Software-based configuration of the power class and additional functions of an inverter

Abstract

The invention relates to a method for operating a power electronics device, said method comprising checking, at the start of operation, whether exactly one activated power class profile is present from a plurality of different power class profiles, and only when exactly one activated power class profile is present, will a start of operation of the device be permitted under the conditions stored in the activated power class profile. In addition, in response to receiving a request for deactivation (11) sent by an authorised person, the activated power class profile is converted (12) into a deactivated power class profile and a deactivation confirmation marked secret and stored on the device is sent (14) to the authorised person, wherein the deactivation confirmation comprises an identification of the device and an identification of the deactivated power class profile. A corresponding power electronics device is likewise disclosed.

Description

[0001] Software-based configuration of the power class and additional functions of an inverter

[0002] Description

[0003] The invention relates to a method for operating a power electronic device and a power electronic device that can be operated with a number of different power class profiles.

[0004] The generation or conversion of electrical power using power electronic devices is becoming increasingly important, particularly in solar power systems, where the direct current generated by solar modules is converted into grid-compliant alternating current for feeding into the grid. Power electronic devices in the form of inverters are used here, whose rated power is selected depending on the maximum power that can be generated by the solar modules. This has made it necessary to offer a wide variety of inverter types with different rated powers in order to optimally equip individually planned solar systems.

[0005] For efficiency reasons, however, it is often more advantageous for the provider of such power electronic devices to offer a few or even just one device type for the required rated power rather than individual device types, whose rated power is only permanently set to a desired value during installation of the system. This setting should be tamper-proof, since, on the one hand, the price of the power electronic device is regularly billed during installation, and, on the other hand, overloading the installation or underperformance of the system must be avoided. For this purpose, a power class profile containing information about the rated power is stored and activated in the power electronic device.At the start of operation, the power electronic device checks whether an activated power class profile is present and operates the device according to the nominal power stored in the activated power class profile. Alternatively, the "BPT-S 3-4.6 Operating Instructions" document from Bosch Power Tee GmbH describes that the language, country, and standard settings for the respective location of an inverter are only made during commissioning using an RFID card on which the data required for the settings is stored. To do this, the installer holds the RFID card in a predetermined position against the inverter during an installation step described in the instructions, whereby the setting parameters are permanently transferred to the inverter. This procedure is not intended for selective billing of the power device activated in this way.

[0006] If a power electronic device with a flexible activation capability of a number of power class profiles is to be replaced, for example due to a defect, it is desirable that the newly installed device can be easily activated using the activated power class profile of the old device, whereby misuse is to be prevented by reliably preventing the continued operation of the old device and only enabling the activation of exactly one new device.

[0007] This object is achieved by a method having the features of independent claim 1. Preferred embodiments of the method are the subject of the dependent claims. Furthermore, the object is achieved by a power electronic device having the features of independent claim 10, with advantageous embodiments being the subject of the dependent claims.

[0008] According to the invention, a method for operating a power electronic device comprises checking, at the start of operation of the power electronic device, whether exactly one activated power class profile from a number of different power class profiles is present. Only if exactly one activated power class profile is present is the device permitted to start operating under the conditions stored in the activated power class profile. The activated power class profile can be selected by the installer from the number of different power class profiles during installation or can already have been activated at the factory or at another point in the supply chain, for example, at a distributor.

[0009] A performance class profile is, for example, a data set stored in the device, in particular a license file, which allows the device's operating system to check whether the device can be operated with a parameter set assigned to the performance class profile, and additionally allows a permanent identification that the device should also be operated with this parameter set. In particular, the data set can also contain the parameter set under which the device is to be operated. The performance class profile does not have to contain all operating parameters and can also contain or specify a selection of values ​​permissible for operation or a permissible value range for parameters. The term performance class profile also does not imply that one of the parameters must necessarily be a power output, for example a rated power of the power electronic device.The data set can also contain information about the device identification of the device for whose activation the data set is intended. This can effectively prevent a device other than the intended one from being put into operation using the data set, for example, by simply copying the data set. One advantageous option is to encrypt, sign, or otherwise mark the data set so that it can only be decrypted or used in a power electronic device with the intended device identification and / or with other key components permanently stored in the device.

