Pitch regulator unit of a wind turbine having a system-wide parameterisable safety run and operating state controller, and related operating method

Abstract

The invention relates to a pitch regulator unit (16) for a wind turbine (10) including a plurality of operating state configurations (50) which can be at least partly transformed into one another. The invention proposes that an operating state controller (52) is comprised which allows parameterisation of dynamic and / or static control variables of a safety run (SFR), comprising at least one of the control variables rotational speed, torque, acceleration, run time and / or end position, and preferably transformability of operating state configurations (50), on the basis of internal and external information signalling (30, 32, 34, 36). In addition, the invention proposes a corresponding control method for operating the pitch regulator unit (16), in which a curve of a safety run (SFR) is parameterised on the basis of internal and external information signalling (30, 32, 34, 36).

Description

[0001] Pitch control unit of a wind turbine with a system-wide parameterizable safety drive and operating state control and related operating procedure

[0002] The invention relates to a pitch control unit for a wind turbine comprising a plurality of operating state configurations which can be at least partially converted into one another, wherein at least for the safety operating state an operating state control is included which enables a system-wide parameterization of the safety travel and preferably a convertibility of operating state configurations on the basis of internal and external information signaling.

[0003] STATE OF THE ART

[0004] Pitch control units for controlling the pitch, i.e., the angle of attack of a rotor blade of a wind turbine, are known from the state of the art. These units can assume a variety of operating states. Safety operating states are particularly important in this regard, protecting the wind turbine from mechanical overload and maintaining control capability in the event of a fault. The individual safety functions and monitoring features, as well as the safe inputs and outputs of the pitch control units, which are also referred to as pitch servo controllers or pitch power controllers, can be flexibly parameterized for their respective applications. In addition to safe setpoints such as the speed profile of the safety run, monitoring limits and triggered reactions can be set.

[0005] Pitch control units are typically designed as finite-state machines (FSMs). Such state machines implement a control concept modeled on an abstracted machine with a series of states that define its operating sequence. A pitch control unit operates by transitioning from one state to another and executing specific actions during such state transitions and while maintaining a certain state. The subsequent state results from the current state and an external event, such as a keystroke. The machine is sensitive to very specific events in different states.

[0006] Depending on the state and configuration of the pitch control unit, designated safety functions are activated or deactivated. Activation can be triggered by a change in operating mode, the end of a previous safety function, or a request via a safe input or fieldbus. In order for a safety function to be activated in a specific operating mode, it must be parameterized as enabled for that mode. Safety functions are generally pre-parameterized and not dynamic, particularly not adaptable depending on the historical and current states of the wind turbine.

[0007] In addition to the setting option for enabling the activation of a safety function, there are also parameters for configuring necessary error responses, depending on the respective operating mode. The corresponding parameters can be identified using code words. Thus, the current state of the art allows the entry and execution of operating states and the transition from one operating state to another of a pitch control unit to another operating state to another via code words or status words. However, this requires operating and monitoring logic from higher-level control components of the wind turbine's pitch control system.Thus, a state machine of the operating states of the pitch control unit must be provided and adapted externally, whereby the pitch control unit (PDU - Pitch Drive Unit) can only carry out a fixed sequence of operating state changes based on internal operating states or external parameterization, which does not allow for dynamic changes in the configuration of the operating state changes and the parameters of the operating states due to events at the level of a system-wide control device of the wind turbine (TCU - Turbine Control Unit) or at the level of the cross-rotor blade pitch control monitoring device (PSC - Pitch System Control Unit). In the prior art, the state and state changes of the pitch control unit are based on a predetermined set of parameters and do not take into account the potentially dynamically changing, system-wide operating state of the wind turbine.

[0008] The safety run (SFR), as the essential safety-relevant operating state for assuming the so-called feathering position, serves to return wind turbines to a safe operating state as quickly as possible in the event of a malfunction. Malfunctions can include, for example, excessive rotor speed or other errors in the wind turbine. Since the brakes in modern wind turbines are often no longer able to stop the rotor, the rotor must be decelerated via the pitch system. To do this, the blades are moved out of the wind towards the "feathering position" as quickly as possible during the safety run. In this position, the blades offer the smallest surface area for the wind to attack, and in addition, the rotor is aerodynamically decelerated by the large surface area in the direction of rotation of the rotor.

