Programmable electronic power regulator

Abstract

The present application describes a programmable electronic power regulator with a power module (10) for controlling at least one connectable drive (80) and a control module (20) for driving the power module (10) by means of a power module control signal (29) and an internal monitoring module (30) for switching the control module (20) into emergency operation, wherein the control module (20) comprises a basic controller (21), an additional controller (23) and a controller disconnect point (22). The basic controller (21) is configured to send the power module control signal (29). Furthermore, open- and closed-loop control functions of the drive (80) required for emergency operation in a critical operating state are implemented in the basic controller (21). The additional controller (23) performs functions not required for emergency operation in a critical operating state. The controller disconnect point (22) connects the basic controller (21) with the additional controller (23) by means of control connections (24, 25) and is configured to receive an error signal (31) from the internal monitoring module (30) and to at least partially disconnect the control connections (24, 25) upon receipt of the error signal (24, 25).

Description

[0001] This invention relates to a programmable electronic power regulator comprising a power module for controlling at least one electromechanical driver connected to or potentially connected to the power module via a driver control signal, in the form of applied voltage or selectable current. The voltage or current can be provided by a suitable power supply and adjusted accordingly within the power module of the power regulator, for example, via a thyristor electronic power regulator, transformer, inverter, pulse width modulator, or similar electronic device; the output power or output current and / or output voltage can be variablely adjusted.

[0002] The power regulator also includes a control module for driving or controlling the power module via power module control signals, and an internal monitoring module for switching the control module to emergency operation. In emergency operation, the control module is adapted to execute a predefined error response and is configured to place the driver in a safe state, while the internal monitoring module is configured to monitor the system status, detect critical operating conditions, and, if a critical operating condition is detected, issue at least one error signal, specifically placing either the control module or the power regulator in an emergency operation state respectively.

[0003] Such programmable power regulators are typically used in systems where simply shutting down one or more electromechanical drives is, or may be, dangerous in the event of a failure (i.e., a critical operating condition) because the system has at least one critical operating phase, and simply shutting down the drives would violate one or more of the system's safety objectives. A preferred and common application of the invention is a pitch system in a wind power plant, where the rotational position of at least one rotor blade is set on the rotor hub. Other plausible application areas might be critical production processes or electric vehicles. In such systems, fault tolerance must be provided to enable at least one emergency operation of the system ("failed-out system") in the event of an error.

[0004] Programmable electronic power regulators are almost always used in the regulated electromechanical drives. In addition to their basic function of controlling the drive, they include many additional functions, such as reading data from external sensors, generating motion profiles, and communicating in real time with other systems via sophisticated communication interfaces. These additional functions facilitate the diagnostic, parameterization, user programming, and debugging of the programmable electronic power regulator. This complexity of programmable power controllers introduces a significant risk of undetected system software errors.

[0005] Software errors in complex additional functions can prevent a power controller from reliably transitioning from normal to emergency operation, for example, if the software freezes during processing, or, for instance, if excessive processing power is used in an endless loop. If multiple similar complex power controllers are used in a system, the risk of errors due to critical "common causes" is high. Sufficiently reducing the probability of these common causes of error through error avoidance measures during product development is often impossible for complex systems, even for cost reasons alone.

[0006] Functional safety integration in electromechanical drive control, such as in electrical drive systems, is well-known and has been introduced into industrial practice. The safe state of a drive is typically a stationary state, with safe shutdown of torque or force generation and safe braking control. Even safety functions that can be requested while movement continues, such as safe torque limiting, safe speed limiting, or safe position range limiting, always include shutting off torque and force upon detection of a fault as a safety error response.

[0007] Complex error responses are particularly likely to reach a safe position within a specified time. For example, a pitch drive used to adjust the angle of wind turbine rotor blades is one such example. Depending on the application, further possible error responses might include maintaining the drive speed or reducing / increasing the drive speed to a given target value based on a defined acceleration or braking ramp.

[0008] A prerequisite for executing complex error handling is that the power controller's control module can reliably control the error response even under critical operating conditions. However, this is impossible if the control module itself malfunctions due to a software error in the complex additional functions, and the processor power is entirely consumed by running additional functions unrelated to safety.

