Software-based configuration of power levels and additional functionality of inverter
By checking and managing power level profiles in power electronic devices, and using encryption and signature mechanisms, the problem of legal activation during the device replacement process and preventing unauthorized operation is solved, and the security of device replacement and simplified process is achieved.
Patent Information
- Application Number
- CN202380085969.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2022-12-15
- Filing Date
- 2023-11-24
- Publication Date
- 2025-07-22
AI Technical Summary
In the prior art, power electronic devices are difficult to prevent abuse of old equipment and ensure legal activation of new equipment during replacement, and there is a lack of an effective anti-tampering mechanism.
By checking in the power electronics for an activated power level profile and allowing the device to run in the presence; using encryption and signature mechanisms to ensure that only authorized devices can activate and deactivate the profile; and setting up the boot, deactivate and activate modules in the device to ensure a legitimate device replacement process.
It realizes legal activation during the equipment replacement process and prevents unauthorized equipment from operating, ensures the safety and legality of the equipment, and simplifies the replacement process.
Smart Images
Figure CN120359690A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a method for operating a power electronic device and a power electronic device that can be operated with multiple different power level profiles. Background Art
[0002] Generating or converting electrical power by means of power electronic devices is becoming increasingly important, especially in the form of solar power plants, in which the power generated as a DC voltage by solar modules is converted into a grid-compliant AC voltage for feeding into the grid. Here, a power electronic device in the form of an inverter is used, and the rated power of the inverter is selected according to the maximum power that the solar modules can generate. Thus, hitherto it has been necessary to provide multiple inverter types with different rated powers in order to be able to equip a planned solar power plant optimally individually.
[0003] However, for reasons of efficiency, it is generally more advantageous for suppliers of such power electronic devices to provide a small number of several or only one device type instead of providing individual device types for the required rated power, and the rated power of the device type is only permanently specified as the desired value within the framework of the installation of the power plant. Here, this specification should be tamper-proof because, within the framework of the installation, on the one hand, the price of the power electronic device is usually also settled, and on the other hand, it is necessary to avoid overloading of the installation or insufficient power of the power plant. For this purpose, a power level profile containing information about the rated power is stored and activated in the power electronic device. Then, at the start of operation, the power electronic device checks whether there is an activated power level profile and operates the device according to the rated power stored in the activated power level profile. Alternatively, as described in the document "BPT-S 3-4.6 Operating Instructions" of Bosch Power Technologies GmbH, only at the time of commissioning are the corresponding locale language settings, country settings, and standard settings for the inverter achieved by means of an RFID card on which the data required for the settings are stored. For this purpose, the installer holds the RFID card in a predefined position on the inverter during the installation steps described in the instructions, whereby the setting parameters are permanently transmitted to the inverter. This method does not provide for selectively settling such activated power devices.
[0004] If now, for example, a flexible activatable power electronic device with multiple power level profiles is to be replaced due to a defect, it is desirable that the newly installed device can be activated in a simple manner by means of the activated power level profile of the old device, and in this case, abuse should be prevented in such a way that the continued operation of the old device is reliably prohibited and only the activation of exactly one new device can be achieved. Summary of the Invention
[0005] This task is solved by a method having the features of independent claim 1. Preferred embodiments of the method are the subject matter of the dependent claims. Additionally, this task is solved by a power electronic device having the features of independent claim 10, wherein advantageous configurations are the subject matter of the claims referring to this independent claim.
[0006] According to the invention, a method for operating a power electronic device includes, when the power electronic device starts operating, checking whether there is exactly one activated power level profile among a plurality of different power level profiles. Only if there is exactly one activated power level profile, is the device allowed to start operating under the conditions stored in the activated power level profile. Here, the activated power level profile can be selected by an installer from among a plurality of different power level profiles in the installed framework, or it can also be already activated at the factory or at other parts of the supply chain (e.g., at the dealer).
[0007] Here, for example, the power level profile is a data set stored in the device, especially a license file, which allows the operating system of the device to check whether the device can operate with the parameter set assigned to this power level profile, and additionally allows the following permanent marking: the device should also operate with this parameter set. In particular, the data set can also contain the following parameter set: the device can operate under this parameter set. Here, the power level profile does not need to contain all operating parameters, and can also contain or specify a selection of allowed pairs of values or allowed value ranges for the parameters. The term power level profile also does not imply that one of the parameters must necessarily be power, such as the rated power of the power electronic device.