[0009] Depending on the pitch system concept, there may be differences in the type of safety travel. The following options can be configured via parameterization:

[0010] • Positioning safety run to the flag position

[0011] • Speed-controlled safety travel until limit switch in flag position

[0012] • Controlled safety travel (U / f characteristic) until limit switch in flag position

[0013] • Speed-controlled / controlled safety travel for a parameterizable time

[0014] • Combinations of the above options (switching during the safety run depending on certain conditions)

[0015] The decisive factor for the type of safety travel is which component is considered the safest way to move the blade toward the feathering position. This results in a wide variety of requirements for the safety travel. With DC drives, a backup voltage is usually applied directly to the motor as a last and safest solution. In this case, it must be quickly and clearly detectable when the servo controller is no longer able to move the blade.

[0016] With three-phase drives, however, the servo controller is usually used as the final instance for moving the blade. The servo controller must therefore be able to ignore errors if possible or acknowledge them independently.

[0017] Further requirements for the safety travel arise from the fact that, depending on the application, a sensor or a limit switch can be considered the most reliable detection feature for reaching the flag position. The drive can therefore either attempt to reach its target by positioning or move to a limit switch with speed control.

[0018] EP 1 959 127 B1 discloses a method and device for indirectly determining dynamic variables of a wind turbine. Force or acceleration sensors arranged symmetrically on the rotor hub enable the determination of rotational dynamic variables such as rotational speed, angular acceleration, and the angle of rotation of the rotor shaft. Knowledge of the dynamic variables can be used to indirectly determine the rotor blade pitch, direction of rotation of the rotor shaft, mechanical load on the rotor, nacelle orientation, and other variables. A safety run in a pitch control unit can be triggered, but this is performed using fixed, predefined control variables that cannot be adapted to the current conditions of the wind turbine.

[0019] EP 2 807 370 B1 discloses a pitch control unit with an emergency voltage supply via a battery in an intermediate circuit of a pitch motor converter, wherein a switchover to an internal control voltage occurs after a functional test and an internal safety chain is closed, and wherein after all internal safety chains of the pitch control units are closed, a system safety chain is closed so that increased system safety can be provided. The safety movement in a flag position should take place synchronously for all pitch control units. The safety chains for activating the safety movement monitor various operating parameters, but the safety movements of each pitch control unit are always carried out consistently with regard to the control parameters of the safety movement itself, i.e. fixed predetermined speed, torque and end position. The sequence of the safety movement itself cannot be parameterized.

[0020] EP 3 940 226 B1 relates to a method for adopting a shutdown position of a pitch control unit, wherein the pitch control unit has an energy storage device and / or a pitch brake, and the pitch control unit adjusts the rotor blade to a shutdown position as a feathering position or spin position based on an activation signal to indicate a special operating condition or malfunction. In this situation, an adjustment operating mode of the pitch control unit can also be provided in order to further adjust the rotor blade, e.g., from the spin position to the feathering position. The safety travel provided for this purpose is carried out with constant, i.e., non-parameterizable control variables.

[0021] DE 10 2014 114 787 B4 teaches a pitch control unit comprising a charging converter device that provides a local network, wherein the charging converter device can adaptively charge an energy storage device in an optimized manner by adjusting the charging voltage and charging current. A safety run can be performed, but there is no indication of parameterization of the safety run, which is thus carried out with constant control parameters. DE 10 2007 030 268 A1 discloses a method and a device for indirectly determining dynamic variables of a wind turbine using arbitrarily arranged measuring sensors. It is disclosed that a force or acceleration sensor rotates around the rotor shaft, whereby the measuring sensor enables a speed determination. A safety run with fixed control variables is mentioned in passing.

[0022] Each of the aforementioned publications discusses a safety run with constant control variables regarding acceleration, speed, torque, and end position. Parameterization depending on the current operating parameters of the wind turbine is neither anticipated nor suggested.

[0023] A disadvantage of the current state of the art is that, with the pitch control units known from the prior art, a safety run is always performed under the same static and dynamic operating parameters, without consideration of structural weakening and aging of the wind turbine, the specific triggering cause, the currently occurring mechanical load, and other triggering factors such as wind conditions, operating status, and the like. In addition, the actual use of the pitch control unit requires considerable effort in parameterizing the transitions and implementing the safety run operating status (SFR) and other operating states, as well as control and monitoring via a higher-level, cross-rotor blade pitch control monitoring device or a system-wide control device.Replacing or replacing a pitch control unit therefore requires significant parameterization effort for higher-level components of a wind turbine's pitch control system. All conceivable operating states and, if applicable, operating state transitions must be considered, and all components involved must be adapted. Therefore, a system-wide state machine for the pitch control system with regard to the safety run (SFR) can only be achieved through the interaction between the pitch control unit and higher-level system components. This makes the effort required to parameterize the safety run (SFR) and other operating states of a pitch control unit, and their conditions for changing the operating state, extremely complex, time-consuming, and error-prone. This compromises safe operation in terms of functional safety.

