Method and system for handling physical intrusions in wind turbines

Abstract

A method for handling physical intrusions in a wind turbine (1) is disclosed. The intrusion detection system (3) detects an intrusion event in the wind turbine (1), generates a first intrusion alarm signal, and provides the first intrusion alarm signal to a control system (4) of the wind turbine (1). In response to receiving the first intrusion alarm signal, the control system (4) initiates at least one safety action at the wind turbine (1), where the at least one safety action comprises stopping power production of the wind turbine (1) and providing a second intrusion alarm signal to the intrusion monitoring system (6). The intrusion monitoring system (6) communicatively isolates the wind turbine (1).

Description

Technical Field

[0001] This invention relates to a method for handling physical intrusions into wind turbines, such as those located in remote locations (e.g., offshore sites). The method according to the invention aims to achieve the security of the intruder and the protection of the wind turbine's hardware and software. The invention also provides a system for performing this method. Background Technology

[0002] Wind turbines are typically located in remote locations to ensure sufficient distance from residential areas and to ensure adequate wind resources are available for their effective operation. These remote locations include offshore locations but can also be onshore. In any case, locating wind turbines in remote locations results in them being difficult to access. For example, maintenance technicians or monitoring personnel may need to spend one or more days to reach the remote location. Furthermore, routine manual monitoring of the site and / or effective fencing may not be an option to prevent or deter malicious intruders from entering the site and reaching the wind turbines within it. This is especially true when the wind turbines form part of a large-area wind farm. Therefore, a method and system are desired for addressing physical intrusions into wind turbines without requiring maintenance or monitoring personnel to be present at the wind turbine site. Summary of the Invention

[0003] The purpose of embodiments of the present invention is to provide a method for remotely handling physical intrusions in wind turbines in a safe and effective manner.

[0004] Another object of embodiments of the present invention is to provide a system for remotely handling physical intrusions into wind turbines in a safe and efficient manner.

[0005] According to a first aspect, the present invention provides a method for handling physical intrusions in a wind turbine, said wind turbine forming part of a wind farm comprising a plurality of wind turbines, said method comprising the following steps: Intrusion detection systems are used to detect intrusion events in the wind turbine. The intrusion detection system generates a first intrusion alarm signal and provides the first intrusion alarm signal to the control system of the wind turbine. In response to receiving the first intrusion alarm signal, the control system of the wind turbine initiates at least one security action at the wind turbine, wherein the at least one security action includes stopping the power generation of the wind turbine and providing a second intrusion alarm signal to the intrusion detection system, and The intrusion detection system communicatively isolates the wind turbine.

[0006] Therefore, according to a first aspect, the present invention provides a method for handling physical intrusions in wind turbines. In this context, the term "physical intrusion" should be interpreted as an event in which at least one intruder (in the form of an unauthorized or even malicious person) physically gains access to the wind turbine at its site. This is in contrast to electronic intrusions (such as cyberattacks), in which an intruder attempts to gain access to the wind turbine's electronic and / or communication systems from a location remote relative to the wind turbine. Thus, in events handled by the method according to the first aspect of the invention, the intruder is physically present at the wind turbine site.

[0007] A wind turbine is part of a wind farm, which consists of multiple wind turbines. In this context, the term "wind farm" should be interpreted as a collection of two or more wind turbines arranged within a limited geographical area, sharing various infrastructure such as access roads, communication lines, connections to the power grid, substations, etc.

[0008] In the method according to a first aspect of the invention, an intrusion event in the wind turbine is initially detected by means of an intrusion detection system. The intrusion detection system may include, for example, one or more associated sensors for detecting intrusion events, such as sensors detecting the opening of access doors formed in the wind turbine tower, movement sensors inside and / or adjacent to the wind turbine, etc. Therefore, the step of detecting an intrusion event may include detecting the presence of one or more persons inside or adjacent to the wind turbine. Alternatively or additionally, the step of detecting an intrusion event may include detecting that one or more components and / or equipment inside and / or at the wind turbine have been tampered with. In any case, the detection of the intrusion event occurs locally at the wind turbine, and the intrusion detection system may be an integral part of the wind turbine. Therefore, the detection of the intrusion event occurs immediately upon occurrence of the intrusion event and does not require maintenance or monitoring personnel to be present at the wind turbine site.