[0009] DE 10 2012 012 521A1 describes a programmable controller for safety-critical applications in machine environments. The functionality of safety-critical program components is unaffected by errors or processes in other program components. Various criteria can be used to control the flow of the application; for example, flow control can be guaranteed based on the runtime system and operating system. Based on a runtime system architecture, normal and safety programs run in parallel and independently, where it is recommended that all components important to control be integrated onto hardware components with a specific hardware architecture, and that they be separated from each other through at least a dual-runtime system architecture with two runtime systems to allow for changes to non-safety-critical components. Separation can be achieved by prioritizing one of the runtime systems.

[0010] DE 10 2005 007 477A1 discloses a programmable controller for machine and / or system automation, comprising a standard controller with standard control functions and a PC-based safety controller with safety functions. The safety controller consists of one or more safety modules connected to a PC bus, each providing security authentication firmware. Thus, through modular partitioning within the control unit, the control provides separation between non-safety-related standard functions and safety functions. This partitioning allows standard functions to be implemented in a correspondingly complex manner, without any safety-related restrictions.

[0011] In view of the above, the object of the present invention is to provide a programmable electronic power regulator that enables the control module to reliably handle complex error responses even in critical operating conditions, so as to safely shut down the system in a prescribed manner.

[0012] This objective is achieved through a programmable electronic power regulator of the type described in the introduction, specifically a programmable electronic power regulator whose control module has a basic controller, an additional controller, and a controller disconnect point.

[0013] In particular, the control module may consist of these three components.

[0014] The basic controller is configured to output power module control signals. Furthermore, preferably, all functions for self-sufficient open-loop and closed-loop control of the drive required for emergency operation in critical operating conditions are implemented in the basic controller. Therefore, the basic controller is part of a control module for controlling the drive (i.e., outputting control signals to the power module). The power module then provides the power required by the drive in the form of drive control signals. These drive control signals can, in particular, be current and / or voltage signals supplying power to the drive (e.g., a three-phase motor).

[0015] The functions implemented for the independent open-loop and closed-loop control of the drive include, in particular, instructions for translating (logic) control commands from the open-loop and / or closed-loop controller into (machine-oriented) power module control signals, the open-loop and closed-loop control algorithms of the drive, and possibly a sensor system.

[0016] For pitch drives of wind turbines, used to adjust the rotation of a single rotor blade on the rotor hub, the electromechanical drive is a preferred application, and is particularly often a three-phase drive (three-phase motor). In this case, the basic controller for automatic open-loop and closed-loop control of the three-phase drive specifically includes measurement acquisition, a field model (primarily based on the acquired measurements, used to describe the state of the drive or the system controlled by the drive), closed-loop current control, modulation, and speed control.

[0017] Functions not required for emergency operation during critical operating conditions are implemented in the additional controller. These functions may include evaluating external sensors, generating motion profiles, or communicating in real time with external systems via (in some cases, complex) communication interfaces. Such functions are particularly useful for optimizing the operation of drive-controlled systems but are not safety-critical. Further additional functions facilitate the diagnostic, parameterization, user programming, and debugging of programmable electronic power regulators, and simplify maintenance and repair.

[0018] Therefore, as an optional component, according to the invention, the proposed electronic power regulator can be connected to or from an external controller via an interface of an additional controller. According to the invention, the additional controller can be configured to send operational data to and / or receive control data from the external controller.

[0019] The controller disconnect point provided by the present invention connects a basic controller and an auxiliary controller via a control connection, which may include a control connection from the basic controller to the auxiliary controller and a control connection from the auxiliary controller to the basic controller. During normal operation, the control connection allows the basic controller and the auxiliary controller to be used together, and they can exchange data with each other. Therefore, during normal operation, not only can the functions required for emergency operations and implemented in the basic controller be performed, but also the functions that can only be performed during normal operation and implemented in the auxiliary controller can be performed.