[0008] The data set can also contain information about the appliance identification of the following device: the data set is set for the activation of the device. Thereby, it can be effectively prevented that a device different from the set device can be put into operation through the data set, for example, by simply copying the data set. An advantageous possibility is to encrypt, sign, or otherwise mark the data set such that the data set can only be decrypted or used when used in the following power electronic device: the power electronic device has the set appliance identification and / or has another key component, and the other encryption component is fixedly stored in the device.
[0009] Here, the device can include multiple power level profiles that can be activated. However, at most one of the power level profiles can be marked for operational use, i.e., activated. For example, the marking can be a specific entry in a dataset or the storage location of a dataset. To prevent abuse, the dataset can be encrypted and / or signed, or can be stored in a storage area of the device where only restricted access is allowed under conditions that meet security standards or upon demonstration of sufficient authorization.
[0010] In principle, the power electronics device can have only one power level profile that can be activated, but preferably there are multiple power level profiles that can be activated. However, only exactly one of the multiple power level profiles that can be activated is activated to allow operation to start. It can be considered that, upon activation of the selected power level profile, the remaining profiles are deleted from the power electronics device, but they can also be retained on the device as deactivated power level profiles such that they can be activated as an alternative at a later point in time if necessary.
[0011] Furthermore, the method according to the invention includes, in response to obtaining a request for deactivation sent by an authorized party, converting the activated power level profile into a deactivated power level profile and sending a deactivation confirmation signed with a secret stored on the device to the authorized party, wherein the deactivation confirmation includes the identification of the device and the identification of the deactivated power level profile. By signing, it can be ensured that a forged deactivation confirmation cannot be generated by an unauthorized person. At the same time, the signed deactivation confirmation ensures that the power level profile contained therein was activated and then deactivated on the device identified by the identification. Thus, the deactivation confirmation can be used like a one-time use voucher to activate the contained power level profile on other devices.
[0012] Sending the deactivation confirmation signed with a secret stored on the device to the authorized party also includes the case where the deactivation confirmation is sent to an authorized instance, such as the portal of the device manufacturer, and the authorized party can confirm receipt there.
[0013] To further safeguard the method against data loss, the activated power level profile can be converted into a deactivated power level profile only after obtaining a receipt confirmation of the deactivation confirmation from the authorized party. This also includes the case where the receipt confirmation is sent by an authorized instance, such as the portal of the device manufacturer. The sending of the receipt confirmation can also be triggered by the authorized party registering the deactivation confirmation in the instance.
[0014] To prevent accidental tampering with the method and thus harmful, unauthorized deactivation of the power electronic device, in one embodiment, the activated power level profile can only be converted to a deactivated power level profile after successful verification of the authorization for the deactivation request. For example, it can be set that only the initial installer or a person having a pre-given secret, such as a data key, can effectively send a request for conversion to the device. This possession can be verified by means of known encryption methods, such as the Diffie-Hellman method (Diffie-Hellman-Verfahren).
[0015] To reliably rule out unauthorized reactivation of the power electronic device, the conversion of the activated power level profile can include deletion of the activated power level profile. Similarly, the conversion can include an immediate end to the operation of the device, such that unauthorized continued operation is also prohibited.
[0016] In another aspect, which does not relate to the commissioning of a failed power electronic device but rather to the commissioning of a replacement appliance, the method further includes the following steps: in response to a further request for activating a power level profile, where the further request includes a proof of authorization for activation, an identifier of the power level profile to be activated, and an identifier of the device to be activated, if activation preconditions are present, activate the power level profile to be activated. The activation preconditions include the consistency of the identifier of the device to be activated with the identifier of the device on which the method is implemented and the validity of the proof of authorization. The validity of the proof of authorization can be achieved by signing the further request using the signature key of the sender of the further request. The signature can be authenticated by the power electronic device in a known manner. The creation of a request that meets the activation preconditions can be supported by an application such that the activation can be simply carried out by an authorized party. The application can preferably be installed on a mobile terminal appliance or a separate computing unit. This action can be recorded by the application and, if necessary, transmitted to a central instance, such as the portal of the device manufacturer, and / or can be enabled by the central instance.
[0017] Additionally, the activation preconditions can include that there is no already activated power level profile on the device. If there is an already activated power level profile, the power level profile to be activated is not activated, and the sender of the further request is preferably notified of this by means of an appropriate reply.
