Secure mobile access for under load tap switching devices

Abstract

An on-load tap changing device 1 includes a control device 4 and an on-load tap changer 2, The control device 4 is configured and adapted to establish a first data link 21 with the first operating device 20. The control device 4 is configured and adapted to establish a second data link 31 with the second operating device 30. The control device 4 is configured and adapted to allow these operating devices 20 and 30 to access the control device 4, i.e., the on-load tap changer 2, via their respective data links 21 and 31. The on-load tap changer 1 is configured and adapted so that the control device 4 disconnects the second data link 31 between the second operating device 30 and the control device 4 while the first data link 21 is established between the first operating device 20 and the control device 4.

Description

Technical Field

[0001] The present invention relates to a load tap changer, to secure mobile access to a load tap changer, and particularly to a method for mobile access to a load tap changer.

Background Art

[0002] In order to maintain a load tap changer, every means must be taken to protect on-site service engineers during maintenance. Therefore, in many cases, the entire tap transformer is removed from the power distribution network for maintenance. However, this is cumbersome and costly.

Summary of the Invention

Problems to be Solved by the Invention

[0003] Therefore, an object of the present invention is to provide a load tap changer that enables safe and low-cost maintenance and a method for mobile access to the load tap changer.

Means for Solving the Problems

[0004] This problem is solved by the load tap changer according to the independent claims and the method for mobile access to the load tap changer.

[0005] According to a first aspect, the present invention is a load tap changer 1 including a control device and a load tap changer, the control device is configured and adapted to establish a first data link with a first operating device, the control device is configured and adapted to establish a second data link with a second operating device, the control device is configured and adapted to permit access to this control device, that is, to the load tap changer, via each data link to these operating devices, The control device proposes an on-load tap changer configured and adapted to interrupt the second data link between the second operating device and the control device while the first data link is established between the first operating device and the control device.

[0006] The on-load tap changer (TAP changer) is designed so that immediately after a field service engineer's first operating device is linked to the TAP changer via short-range communication, all data links to a second operating device are cut off. Therefore, switching signals or other commands from a second operating device, such as a remote monitoring device, are blocked. As a result, only the field service engineer can operate or access the TAP changer. Errors are avoided, and the safety of the service engineer is guaranteed during maintenance.

[0007] The on-load tap changer can be configured as desired and may include, for example, a changeover switch and a selector. The changeover switch may include, for example, a vacuum valve or a semiconductor switching element. Preferably, the on-load tap changer is operated by a motor drive unit controlled by a control unit. The motor drive unit is mechanically connected to the on-load tap changer directly or indirectly.

[0008] The control device for the load-tapping device can be configured as desired and may include, for example, a first communication module, which is a short-range communication module. The first communication module monitors the short-range area of ​​the load adjustment switch device within a radius of up to 20 meters. Preferably, the first communication module is a Bluetooth or WLAN module.

[0009] The control device for the on-load tap switching device can be configured as desired and may include, for example, a second communication module, which is a long-range communication module. Preferably, the second communication module is linked to a second operating device or establishes a second data link together with the second operating device. Preferably, the second communication module is an LTE, 5G, MESH, LoRaWAN, a low-power wide-area network (LPWAN) such as Mioty, or any mobile communication module.

[0010] The first operating device can be configured as any device, for example, as an external operating device, particularly as a smartphone, PDA, or laptop computer. The first operating device communicates with the first communication module of the control device and enables a data link.

[0011] The second operating device can be configured as any device, for example, as an external operating device, and in particular as a server. The second operating device has a suitable communication module that communicates with the second communication module of the control unit and enables a data link. After the first data link is established, the first operating device is granted access to the control unit, i.e., the on-load tap changer.

[0012] The control unit is used to operate the on-load tap changer directly or indirectly. Direct operation means the control unit is configured and adapted to autonomously control or operate the on-load tap changer via a motor drive. Indirect operation means the control unit is used as an intermediary between operating units, allowing these units to operate the on-load tap changer by granting them access.

[0013] The operating device can be arbitrarily configured as, for example, an output device and an input device. In the output device, data and signals received by the control device are output as data and charts. In the input device, for example, a switching command may be input to the operating device, and this switching command is executed by the control device after being transmitted via a data link.

[0014] Each time the operating device and the control device are data-linked, data, signals, and / or control commands / switching commands may be transmitted. In other words, access to the control device is permitted. The data link is a bidirectional data link.

