Secure mobile access for on-load tap-changer device

Abstract

The invention relates to an on-load tap-changer device (1), comprising: – a control device (4) and an on-load tap-changer (2); – wherein the control device (4) is designed and configured to establish a first data connection (21) to a first operating unit (20); – wherein the control device (4) is designed and configured to establish a second data connection (31) to a second operating unit (30); – wherein the control device (4) is designed and configured to grant access to the control device (4) and thus the on-load tap-changer (2) via the associated data connection (21, 31) to the operating units (20, 30); – wherein the control device (4) is designed and configured to prevent the second data connection (31) between the second operating unit (30) and the control device (4) as long as the first data connection (21) between the first operating unit (20) and the control device (4) exists. Figure 1

Description

[0001] Secure mobile access for on-load tap-changer device

[0002] The invention relates to an on-load tap-changer device and a secure mobile access to an on-load tap-changer device, in particular a method for mobile access to an on-load tap-changer device.

[0003] When servicing on-load tap-changers, it is necessary to take all necessary measures to protect on-site service technicians during maintenance. Therefore, it is not uncommon for the entire tap-changer to be taken offline for maintenance. This is time-consuming and costly.

[0004] The object of the invention is therefore to provide an on-load tap-changer device and a method for mobile access to an on-load tap-changer device which enable safe and cost-effective maintenance.

[0005] This object is achieved by an on-load tap-changer device and a method for mobile access to an on-load tap-changer device according to the independent claims. Advantageous further developments are described in the subclaims.

[0006] According to a first aspect, the invention proposes an on-load tap-changer device, comprising: a control device and an on-load tap-changer; wherein the control device is designed and configured to establish a first data connection with a first operating unit; wherein the control device is designed and configured to establish a second data connection with a second operating unit; wherein the control device is designed and configured to grant access to the control device and thus to the on-load tap-changer via the respective data connection with the operating units; wherein the control device is designed and configured to prevent the second data connection between the second operating unit and the control device as long as the first data connection between the first operating unit and the control device exists.

[0007] The on-load tap-changer device enables all data connections to a second control unit to be blocked as soon as a service technician on site is connected to the on-load tap-changer device via a first control unit with short-range communication. Switching signals or other instructions from a second control unit, such as a remote control unit, are thus blocked, ensuring that only a service technician on site can operate the on-load tap-changer device or has access to it. On-site faults are avoided. A high level of safety for service technicians is ensured during maintenance.

[0008] The on-load tap-changer can be designed in any desired manner and, for example, comprise a diverter switch and selector. The diverter switch can, for example, comprise vacuum interrupters or semiconductor switching elements. The on-load tap-changer is preferably operated by a motor drive controlled by the control device. The motor drive is mechanically connected directly or indirectly to the on-load tap-changer.

[0009] The control device of the on-load tap-changer device can be designed in any desired manner and, for example, comprise a first communication module, which is a short-range communication module. The first communication module monitors the short-range area of ​​the on-load tap-changer device within a radius of up to 20 meters. The first communication module is preferably a Bluetooth or WLAN module.

[0010] The control device of the on-load tap-changer device can be configured in any desired manner and, for example, comprise a second communication module, which is a long-range communication module. The second communication module is preferably connected to a second control unit or has a second data connection therewith. The second communication module is preferably an LTE, 5G, MESH, LoRaWAN, Low Power Wide Area Network (LPWAN) such as Mioty, or any cellular module.

[0011] The first control unit can be configured in any desired manner, for example, as an external control unit, in particular as a smartphone, PDA, or notebook. The first control unit has a corresponding communication module, which corresponds to the first communication module of the control device and enables a data connection.

[0012] The second operating unit can be designed in any desired way, for example as an external operating unit, in particular as a server. The second operating unit has a corresponding communication module which corresponds to the second communication module of the control device and enables a data connection. After the first data connection has been established, the first operating unit is granted access to the control device and thus to the on-load tap-changer device. The control device is used to directly or indirectly operate the on-load tap-changer. Direct means that the control device is designed and configured to independently control or operate the on-load tap-changer via the motor drive. Indirect means that the control device is used as a link between the operating units and enables the operating units to operate the on-load tap-changer by granting access.

[0013] The control units can be configured as desired, for example, as output units and input units. An output unit means that the data and signals received by the control device are output in the form of data and diagrams. An input unit means that, for example, switching commands can be entered into the control unit, which are then executed by the control device after transmission via the data connection.