[0020] In the event of an error, i.e., when the internal monitoring module detects a critical operating state, the controller disconnect point is configured to receive an error signal from the internal monitoring signals, and upon receiving the error signal, to at least partially disconnect the control connection, for example, in the direction of the control connection from the basic controller to the controller, or in the direction of the control connection from the auxiliary controller to the basic controller, but preferably entirely in both directions. In other words, the monitoring module according to the invention is configured to perform a functional disconnection between the basic controller and the auxiliary controller during emergency operation, thereby preventing any external influence of the auxiliary controller on the basic controller.

[0021] Using the programmable electronic power regulator according to the invention, a similar method according to the invention can be implemented in the control module to achieve safety drive control, wherein upon detection of a faulty function, a switch to emergency operation with a reduced functional range is initiated, wherein the basic controller automatically executes complex fault responses, without interference and / or access to additional controllers before safely shutting down the drive in a manner common in the prior art. According to the invention, particularly in emergency operation, fault assessment can be eliminated from being performed in software. Such fault assessment is typically laborious, especially for systematically detecting and reporting faults before reaching a critical operating state. Therefore, there is the possibility of correcting system errors and / or preventing premature development of a critical operating state through software updates. When a critical operating state is reached, resources are diverted to executing complex faulty functions. Therefore, according to the invention, (integrated) fault assessment can be implemented in an additional controller, which may be unavailable in emergency operation.

[0022] In the context of this invention, it is understood that problems arise, particularly during emergency operations, when software components for basic and additional functions execute on the same microcontroller and share resources (CPU, peripherals, memory). To avoid this problem, the various parts of the control are divided into a self-contained basic controller and an additional controller, providing reliable controller disconnect points to reliably isolate the two sub-controllers from each other, especially in the event of a serious error. The solution described in this invention initiates emergency operations by reducing the scope of functionality; that is, by separating the complex control hardware and software into a basic controller and an additional controller through independent monitoring modules. The basic controller contains only the hardware and software components required for the reduced scope of emergency operation functionality, and its overall complexity is significantly lower than that of the additional controller. One advantage of this is that safety-related assessments of the driver control software (i.e., the control module) can be limited to the software of the basic controller, and are therefore much simpler than assessing the entire control software.

[0023] In a simplified embodiment, the separation of the base controller and the auxiliary controller can be achieved by inserting a preferred bidirectional interface between the two controllers, thereby establishing a control connection (in the sense of a communication connection) between the two controllers, allowing data exchange between them. In this case, the base controller can be separated from the auxiliary controller by interrupting the communication interface.

[0024] In another preferred embodiment, which can be added or replaced, the controller disconnect point can be implemented in the form of a memory protection device configured to protect a designated memory region of the base controller from the influence of the additional controller. For this purpose, access restrictions (e.g., write restrictions, possibly combined with read restrictions) regarding the memory region of the base controller can be implemented. This also prevents technical software problems in the additional controller from affecting the base controller. This also manifests as a disconnection of the control connection between the base controller and the additional controller.

[0025] In another alternative or further preferred embodiment, the controller disconnect point can be configured to place the auxiliary controller in a reset state upon receiving an error signal from the internal monitoring module and maintain it in that state until the emergency operation ends. In the reset state, the auxiliary controller has no effect on the power regulator, and therefore the basic controller is unaffected by the auxiliary controller. This also isolates the control connection between the basic controller and the auxiliary controller.

[0026] According to a preferred embodiment of the power regulator proposed by the present invention, the control module may include multiple processors, with the basic controller and the auxiliary controller implemented on different processors. Therefore, at least one dedicated processor is provided for both the basic controller and the auxiliary controller. This also allows for the separation of the basic controller and the auxiliary controller in hardware. If necessary, in emergency mode, the processor can be shut down or disabled along with the auxiliary controller to prevent the auxiliary controller from affecting the execution of complex error responses, thereby separating the control connection between the basic controller and the auxiliary controller.

[0027] In a similar embodiment of the invention, the control module may have a multi-core processor, with the basic controller and the auxiliary controller respectively installed on at least one different core of the multi-core processor. In this way, the control connection between the basic controller and the auxiliary controller is also separated at the hardware level.