[0018] Alternatively, the activation of the power level profile to be activated may include the deactivation of another power level profile that may already be activated. In this case, the sender of the other request may also be notified by a corresponding response. The response may include a further deactivation confirmation to enable the further use of the deactivated power level profile on other appliances. The further deactivation confirmation may be signed with a secret stored on the device, where the further deactivation confirmation includes the identification of the device and the identification of the other deactivated power level profile. If there is already an activated power level profile, the choice between the two alternative options may also be made in a dialogue with the sender of the other request.
[0019] In another aspect of the invention, the power electronic device includes a startup module that is configured to, when the device starts to operate, check whether there is exactly one activated power level profile among a plurality of different power level profiles, and put the device into operation under the conditions stored in the activated power level profile if there is exactly one activated power level profile, otherwise not put the device into operation. Additionally, the power electronic device includes a deactivation module that is configured to, when a deactivation command is received from an external unit, check the authorization of the deactivation command, and if the authorization is confirmed after the check, convert the activated power level profile into a deactivated power level profile and send a deactivation confirmation signed with a secret stored on the device to the external unit, where the deactivation confirmation includes the identification of the device and the label of the deactivated or deleted power level profile.
[0020] In an advantageous configuration, the power electronic device may be configured as an inverter. In particular, the power level profile may include the maximum converter power. In particular, additionally or alternatively, the power level profile may include at least one of the following power characteristics:
[0021] - Maximum reactive power,
[0022] - Activation options for the operating mode of forming a power grid, and
[0023] - Activation options for the operating mode of supporting a power grid. Description of the Drawings
[0024] Hereinafter, the present invention is illustrated with the aid of the drawings, in which:
[0025] Figure 1 An exemplary process of appliance replacement when using the method according to the present invention is shown,
[0026] Figure 2Shows the configuration of a power electronic device according to the present invention. Detailed implementation
[0027] In Figure 1 An exemplary process for the replacement of an appliance of a power electronic device according to the present invention is shown. The participants in this replacement are: installer 1, application 2 (especially as an application program on the mobile appliance of installer 1), old appliance 3 to be replaced, new appliance 4 to replace old appliance 3, and central instance 5 (the central instance can especially be a portal installed on a remote server, which can be accessed through a data remote connection).
[0028] At the start of the process, in the first action 10, installer 1 selects in application 2 the function for initiating the appliance replacement to stop the operation of old appliance 3. Then, in the second action 11, application 2 sends a deactivation command to old appliance 3 and requests the appliance identification from the old appliance. In response to the receipt of the deactivation command, in the third action 12, old appliance 3 deactivates the license file of the activated power level profile of the old appliance. Additionally, in the fourth action 13, old appliance 3 sends its appliance identification back to application 2 according to the request. Optionally, in the fifth action 14, old appliance 3 sends a confirmation to application 2 regarding the deactivation of the power level profile. This deactivation confirmation can also be sent in the fourth action 13 together with the appliance identification, and especially and independently of this can also include the deactivated license file. Additionally, in the sixth action 15, old appliance 3 stops operating.
[0029] In a preferred embodiment, in the seventh action 16, application 2 sends the deactivation confirmation together with the appliance identification of old appliance 3 to central instance 5. Here, in the eighth action 17, the deactivation of old appliance 3 can be permanently registered and / or the deactivated power level profile can be pre-recorded for later activation on the replacement appliance. Instead of application 2, old appliance 3 itself can also send the deactivation confirmation together with the appliance identification to central instance 5.
[0030] Advantageously, in the ninth action 18, application 2 also permanently stores the appliance identification and the deactivated power level profile or the deactivated license file so that the power level profile of the replacement appliance can be activated at a later point in time with the aid of this information. Since a data connection to central instance 5 is not required subsequently, the activation of the replacement appliance can be simplified in this way.
[0031] After the above actions are completed, in the tenth action 19, installer 1 can remove old appliance 3 and, if necessary, can clean the old appliance, can send the old appliance for repair, or can also sell the old appliance. Then, in the eleventh action 20, the installer can install new appliance 4 and start it up.
[0032] To put the new appliance 4 into operation, in the twelfth action 21, the installer 1 selects on the application 2 the function for setting up the replacement appliance. In the thirteenth action 22, the application 2 requests the appliance identifier of the new appliance 4, to which, in the fourteenth action 23, the new appliance sends its appliance identifier back to the application 2. After checking whether the new appliance 4 is suitable for activation by means of the deactivated power level profile of the old appliance 3 based on the received appliance identifier, in the fifteenth action 28, the application 2 sends a request to the new appliance 4 for activating the power level profile, which request includes information about the power level profile to be activated or the corresponding license file, and the new appliance activates the corresponding license file and can start operating with the relevant power level profile (actions 29 and 30). Here, the power level profile to be activated or the corresponding license file can also already be stored on the new appliance 4 (as a still deactivated power level profile).