[0014] Each data connection between the operating units and the control device can transmit data, signals, and / or control / switching commands; in other words, access to the control device is granted. These data connections are bidirectional.

[0015] The control device of the on-load tap-changer device is configured and designed to prevent the data connection to the second control unit when a first data connection to the first control unit is established. In this case, access to the second control unit is denied, and access is granted to the first control unit. Preventing or denying, within the meaning of the invention, means that control commands, switching commands, and / or signals transmitted or received via the second data connection to the control device are ignored and / or not further processed and / or deleted.

[0016] According to a second aspect, the invention proposes a method for mobile access to an on-load tap-changer device, comprising the following steps:

[0017] Monitoring a close range by means of a control device and detecting a first operating unit;

[0018] Establishing a first connection between the first operating unit and the control device;

[0019] Establishing a secure connection between the first operating unit and the control device;

[0020] Establishing a first data connection between the first operating unit and the control device;

[0021] Preventing a second data connection between a second operating unit and the control device by the control device.

[0022] The on-load tap-changer located in the field is usually connected to a second operating unit, i.e. a server. Data, signals, etc. from the on-load tap-changer are transmitted to the server via the second data connection with the help of the second communication module of the control device. The server, i.e. the second operating unit, can process this data accordingly and derive actions from it, such as switching commands for the on-load tap-changer. These switching commands are then transmitted to the control device via the second data connection and the on-load tap-changer is operated accordingly via the motor drive. A first communication unit of the control device monitors the immediate vicinity of the on-load tap-changer. As soon as a service employee with a first operating unit is on site, i.e. in the immediate vicinity of the on-load tap-changer, this is detected by the first communication module.An attempt is made manually or automatically to establish a first data connection - a mobile access - between the first operating unit and the control device.

[0023] Monitoring the near area via the control device's first communication module can be performed in any way, particularly continuously or at specific predefined times. The first control unit is detected automatically. The near area is defined as a radius of approximately 20 meters. The initial step to establish the connection can be performed by the control device or by the service technician via the first control unit.

[0024] The second control unit is designed and configured to process the data and signals received via the second data connection and to derive actions and switching commands for the on-load tap-changer device from them. This is possible because the second control unit has access to the control device.

[0025] After the first connection is established, an attempt is made to establish a secure connection. This involves verifying the trust relationship between the first operating unit and the control device. The control device is designed and configured accordingly, or has the appropriate means, for this purpose.

[0026] Furthermore, after the secure connection has been established, the first operating unit is authorized and authenticated by the control device. The control device is designed and configured accordingly for this purpose and / or has corresponding means. If the second data connection between the second operating unit and the control device is blocked, the commands and / or signals received from the second operating unit are either ignored by the control device and / or not further processed and / or deleted. It is important here that only signals and commands from the first operating unit are executed and transmitted by the control device. This protects the service technician on site; secure mobile access is created. This occurs after the first operating unit has been successfully connected to the control device, i.e. when the first operating unit has access to the control device.

[0027] The invention and its advantages are described in more detail below with reference to the accompanying drawings. They show:

[0028] Fig. 1 shows a first embodiment of an on-load tap-changer device;

[0029] Fig. 2 shows a process flow.

[0030] Figure 1 shows a first embodiment of an on-load tap-changer device 1, a first operating unit 20, and a second operating unit 30. Both the first operating unit 20 and the second operating unit 30 are external operating units. The on-load tap-changer device 1 comprises an on-load tap-changer 2, a motor drive 3, and a control device 4. The on-load tap-changer device 1 is designed and configured, in particular by the control device 4, to establish a first data connection 21 between the on-load tap-changer device 1, i.e., the control device 4, and the first operating unit 20.

[0031] The first operating unit 20 is preferably designed as a mobile device, such as a smartphone, notebook, etc. To establish the first data connection 21, the control device 4 has a first communication module 22, which is a short-range communication module and preferably establishes a first data connection 21 with the first operating unit 20 via Bluetooth or WLAN. The first operating unit 20 is designed and configured accordingly to be able to establish a first data connection 21 with the first communication module 22 and to grant it access. The first data connection 21 is a bidirectional connection in which data can be sent and received both by the control device 4 and by the first external operating unit 20.

[0032] The on-load tap-changer device 1 is designed and configured, in particular by the control device 4, to establish a second data connection 31 between the on-load tap-changer device 1, i.e. the control device 4, and the second external operating unit 30 and to grant access to the latter.