[0028] As a further safety feature, the power module according to the invention may have a power module disconnect point located between the power module and the driver connection, and configured to receive error signals from an internal monitoring module, and upon receiving said signal, not forward driver control signals to the driver connection (in fact: not forward to one or more drivers). This roughly corresponds to an emergency stop function, completely disconnecting from the driver, i.e., causing the driver to stop immediately. In this case, the complex error response according to the invention can no longer be executed. This situation may occur after a failure of critical hardware components that no longer allow the power regulator to operate in an emergency. In this case, it is recommended to immediately shut down the electromechanical driver.

[0029] In this scenario (effectively serving as a second backup level for error handling), the internal monitoring module can activate the power module disconnect point by sending an error signal to it, thereby disconnecting one or more externally connected components from the power regulator. This prevents power flow between the externally connected components and the power regulator. These components may be various drivers performing different adjustment processes and can be installed individually or together with the power regulator. Possible drivers could be motors, service brakes, or other electrical devices. For example, a service brake might be implemented in a manner where releasing the brake requires an energy supply, and the brake engages when the energy supply is removed.

[0030] Other components connected to the power module can be power sources, such as mains power or an energy storage system. Activating the power module disconnect point can also preferably disconnect power from the power module of the power regulator, thereby shutting down all connected drives.

[0031] Individual components can be selectively, in groups, or separated together.

[0032] In a particularly preferred embodiment of the invention, internal sensors, external sensors, and / or an external monitoring module can be connected to an internal monitoring module, and the internal sensors, external sensors, and / or external monitoring module are configured to send data signals to the internal monitoring module. For example, the internal and external sensors can be measurement value transmitters with sensors that transmit sensor signals and / or sensor values ​​derived from the sensor signals as data signals. The external monitoring module can be a separate safety module for detecting errors or dangerous situations, collecting and evaluating automatically collected information (measurements, status values, or other data). For example, an error signal can be sent as a data signal to the internal monitoring module. This error signal can be considered a signal sent to the internal monitoring module requiring the programmable electronic controller to be placed in emergency operation, in which, according to the invention, the basic controller is decoupled from the additional controller (execution of complex error response), and / or the power module is disconnected from connected drivers, power supplies, and / or other connected power components (component shutdown, especially in the case of an emergency stop).

[0033] The basic controller can also connect directly to the internal monitoring module and send data signals to it. One possibility for such data signals is an error signal. This error signal can also be understood as a signal sent to the internal monitoring module requesting that the programmable electronic power regulator be switched to emergency operation. For example, if the status of the basic controller and / or (also in normal operation) auxiliary controller is identified as a critical state in the basic controller, this could lead to a malfunction of the basic controller and / or auxiliary controller.

[0034] In response to the assessment, if the internal monitoring module detects a critical operational condition, it can send one or more error signals. For example, a critical operational condition can be determined by comparing the received data signals with an allowable range. If necessary, multiple data values ​​can also be combined using algebraic rules, fuzzy logic methods, or artificial intelligence (AI).

[0035] The internal monitoring module can also identify different levels of critical operating conditions and issue different error signals based on the detected level. The various possibilities for these error signals will be explained below. All these error signals can be transmitted individually or in any combination, and may also be transmitted to the controller disconnect point described earlier, in addition to the error signal itself.

[0036] In a preferred embodiment of the invention, the internal monitoring module may be configured to send an error signal (reboot error signal) to the basic controller, wherein the basic controller is configured to trigger a reboot upon receiving the error signal. If a complex programmable power regulator fails in a critical system state, emergency operation can be activated by rebooting the driver controller's software.

[0037] According to another preferred embodiment, the restart method is that after a restart is triggered by a restart error signal, the control module automatically operates in emergency mode, that is, the basic controller and the auxiliary controller are disconnected.

[0038] During restart, the entire controller should ideally be shut down, with only the basic controller activated. This allows for a restart to be performed as quickly as possible, meeting system safety response time requirements. Upon restart, the software automatically operates in emergency mode, where complex additional functions not required by the programmable electronic power regulator are reliably disabled. This eliminates the potentially dangerous impact of system software errors in complex additional functions on the availability of essential functions required for emergency operation. For example, the additional controller can remain in the reset state described earlier until the critical operating condition no longer exists.