[0033] If the license file or the information about the power level profile to be activated is not stored on the application 2 but only on the central instance 5, the application 2 requests from the central instance 5 the information required for activating the power level profile (action 24), where the query contains the appliance identifier of the old appliance 3, by means of which the power level profile to be activated and the authorization for activation are checked. If the query also contains the appliance identifier of the new appliance 4, the central instance 5 can also check the suitability of the new appliance 4 for activation. Subsequently, the result of the check is communicated to the application 2. In the case of a successful check of the query, the central instance 5 compiles the information for the power level profile to be activated or the corresponding license file (action 25) and sends this information back to the application 2, which can thus complete the activation of the new appliance 4 (action 27). Here, the central instance 5 marks the power level profile to be activated as used or deletes it permanently, such that only a one-time (re)activation can be achieved and renewed queries for activating the same power level profile remain unsuccessful. It is also possible to consider registering the activated power level profile under the appliance identifier of the new appliance 4.
[0034] In Figure 2An exemplary configuration of the power electronics device 34 according to the present invention is shown. The device has a communication module 120 through which the device 34 can exchange data with an application 2 installed on a mobile appliance (such as a smartphone) or also with a remote central instance 5. This data exchange can be carried out wired or also wirelessly via a radio connection. In particular, the communication module 120 can be set up to carry out manufacturing and data transmission by means of a secure, for example encrypted, connection. In addition, the communication module 120 is set up to exchange data with other modules within the device 34 via a data bus. The individual modules can be configured as separate electronic components or as separate program components of the software architecture of the operating system of the device.
[0035] In addition, the device 34 has a startup module 100 which is set up and determined to, when the device starts running, check whether exactly one activated power level profile out of a plurality of different power level profiles exists, and, in the case where exactly one activated power level profile exists, put the device into operation under the conditions stored in the activated power level profile, otherwise not put the device into operation. For this purpose, the startup module 100 accesses in a read-only manner a secure area 140 in which the power level profiles are stored. In the case of a successful check, the startup module 100 transmits a command for starting operation to the control module 150. This check is carried out each time the device starts running, such that operation of the device 34 without an activated power level profile is effectively prevented.
[0036] In addition, the device 34 includes a deactivation module 110 which is set up and determined to, in the case of receiving a deactivation command from an external unit (here a deactivation command for an old appliance triggered by an installer 1 in the framework of an appliance replacement with the aid of the application 2), check the authorization of the deactivation command. Such a command is forwarded by the communication module 120 to the deactivation module 110. For this purpose, the deactivation command contains an identifier of the sender of the command, which is compared with authorization information which is preferably also stored in the secure area 140.
[0037] In the case where the authorization is confirmed after inspection, the deactivation module 110 is deactivated from accessing the protected area 140 in a write manner, and the activated power level profile is converted into a deactivated power level profile. This can be achieved by changing the power level profile or by deleting the power level profile. Additionally, the deactivation module 110 causes a deactivation confirmation signed with the secret stored on the device to be sent back to the external unit via the communication module 120, where the deactivation confirmation includes the identification of the device and the marker of the deactivated or deleted power level profile. With this information, the sender can later activate the same power level profile on a new appliance replacing the old one.
[0038] Alternatively or additionally, the communication module 120 can send the deactivation confirmation to the central instance 5 for storage there, where the central instance confirms the receipt to the application 2 if necessary.
[0039] In an advantageous embodiment, the power electronics is configured as an inverter.
[0040] Additionally, the power electronics 34 includes an activation module 130 that is used when activating the power level profile on a new appliance within the framework of appliance replacement. If the communication module 120 receives a request to activate the power level profile, the communication module forwards the request to the activation module 130. Here, the request contains the identification of the power level profile to be activated and the identification of the device to be activated, in particular its appliance identification. The request may also contain the power level profile to be activated itself. After checking the authorization of the sender of the request and the applicability of the power level profile to be activated on the device 34 (if necessary by comparing with the corresponding information stored in the protected area 140), the activation module 130 performs the transfer of the power level profile to be activated into the protected area 140 or changes the power level profile already existing in the protected area 140 into an activated power level profile. If there is already an activated power level profile there, alternatively the activated power level profile can be deactivated or the request to activate the power level profile can be rejected.