[0033] The second operating unit 30 is preferably configured as a server, computer, etc. To establish the second data connection 31, the control device 4 has a second communication module 32, which is a long-range communication module and preferably establishes a second data connection 31 with the second operating unit 30 via LTE, MESH, 5G, LoRaWAN, or any other mobile radio standard. The second operating unit 30 is configured and designed accordingly to be able to establish a second data connection 31 with the second communication module 32. The second data connection is a bidirectional connection in which data can be sent and received both from the control device 4 and from the second external operating unit 30.

[0034] The control device 4 of the on-load tap-changer device 1 is designed and configured to control the motor drive 3, which is coupled to the on-load tap-changer 2, and thus to actuate the on-load tap-changer 2. The control device 4 has a corresponding processor and a memory for this purpose. The control device 4 can further comprise a voltage regulator, which is used to decide when the on-load tap-changer 2 needs to be actuated.

[0035] Furthermore, the on-load tap-changer device 1 can comprise current sensors and voltage sensors connected to the control device 4. These sensors can be connected to the voltage regulator on the one hand and, on the other hand, provide measurement data and signals that are stored and processed in the control device and transmitted to each of the control units via the corresponding data connection.

[0036] If a second data connection 31 exists between the on-load tap-changer device 1 and the second control unit 30, switching commands can be transmitted from the second control unit 30 to the control device 4; the second control unit has access to the control device 4. The control device 4 grants the second control unit 30 access to the on-load tap-changer device 1 and thus to the on-load tap-changer 4. The measurement data determined by the current sensors and voltage sensors are transmitted to the second control unit 30 and form a basis for possible switching commands. The on-load tap-changer device 1 is thus controlled by the second control unit 30.

[0037] The measurement data can thus be stored and processed in the control device 4 itself or in the second control unit 30, so that the on-load tap-changer device 1 or the on-load tap-changer 2 can be controlled or actuated. In addition, historical operating data, which were determined by the control device 4 in the on-load tap-changer 2, can be transmitted to the second control unit 30 via the second data connection 31 and evaluated at a later time.

[0038] The transmitted data can preferably be switching commands to the on-load tap-changer, error messages from the on-load tap-changer, measurement data from the sensors, etc.

[0039] The first operating unit 20 is preferably designed as a mobile device and, above all, provides service technicians with the option of connecting to the on-load tap-changer device 1; mobile access. In this case, the service technicians are on-site, i.e., in the immediate vicinity of the on-load tap-changer device 1. The first operating unit 20 also has access to the on-load tap-changer device 1 and thus to or to the on-load tap-changer 4 as soon as the first data connection 21 is established. The service technician can send various commands to the on-load tap-changer 4 or the on-load tap-changer device 1 via the control device 4, for example, to trigger a manual switching operation. In addition, the service technician can transfer historical operating data, which was determined in the on-load tap-changer 2 by means of the control device 4, to their mobile device, i.e., the first operating unit 20, and evaluate it immediately or at a later time.

[0040] For safety reasons, however, it is necessary that as soon as the first operating unit 20, i.e. a service technician, is connected to the on-load tap-changer device 1, no further operating units, i.e. also no second operating unit 30, can transmit switching commands to the on-load tap-changer 4. Therefore, the control device 4 is configured such that the second data connection is blocked as soon as the first data connection 21 is established between the control device 4 and the first operating unit 20. Blocking can mean, for example, that the second data connection 31 is disconnected, for example by switching off the second communication module 32. Furthermore, blocking can mean that the incoming commands received via the second data connection are ignored, deleted directly, or simply not executed.

[0041] The control device 4 is further designed and configured to detect a connection setup and connection termination, as well as connection interruptions in the first data connection 21 and the second data connection 31.

[0042] Figure 2 shows a method sequence for mobile access to the on-load tap-changer device 1, in which a first operating unit 20 connects to the on-load tap-changer device 1, in particular to its control device 4. The control device 4 of the on-load tap-changer device 1 monitors the short-range communication channel using the first communication module 22 of the control device 4 of the on-load tap-changer device and detects (step 40) when a first operating unit 20 attempts to establish a connection with the on-load tap-changer device 1 via this channel.

[0043] After an initial connection has been established between the first control unit 20 and the on-load tap-changer device 1, a secure connection is established in the next step 41. The TLS protocol can be used as an example of a secure connection. In the first step, an encrypted connection is established between the first control unit 20 and the on-load tap-changer device 1. As an example, AES encryption can be used here, and the Diffie-Hellman method can be used as the key exchange algorithm.