[0010] The device can contain a plurality of activatable performance class profiles, of which only one profile may be marked for operational use, i.e., activated. This marking can be, for example, a specific entry in the data set or a storage location for the data set. To prevent misuse, the data set can be encrypted and / or signed, or stored in a storage area of ​​the device where only restricted access is permitted, subject to fulfillment of security criteria or proof of sufficient authorization.

[0011] In principle, the power electronic device can only have one activatable power class profile. Preferably, however, a plurality of activatable power class profiles is present, of which only one is activated to allow operation to begin. It is conceivable that upon activation of the selected power class profile, the remaining profiles are deleted from the power electronic device; however, they can also remain on the device as deactivated power class profiles, so that they can be activated as replacements at a later time if necessary.

[0012] Furthermore, the method according to the invention, in response to receiving a deactivation request sent by an authorized person, comprises converting the activated performance class profile into a deactivated performance class profile and sending a deactivation confirmation signed with a secret stored on the device to the authorized person, wherein the deactivation confirmation includes an identification of the device and an identification of the deactivated performance class profile. The signature ensures that no forged deactivation confirmations can be generated by unauthorized persons. At the same time, the signed deactivation confirmation ensures that the performance class profile contained therein was activated and deactivated on the device designated by the identification.Therefore, the deactivation confirmation can be used like a one-time voucher for activating the included performance class profile on another device.

[0013] Sending a deactivation confirmation signed with a secret stored on the device to the authorized person also includes the case in which the deactivation confirmation is sent to an authorized entity, for example a portal of the manufacturer of the device, and the authorized person can have the receipt confirmed there.

[0014] To further protect the process against data loss, the conversion of the activated performance class profile to a deactivated performance class profile can only occur after receiving an acknowledgment of receipt of the deactivation confirmation from the authorized party. This also includes the case where the acknowledgment of receipt is sent by an authorized entity, for example, a portal of the device manufacturer. The acknowledgment of receipt can also be triggered by the authorized party registering the deactivation confirmation with the entity.

[0015] To prevent unwanted manipulation of the process and thus a harmful, unauthorized deactivation of the power electronic device, in an advantageous embodiment, the conversion of the activated power class profile into a deactivated power class profile can only occur after successful verification of authorization for the deactivation request. For example, it can be provided that only the original installer or a person in possession of a specified secret, such as a data key, can effectively send the conversion request to the device. Possession can be verified using known cryptographic methods such as the Diffie-Hellman method.

[0016] To reliably prevent unauthorized restart of the power electronic device, converting the activated power class profile may involve deleting it. Likewise, converting may involve immediately terminating the device's operation, thus preventing unauthorized continued operation.

[0017] In a further aspect relating to the commissioning of a replacement device in place of a failed power electronic device, the method further comprises the step of activating the power class profile to be activated in response to a further request to activate a power class profile, wherein the further request comprises a proof of authorization for the activation, an identification of the power class profile to be activated, and an identification of the device to be activated, provided that activation requirements are met. The activation requirements include the identity of the identification of the device to be activated with the identification of the device executing the method and the validity of the proof of authorization.The validity of the authorization credential can be verified by signing the further request with a signature key of the person sending the further request. This signature can be authenticated by the power electronic device in a known manner. The creation of a request that meets the activation requirements can be supported by an application, preferably installable on a mobile device or a separate computing unit, so that activation can be easily carried out by an authorized user. This action can be logged by the application and, if necessary, transmitted to and / or approved by a central authority, for example, a portal of the device manufacturer.

[0018] Furthermore, the activation requirements may include the absence of an already activated performance class profile on the device. If an already activated performance class profile exists, the performance class profile to be activated will not be activated, and the sender of the further request will be informed of this, preferably with a corresponding response.

[0019] Alternatively, activating the performance class profile to be activated can include deactivating any other, possibly already existing, activated performance class profile. In this case, too, the sender of the further request can be informed by a corresponding response. This response can include a further deactivation confirmation to enable further use of the deactivated performance class profile on another device. The further deactivation confirmation can be signed with the secret stored on the device, whereby the further deactivation confirmation includes an identification of the device and an identification of the other, deactivated performance class profile. The choice between the two alternative options, if an activated performance class profile already exists, can also be made in a dialog with the sender of the further request.

