Secure mobile access for on-load tap changer

Abstract

The invention relates to an on-load tap changer device (1), comprising: a control device (4) and an on-load tap changer (2); wherein the control device (4) is designed and arranged to establish a first data connection (21) with a first operating unit (20); the control device (4) is designed and arranged to establish a second data connection (31) with a second operating unit (30); the control device (4) is designed and arranged to grant access rights to the control device (4) and thus to the on-load tap changer (2) via respective data connections (21, 31) to the operating units (20, 30); the control device (4) is designed and arranged in such a way that a second data connection (31) between the second operating unit (30) and the control device (4) is prohibited as long as a first data connection (21) is present between the first operating unit (20) and the control device (4).

Description

Technical Field

[0001] The present invention relates to a on-load tap-changer device and a safe mobile access to the on-load tap-changer device, and in particular to a method for mobile access to the on-load tap-changer device. Background Art

[0002] For the maintenance of the on-load tap-changer, it is necessary to take all measures to protect the on-site maintenance technicians during the maintenance. Therefore, it is not uncommon to disconnect the entire tap transformer from the power grid for maintenance. However, this is both time-consuming and costly. Summary of the Invention

[0003] Therefore, the object of the present invention is to provide an on-load tap-changer device and a method for mobile access to the on-load tap-changer device, which can achieve safe and low-cost maintenance.

[0004] This object is solved by an on-load tap-changer device according to the independent claims and a method for mobile access to the on-load tap-changer device. Advantageous improvements are described in the dependent claims.

[0005] According to a first aspect, the present invention provides an on-load tap-changer device, comprising: a control device and an on-load tap-changer; the control device is configured and arranged to establish a first data connection with a first operating unit; the control device is configured and arranged to establish a second data connection with a second operating unit; the control device is configured and arranged to grant access rights to the control device and thus to the on-load tap-changer through the corresponding data connection with the operating unit; the control device is configured and arranged to prohibit the second data connection between the second operating unit and the control device as long as there is a first data connection between the first operating unit and the control device.

[0006] The on-load tap-changer device enables all data connections with the second operating unit to be prohibited if a maintenance technician connects to the on-load tap-changer device on-site by means of a first operating unit with near-field communication. Switching signals or other operating instructions from the second operating unit (e.g., from a remote control station) will be prohibited, so that only the on-site maintenance technician can operate the on-load tap-changer device or have access rights to the on-load tap-changer device. Fault situations on-site are avoided. During maintenance, a high level of safety for the maintenance technician is ensured.

[0007] The on-load tap changer can be constructed in any way and manner and can, for example, have a load switch and a selector. The load switch can, for example, have vacuum switch tubes or semiconductor switch elements. The operation of the on-load tap changer is preferably carried out by means of a motor drive device controlled by a control device. The motor drive device is mechanically connected directly or indirectly to the on-load tap changer.

[0008] The control device of the on-load tap changer device can be constructed in any way and manner and can, for example, have a first communication module, which is a near-field communication module. The first communication module monitors the near-field area within a radius of up to 20 meters of the on-load tap changer device. The first communication module is preferably a Bluetooth or wireless local area network (WLAN) module.

[0009] The control device of the on-load tap changer device can be constructed in any way and manner and can, for example, have a second communication module, which is a far-field communication module. The second communication module is preferably connected to a second operating unit or has a second data connection to the second operating unit. The second communication module is preferably LTE, 5G, MESH, LoRaWAN, low-power wide area network (LPWAN), such as Mioty or any mobile radio module.

[0010] The first operating unit can be constructed in any way and manner, for example as an external operating unit, in particular as a smartphone, personal digital assistant (PDA) or laptop. The first operating unit has a corresponding communication module, which corresponds to the first communication module of the control device and enables a data connection.

[0011] The second operating unit can be constructed in any way and manner, for example as an external operating unit, in particular as a server. The second operating unit has a corresponding communication module, which corresponds to the second communication module of the control device and enables a data connection. After establishing the first data connection, access to the control device and thus to the on-load tap changer device is granted to the first operating unit.

[0012] The control device is used to operate the on-load tap changer directly or indirectly. "Directly" means that the control device is constructed and arranged to independently control or operate the on-load tap changer by means of the motor drive device. "Indirectly" means that the control device is used as a connection link between the operating units and enables the operating units to operate the on-load tap changer by granting access rights.

[0013] The operating unit can be constructed arbitrarily, for example as an output unit and an input unit. "Output unit" means that the data and signals received by the control device are output in the form of data and diagrams. "Input unit" means that, for example, a switching instruction can be input into the operating unit, which switching instruction is then executed by the control device after being transmitted via the data connection.

