Efficient updating of software of a multiplicity of low-voltage elements that are able to communicate

Abstract

The invention relates to an updating of software of a multiplicity of low-voltage elements (ED) that are able to communicate. In this case, the low-voltage elements (ED) are arranged in groups and the individual groups of low-voltage elements (ED) are updated in succession. In contrast, the low-voltage elements (ED) in a group are updated substantially at the same time. This makes it possible to update the software of a networked system of low-voltage components more efficiently and more quickly.

Description

[0001] Description

[0002] Ef fi cient software update of a variety of communication-capable low-voltage devices

[0003] The invention relates to a method, a control device and a system for updating the software of a plurality of communication-capable low-voltage elements.

[0004] In low-voltage technology, there is a wide variety of circuit breakers that fulfill different protective functions. Common examples are residual current circuit breakers (also known as RCDs or residual current breakers), miniature circuit breakers (also known as MCBs or miniature circuit breakers) and fire protection devices (also known as AFDDs or arc fault detection devices). Different functions can also be implemented in one switch, see DE 10 2010 021 068 Al (AFDD + MCB), DE 10 2016 223 264 Al (AFDD + RCD) and DE 10 2016 218 960 Al (AFDD + RCBO, where an RCBO (residual current operated circuit breaker with overcurrent protection) combines the functions of an RCD and an MCB). The latest developments are aimed at protective switches based on semiconductor switches.These are subsumed under the term SSCB (solid state circuit breaker) and can in principle implement optional circuit breaker functions through the installed software.

[0005] Typically, a large number of circuit breakers are used together. The breakers are often arranged together in a control cabinet. Mounting rails or top-hat rails are typically used for the arrangement, onto which the breakers are mounted and locked using a clamping mechanism.

[0006] In recent years, circuit breakers have increasingly been equipped with interfaces for wireless communication. Figure 1 shows how several low-voltage elements (e.g., low-voltage protective devices or circuit breakers) EDI, EDI, ED3, ... EDn are wirelessly connected to a data collector or data concentrator ZC. Communication takes place via the Zigbee protocol. Data for applications can then be sent directly or indirectly to the cloud via the data collector ZC. The data concentrator ZC can also be used to flexibly configure the provision of data in the cloud, e.g., with regard to settings, data adjustments, and transmission options.

[0007] Some of the low-voltage elements EDI, ED2, ED3, etc. EDn may not be capable of communication themselves. This is then achieved via mechanical coupling with a communication module. Such a module is described, for example, in DE 202021000293 UI.

[0008] Whenever communication-capable low-voltage elements are referred to below, the term "communication-capable low-voltage elements" also includes a combination of a low-voltage element that is not independently communication-capable (in particular low-voltage switches such as RCDs or MCBs without a wireless communication interface) with such a communication module.

[0009] The invention aims to improve the software update of a variety of low-voltage elements.

[0010] This object is achieved by a method according to claim 1, a control device according to claim 9 or a system according to claim 10.

[0011] Advantageous further developments of the subject matter of the invention are specified in the subclaims.

[0012] A method is proposed for updating the software (e.g. firmware) of a large number of communication-capable low-voltage elements (in particular circuit breakers, communication-capable fuses (smart fuses) and measuring devices). The low-voltage elements are arranged in groups and these groups of low-voltage elements are updated one after the other. The low-voltage elements in a group, however, are not updated one after the other, but essentially at the same time. "Essentially at the same time" means that the individual low-voltage elements are updated in parallel to ensure the update is as quick as possible. For technical reasons, the update for the individual low-voltage elements may not be entirely simultaneous. Individual steps of the update process can also take place one after the other, e.g.with regard to resource-optimised downloading of software by several low-voltage elements from a single data concentrator. But overall the temporal overlap of the updates of the individual low-voltage elements dominates, so that this update of the low-voltage elements in a group is described by the terms "parallel" or "essentially simultaneous". The term "update" refers to situations in which similar software is to be transferred to a number of end devices. This can also involve new software packages (e.g. transfer of license files). If the update is meant in the narrower sense of a new version of software already present on the end device, the term "update" is used.

[0013] In exceptional cases, a group of low-voltage elements may also comprise only one element. This is because the procedure is applicable even if at least one group with more than one element exists. This can be verified after the low-voltage elements have been arranged in groups. If no groups with multiple elements exist, the individual low-voltage elements can be updated consecutively.

[0014] The term "multiple" means "three or more." This definition is also logical from a technical perspective, because the process can be carried out with three or more low-voltage elements (two groups of low-voltage elements, one group with two elements, and one with one element).