[0015] The control device of the on-load tap changer is adapted and configured to block the data link to the second operating device when a first data link is established with the first operating device. In this case, access to the second operating device is denied, and access is granted to the first operating device. Blocking or denial in this invention means that control commands, switching commands and / or signals transmitted to or reaching the control device via the second data link are ignored and / or not processed and / or erased.

[0016] According to the second feature, the present invention is as follows: - A step of monitoring the immediate vicinity with a control device and recognizing the first operating device, - The step of establishing the initial data link between the first operating device and the control device, - The step of establishing a secure link between the first operating device and the control device, - The step of establishing a first data link between the first operating device and the control device, - A step of disconnecting the second data link between the second operating device and the control device, We propose a method for mobile access to on-load tap changers, including those mentioned above.

[0017] Generally, a remote on-load tap changer is connected to a second operating device, i.e., a server. Data, signals, etc., from the on-load tap changer are transmitted to the server via a second data link using the control unit's second communication module. The server, i.e., the second operating device, can process this data appropriately and derive actions from this processing, such as a switching command to the on-load tap changer. This switching command is then transmitted to the control unit via the second data link, and the on-load tap changer is properly operated by the motor drive unit. The control unit's first communication module monitors the area in the vicinity of the on-load tap changer. If a service engineer carrying the first operating device is on-site, i.e., very close to the on-load tap changer, this is detected by the first communication module. An attempt is made, manually or automatically, to establish a first data link—mobile access—between the first operating device and the control unit.

[0018] The monitoring of the short - range area by the first communication module of the control device can be executed arbitrarily, and in particular, it can be executed constantly or at a predetermined time set in advance. The recognition of the first operating device is executed automatically. A radius of about 20 meters is regarded as the short - range area. The first step for establishing a link can be executed by a service engineer via the control device or the first operating device.

[0019] The second operating device is configured and adapted to process the data and signals received via the second data link and derive actions and switching commands for the on - load tap - changer from this processing. Therefore, since the second operating device has access rights to the control device, this is possible.

[0020] After the establishment of the first data link, an attempt is made to establish a secure link. In this case, the trust relationship between the first operating device and the control device is inspected. For this purpose, the control device is appropriately configured and adapted or has appropriate means.

[0021] Furthermore, after the establishment of a secure link, the authentication and authorization of the first operating device are executed by the control device. For this purpose, the control device is appropriately configured and adapted or has appropriate means.

[0022] When there is a break between the second operating device and the control device, the commands and / or signals arriving from the second operating device are ignored and / or not processed and / or erased by the control device. In this case, only the signals and commands from the first operating device are executed and transmitted by the control device, which is important. Thus, the service engineer is protected on - site and mobile access is executed safely. This is executed after the first operating device is linked to the control device without problems, that is, when the first operating device has access rights to the control device.

[0023] The present invention and its advantages will be described in more detail below with reference to the accompanying drawings.

Brief Description of the Drawings

[0024] [Figure 1] Shows a first embodiment of a load tap changer. [Figure 2] Shows a method procedure.

Embodiments for Carrying Out the Invention

[0025] FIG. 1 shows a first embodiment of a load tap changer 1, a first operating device 20, and a second operating device 30. Both the first operating device 20 and the second operating device 30 are external operating devices. The load tap changer 1 has a load tap changer 2, a motor drive unit 3, and a control device 4. In particular, the load tap changer 1 is configured and adapted by the control device 4 to establish a first data link 21 between the load tap changer, that is, between the control device 4 and the first operating device 20.

[0026] Preferably, the first operating device 20 is configured as a mobile terminal, that is, as a smartphone, a notebook computer, or the like. To establish the first data link 21, the control device 4 has a first communication module 22. This first communication module 22 is a short-range communication module and preferably establishes a first data link 21 with the first operating device 20 via Bluetooth or WLAN. The first operating device 20 is appropriately constructed and configured so as to be able to establish a first data link 21 with the first communication module 22 and to provide access to this first data link 21. The first data link 21 is a bidirectional link through which data can be transmitted and received by both the control device 4 and the external first operating device 20.

[0027] In particular, the load tap changer 1 is configured and adapted by the control device 4 to establish a second data link 31 between the load tap changer 1, that is, between the control device 4 and the external second operating device 30, and to provide access to this second data link 31.