[0009] In response to the detection of an intrusion event, the intrusion detection system generates a first intrusion alarm signal and provides this signal to the wind turbine's control system. Therefore, the controller responsible for operating the wind turbine is notified that an intrusion event has occurred.

[0010] In response to receiving the first intrusion alarm signal, the wind turbine's control system initiates at least one safety action at the wind turbine. This safety action includes stopping the wind turbine's power production. Thus, the wind turbine enters a safe mode where no power production occurs. This ensures that the wind turbine cannot be operated in a manner that could damage the wind turbine or harm the power grid. Therefore, an intruder would not be able to operate the wind turbine in this way. Furthermore, stopping power production ensures that the voltage level occurring within the wind turbine does not pose a safety hazard to anyone inside the wind turbine, including an intruder.

[0011] The wind turbine's control system also provides a second intrusion alarm signal to the intrusion detection system. This second intrusion alarm signal can simply be the first intrusion alarm signal forwarded by the wind turbine's control system to the intrusion detection system. Alternatively, the second intrusion alarm signal can be different from the first intrusion alarm signal. In this case, the wind turbine's control system can generate the second intrusion alarm signal. For example, the second intrusion alarm signal may include information also included in the first intrusion alarm signal, and may also include additional information generated and / or added by the wind turbine's control system. In any case, the intrusion detection system is preferably not part of the wind turbine and can even be remotely located relative to the wind farm. The intrusion detection system can be associated with several wind turbines, for example, with all wind turbines in the wind farm. Therefore, the second intrusion alarm signal provided from the wind turbine's control system to the intrusion detection system constitutes communication leaving the wind turbine, notifying the intrusion detection system that an intrusion event has occurred at a given wind turbine.

[0012] In response to receiving a second intrusion alarm signal, the intrusion detection system communicatively isolates the wind turbine. This prevents all communication with the wind turbine, including communication signals sent by the wind turbine to entities outside the wind turbine and communication signals received by the wind turbine from entities outside the wind turbine. This prevents malicious intruders from reaching other entities that the wind turbine is normally communicatively connected to, such as other wind turbines, the wind farm's power plant controller, substations, SCADA systems, etc., from the wind turbine's communication system. This effectively limits intrusion events to the wind turbine to which an intrusion event has been detected. Furthermore, because the step of communicatively isolating the wind turbine is performed by the intrusion detection system, rather than by the wind turbine's control system, intruders will not be able to override the commands used to communicatively isolate the wind turbine.

[0013] Therefore, the method according to the first aspect of the invention allows for the safe, efficient and reliable handling of physical intrusions into wind turbines without the need for maintenance or monitoring personnel at the wind turbine site.

[0014] The at least one safety action may also include shutting down the wind turbine. According to this embodiment, in addition to stopping power production upon detecting an intrusion event, the wind turbine is also shut down. This prevents inertial coasting of the wind turbine and locks the rotor. Furthermore, the electrical system can be de-energized or shut down. This further prevents the wind turbine from operating in a manner that could damage the wind turbine, harm the power grid, or endanger people present inside the wind turbine.

[0015] Alternatively or additionally, at least one safety action may also include de-energizing one or more electrical components of the wind turbine. As described above, this can, for example, form part of the wind turbine shutdown process. De-energizing a given electrical component of the wind turbine protects the component from operation in a manner that could damage the component and in a manner that could cause the component to damage other components. The de-energized electrical component may include, but is not limited to, any electrical component that is part of the power output circuitry, particularly high / medium voltage components such as switchgear, converters, and / or transformers.

[0016] Alternatively or additionally, at least one security action may also include erasing confidential and / or sensitive data from one or more storage devices on the wind turbine. According to this embodiment, intruders are effectively prevented from gaining access to confidential and / or sensitive data stored at the wind turbine. Therefore, in addition to the physical and personal security measures described above, this also introduces cybersecurity measures.