[0014] In each data connection between the operating unit and the control device, data, signals, and / or control instructions / switching instructions can be transmitted; in other words, access to the control device is granted. These data connections are two-way data connections.

[0015] The control device of the on-load tap-changer device is thus arranged and constructed such that, in the presence of a first data connection with a first operating unit, the data connection with a second operating unit is prohibited. Here, access of the second operating unit is blocked while access of the first operating unit is granted. In the sense of the present invention, "prohibited" or "blocked" means that control instructions, switching instructions, and / or signals transmitted to or arriving at the control device via the second data connection are ignored and / or not further processed and / or deleted.

[0016] According to a second aspect, the present invention provides a method for mobile access to an on-load tap-changer device, comprising the following steps:

[0017] 1. Monitoring a near-field area by means of a control device and identifying a first operating unit;

[0018] 2. Establishing a first connection between the first operating unit and the control device;

[0019] 3. Creating a secure connection between the first operating unit and the control device;

[0020] 4. Establishing a first data connection between the first operating unit and the control device;

[0021] 5. Prohibiting a second data connection between a second operating unit and the control device by means of the control device.

[0022] Typically, the on-load tap-changer device at the site is connected to a second operating unit (i.e., a server). Data, signals, etc. of the on-load tap-changer are transmitted to the server via a second data connection by means of a second communication module of the control device. The server (i.e., the second operating unit) can process these data accordingly and derive operations such as operations for the on-load tap-changer, for example, switching instructions. Then, these switching instructions are transmitted to the control device via the second data connection and the on-load tap-changer is operated accordingly by means of a motor drive device. A first communication unit of the control device monitors the near-field area of the on-load tap-changer device. If now a maintenance worker carries the first operating unit on-site (i.e., in the immediate vicinity of the on-load tap-changer device), this will be detected by the first communication module. A first data connection (i.e., mobile access) is manually or automatically attempted between the first operating unit and the control device.

[0023] Monitoring of the near-field area by means of the first communication module of the control device can be carried out in any way and manner, in particular continuously or at specific predefined times. Identification of the first operating unit is carried out automatically. The near-field area is understood to be a radius of approximately 20 meters. The initial steps for creating a connection can be carried out by the control device or the maintenance technician via the first operating unit.

[0024] The second operating unit is accordingly constructed and set up to process the data and signals received via the second data connection and to derive therefrom operating and switching instructions for the on-load tap-changer device. This is thus possible because the second operating unit has access to the control device.

[0025] After establishing the first connection, an attempt is made to create a secure connection. Here, the trust relationship between the first operating unit and the control device is checked. For this purpose, the control device is accordingly constructed and set up or has corresponding means.

[0026] Furthermore, after establishing the secure connection, the first operating unit is authorized and authenticated by the control device. For this purpose, the control device is accordingly constructed and set up or has corresponding means. When the second data connection between the second operating unit and the control device is prohibited, the control device ignores and / or does not further process and / or deletes the instructions and / or signals from the second operating unit. Here, it is important that only the signals and instructions from the first operating unit are still executed and transmitted by the control device. Thus, the maintenance technician on site is protected; secure mobile access is achieved. This is achieved after a successful connection between the first operating unit and the control device, i.e., when the first operating unit has access to the control device. Description of the Drawings

[0027] Next, the invention and its advantages will be described in more detail with reference to the accompanying drawings. Among them:

[0028] - Figure 1 Shows a first embodiment of the on-load tap-changer device;

[0029] - Figure 2 Shows a method flow. Detailed Description of the Invention

[0030] Figure 1 Shows a first embodiment of the on-load tap-changer device 1, the first operating unit 20 and the second operating unit 30. Both the first operating unit 20 and the second operating unit 30 are external operating units. The on-load tap-changer device 1 has an on-load tap-changer 2, a motor drive device 3 and a control device 4. The on-load tap-changer device 1 is in particular constructed and set up by means of the control device 4 to establish a first data connection 21 between the on-load tap-changer device 1 (i.e., the control device 4) and the first operating unit 20.

[0031] The first operating unit 20 is preferably configured as a mobile terminal device, such as a smartphone, a laptop computer, etc. To establish the first data connection 21, the control device 4 has a first communication module 22, which is a near-field communication module and preferably establishes the first data connection 21 with the first operating unit 20 via Bluetooth or wireless local area network (WLAN). The first operating unit 20 is correspondingly configured and constructed so as to be able to enter into the first data connection 21 with the first communication module 22 and grant the first communication module access rights. The first data connection 21 is a two-way connection, in which data can be both sent and received by the control device 4 and by the first external operating unit 20.

[0032] The on-load tap-changer device 1 is in particular constructed and arranged by the control device 4 to establish a second data connection 31 between the on-load tap-changer device 1 (i.e., the control device 4) and the second external operating unit 30 and grant the second external operating unit access rights.