[0020] In a further aspect of the invention, a power electronic device comprises a start-up module which is configured to check, at the start of operation of the device, whether exactly one activated power class profile from a number of different power class profiles is present, and if exactly one activated power class profile is present, to put the device into operation under the conditions stored in the activated power class profile, and otherwise not to put the device into operation.Furthermore, the power electronic device comprises a deactivation module which is configured, upon receipt of a deactivation command from an external unit, to check this deactivation command for authorization, to convert the activated power class profile into a deactivated power class profile if the authorization is confirmed after the check, and to send a deactivation confirmation signed with a secret stored on the device to the external unit, wherein the deactivation confirmation comprises an identification of the device and an identification of the deactivated or deleted power class profile.

[0021] In an advantageous embodiment, the power electronic device can be designed as an inverter. In particular, the power class profile can include a maximum converter power. In particular, the power class profile can additionally or alternatively include at least one of the following performance features:

[0022] - a maximum reactive power,

[0023] - an activation option for a network-forming operating mode, and

[0024] - an activation option for a grid-supporting operating mode.

[0025] In the following, the invention is illustrated by means of figures, of which

[0026] Fig. 1 shows an exemplary procedure for replacing a device using the method according to the invention and

[0027] Fig. 2 shows a structure of a power electronic device according to the invention.

[0028] Fig. 1 shows an exemplary process for replacing a device in a power electronic device according to the invention. The participants in the replacement are an installer 1, an application 2, in particular an application on a mobile device of the installer 1, an old device 3 to be replaced, a new device 4 intended to replace the old device 3, and a central instance 5, which can in particular be a portal installed on a remote server and accessible via a remote data connection.

[0029] At the beginning of the process, in order to decommission the old device 3, the installer 1 selects the function for initiating a device replacement in a first action 10 in the application 2. The application 2 then sends a deactivation command to the old device 3 in a second action 11 and requests a device identification from it. In response to receiving the deactivation command, the old device 3 deactivates its license file of the active performance class profile in a third action 12. Furthermore, the old device 3 sends its device identification back to the application 2 as requested in a fourth action 13. Optionally, the old device 3 sends a confirmation of the deactivation of the performance class profile to the application 2 in a fifth action 14. This deactivation confirmation can also be sent together with the device identification in the fourth action 13 and can, in particular and independently, also contain the deactivated license file.Furthermore, in a sixth action 15, the old device 3 ceases operation.

[0030] In a preferred embodiment, application 2 sends the deactivation confirmation along with the device identification of the old device 3 to the central instance 5 in a seventh action 16. Here, the deactivation of the old device 3 can be permanently registered in an eighth action 17 and / or the deactivated performance class profile can be reserved for later activation on a replacement device. Alternatively to application 2, the old device 3 itself can also send the deactivation confirmation along with the device identification to the central instance 5.

[0031] Advantageously, in a ninth action 18, application 2 also permanently saves the device identification and the deactivated performance class profile or the deactivated license file in order to be able to use this information to activate a performance class profile of a replacement device at a later time. This simplifies the activation of a replacement device, since no data connection to the central instance 5 is required.

[0032] After completing the aforementioned steps, the installer 1 can remove the old device 3 in a tenth step 19 and, if necessary, dispose of it, have it repaired, or sell it. In an eleventh step 20, the installer can then install the new device 4 and initiate commissioning.