[0017] Confidential and / or sensitive data may include, for example, encryption keys, data related to the control scheme of the wind turbine, operational data (such as sensor measurements), etc.

[0018] The steps of an intrusion detection system to communicatively isolate wind turbines may include interrupting communication between one or more of the other wind turbines in the wind farm and the wind turbine itself. According to this embodiment, malicious intruders are effectively prevented from gaining access to other wind turbines in the wind farm, thus effectively limiting intrusion events to the wind turbine where the intrusion event is detected. Furthermore, the wind farm's communication network may have a circular structure, in which each wind turbine communicates with its adjacent wind turbine, and only a limited number of wind turbines are able to communicate with the power plant controller and / or physical entities located outside the wind farm. In this case, if communication with an adjacent wind turbine is interrupted, communication to and from a given wind turbine is prevented.

[0019] Since the steps to interrupt communication with the wind turbines are performed by one or more of the other wind turbines in the wind farm, an intruder cannot prevent the interruption of communication by damaging the wind turbines' communication systems.

[0020] In response to the central intrusion monitoring facility receiving a second intrusion alarm signal, the central intrusion monitoring facility can instruct other wind turbines in the wind farm to suspend communication with the wind turbines. Alternatively, the second intrusion alarm signal can be directly provided to the other wind turbines, and the other wind turbines can respond to it without requiring commands or instructions from the central facility. In the latter case, the other wind turbines can be considered as part of the intrusion monitoring system.

[0021] The intrusion detection system may include a central intrusion detection facility, and the step of communicatively isolating a wind turbine may include interrupting communication between the wind turbine and the central intrusion detection facility. According to this embodiment, a second intrusion alarm signal may be provided from the wind turbine's control system to the central intrusion detection facility, and in response, the central intrusion detection facility prevents all subsequent communication to and from the wind turbine, including communication between the wind turbine and the central intrusion detection facility. Therefore, a malicious intruder will not be able to gain access to the central intrusion detection facility, and it will be impossible for them to gain access from there to other wind turbines communicatively connected to the central intrusion detection facility and / or other related infrastructure.

[0022] A central intrusion monitoring facility can be configured, for example, to monitor all or a subset of the wind turbines in a wind farm, at least regarding intrusion events and possibly also regarding other events such as weather events, operational and / or component failures, and / or for monitoring the operation of the wind turbines. For example, the central intrusion monitoring facility can be or form part of the power plant controller of the wind farm, in which case the central intrusion monitoring facility can be located within the wind farm. Alternatively, the central intrusion monitoring facility can be remotely located relative to the wind farm, and it can be configured to monitor wind turbines located in two or more independent wind farms.

[0023] The steps of an intrusion detection system to communicatively isolate a wind turbine may include interrupting all external communications to and from the wind turbine. According to this embodiment, intrusion events are effectively prevented from affecting other wind turbines in the wind farm and / or any other entities or infrastructure to which the wind turbine is normally communicatively connected.

[0024] The method may further include the following step: upon completion of a safety action, the wind turbine's control system reports the completion of the safety action to the intrusion detection system. According to this embodiment, the intrusion detection system receives confirmation that necessary and appropriate safety actions (including stopping power generation) have been performed at the wind turbine, thereby reassuring personnel operating the intrusion detection system that an intrusion incident is being handled appropriately. This may, for example, include transmitting the completion of the safety action to a central intrusion detection facility.

[0025] According to this embodiment, the intrusion detection system can delay the activation of communication isolation of the wind turbine until confirmation of completion of at least one security action has been received, because the communication isolation of the wind turbine will prevent such confirmation from the wind turbine's control system to the intrusion detection system. The completion of the security action can, for example, be reported to the intrusion detection system along with a second intrusion alarm signal, and may even form part of the second intrusion alarm signal.