[0015] According to a development of the method, a control device (can also be a system of control devices) communicates with the low-voltage elements (e.g., using a radio protocol such as Bluetooth, Zigbee, Thread, etc.) to control at least parts of the update process. The low-voltage elements of at least a first group then send status information to the control device when the update has been successfully carried out, and the update of a second group of low-voltage elements is started when all low-voltage elements of the first group have sent status information to the control device, signaling that the update has been successfully carried out.Preferably, the low-voltage elements of all groups send status information to the control device, and an update is only carried out for all groups once the low-voltage elements of the group preceding them in the processing order have all sent status information that signals that the update has been carried out successfully. The control device can also be a system with several physical devices, which then preferably communicate with each other. Such a constellation is conceivable if the groups become very large (e.g. updating all the switches in a large building or factory). According to a further development, the low-voltage elements of the first group also send status information to the control device if the update could not be carried out successfully.This can prevent a situation where a message about the completion of the update of a low-voltage element is waited for in vain. In such a case, it is conceivable that the unsuccessful update is attempted again and, if successful, the next group is started. It is also possible that, as an exception, the update is repeated in parallel with the update of the next group. The update of the second group may then be started as soon as status messages have been received from all low-voltage elements in the first group that are to be updated, regardless of whether these messages signal success or cancellation of the updates. This can be further refined by requiring a predefined number or percentage of updates to be successful before the update of the second group is started. If, for example,If this criterion is not met , an attempt will be made to update the low - voltage elements of the first group for which the update was not completed correctly in the first attempt .

[0016] According to a further development of the embodiments described in the previous paragraph, when an update is aborted, the low-voltage elements generate error information, which can be used to determine the process during which the update was aborted. This error information or information derived therefrom (e.g., a percentage characterizing the successful part of the update) is then sent to the control device along with the status information regarding the unsuccessful update.

[0017] One embodiment of the method according to the invention provides that the update is started by an application on a terminal device (desktop, laptop, cell phone, etc.). To start the update, the application then sends a message or a command to the control device. According to a further development, group status information is then generated from the status information of the low-voltage elements of a group and this is transmitted from the control device to the application. In this way, the application preferably receives group status information for all groups consecutively. It is possible to also communicate the status of the individual terminal devices when transmitting the group status.Preferably, however, the application has the group division (which originates from the application or was transmitted to it by the control device) and can thus determine the individual updated end devices based on successful group updates and optionally display them.

[0018] In the method according to the invention, the arrangement of the low-voltage elements in groups can be carried out, for example, according to the type of low-voltage element (e.g. RCD, MCB, AFDD, Smart Fuse, measuring device, etc.) or according to the similarity of the software of the low-voltage elements (low-voltage elements with identical software are assigned to a group - in this case it is conceivable that the control device of low-voltage elements queries identification information about the software (possibly including the software version if this is not already available). It may be that not all low-voltage elements that meet the criteria for classification in this group are assigned to this group. This can be the case, for example, if there are a large number of low-voltage elements of one type and, for reasons of efficiency, these are divided into two or more groups for updating, i.e.only subsets of low-voltage elements of a type are then updated simultaneously.

[0019] The invention also relates to a control device for controlling at least parts of the process of updating the software (e.g. firmware) of a large number of communication-capable low-voltage components. This control device is then designed to arrange the low-voltage elements in groups, to support a consecutive update of the groups of low-voltage elements and to communicate with the low-voltage elements essentially simultaneously for an essentially simultaneous update of the low-voltage elements. The control device can also be a system with a plurality of physical devices, which then preferably communicate with one another. The control device can be part of a system which has a large number of communication-capable low-voltage elements or-components with updatable software and possibly also a terminal device with an application designed to initiate a software update of the plurality of communication-capable low-voltage elements. The arrangement of the low-voltage elements in groups can be carried out, for example, by the control device or by the application. In the former case, logic or rules for the arrangement can be transmitted from the application to the control device; in the latter case, the arrangement can be communicated from the application to the control device.

[0020] The invention is described in more detail below within the framework of an exemplary embodiment using the figures. They show:

[0021] Fig. 1: a data collector and low-voltage protection devices that are wirelessly connected,

[0022] Fig. 2: a flow chart for an inventive updating of low-voltage elements,

[0023] Fig. 3: a more detailed section of an update process like Fig. 2, and

[0024] Fig. 4: a flow chart for determining a status message of an update of a low-voltage element, possibly together with information as to which processing step was aborted.