[0039] A particular advantage of this preferred embodiment of the invention is that, after a rapid restart, the basic controller operates in a defined operating state and can reliably execute complex error responses to be processed.

[0040] According to another preferred embodiment, the internal monitoring module can be configured to send an error signal to the basic controller, which is configured to prepare for emergency operation upon receiving the error signal (early warning error signal). This early warning error signal can be sent in advance by the internal monitoring module, for example, if there is a possible indication of a critical operational state in the internal monitoring module, or, for example, if it has not been fully confirmed in the internal monitoring module. For example, such an early warning error signal can be used in the basic controller to check its operational status, cancel functions executed upon request from an additional controller, and / or send a data signal to the internal monitoring module indicating that restarting the basic control is desirable or necessary. This early warning error signal can initiate an orderly transition to emergency operation.

[0041] According to the present invention, further error signals can be sent to an external monitoring module to forward the occurrence of a critical operating condition to an alarm control center for, for example, reporting an alarm. The external monitoring module can also be an internal monitoring module of one or more further programmable power regulators installed in the same system. This allows various power regulators to be networked within the same system. This is advantageous because a critical operating condition detected in one power regulator, especially one arising from environmental influences, is generally also applicable to other power regulators in the same system. Based on such a network, this can be detected rapidly throughout the system.

[0042] In addition to error signals indicating a critical operating state or the initiation of emergency operations, the previously described early warning error signals can also be sent to external monitoring modules.

[0043] In a particularly preferred embodiment, only the basic controller can be configured to send power module control signals to the power module and / or perform other (basic) functions of the control module. Thus, the basic functions of the basic controller, especially those directly related to driver control, can operate in both normal operation (i.e., both the basic controller and the auxiliary controller are active) and emergency mode (i.e., the basic controller is active, and the auxiliary controller is disabled / deactivated). Therefore, it can be assumed that these functions will also be performed error-free during emergency operation. In other words, most of the functions required for emergency operation also continue to operate or be used during normal operation. Therefore, these functions can be considered operationally validated.

[0044] To cancel an emergency operation again, for example when the critical operating state no longer exists, according to the invention, the internal monitoring module can be configured to detect the end of the emergency operation and remove the programmable electronic power regulator from the emergency operation to switch the programmable electronic power regulator from emergency operation to normal operation, especially by disabling the control disconnect point and / or power module disconnect point.

[0045] The internal monitoring module can advantageously be the automatic control function unit of the programmable electronic power regulator, which can operate independently of the control module. In other words, this means that the internal monitoring module of the power regulator can still function normally even if neither the control module nor the power module is activated. This independence from other functional units of the power regulator results in reliable safety functions. In this way, the internal monitoring module can also act as a watchdog timer, particularly checking the basic controller's functions, for example, by querying certain status data on a quasi-continuous basis. If no status data is received, the internal monitoring module can restart the entire control module during normal operation, or restart only the basic controller in emergency operation.

[0046] The invention also relates to the particularly advantageous use of the proposed programmable electronic power regulator for controlling the pitch system of a wind turbine, wherein the rotational position of one or more rotor blades is located within the rotor hub. This constitutes a particularly safety-critical application, for example, in the event of a storm or strong wind, where the rotor blades of the wind turbine must be moved to a position where the wind blowing on the rotor blades delivers only a small force to the rotor blades, thus avoiding the worst-case scenario of the rotor blades separating from the wind turbine rotor hub.

[0047] One advantageous use is also applicable to other applications, such as ensuring uninterrupted operation of drives in critical processes, such as chemical production processes, electric drives, or other applications where simply shutting down the drive (emergency stop) could lead to particularly dangerous situations.

[0048] Other advantages, features, and applicability of the invention are also apparent in the following description of exemplary embodiments and the accompanying drawings. All features described in the text and / or illustrated in the drawings, together or in any combination in any technical sense, constitute the subject matter of the invention, regardless of how they are summarized in the described or illustrated exemplary embodiments or the claims.