[0041] The activation module 130 can feedback a message to the sender via the communication module 120 regarding the success or rejection of implementing the request to activate the power level profile. Additionally, the activation module 130 can directly report the activation success to the control module 150, which immediately starts the operation of the device 34 according to the pre - specification of the activated power level profile.
[0042] List of reference signs
[0043] 1 Installer
[0044] 2 Applications
[0045] 3 Old Appliances
[0046] 4 New Appliances
[0047] 5 Central Instance
[0048] 10 - 30 Actions
[0049] 34 Power Electronics
[0050] 100 Startup Module
[0051] 110 Shutdown Module
[0052] 120 Communication Module
[0053] 130 Activation Module
[0054] 140 Protected Area
[0055] 150 Control Module
Claims
1. A method for operating a power electronic device, the method comprising: - At startup, checking whether exactly one activated power level profile among a plurality of different power level profiles exists, and only allowing the device to start operating under the conditions stored in the activated power level profile if exactly one activated power level profile exists, - In response to obtaining a request for deactivation (11) sent by an authorized party, converting (12) the activated power level profile into a deactivated power level profile and sending (14) to the authorized party a deactivation confirmation marked with a secret stored on the device, wherein the deactivation confirmation includes the identification of the device and the identification of the deactivated power level profile.
2. The method according to claim 1, wherein, The conversion (12) is performed after receiving an acknowledgment of receipt of the deactivation confirmation from the authorized party.
3. The method according to claim 1 or 2, wherein The activated power level profile is converted (12) into a deactivated power level profile only after successfully checking the authorization of the request for deactivation.
4. The method according to any one of the preceding claims, wherein, The conversion (12) includes deletion of the activated power level profile.
5. The method according to any one of the preceding claims, wherein, The conversion (12) includes ending (15) the operation of the device.
6. The method according to any one of the preceding claims, the method further comprising: In response to a further request for activating a power level profile (28), wherein the further request includes proof of authorization for the activation, the identification of the power level profile to be activated, and the identification of the device to be activated, if activation preconditions exist, activating the power level profile to be activated, wherein the activation preconditions include the consistency of the identification of the device to be activated with the identification of the device implementing the method and the validity of the proof of authorization.
7. The method according to claim 6, wherein The activation preconditions further include that no already activated power level profile exists on the device.
8. The method according to claim 6, wherein Activation (29) of the power level profile to be activated includes deactivating any other already activated power level profiles that may exist.
9. The method according to claim 8, wherein Deactivation of an already existing power level profile includes sending a further deactivation confirmation signed with a secret stored on the device, wherein the further deactivation confirmation includes the identification of the device and the identification of the further deactivated power level profile.
10. A power electronic device, the power electronic device comprising: - A startup module (100) configured to, at startup of the device, check whether exactly one activated power level profile among a plurality of different power level profiles exists and, if exactly one activated power level profile exists, put the device into operation under the conditions stored in the activated power level profile, otherwise not put the device into operation, and - Deactivation module (110), which is configured to, in the case of receiving a deactivation command from an external unit, check the authorization of the deactivation command, and in the case where the authorization is confirmed after the check, convert the activated power level profile into a deactivated power level profile and send a deactivation confirmation signed with the secret stored on the device to the external unit, wherein the deactivation confirmation includes the identification of the device and a marker of the deactivated or deleted power level profile.
11. The power electronic device according to claim 10, wherein the power electronic device is configured as an inverter.
12. The power electronic device according to claim 11, wherein, The power level profile includes the maximum converter power.
13. The power electronic device according to claim 11, wherein, The power level profile includes at least one of the following power characteristics: - Maximum reactive power, - Activation options for forming the operating mode of the power grid, and - Activation options for supporting the operating mode of the power grid.
14. The power electronic device according to any one of claims 10 to 13, wherein the power electronic device further comprises an activation module (130), the activation module (130) being configured to, in response to a further request for activating a power level profile, wherein, The additional request includes a proof of authorization for the activation, the identification of the power level profile to be activated, and the identification of the device to be activated. If activation preconditions exist, the activation of the power level profile to be activated is performed, wherein the activation preconditions include the consistency between the identification of the device to be activated and the identification of the device implementing the method and the validity of the proof of authorization.