[0025] Fig. 1 shows how several low-voltage elements (e.g. low-voltage protective devices or breakers) EDI, ED2, ED3 and EDnn are wirelessly connected to a data collector or data concentrator ZC (ZC stands for Zigbee coordinator). Communication takes place via the Zigbee protocol. Data for applications can then be sent directly or indirectly to the cloud via the data collector ZC. The data concentrator ZC can be used to flexibly structure the provision of data in the cloud, for example with regard to settings, data adjustments and transmission options. In the other direction, the data concentrator ZC can be used for the low-voltage elements EDI, ED2, ED3 and EDn to change settings, update software and initiate tests. This data concentrator ZC takes over control functions in the course of the inventive procedure and thus corresponds to a control device used above in embodiments of the subject matter of the invention.

[0026] The procedure according to the invention is described below for a constellation corresponding to Fig. 1, i.e. a large number of low-voltage elements that communicate via a data concentrator ZC. Communication via the data concentrator ZC is an optional embodiment. In the specific exemplary embodiment, the data concentrator ZC also serves for protocol adaptation. It is therefore equally conceivable for the invention to be used for a large number of low-voltage elements that communicate without a data concentrator ZC. The low-voltage elements ED1, ED2, ED3 ... EDn from Fig. 1 typically form an interconnection or system, e.g., by being responsible as a whole for power distribution and power protection functions in a defined area. Below, the entirety of these low-voltage elements is also referred to as a "system" or "system interconnection."

[0027] Fig. 2 shows a flow diagram in which an app performs a software update (hereinafter the term "update" is subsumed under the term "update") via a data concentrator ZC on low-voltage elements EN configured as Zigbee end devices (hereinafter abbreviated as "end devices" - in the Zigbee protocol this role is often referred to with the abbreviation ED (End Device)). The app is, for example, the Powerconfig PC Windows application from Siemens and the data concentrator is the product commercialized under the name "Powercenter 1000".

[0028] Product from Siemens. An app can be used to download and start an update package for the system from a support portal of the manufacturer of the end devices ED. The update package contains signed firmware images of all end devices in the system network, thus ensuring compatibility between the end devices. The app recognizes devices connected to a Zigbee coordinator (in Fig. 2 this is the data collector ZC) using their MLFBs (machine-readable manufacturer designation). Devices of the same type, e.g. AFDDs, are divided into update groups. The logic for this division is stored in the app. During the system update, the app first updates the Zigbee coordinator ZC in two steps, each with a file transfer via Modbus TCP for the “App Controller” and “Com Controller” programs (applications on Powercenterl OOO). The first device group is then prepared for the update.Device groups are prepared for the update using a Modbus TCP command, which is passed on from the Zigbee coordinator ZC to the end devices. The Zigbee coordinator remembers the end devices that should receive an update as part of the update of the corresponding group. The update is then passed from the app to the Zigbee coordinator ZC using Modbus TCP and internal Modbus RTU communication and buffered in the flash memory of the COM controller. The update file in the Zigbee coordinator ZC is in the standardized Zigbee OTA (over-the-air) file format and contains a proprietary update file in a signed, proprietary format and can only be downloaded by the manufacturer's devices. As soon as the update file is available, the previously instructed Zigbee end devices EN start a download independently.After receiving the "Start FW Update" command, all devices poll the Zigbee coordinator ZC until it reports back that a suitable update is available after receiving the "Start FW Update" command. The update process is terminated after a successful update or a timeout. According to the invention, groups of devices of the same type are downloaded in parallel. This means that the update time can be roughly halved (instead of 2 hours for 24 devices, e.g. AFDDs, this results in 1 hour, or for so-called Zigbee Sleepy End Devices (Sleepy End Devices SEDs are a category of Zigbee end devices that have a sleep mode to reduce energy consumption), e.g. for the fuses with measuring and communication function commercialized by Siemens AG under the name "SENTRON 3NA COM LV HRC fuse link", 2 hours instead of 4 hours). The update status is supported by each individual end device ED, i.e. reported to the Zigbee coordinator ZG and evaluated there.

[0029] Fig. 3 illustrates the update status reporting process in more detail. It shows an excerpt from the update of a group, for example, group 1 from Fig. 2.

[0030] Three terminal devices, EDI, ED2, and ED3, are shown as examples. In reality, the number of update groups can vary considerably. For example, it is conceivable that an update group may contain only one terminal device (ED). A typical application would be that the update groups are defined by the similar low-voltage elements of a control cabinet. However, it is also conceivable that similar devices in a large system (e.g., a building complex) are updated during a group update. In this case, the number of terminal devices (ED) could be in the range of 10**2 to 10**3.