[0024] The object of the present invention is therefore to achieve a simple and dynamic parameterization and control of the safety travel (SFR) and preferably the transitions of operating states of a pitch control unit with reduced adaptation effort and reduced susceptibility to errors, which takes into account both internal and external states, behavior and function of the wind turbine.

[0025] This object is achieved by a pitch control unit according to the independent claims. Advantageous embodiments of the invention are the subject of the dependent claims.

[0026] DISCLOSURE OF THE INVENTION

[0027] The invention relates to a pitch control unit for a wind turbine comprising a plurality of operating state configurations (50) which can be at least partially converted into one another.

[0028] It is proposed that an operating state control is included which enables a parameterization of dynamic and / or static control variables of a safety travel (SFR), with at least one of the control variables speed, torque, acceleration, travel duration and / or end position, and preferably a transferability of operating state configurations on the basis of internal and external information signaling.

[0029] In other words, a pitch controller unit is proposed whose execution of the safety run (SFR) and possibly other operating states and preferably transitions of the operating states are based not only on internal parameterization and internal states of the pitch controller unit, but also on a dynamic external state, behavior, and function of the wind turbine, in particular the state, behavior, and function of the system-wide control device of the wind turbine and / or the cross-rotor blade pitch controller monitoring device. Parameterizable here preferably means a switching, an offset, and / or scaling of dynamic control variables in the temporal or path-based or pitch angle-based execution of the safety run, in particular speed and torque in individual phases of the safety run, as well as target angle and duration as static variables of the safety run.For example, based on a base profile BP of a safety run, this can include profile switching, offset generation, and / or scaling of initial acceleration, constant speed, and deceleration acceleration over the path (or pitch angle) or time course of the safety run. Thus, the state machine of the pitch controller unit takes into account a higher state level of the wind turbine with regard to the safety run (SFR), reducing both the adaptation effort and the susceptibility to errors in the selection and execution of the safety run and the transitions between various other operating states. This enables easy replacement of the pitch controller unit PDU without intervention or modification of the higher-level pitch controller monitoring device PSC or the plant-wide control unit TCU.Functional safety is taken into account during the safety run, wear is reduced, and a situation-adapted shutdown of the wind turbine is enabled. Since a higher-level control system typically knows the system status of the entire wind turbine, whereas a pitch control unit can only consider an internal operating state, external parameterization of a basic driving profile of a safety run enables adaptation to this overall status. Furthermore, the pitch control unit can perform the safety run autonomously. In addition, limiting, adapting, and overriding the safety run through parameterization based on external information signals can significantly increase functional safety, extend service life, reduce wear, and minimize failure rates and operational risks.

[0030] Thus, the invention proposes equipping the safety travel with an alternative travel profile, an offset value, and / or a scaling factor over the base profile. This serves to ensure load-optimized operation of the affected system, compared to a previously profiled safety travel. This is intended to enable the type of safe movement to be carried out more specifically for specific load cases at the time of the fault occurrence. The parameterization for speed, acceleration, and deceleration can be influenced online during the safety travel, e.g., via a safe fieldbus.

[0031] The general goal for load management is that an ongoing movement, especially during a safety movement, should not be interrupted, and care should be taken to ensure that the same movement is performed on all axes. However, different load cases also result in different optimal movements. In the current situation, these load cases are all represented by a compromise in a profiled safety movement. The new functionality of the parameterized safety movement is intended to take this circumstance into account.

[0032] In an advantageous embodiment, a change in the parameterization can be enabled during the safety travel sequence (SFR). It is conceivable that after the start of a safety travel sequence, an excessively high or low load is detected by an internal and / or external information signal, for example an external wind sensor, an internal current sensor, or similar, so that during the safety travel sequence, the torque profile can be switched, offset, and / or scaled towards a reduced or increased load. Thus, the safety sequence can be dynamically adjusted based on internal or external signaling even during the safety travel sequence, so that an optimized safety travel sequence can be provided, taking into account any changed information signaling that occurs during the safety travel sequence.