[0049] Figure 1 A schematic diagram of the functional components of the programmable electronic power regulator 200 is shown.

[0050] The programmable electronic power regulator 200 includes a power module 10, which is connected to a power source 100 via a power connection 101 and / or to an energy storage system 90 via a power connection 91 (e.g., in the event of a power failure) to provide energy. The power module 10 controls a driver 80 connected to the power regulator 200 via a driver control signal 81.

[0051] The power module 10 is controlled by the control module 20 via the power module control signal 29. Status data of the power module 10 is reported to the control module 20 via the feedback signal 15.

[0052] In order to enable the control module 20 to reliably continue to handle complex error responses even under critical operating conditions and to bring the system to a specified resting state in a safe manner, the programmable electronic power regulator 200 has an autonomously operating internal monitoring module 30, which is configured to detect and assess critical operating conditions.

[0053] The internal monitoring module 30 receives data signal 41 for evaluation from the internal signal generator 40. The internal signal generator 40 may in particular include a sensor that detects status values ​​such as temperature in the electronic power regulator 200 and sends them as data signal 41 to the internal monitoring module 30.

[0054] Similarly, the external sensor of the external signal generator 70, which is connected to the power regulator 200, is connected to the internal monitoring module 30 and sends the detected status value to the internal monitoring module 30 through the data signal 71.

[0055] The internal monitoring module 30 receives further data signals 51 from the external monitoring module 50. For example, the external monitoring module 50 can detect and assess the impact of the external environment on the system affected by the driver. If these external environmental influences indicate that the system affected by the driver 80 is in a dangerous state, the external monitoring module 50 sends data signal 51, which will be interpreted as a request for the internal monitoring module 30 to identify the dangerous operating condition.

[0056] The software records and evaluates the data signals 41, 71, and 51 arriving at the internal monitoring module 30. If the internal monitoring module 30 detects a critical operating condition, it puts the control module 20 into emergency mode by sending an error signal 31.

[0057] Unlike a simple emergency stop function, the emergency operation of control module 20 must still execute a complex error response and appropriately operate driver 80 via power module control signal 29 to safely stop the system in a prescribed manner. Rules regarding how such a complex error response should be handled in practice can be input into control module 20, for example, through appropriate programming of certain process sequences.

[0058] Because complex controllers with extensive functions, especially programmable controllers, are prone to software errors or failures, while safety-critical functions must still be executed reliably, this invention divides the control in the control module 20 into a basic controller 21 and an additional controller 23.

[0059] The basic controller 21 contains the hardware and software components required for streamlined emergency operation functions. These specifically include connections for outputting power module control signals 29 from internal signal generator 40 and external signal generator 70, and connections for data signals 42, 72. The sensor values ​​captured by these signal generators 40, 70 are also typically needed for processing complex error responses.

[0060] The additional controller 23 includes additional functions not required for emergency operations, such as evaluating external sensors in the external controller 60 to generate kinematic motion profiles and for real-time communication with external systems (e.g., external controller 60) via a (complex) communication interface. The external controller 60 receives data signal 26 containing operational data from the controller (receiving operational data sent by the additional controller 23) and sends data signal 61 containing external control data (data transmission from the external controller 60 received by the additional controller 23).

[0061] For example, additional functions of the additional controller 23 can facilitate the diagnosis, parameterization, user programming, and debugging of the programmable electronic power regulator 200.

[0062] To prevent errors in the additional controller 23 when performing the functions of the basic controller 21, such as due to software errors, and to avoid the need for complex safety checks on the entire software of the additional controller, the electronic power regulator 200 is equipped with a controller disconnect point 22, which is located in the control connection 24 from the basic controller 21 to the additional controller 23, and in the control connection 25 from the additional controller 23 to the basic controller 21. This disconnect point can be activated by an error signal 31 from the internal monitoring module 30 to set up emergency operation. Activation of the controller disconnect point 22 prevents the additional controller 23 from accessing the basic controller 21. This can be achieved technically in various ways, such as by preventing the additional controller 23 from accessing the memory of the basic controller 21, by placing the additional controller 23 in an inactive or reset state (e.g., effectively powering off the additional controller 23), by disconnecting the communication link between the basic controller 21 and the additional controller 23 (e.g., different processors connected to each other via a communication link), or similar techniques.