[0044] In the next step 42, the trust relationship between the first control unit 20 and the on-load tap-changer device 1 is checked to rule out potential attacks such as man-in-the-middle attacks. The RSA method can be used here, for example.

[0045] In the next step 43, it must be checked whether the user is even allowed to log in to the on-load tap-changer device (authorization) and which rights this user has (authentication). A signed JWT token can be used for this purpose, which contains all the information required for authorization and authentication. By verifying the token's signature, it can be ensured that the token's content has not been altered and that it is a valid token. In addition, the additional information from the token can be used to decide whether the user is granted access to the on-load tap-changer device 1.

[0046] If an error occurs during the establishment of the first secure data connection; the identity of the parties involved cannot be fully confirmed, or authorization or authentication fails, the connection is terminated (step 44). In addition, if the connection is unsuccessful, all information sent during connection establishment, such as certificates, base values ​​for calculating session keys, etc., are deleted. Authorization and authentication take place in step 45.

[0047] After the first control unit 20 has successfully connected to the on-load tap-changer device 1, i.e., a first data connection has been established (step 46), the current state of the second data connection 31 is determined in step 47. In particular, the setting as to whether data arriving at the on-load tap-changer device 1 via the second data connection should be discarded or not is determined. The current state of the second data connection 31 and, in particular, the setting as to whether incoming data via the second data connection should be discarded or not are saved in a non-volatile memory. A flash memory can serve as the non-volatile memory here. The setting that signals whether incoming data via the second data connection should be discarded or not is set so that the incoming data is discarded.Thus, the second data connection 31 in step 48 between the second external control unit 30 and the on-load tap-changer device 1 is prevented.

[0048] List of reference symbols

[0049] 1 on-load tap-changer device

[0050] 2 on-load tap-changers

[0051] 3 Motor drive 4 Control device

[0052] 20 first control unit

[0053] 21 first data connection

[0054] 22 first communication module

[0055] 30 second control unit 31 second data connection

[0056] 32 second communication module

Claims

Patent claims 1. On-load tap-changer device (1), comprising: a control device (4) and an on-load tap-changer (2); wherein the control device (4) is designed and configured to establish a first data connection (21) with a first operating unit (20); wherein the control device (4) is designed and configured to establish a second data connection (31) with a second operating unit (30); wherein the control device (4) is designed and configured to grant access to the control device (4) and thus to the on-load tap-changer (2) via the respective data connection (21, 31) with the operating units (20, 30); wherein the control device (4) is designed and configured to prevent the second data connection (31) between the second operating unit (30) and the control device (4) as long as the first data connection (21) between the first operating unit (20) and the control device (4) exists.

2. On-load tap-changer device (1) according to claim 1, wherein the first operating unit (20) is an external operating unit.

3. On-load tap-changer device (1) according to one of claims 1 to 2, wherein the second operating unit (30) is an external operating unit.

4. On-load tap-changer device (1) according to one of claims 1 to 3, wherein the control device (4) has a first communication module (22), which is a short-range communication module; the first operating unit (20) establishes the first data connection (21) with the control device (4) via the first communication module (22).

5. On-load tap-changer device (1) according to one of claims 1 to 4, wherein the control device (4) has a second communication module (22), which is a long-range communication module; the second operating unit (30) establishes the second data connection (31) with the control device (4) via the second communication module (22).

6. Method for mobile access to an on-load tap-changer device (1), comprising the following Steps: Monitoring a close range by means of a control device (4) and detecting a first operating unit (20); Establishing a first connection between the first operating unit (20) and the control device (4); Establishing a secure connection between the first operating unit (20) and the control device (4); Establishing a first data connection (21) between the first operating unit (20) and the control device (4); Preventing a second data connection (31) between a second operating unit (30) and the control device (4) by the control device (4). Method according to claim 6, wherein the monitoring of the close range takes place by means of a first communication module (22) of the control device (4), which detects the first operating unit (20). Method according to one of claims 6 to 7, wherein after the establishment of the secure connection, a relationship of trust between the first operating unit and the control device (4) is checked. Method according to one of claims 6 to 8, wherein before a first data connection (21) is established, an authorization and authentication of the first operating unit (20) is carried out by the control device (4).Method according to one of claims 6 to 9, wherein when the second data connection (31) between a second operating unit (30) and the control device (4) is blocked, the commands and / or signals arriving from the second operating unit are either ignored and / or not further processed and / or deleted by the control device (4).

Images