[0026] The method may also include the following steps: allowing a predefined time period to elapse from the moment the wind turbine's control system receives the first intrusion alarm signal before the wind turbine's control system initiates at least one safety action.

[0027] When an intrusion is detected, it could be due to an unauthorized or even malicious intruder gaining physical access to the wind turbine. However, it could also be due to authorized personnel accidentally triggering the intrusion detection system, for example, by failing to disable alarms and / or switch the relevant components of the wind turbine to safe mode. In the latter case, at least one security action may not be required. Furthermore, once at least one security action has been performed, it can be difficult to get the wind turbine back into operation. For example, since the wind turbine has already been communicatively isolated as part of the response to the detected intrusion, getting the wind turbine back into operation may require maintenance personnel to be present at the wind turbine site. In cases where the wind turbine is located in a remote location, it could take several days for maintenance personnel to reach the wind turbine site. Therefore, in addition to the cost of dispatching maintenance personnel to the site, initiating at least one security action when the detected intrusion is actually due to the misconduct of authorized personnel can result in significant and unnecessary production losses for the wind turbine.

[0028] By allowing a predefined time period from the moment the wind turbine's control system receives the first intrusion alarm signal before initiating at least one safety action, authorized personnel who accidentally trigger the intrusion detection system will have time to reset the intrusion detection system, thereby canceling the automatic security procedure and preventing the initiation of at least one safety action.

[0029] Therefore, if a cancellation signal is received within a predefined time period, the wind turbine's control system can avoid initiating at least one safety action. As mentioned above, this cancellation signal can be provided by authorized personnel who accidentally trigger the intrusion detection signal.

[0030] The method may also include the following steps: a maintenance technician inspects the wind turbine and restores its operation. This may, for example, follow after the wind turbine has been shut down.

[0031] In any case, once an intrusion event has been detected, this raises suspicion that the intruder has gained physical access to the wind turbine. This typically involves a manual inspection of the wind turbine to investigate and repair any potential damage caused by the intruder. Furthermore, because the wind turbine is communicatively isolated as part of the security process following the detection of an intrusion, it will be impossible to remotely restore its operation (including restarting power production) because the communication isolation prevents the transmission of relevant control commands for this purpose. Therefore, scheduling maintenance access to the wind turbine by relevant maintenance technicians is usually appropriate as part of the security process following the detection of an intrusion.

[0032] According to a second aspect, the present invention provides an intrusion handling system for a wind turbine forming part of a wind farm comprising a plurality of wind turbines, the intrusion handling system comprising: An intrusion detection system configured to detect intrusion events in the wind turbine. The control system of the wind turbine is configured to initiate at least one safety action at the wind turbine. An intrusion detection system communicatively connected to the wind turbine and at least one other wind turbine in the wind farm. The intrusion detection system is configured to generate a first intrusion alarm signal in response to detecting an intrusion event in the wind turbine, and to provide the first intrusion alarm to the control system of the wind turbine. The control system of the wind turbine is configured to initiate at least one security action at the wind turbine in response to receiving the first intrusion signal, wherein the at least one security action includes stopping the power generation of the wind turbine and providing a second intrusion alarm signal to the intrusion detection system. The intrusion detection system is configured to communicatively isolate the wind turbine.

[0033] The intrusion handling system according to the second aspect of the invention is configured to perform the method according to the first aspect of the invention, and the comments set forth above with reference to the first aspect of the invention are therefore equally applicable herein.

[0034] An intrusion detection system may include a central intrusion detection facility. This has already been described above with reference to the first aspect of the invention.

[0035] Central intrusion detection facilities may be or form part of a central data collection and / or monitoring system for wind farms, and may be used in several wind farms, for example, in the form of a SCADA system. Attached Figure Description

[0036] Examples of the invention will now be described with reference to the accompanying drawings, in which: Figure 1 This is a block diagram illustrating a system according to an embodiment of the present invention, and Figure 2 This is a flowchart illustrating a method according to an embodiment of the present invention. Detailed Implementation

[0037] Figure 1 This is a block diagram illustrating an intrusion handling system for a wind turbine 1 according to an embodiment of the present invention. The wind turbine forms part of a wind farm comprising a plurality of additional wind turbines 2, two of which are illustrated in addition to wind turbine 1. Figure 1 The intrusion handling system shown can be operated in the following manner.