[0028] Preferably, the second operating device 30 is configured as a server, computer, etc. To establish a second data link 31, the control device 4 has a second communication module 32. This second communication module 32 is a long-range communication module and preferably establishes a second data link 31 with the second operating device 30 via LTE, MESH, 5G, LoRaWAN, or any other mobile communication standard. The second operating device 30 is appropriately constructed and configured to establish a second data link 31 with the second communication module 32. The second data link 31 is a bidirectional link in which data can be sent and received by both the control device 4 and the external second operating device 30.

[0029] The control device 4 of the on-load tap changer 1 is configured and adapted to control the motor drive unit 3 connected to the on-load tap changer 2, thereby operating the on-load tap changer 2. For this purpose, the control device 4 has a suitable processor and memory. Furthermore, the control device 4 may include a voltage regulator. The timing of when the on-load tap changer 2 must be operated is determined by the use of this voltage regulator.

[0030] Furthermore, the on-load tap changer 1 may have current sensors and voltage sensors connected to the control device 4. These sensors may be connected to a voltage regulator on one hand and to supply measurement data and signals on the other. The measurement data and signals are stored and processed in the control device and transmitted to each of the above-mentioned operating devices via the corresponding data link.

[0031] Once the second data link 31 is established between the on-load tap changer 1 and the second operating device 30, a switching command can be transmitted from the second operating device 30 to the control device 4; the second operating device then accesses the control device 4. The control device 4 allows the second operating device 30 to access the on-load tap changer 1, i.e., the on-load tap changer 4. Measurement data measured by the current sensor and voltage sensor is transmitted to the second operating device 30 and serves as a basis for possible switching commands. Thus, the on-load tap changer 1 is controlled by the second operating device 30.

[0032] Therefore, the measurement data may be stored and processed in the control device 4 itself or in the second operating device 30 so that the on-load tap changer 1 or the on-load tap changer 2 can be controlled or operated. Furthermore, the operation history data collected by the on-load tap changer 2 by the control device 4 can be transmitted to the second operating device 30 via the second data link 31 and evaluated at a later point in time.

[0033] Preferably, the transmitted data may include switching commands to the on-load tap changer, error messages from the on-load tap changer, sensor measurement data, etc.

[0034] Preferably, the first operating device 20 is configured as a mobile terminal, in particular enabling a service engineer to link to, i.e., have mobile access to, the on-load tap changer 1. In this case, the service engineer is on-site, i.e., very close to the on-load tap changer 1. When the first data link 21 is established, the first operating device 20 also gains access to the on-load tap changer 1, i.e., the on-load tap changer 4. For example, to initiate a manual changing process, the service engineer can send various commands via the control device 4 to the on-load tap changer 4 or the on-load tap changer 1. Furthermore, the service engineer can transmit the operating history data collected by the on-load tap changer 4 via the control device 4 to their terminal equipment, i.e., the first operating device 20, and perform an evaluation immediately or at a later time.

[0035] However, for safety reasons, it is necessary that immediately after the first operating device 20, i.e., the service engineer, is linked to the on-load tap changer 1, another operating device, i.e., the second operating device 30, cannot transmit a switching command to the on-load tap changer 4. Therefore, the control device 4 is configured such that the second data link is disconnected immediately after the first data link 21 is established between the control device 4 and the first operating device 20. For example, disconnection may mean that the second data link 31 is disconnected, for example, that the second communication module 32 is disconnected from the second data link 31. Furthermore, disconnection may mean that input commands entered via the second data link are ignored, immediately deleted, or simply not executed.

[0036] Furthermore, the control device 4 is configured and adapted to recognize the establishment, disengagement, and disconnection of links between the first data link 21 and the second data link 31.

[0037] Figure 2 shows a method and procedure for mobile access to the on-load tap changer 1 when the first operating device 20 is linked to the on-load tap changer 1, and in particular to the control device 4 of the on-load tap changer 1.

[0038] The control device 4 of the on-load tap changer 1 monitors the short-range region (short-range region channel) via the first communication module 22 of the control device 4 of the on-load tap changer 1 and recognizes that the first operating device 20 is attempting to establish a link with the on-load tap changer 1 via this channel (step 40).

[0039] After the initial link between the first operating device 20 and the on-load tap changer 1 is established, a secure link is established in the next step 41. Here, the TLS protocol may be used as an example for the secure link. In this case, an encrypted link is first established between the first operating device 20 and the on-load tap changer 1. In this case, AES encryption may be used as an example, and the Diffie-Hellman scheme may be used as the algorithm for key exchange.