[0031] As shown in Fig. 3, after the download, messages about the status of the update are sent from the individual end devices EDI, ED2 and ED3 to the Zigbee coordinator ZG. The message can be a confirmation of the successful software or firmware update. If the update was not successful, an error message is sent to the Zigbee coordinator ZG. This error message can also contain information about the phase in which the update was aborted or the percentage of completion of the update (see Fig. 4 and the corresponding description). Fig. 4 shows a flow chart for determining an update message and, if necessary, information to help locate the cause of the abort. A distinction is made between the following phases: Start update, Prepare download, Download, Verification, Installation and Finalization. Each of these phases is assigned an error code in the event of an abort during the phase.This is 1 , if the update cannot be started at all, 2 , if the preparation of the download is unsuccessful, 3 , if a problem occurs during the download of new firmware, 4 , if the authentication of the transmitter is not successful or the transmitter is not authorized for a firmware update, 5 , if a problem occurs during the installation of the downloaded software, and 6 if the update cannot be completed. The error code can be assigned a percentage that represents how far the update had progressed before the error occurred. The error code or the percentage can then be sent to the Zigbee coordinator ZC with the error message. If all phases are completed successfully, the Zigbee coordinator ZC receives a corresponding status message.

[0032] The progress of the Zigbee terminals ENI, EN2, and EN3 is summed up at the Zigbee coordinator ZC to form a group or gateway status ("gateway" refers to the control device and the terminals EN connected to it) and reported to the app, as shown in Fig. 3. Once the update process for an update group is completed, the process described above is repeated for the next group until all underlying Zigbee terminals EN are updated.

[0033] The app visualizes the status of the system update (i.e., the progress of updates for individual groups), the individual group updates, and the individual subordinate devices. The major advantage for the user is that only a single update process is required for the entire system, instead of up to 25 individual device updates. This greatly reduces manual processes (starting updates, waiting for updates, checking the compatibility of individual devices, etc.).

Claims

Patent claims 1. Method for updating the software of a large number of communication-capable low-voltage (ED) elements, wherein - the low-voltage elements (ED) are arranged in groups, - the groups of low voltage elements (ED) are updated sequentially, and - the low voltage elements (ED) of a group are updated essentially simultaneously.

2. Method according to claim 1, characterized in that - a control device (ZG) for controlling at least parts of the update process communicates with the low voltage elements (ED), - the low-voltage elements (ED) of a first group send status information to the control device (ZG) when the update has been successfully performed, and - the update of a second group of low voltage elements (ED) is started when status information has been sent from all low voltage elements (ED) of the first group to the control device (ZG), signaling the successful completion of the update.

3. Method according to claim 2, characterized in that the low voltage elements (ED) of the first group also send status information to the control device (ZG) if the update could not be carried out successfully.

4. Method according to claim 3, characterized in that - the low-voltage elements (ED) generate an error message when an update is aborted, through which the previous- The process can be determined in which the update was aborted, and - this error information or information derived from it is sent to the control device (ZC) along with the status information indicating an unsuccessful update.

5. Method according to one of claims 2 to 4, characterized in that - the update is initiated by an application (app) on an end device, and - to start the update by the application (App) sends a message to the control device (ZC).

6. Method according to claim 5, characterized in that - from the status information of the low-voltage elements (ED) a group status information is generated for a group, and - the group status information is transmitted from the control device (ZC) to the application (App).

7. Method according to one of the preceding claims, characterized in that the arrangement of the low-voltage elements (ED) in groups is carried out either according to the low-voltage element type or according to the equality of software of the low-voltage elements (ED).

8. Method according to one of the preceding claims, characterized in that communication is carried out using at least one radio protocol.

9. Control device (ZC) for controlling at least parts of the process of updating software of a large number of communication-capable low-voltage elements (ED) , which is designed for this purpose , - to arrange the low-voltage elements (LD) in groups, - to support a consecutive update of the groups of low voltage elements (ED), and - to communicate with the low voltage elements (ED) essentially simultaneously for an essentially simultaneous update.

10. System comprehensive - a control device (CD) according to claim 9, and - a variety of communication-enabled low voltage (ED) elements with updatable software.

11. System according to claim 10, comprising an end device with an application (app) designed to initiate a software update of the plurality of communication-enabled low voltage elements (ED).

Images