[0063] This is a very effective method to limit the function of the control module 20 to the functions that are essential for emergency operations and to avoid errors in emergency operations caused by the complex functions of the additional controller 23.

[0064] The internal monitoring module 30 can also send an error signal 32 to the basic controller 21, which triggers the basic controller 21 to restart in an emergency operation, and preferably simultaneously disables the auxiliary controller (restart error signal). Technically, this can be achieved by rapidly shutting down the entire control module 20 (including the basic controller 21 and the auxiliary controller 23) and selectively restarting the basic controller 21. Furthermore, if necessary, the internal monitoring module 30 can also issue an error signal 33 in advance, providing advance notification of an emergency operation (early warning error signal). This allows the basic controller 21 to prepare for emergency operations.

[0065] Alternatively, for example, if the basic controller 21 detects an unstable state of the additional controller 23 and / or the basic controller 21, it sends a data signal 28 with the information to the internal monitoring module 30 for evaluation, and the module evaluates the information and then, if necessary, initiates emergency operations in the manner described.

[0066] Depending on the operating state type determined by the internal monitoring module 30, an immediate emergency shutdown of the driver 80 or the entire system may be required, rather than a complex error response involving a controlled shutdown of the driver 80. In a preferred embodiment, the internal monitoring module 30 can achieve this without involving the basic controller 21 by sending an error signal 34 to the power module disconnect point 11. This controller is configured to selectively disconnect some or all of the power inputs of the power supply and selectively disconnect some or all of the power outputs of one or more drivers 80 (only one driver is shown in the figure for simplicity) when activated by the error signal 34 (power supply 100, energy storage system 90). This replicates the classic emergency stop function.

[0067] In the event of an emergency operation and / or an early warning, the internal monitoring module 30 can also send an error signal 36 to the external monitoring module 50, which can be connected to a control room or control center.

[0068] List of reference numerals in the attached diagram:

[0069] 10: Power Module

[0070] 11: Power module disconnection point

[0071] 15: Feedback signal

[0072] 20: Control Module

[0073] 21: Basic Controller

[0074] 22: Controller disconnection point

[0075] 23: Additional Controller

[0076] 24: Control connection from basic controller to additional controller

[0077] 25: Control connection from the auxiliary controller to the basic controller

[0078] 26: Data signal with operation data

[0079] 28: Data signal with operation data

[0080] 29: Power module control signal

[0081] 30: Internal monitoring module

[0082] 31: Error signal (transmitted to) the controller disconnect point

[0083] 32: Error signal (transmitted to) the basic controller for restart (restart error signal)

[0084] 33: Error signals (early warning error signals) transmitted to the basic controller for advance notification.

[0085] 34: Error signal (transmitted to) the power module disconnection point

[0086] 36: Error signal (transmitted to) external monitoring module

[0087] 40: Internal signal generator

[0088] 41: Data Signal

[0089] 42: Data signal

[0090] 50: External monitoring module

[0091] 51: Data signal

[0092] 60: External control unit (external controller)