[0033] The second operating unit 30 is preferably configured as a server, a computer, etc. To establish the second data connection 31, the control device 4 has a second communication module 32, which is a far-field communication module and preferably establishes the second data connection 31 with the second operating unit 30 via LTE, MESH, 5G, LoRaWAN or any other mobile radio standard. The second operating unit 30 is correspondingly configured and constructed so as to be able to enter into the second data connection 31 with the second communication module 32. The second data connection is a two-way connection, in which data can be both sent and received by the control device 4 and by the second external operating unit 30.

[0034] The control device 4 of the on-load tap-changer device 1 is constructed and arranged to control the motor drive device 3 coupled to the on-load tap-changer 2 and thus operate the on-load tap-changer 2. For this purpose, the control device 4 has a corresponding processor and memory. The control device 4 may also include a voltage regulator, by means of which it is determined when the on-load tap-changer 2 must be operated.

[0035] Furthermore, the on-load tap-changer device 1 may have a current sensor and a voltage sensor, which are connected to the control device 4. These sensors can on the one hand be connected to the voltage regulator and on the other hand provide measurement data and signals, which are stored in the control device, processed and transmitted via the respective data connections to each of the said operating units.

[0036] In the case where there is a second data connection 31 between the on-load tap-changer device 1 and the second operating component 30, a switching instruction can be transmitted from the second operating component 30 to the control device 4; the second operating unit has access rights to the control device 4. The control device 4 grants the second operating component 30 access rights to the on-load tap-changer device 1 and thus grants access rights to the on-load tap-changer 4. The measurement data determined by the current sensor and the voltage sensor is transmitted to the second operating component 30 and forms the basis for possible switching instructions. Thus, the on-load tap-changer device 1 is controlled by means of the second operating component 30.

[0037] Therefore, the measurement data can be stored in the control device 4 itself or can also be stored in the second operating unit 30 and processed such that the on-load tap-changer device 1 or the on-load tap-changer 2 can be adjusted or operated. Additionally, the historical operating data determined in the on-load tap-changer 2 by means of the control device 4 can be transmitted via the second data connection 31 to the second operating unit 30 and evaluated at a subsequent point in time.

[0038] The data transmitted can preferably be a switching instruction for the on-load tap-changer, a fault message of the on-load tap-changer, measurement data of the sensor, etc.

[0039] The first operating unit 20 is preferably configured as a mobile device and mainly provides the possibility for maintenance technicians to connect to the on-load tap-changer device 1, i.e., mobile access. At this time, the maintenance technician is on-site, i.e., in the immediate vicinity of the on-load tap-changer device 1. If the first data connection 21 exists, the first operating unit 20 also has access rights to the on-load tap-changer device 1 and thus has access rights to the on-load tap-changer 4 or to the on-load tap-changer. The maintenance technician can send different instructions to the on-load tap-changer 4 or the on-load tap-changer device 1 via the control device 4 in order to trigger, for example, a manual switching process. Additionally, the maintenance technician can transmit the historical operating data determined in the on-load tap-changer 2 by means of the control device 4 to their mobile terminal device (i.e., the first operating unit 20) and evaluate it immediately or at a subsequent point in time.

[0040] However, for safety reasons, it is necessary that if the first operating unit 20 (i.e., the maintenance technician) is connected to the on-load tap-changer device 1, no other operating unit (i.e., thus also no second operating unit 30) can transmit a switching instruction to the on-load tap-changer 4. Therefore, the control device 4 is configured such that if a first data connection 21 exists between the control device 4 and the first operating unit 20, the second data connection is prohibited. "Prohibited" can mean, for example, that the second data connection 31 is disconnected, for example, by shutting down the second communication module 32. Additionally, "prohibited" can mean that incoming instructions entering via the second data connection are ignored, directly deleted, or not executed at all.

[0041] The control device 4 is also constructed and arranged to recognize the creation, elimination, and interruption of the connections with respect to the first data connection 21 and the second data connection 31.

[0042] Figure 2 A method flow for mobile access to the on-load tap-changer device 1 is shown, in which the first operating unit 20 is connected to the on-load tap-changer device 1 (in particular to the control device 4 of the on-load tap-changer device). The control device 4 of the on-load tap-changer device 1 monitors the near-field area (near-field communication channel) by means of the first communication module 22 of the control device 4 of the on-load tap-changer device and recognizes it when the first operating unit 20 attempts to establish a connection with the on-load tap-changer device 1 via this channel (step 40).

[0043] After establishing the first connection from the first operating unit 20 to the on-load tap-changer device 1, a secure connection is created in the next step 41. Here, the TLS protocol can be used as an example for the secure connection. Here, in the first step, an encrypted connection is established between the first operating unit 20 and the on-load tap-changer device 1. As an example, AES encryption can be used here and the Diffie-Hellman method can be used as an algorithm for key exchange.