[0038] An intrusion detection system 3, which is part of or connected to the wind turbine 1, detects intrusion events in the wind turbine 1. This may include, for example, detecting the opening of a door of the wind turbine 1, movement inside or near the wind turbine 1, and / or detecting any other kind of event or action that may indicate physical intrusion into the wind turbine 1.

[0039] Upon detecting an intrusion event, the intrusion detection system 3 generates a first intrusion alarm signal and provides it to the control system 4 of the wind turbine 1. In response to receiving the first intrusion alarm signal, the control system 4 of the wind turbine 1 initiates at least one safety action. This includes forwarding control commands to one or more components 5 of the wind turbine 1 to stop the wind turbine 1 from generating electricity.

[0040] The control system 4 of wind turbine 1 also provides a second intrusion alarm signal to the intrusion detection system 6, which also communicates with other wind turbines 2 in the wind farm. The second intrusion alarm signal can be the same as the first intrusion alarm signal; in this case, the control system 4 of wind turbine 1 simply forwards the first intrusion alarm signal received from the intrusion detection system 3 to the intrusion detection system 6. Alternatively, the second intrusion alarm signal can be generated by the control system 4 of wind turbine 1 and is therefore different from the first intrusion alarm signal.

[0041] In response to receiving the second intrusion alarm signal, the intrusion detection system initiates communication isolation for wind turbine 1. Figure 1 In the illustrated embodiment, this includes instructing at least some other wind turbines 2 to interrupt communication with wind turbine 1. Furthermore, communication between the intrusion detection system 6 and wind turbine 1 can be interrupted.

[0042] Therefore, wind turbine 1 is now in a safe state where power generation has ceased, and this prevents wind turbine 1 from being operated in a manner that could cause damage to wind turbine 1 and / or to persons present in or near the wind turbine. Furthermore, wind turbine 1 is communicatively isolated to prevent malicious intruders from using wind turbine 1 to access other wind turbines 2 in the wind farm; intrusion detection system 6 and / or other types of infrastructure are typically communicatively connected to wind turbine 1.

[0043] Finally, the intrusion detection system 6 sends reports or logs about intrusion events and their handling to the external system 7, for example, to allow the external system 7 to track intrusion events.

[0044] Figure 2 This is a flowchart illustrating a method according to an embodiment of the present invention. The process begins at step 8. At step 9, it is investigated whether the intrusion detection system has detected an intrusion event in the wind turbine. If not, the process returns to step 9 to continue monitoring for intrusion events.

[0045] If step 9 reveals that an intrusion event has been detected in the wind turbine, the process is forwarded to step 10, where the intrusion detection system provides a first intrusion alarm signal to the wind turbine's control system. At step 11, the wind turbine's control system investigates whether a predefined time period has elapsed since receiving the first intrusion alarm signal. If not, the process returns to step 11 to wait for the predefined time period to elapse.

[0046] If step 11 reveals that a predefined time period has elapsed, the process is forwarded to step 12, where it is investigated whether a cancellation signal was received during the predefined time period. If the intrusion detection system is triggered due to an error, authorized personnel can reset the system and / or cancel the initiation of measures to handle the detected intrusion event by providing a cancellation signal to the wind turbine's control system within a predefined time period after receiving the intrusion alarm signal. Therefore, if step 12 reveals that a cancellation signal was received during the predefined time period, this indicates that the detected intrusion event was due to an error, and thus the handling of the intrusion event is suspended, and the process returns to step 9 to continue monitoring for the intrusion event.

[0047] If no cancellation signal is received during the predefined time period as disclosed in step 12, it can be assumed that the detected intrusion event is a real intrusion event, and therefore the process is forwarded to step 13, in which the wind turbine's control system initiates at least one safety action, including stopping the wind turbine's power production.