[0093] 61: Data signal with external control data

[0094] 70: External signal generator

[0095] 71: Data Signal

[0096] 72: Data Signal

[0097] 80: Electromechanical drive

[0098] 81: Driver control signal

[0099] 90: Energy Storage System

[0100] 91: Power Connection

[0101] 100: Power supply

[0102] 101: Power Connection

[0103] 200: Programmable Electronic Power Regulator

Claims

1. A programmable electronic power regulator comprising a power module (10) for controlling at least one driver (80) by a driver control signal (81), the driver (80) being connected to the power module (10), a control module (20) for activating the power module (10) by a power module control signal (29), and an internal monitoring module (30) for transitioning the control module (20) to an emergency operation, wherein the control module (20) is configured to perform a predefined error response and to put the driver (80) into a safe state, wherein the internal monitoring module (30) is configured to monitor a system state, to detect a critical operating state, and to output at least one error signal (31, 32, 33, 34, 36), wherein the control module (20) comprises: • a base controller (21) configured to output the power module control signal (29) and in which open- and closed-loop control functions required for the emergency operation of the driver (80) in the critical operating state are implemented, • an additional controller (23) in which functions not required for the emergency operation in the critical operating state are implemented, and • a controller disconnect point (22) connecting the base controller (21) with the additional controller (23) by control connections (24, 25) and configured to receive the error signal (31) from the internal monitoring module (30) and to at least partially disconnect the control connections (24, 25) upon reception of the error signal. The controller disconnect point (22) as a memory protection device is configured to protect a designated memory area of the base controller (21) from the additional controller (23). The controller disconnect point (22) is configured to put the additional controller (23) into a reset state upon reception of the error signal (31) from the internal monitoring module (30) and to maintain said reset state until the emergency operation is terminated. The control module (20) comprises a plurality of processors, wherein the base controller (21) and the additional controller (23) are each implemented on at least one different processor.

2. The programmable electronic power regulator of claim 1, wherein, The control module (20) comprises a multi-core processor, wherein the base controller (21) and the additional controller (23) are each implemented on at least one different core of the multi-core processor.

3. The programmable electronic power regulator of claim 1, wherein, The power module (10) comprises a power module disconnect point (11) arranged between the power module (10) and the connection to the driver (80) and configured to receive the error signal (34) from the internal monitoring module (30) and, upon reception of the signal, to not forward the driver control signal (81) to the connection of the driver (80).

4. The programmable electronic power regulator of claim 1, wherein, An internal signal generator (40), an external signal generator (70) and / or an external monitoring module (50) are connected to the internal monitoring module (30), wherein the internal signal generator (40), the external signal generator (70) and / or the external monitoring module (50) are configured to send a data signal (41, 51, 71) to the internal monitoring module (30).

5. The programmable electronic power regulator of claim 1, wherein, ​ 6. The programmable electronic power regulator of claim 1, wherein, ​ 7. The programmable electronic power regulator of claim 1, wherein, ​ 8. The programmable electronic power regulator of claim 7, wherein, The external monitoring module (50) is an internal monitoring module (30) of another programmable electronic power regulator (200).

9. The programmable electronic power regulator of claim 1, wherein, The base controller (21) is connected to the internal monitoring module (30) and is configured to send a data signal (28) to the internal monitoring module (30).

10. The programmable electronic power regulator of claim 7, wherein, The internal monitoring module (30) is configured to evaluate the received data signal (28, 41, 51, 71) and to send an error signal (31, 32, 33, 34, 36) or a plurality of error signals (31, 32, 33, 34, 36) upon detection of a critical operating state.

11. The programmable electronic power regulator of claim 8, wherein, The internal monitoring module (30) is configured to send an error signal (32) to the base controller (21), wherein the base controller (21) is configured to trigger a restart of the base controller (21) upon receipt of the error signal (32).

12. The programmable electronic power regulator of claim 9, wherein, The internal monitoring module (30) is configured to send an error signal (33) to the base controller (21), wherein the base controller (21) is configured to prepare an emergency operation upon receipt of the error signal (33).

13. The programmable electronic power regulator of claim 1, wherein, Only the base controller (21) is configured to send a power module control signal (29) to the power module (10).

14. The programmable electronic power regulator of claim 1, wherein, The internal monitoring module (30) is configured to detect the end of the emergency operation and to switch the programmable electronic power regulator (200) from the emergency operation to the normal operation.

15. The programmable electronic power regulator of claim 1, wherein, The internal monitoring module (30) is an automatic control function unit of the programmable electronic power regulator (200) and is operable independently of the control module (20).

16. Use of a programmable electronic power regulator (200) according to any one of claims 1 to 15, characterized in that, The power regulator (200) is used to control a pitch system of a wind turbine, the pitch system being used to adjust a rotational position of at least one rotor blade on a rotor hub.

Images