[0044] In the next step 42, the trust relationship between the first operating unit 20 and the on-load tap-changer device 1 is also checked to rule out potential attacks such as man-in-the-middle attacks. For example, the RSA method can be used here.

[0045] In the next step 43, it is also necessary to check whether the user is actually allowed to log in to the on-load tap-changer device (authorization) and what permissions the user has (authentication). For this purpose, a signed JWT token can be used, which contains all the information required for authorization and authentication. By checking the signature of the token, it can be ensured that the content of the token has not been changed and that it concerns a valid token. Additionally, the other information of the token can be used to decide whether to grant the user access rights to the on-load tap-changer device 1.

[0046] If an error occurs during the creation of a secure first data connection; if the identity of the participating participants cannot be confirmed 100%, or if authorization or authentication fails, the connection is terminated (step 44). Additionally, when the connection creation fails, all information sent during the connection creation (such as certificates, basic values for calculating session keys, etc.) is deleted. Authorization and authentication are performed in step 45.

[0047] After the first operating unit 20 has successfully connected to the on-load tap-changer device 1 (i.e., a first data connection has been established) (step 46), the current state of the second data connection 31 is determined in step 47. Here, in particular, the setting regarding whether the data arriving at the on-load tap-changer device 1 via the second data connection should be discarded is determined. The current state of the second data connection 31 and in particular the setting regarding whether the data arriving via the second data connection should be discarded are stored in a non-volatile memory. Here, a flash memory can be used as the non-volatile memory. The setting indicating whether the data arriving via the second data connection should be discarded is set such that the arriving data is discarded. Thus, in step 48, the second data connection 31 between the second external operating unit 30 and the on-load tap-changer device 1 is prohibited.

[0048] List of reference numerals

[0049] 1. On-load tap-changer device

[0050] 2. On-load tap-changer

[0051] 3. Motor drive device

[0052] 4. Control device

[0053] 20. First operating unit

[0054] 21. First data connection

[0055] 22. First communication module

[0056] 30. Second operating unit

[0057] 31. Second data connection

[0058] 32. Second communication module

Claims

1. On-load tap-changer device (1), comprising: a control device (4) and an on-load tap-changer (2); wherein, the control device (4) is configured and arranged to establish a first data connection (21) with a first operation unit (20); the control device (4) is configured and arranged to establish a second data connection (31) with a second operation unit (30); the control device (4) is configured and arranged to grant access rights to the control device (4) and thus to the on-load tap-changer (2) through the corresponding data connections (21, 31) with the operation units (20, 30); the control device (4) is configured and arranged to prohibit the second data connection (31) between the second operation unit (30) and the control device (4) as long as there is a first data connection (21) between the first operation unit (20) and the control device (4).

2. The on-load tap-changer device (1) according to claim 1, wherein, the first operation unit (20) is an external operation unit.

3. The on-load tap-changer device (1) according to any one of claims 1 to 2, wherein, the second operation unit (30) is an external operation unit.

4. The on-load tap-changer device (1) according to any one of claims 1 to 3, wherein, the control device (4) has a first communication module (22), and the first communication module is a near-field communication module; the first operation unit (20) establishes a first data connection (21) with the control device (4) through the first communication module (22).

5. The on-load tap-changer device (1) according to any one of claims 1 to 4, wherein, the control device (4) has a second communication module (22), and the second communication module is a far-field communication module; the second operation unit (30) establishes a second data connection (31) with the control device (4) through the second communication module (22).

6. A method for mobile access to an on-load tap-changer device (1), comprising the following steps: monitoring a near-field area by means of a control device (4) and identifying a first operation unit (20); establishing a first connection between the first operation unit (20) and the control device (4); creating a secure connection between the first operation unit (20) and the control device (4); establishing a first data connection (21) between the first operation unit (20) and the control device (4); prohibiting, by means of the control device (4), a second data connection (31) between the second operation unit (30) and the control device (4).

7. The method according to claim 6, wherein, monitoring the near-field area is carried out by means of a first communication module (22) of the control device (4), and the first communication module identifies the first operation unit (20).

8. The method according to any one of claims 6 to 7, wherein, after creating the secure connection, verifying the trust relationship between the first operation unit and the control device (4).

9. The method according to any one of claims 6 to 8, wherein, Before establishing the first data connection (21), the first operation unit (20) is authorized and authenticated by the control device (4).

10. The method according to any one of claims 6 to 9, wherein, when the second data connection (31) between the second operation unit (30) and the control device (4) is prohibited, the control device (4) ignores and / or does not further process and / or deletes instructions and / or signals from the second operation unit.

Images