[0040] In the next step 42, the trust relationship between the first operating device 20 and the on-load tap changing device 1 is further examined to rule out potential attacks such as man-in-the-middle attacks.

[0041] In the next step, 43, it is necessary to further examine whether the user is even permitted to log in to the on-load tap changer (authorization) and what privileges this user has (authentication). For this purpose, a signed JWT token containing all the information necessary for authorization and authentication may be used. By checking the signature of the token, it can be ensured that the contents of the token have not been altered and that it is a valid token. Furthermore, whether or not the user is granted access to the on-load tap changer 1 can be determined from the additional information in the token.

[0042] If an error occurs during the establishment of the secure first data link; if the identities of the parties involved cannot be verified with 100% certainty; or if authorization or authentication fails, the link is terminated (step 44). Furthermore, if the link establishment fails, all information transmitted during the establishment of the link, such as certificates and base values ​​for calculating session keys, is erased. In step 45, authorization and authentication are performed.

[0043] After the first operating device 20 has successfully linked to the on-load tap changer 1, that is, after the first data link has been established (step 46), the actual state of the second data link 31 is checked in step 47. In this case, in particular, it is considered whether the data to be input to the on-load tap changer 1 via the second data link 31 should be discarded.

[0044] The current state of the second data link 31, in particular, a setting (Einstellung) indicating whether or not data input via the second data link should be discarded, is stored in non-volatile memory. In this case, flash memory may be used as the non-volatile memory.

[0045] The setting value indicating whether the data input via the second data link should be discarded is set to discard the input data. Therefore, in step 48, the second data link 31 between the external second operating device 30 and the on-load tap changer 1 is disconnected. [Explanation of Symbols]

[0046] 1. On-load tap changer 2. On-load tap changer 3. Motor drive unit 4. Control device 20 1st operating device 21. Data Link 1 22. First Communication Module 30 Second operating device 31. Second Data Link 32. Second communication module

Claims

1. An on-load tap changing device (1) includes a control device (4) and an on-load tap changer (2), The control device (4) is configured and adapted to establish a first data link (21) with the first operating device (20), The control device (4) is configured and adapted to establish a second data link (31) with the second operating device (30), The control device (4) is configured and adapted to allow these operating devices (20, 30) to access the control device (4), i.e., the on-load tap changer (2), via their respective data links (21, 31). The on-load tap changer (1) is configured and adapted so that the control device (4) disconnects the second data link (31) between the second operating device (30) and the control device (4) while the first data link (21) is established between the first operating device (20) and the control device (4).

2. The first operating device (20) is an external operating device, as described in claim 1, for the on-load tap changing device (1).

3. The second operating device (30) is an external operating device, as described in claim 1 or 2 for the on-load tap changing device (1).

4. The control device (4) has a first communication module (22) which is a short-range communication module. The on-load tap switching device (1) according to any one of claims 1 to 3, wherein the first operating device (20) establishes a first data link (21) with the control device (4) via a first communication module (22).

5. The control device (4) has a second communication module (32) which is a long-distance communication module. The on-load tap switching device (1) according to any one of claims 1 to 4, wherein the second operating device (30) establishes a second data link (31) with the control device (4) via a second communication module (32).

6. below, The control device (4) monitors the immediate vicinity and recognizes the first operating device (20), The steps include establishing the initial data link between the first operating device (20) and the control device (4), The steps include establishing a secure link between the first operating device (20) and the control device (4), The steps include establishing a first data link (21) between the first operating device (20) and the control device (4), The steps include: disconnecting the second data link (31) between the second operating device (30) and the control device (4); A method for mobile access to a load-operated tap-changing device (1), including the following.

7. The method according to claim 6, wherein short-range monitoring is performed by a first communication module (22) that recognizes a first operating device (20) of a control device (4).

8. The method according to claim 6 or 7, wherein, after a secure link has been established, the trust relationship between the first operating device and the control device (4) is checked.

9. The method according to any one of claims 6 to 8, wherein authentication and authorization of the first operating device (20) are performed by the control device (4) before the establishment of the first data link (21).

10. The method according to any one of claims 6 to 9, wherein when the second data link (31) between the second operating device (30) and the control device (4) is interrupted, commands and / or signals arriving from the second operating device are ignored and / or not processed and / or erased by the control device (4).

Images