[0033] To commission the new device 4, the installer 1 selects the function for setting up a replacement device in a twelfth action 21 on the application 2. In a thirteenth action 22, the application 2 requests a device identification from the new device 4, whereupon the new device 4 sends its device identification back to the application 2 in a fourteenth action 23. After checking, based on the received device identification, whether the new device 4 is suitable for activation using the deactivated performance class profile of the old device 3, the application 2 sends, in a fifteenth action 28, a request to activate a performance class profile, which includes information about the performance class profile to be activated or the corresponding license file, to the new device 4, which activates the corresponding license file and enables the start of operation with the associated performance class profile (actions 29 and 30).The performance class profile to be activated or the corresponding license file can already be stored on the new device 4 (as a still deactivated performance class profile). If the license file or the information about the performance class profile to be activated is not stored on application 2 but only on the central instance 5, application 2 requests the information required to activate the performance class profile from the central instance 5 (action 24). The request contains the device identification of the old device 3, which is used to check the performance class profile to be activated and the authorization for activation. If the request also includes the device identification of the new device 4, the central instance 5 can also check the suitability of the new device 4 for activation. The test result is then communicated to application 2.If the request is successfully verified, central instance 5 compiles the information for the performance class profile to be activated or the corresponding license file (action 25) and sends it back to application 2, which can then complete the activation of new device 4 (action 27). Central instance 5 either marks the performance class profile to be activated as used or permanently deletes it, allowing only a one-time (re-)activation, and a subsequent request to activate the same performance class profile will be unsuccessful. Registration of the activated performance class profile under the device identification of new device 4 is also conceivable.

[0034] Fig. 2 shows an exemplary structure of a power electronic device 34 according to the invention. The device has a communication module 120, via which the device 34 can exchange data with an application 2 installed on a mobile device, for example a smartphone, or with a remote central instance 5. The data exchange can take place via a cable or wirelessly via a radio connection. In particular, the communication module 120 can be configured to establish and transmit data using a secure, for example encrypted, connection. Furthermore, the communication module 120 is configured to exchange data within the device 34 with other modules via a data bus. The individual modules can be designed as separate electronic components or as separate program components of a software architecture of an operating system of the device.

[0035] The device 34 further comprises a start-up module 100, which is configured and intended to check, at the start of operation of the device, whether exactly one activated power class profile from a number of different power class profiles is present. If exactly one activated power class profile is present, to start the device under the conditions stored in the activated power class profile, and otherwise not to start the device. To this end, the start-up module 100 has read access to a secure area 140 in which the power class profiles are stored. If the check is successful, the start-up module 100 transmits a command to start operation to the control module 150. This check is performed each time the device starts operating, effectively preventing operation of the device 34 without an activated power class profile.

[0036] The device 34 further contains a deactivation module 110, which is configured and intended to check for authorization upon receipt of a deactivation command from an external unit, in this case a deactivation command triggered by an installer 1 during a device replacement using the application 2 to an old device. Such a command is forwarded by the communication module 120 to the deactivation module 110. For this purpose, the deactivation command contains an identifier of the sender of the command, which is preferably compared with authorization information also stored in the secure area 140.

[0037] If authorization is confirmed after verification, the deactivation module 110 accesses the secure area 140 for writing and converts the activated performance class profile into a deactivated performance class profile. This can be implemented by changing the performance class profile or by deleting it. Furthermore, the deactivation module 110 causes a deactivation confirmation signed with a secret stored on the device to be sent back to the external unit via the communication module 120. The deactivation confirmation includes an identification of the device and an identification of the deactivated or deleted performance class profile. Using this information, the sender can later activate an identical performance class profile on a new device that replaces the old device.

[0038] The communication module 120 can alternatively or additionally send the deactivation confirmation to the central instance 5 for storage there, wherein the central instance of the application 2 confirms receipt if necessary.

[0039] In an advantageous embodiment, the power electronic device is designed as an inverter.

[0040] Furthermore, the power electronic device 34 includes an activation module 130, which is used during the device replacement process to activate a power class profile on the new device. When the communication module 120 receives a request to activate a power class profile, it forwards this request to the activation module 130. The request contains an identification of the power class profile to be activated and an identification of the device to be activated, in particular its device identification. The request can also contain the power class profile to be activated itself.After verifying the authorization of the person sending the request and the suitability of the performance class profile to be activated on the device 34 (if necessary by comparing it with corresponding information stored in the secure area 140), the activation module 130 transfers the performance class profile to be activated to the secure area 140 or changes the performance class profile already present in the secure area 140 into an activated performance class profile. If an activated performance class profile already exists there, it can alternatively be deactivated, or the request to activate a performance class profile is rejected.

