in , the security configuration file may initially be received by the control system 201. This may allow existing control system connections to be used to transmit and receive the security configuration file. In these embodiments, the control system 201 is unaware of the decryption algorithm / expected result required to extract the data from the file. Instead, the file is passed to the safety system 202 of the turbine 100. A common central processor of the safety system or a "gateway" safety system for receiving the file may perform checks 302 and 303 before extracting the security configuration parameters and passing the parameters to the relevant safety system 202. Alternatively, for additional security and robustness, the decryption algorithm / expected result required to extract the parameters may be known only by the relevant safety system. In this case, the file (or a relevant portion thereof) may be passed to the relevant safety system, which then performs at least the tampering check of step 303 itself.

[0057] As an alternative to receiving the security configuration file from a remote database, the security configuration file may be received from a portable storage device, such as a USB key or a portable hard drive. The service operator may connect the portable storage device directly to the turbine 100, or to a wind farm controller, which in turn communicates with the wind turbine 100 to transfer the security configuration file. The turbine 100 will then perform the checks of step 302 and step 303 of method 300 to ensure the integrity of the received security configuration parameters. This embodiment may be particularly useful in situations where a network connection to the wind turbine 100 is unavailable or unreliable, such as during construction of the wind turbine 100.

[0058] In some embodiments, in the early stages of turbine commissioning, it may not be possible to receive specific safety configuration parameters for the turbine. For example, a unique turbine ID may not yet be determined for the turbine, or may be unavailable for other reasons, which prevents the selection of correct parameters. In such embodiments, default safety configuration parameters may be provided for use during initial operation of the wind turbine. For example, the turbine 100 may request safety configuration parameters from a remote database 203 or alternatively from local storage using a pre-agreed default ID. The default safety configuration parameters may be deployed with the turbine control system software, and may often be available, even when the network does not exist and the safety configuration parameters have never been retrieved from an external server or programmed by service personnel. Alternatively, the default parameters may be hard-coded in their own software on each of the individual safety systems 202, and automatically used when a unique turbine identifier is not programmed. The default parameters may be designed to be safe for any possible turbine setting at any location where the turbine may be erected. In this way, they may provide limited, degraded performance by providing the most stringent parameter set possible. Service personnel may then perform limited commissioning and testing until a unique turbine identifier / individual turbine safety control parameters have been obtained.

[0059] Although the present invention is described above as a method, the present invention may also be implemented as a computer program product comprising software codes adapted to the above method.

[0060] Furthermore, although the invention has been described above with reference to one or more preferred embodiments, it should be appreciated that various changes or modifications may be made without departing from the scope of the invention as defined in the appended claims.

Claims

1. A method for providing safety configuration parameters for a wind turbine, the wind turbine comprising a control system and a safety system, the control system and the safety system being different systems located within the wind turbine and communicating with each other, the method comprising: receiving a security profile at a location of a wind turbine; The security configuration file is received by the control system, and the security configuration file is received from a remote security configuration database via a network connection connected to the control system; The safety configuration file is transferred to the safety system, and in the safety system of the wind turbine, the following steps are performed: comparing the turbine ID associated with the security profile to turbine IDs of wind turbines stored at the location of the wind turbine; performing a tamper check on the security configuration file to determine whether data in the security configuration file has been modified; as well as If the turbine ID associated with the security profile matches the turbine ID of the wind turbine, and the tamper check determines that the data has not been modified: extracting, from the security configuration file, security configuration parameters associated with a security system of the wind turbine; as well as Stores security configuration parameters.

2. The method according to claim 1, wherein: Performing a tamper check involves comparing an aspect of the data in the security profile to an expected result.

3. The method according to claim 1, wherein: Performing a tamper check involves comparing the data structure of the security profile to the expected data structure.

4. A method according to any one of the preceding claims, wherein: At least a portion of the security profile is encrypted, and wherein performing the tamper check includes decrypting the encrypted portion of the security profile.

5. The method according to claim 4, wherein: The encrypted portion of the security profile includes an encrypted form of a turbine ID associated with the security profile; as well as Therein, the method comprises, after decrypting the encrypted portion, comparing the turbine ID in the decrypted portion with a turbine ID stored at the location of the wind turbine.

6. The method according to any one of claims 1 to 3, further comprising: Security configuration parameters requested to be updated by the security system; as well as Therein, in response to a request for updated security configuration parameters, a security configuration file is received.

7. The method according to any one of claims 1 to 3, wherein: The method further comprises: providing default safety configuration parameters for the safety system to use during initial operation of the wind turbine; and Requests an update of security configuration parameters for use after an initial operation period.

8. The method according to any one of claims 1 to 3, wherein: The security configuration parameters included in the security profile are specific to a wind turbine, a wind turbine model and / or a location of a wind turbine.

9. The method according to any one of claims 1 to 3, wherein: From the portable storage device, a security configuration file is received.

10. The method according to any one of claims 1 to 3, wherein: If the turbine ID associated with the security profile does not match the turbine ID of the wind turbine; or the tamper check determines that the data has been modified, the method includes: Opt out of data profiling; and The existing security configuration parameters of the security system are retained.

11. Wind turbines, including: a control system for controlling the operation of a wind turbine; as well as one or more safety systems, each safety system being configured to: limit an aspect of the operation of the wind turbine according to one or more safety control parameters, the control system and the safety system being distinct systems located within the wind turbine that communicate with each other; Wherein, the wind turbine is configured to: receive a safety configuration file according to the method of any one of claims 1-10, and update the one or more safety control parameters of the one or more safety systems.

Images