[0048] At step 14, the wind turbine's control system provides a second intrusion alarm signal to the intrusion detection system, and at step 15, the intrusion detection system communicatively isolates the wind turbine.

Claims

1. A method for handling physical intrusions in a wind turbine (1), said wind turbine (1) forming part of a wind farm comprising a plurality of wind turbines (1, 2), said method comprising the steps of: Intrusion events in the wind turbine (1) are detected by means of an intrusion detection system (3). The intrusion detection system (3) generates a first intrusion alarm signal and provides the first intrusion alarm signal to the control system (4) of the wind turbine (1). In response to receiving the first intrusion alarm signal, the control system (4) of the wind turbine (1) initiates at least one safety action at the wind turbine (1), wherein the at least one safety action includes stopping the power generation of the wind turbine (1) and providing a second intrusion alarm signal to the intrusion detection system (6), and The intrusion detection system (6) communicatively isolates the wind turbine (1).

2. The method according to claim 1, wherein, The at least one safety action also includes shutting down the wind turbine (1).

3. The method according to claim 1 or 2, wherein, The at least one safety action also includes de-energizing one or more electrical components (5) of the wind turbine (1).

4. The method according to any one of the preceding claims, wherein, The at least one security action also includes erasing confidential and / or sensitive data from one or more storage devices of the wind turbine (1).

5. The method according to any one of the preceding claims, wherein, The intrusion detection system (6) communicatively isolates the wind turbine (1) by interrupting communication between one or more of the other wind turbines (2) in the wind farm and the wind turbine (1).

6. The method according to any one of the preceding claims, wherein, The intrusion detection system (6) includes a central intrusion detection facility, and the step of wherein the intrusion detection system (6) communicatively isolates the wind turbine (1) includes interrupting communication between the wind turbine (1) and the central intrusion detection facility.

7. The method according to any one of the preceding claims, wherein, The steps by which the intrusion detection system (6) communicatively isolates the wind turbine (1) include interrupting all external communications to and from the wind turbine (1).

8. The method according to any one of the preceding claims further includes the following step: Upon completion of the safety action, the control system (4) of the wind turbine (1) reports the completion of the safety action to the intrusion detection system (6).

9. The method according to any one of the preceding claims further includes the following step: Before the control system (4) of the wind turbine (1) initiates the at least one safety action, a predefined time period is allowed to elapse from the time the control system (4) of the wind turbine (1) receives the first intrusion alarm signal.

10. The method according to claim 9, wherein, If a cancellation signal is received during the predefined time period, the control system (4) of the wind turbine (1) avoids initiating the at least one safety action.

11. The method according to any one of the preceding claims further includes the following step: The maintenance technicians inspected the wind turbine (1) and restored its operation.

12. An intrusion handling system for a wind turbine (1), the wind turbine (1) forming part of a wind farm comprising a plurality of wind turbines (1, 2), the intrusion handling system comprising: An intrusion detection system (3) is configured to detect intrusion events in the wind turbine (1). The control system (4) of the wind turbine (1) is configured to initiate at least one safety action at the wind turbine (1), and An intrusion detection system (6) is communicatively connected to the wind turbine (1) and at least one other wind turbine (2) of the wind farm. The intrusion detection system (3) is configured to generate a first intrusion alarm signal in response to the detection of an intrusion event in the wind turbine (1) and to provide the first intrusion alarm to the control system (4) of the wind turbine (1). The control system (4) of the wind turbine (1) is configured to initiate at least one security action at the wind turbine (1) in response to receiving the first intrusion signal, wherein the at least one security action includes stopping the power generation of the wind turbine (1) and providing a second intrusion alarm signal to the intrusion detection system (6). The intrusion detection system (6) is configured to communicatively isolate the wind turbine (1).

13. The intrusion handling system according to claim 12, wherein, The intrusion detection system (6) includes a central intrusion detection facility.

14. The intrusion handling system according to claim 13, wherein, The central intrusion monitoring facility (6) is or forms part of a central data collection and / or monitoring system for the wind farm.

Images