[0041] The activation module 130 can report a message about the successful or rejected implementation of the request to activate a performance class profile back to the sender via the communication module 120. Furthermore, the activation module 130 can report a successful activation directly to the control module 150, which immediately initiates commissioning of the device 34 according to the specifications of the activated performance class profile.

[0042] List of reference symbols

[0043] 1 installer

[0044] 2 Application

[0045] 3 Old device

[0046] 4 new devices

[0047] 5 central instance

[0048] 10-30 action

[0049] 34 power electronic device

[0050] 100 start-up module

[0051] 110 Deactivation module

[0052] 120 communication module

[0053] 130 Activation module

[0054] 140 secured area

[0055] 150 control module

Claims

Claims:

1. A method for operating a power electronic device, comprising: - checking at the start of operation whether exactly one activated performance class profile from a number of different performance class profiles is present, and only if exactly one activated performance class profile is present, allowing the device to start operating under the conditions stored in the activated performance class profile, and - in response to receiving a deactivation request (11) sent by an authorized person, converting (12) the activated performance class profile into a deactivated performance class profile and sending (14) a deactivation confirmation identified by a secret stored on the device to the authorized person, wherein the deactivation confirmation comprises an identification of the device and an identification of the deactivated performance class profile.

2. Method according to claim 1, wherein the conversion (12) takes place after receipt of an acknowledgment of receipt of the deactivation confirmation from the authorized person.

3. Method according to claim 1 or 2, wherein the conversion (12) of the activated performance class profile into a deactivated performance class profile only takes place after successful verification of an authorization for the request for deactivation.

4. Method according to one of the preceding claims, wherein the converting (12) comprises deleting the activated power class profile.

5. Method according to one of the preceding claims, wherein the converting (12) comprises terminating (15) the operation of the device.

6. The method according to any one of the preceding claims, further comprising: in response to a further request to activate a performance class profile (28), wherein the further request comprises a proof of authorization for the activation, an identification of the performance class profile to be activated and an identification of the device to be activated, activating the performance class profile to be activated if activation requirements are met, wherein the activation requirements comprise an identity of the identification of the device to be activated with the identification of the device executing the method and a validity of the proof of authorization.

7. The method of claim 6, wherein the activation prerequisites further comprise that no previously activated performance class profile is present on the device. The method according to claim 6, wherein the activation (29) of the power class profile to be activated comprises deactivating a possibly already existing further activated power class profile. The method according to claim 8, wherein the deactivation of the already existing power class profile comprises sending a further deactivation confirmation signed with the secret stored on the device, wherein the further deactivation confirmation comprises an identification of the device and an identification of the further, deactivated power class profile. A power electronic device, comprising: - a start-up module (100) configured to check, at the start of operation of the device, whether exactly one activated power class profile from a number of different power class profiles is present, and if exactly one activated power class profile is present, to put the device into operation under the conditions stored in the activated power class profile, and otherwise not to put the device into operation, and - a deactivation module (110) configured to, upon receipt of a deactivation command from an external unit, check the deactivation command for authorization, convert the activated power class profile into a deactivated power class profile if the authorization is confirmed after the check, and send a deactivation confirmation signed with a secret stored on the device to the external unit, wherein the deactivation confirmation comprises an identification of the device and an identification of the deactivated or deleted power class profile. The power electronic device according to claim 10, configured as an inverter. The power electronic device according to claim 11, wherein the power class profile comprises a maximum converter power. The power electronic device according to claim 11, wherein the power class profile comprises at least one of the following performance features: - a maximum reactive power, - an activation option for a network-forming operating mode, and - an activation option for a grid-supporting operating mode. Power electronic device according to one of claims 10 to 13, further comprising an activation module (130) configured to, in response to a further request, activate a power class profile, wherein the further Request includes proof of authorization for the activation, identification of the performance class profile to be activated and identification of the device to be activated, to activate the performance class profile to be activated, provided that activation requirements are met, wherein the activation requirements include identity of the identification of the device to be activated with the identification of the device executing the procedure and validity of the proof of authorization.

Images