[0033] As a rule, the safety travel SFR is stored as a predefined profile of dynamic or static control variables on an ordinate over the temporal travel course or over the current pitch angle as an abscissa, which, for example, specifies a change in speed, torque, acceleration over the course of the safety travel SFR. This profile can be referred to as the basic profile of the safety travel SFR. In an advantageous embodiment, the parameterization can include a switchover, an offset, and / or a scaling of a basic profile of the safety travel (SFR). A switchover means the use of a completely different profile than the basic profile, whereby the changed profile can be available, for example, as a characteristic curve, in tabular form or stored in another way, or dynamically generated. An offset means at least a section-by-section, static abscissa and / or ordinate shift, i.e.an at least partially static offset in the temporal or path-based (pitch angle-based) profile and / or in the profile value height. Scaling can be an at least partially multiplication of either the ordinate and / or abscissa of the base profile profile, so that either the profile can be stretched or compressed, and / or the profile value heights can be stretched or compressed. Thus, within the framework of parameterization, the base profile of the safety travel SFR can be changed at least partially with relatively few manipulated variables such as scaling parameters, offset parameters, or sets of safety travel profiles.

[0034] In an advantageous embodiment of the preceding embodiment, the operating state control can be configured to define a parameterization of a safety run (SFR) at least section by section, i.e. in path- or time-based subsections of the safety run, based on external information signaling relating to one or more scaling parameters of the safety run (SFR), which can be defined by a system-wide control device (TCU - Turbine Control Unit) and / or a pitch controller monitoring device (PSC - Pitch System Control Unit). The PSC, which controls the blade angle setting of all rotor blades, and the system-wide TCU record operating and environmental states of the wind turbine, which can be incorporated into the sequence and type of the safety run. For example, in the event of a "power failure" with the associated load shedding, the PSC can adapt the safety run.

[0035] The pitch control units can advantageously be able to communicate with one another, in particular in order to provide coordinated behavior, preferably within the scope of a safety run. It is also conceivable that an adaptive neural network, for example in the form of artificial intelligence, can be provided at least in an internal pitch control module of at least one pitch control unit, which can select suitable operating parameters for internal information signaling based on historical experience data and the current state of the wind turbine. When communicating with further pitch control units, the parameterizations can be forwarded to further pitch control units as external information signals. This advantageously makes it possible to dispense with a higher-level, central pitch control monitoring device or to implement one.to distribute at least some of their function decentrally to the pitch control units in order to create safety redundancy, reduce susceptibility to errors, reduce technical complexity and / or create installation space.

[0036] In an advantageous embodiment, the switching profiles, offset values, and / or scaling parameters can be used to parameterize the basic profile BP of the safety travel (SFR) between a maximum scaled profile SPmax and a minimum scaled profile SPmin. The switching profiles, offset values, and / or scaling parameters relate in particular to speed (sv1, sv2, sv3), acceleration (sa1), and deceleration (sd1, sd2) of the safety travel (SFR), which can preferably be parameterized individually, and in particular in sections during the course of the safety travel (SFR), and which can furthermore preferably exceed maximum normal travel parameters or fall below minimum normal travel parameters. The scaling, based on the basic profile BP, can preferably be selected between at least 0% and 200%. A scaling of 100% would correspond to the basic profile BP.By scaling sections of the safety travel, in particular acceleration, deceleration and constant speed sections of the pitch motor, a time specification of the safety travel can be set precisely, a motor load can be set and a mechanical load can be optimized taking into account aging, wear and external environmental conditions.

[0037] In an advantageous embodiment, the operating state control can comprise at least the operating states Normal Operation, Service Mode, Engineering Mode and Feathering Mode, in particular further comprise the states Firmware Update and Initialization.

[0038] In this embodiment, preferred operating states are considered advantageous. Figs. 4 and 5 illustrate advantageous transitions between these operating states. Based on internal and external, dynamically changed parameterization, it is determined which operating state can be converted into a further operating state and which internal and external boundary conditions may prevail.

[0039] In addition to the operating state of the initialization phase, e.g., after a power-up or reset of the pitch control unit and a firmware update phase, four basic operating modes can be distinguished for the pitch control unit, for each of which a specific subset of the safety functions can be activated:

[0040] Normal Operation

[0041] The Normal Operation mode is the standard operation of the pitch control unit when the wind turbine is in productive operation.

[0042] Service Mode

[0043] The service mode is required for setting up the converter and for maintenance work on existing systems.

[0044] Engineering Mode

[0045] In Engineering Mode, the inverter's performance can be designed and tested on the test bench. In this operating mode, all safety functions are deactivated.

[0046] Feathering Mode

[0047] Feathering mode is the override operating mode for the safety function "Safety Travel" (SFR). This mode includes movement within the safety travel and maintaining the safe state in the feathering position. The "Initialization" operating state can only be fully completed if a data set for the safety functions (DS-Safe) is available. If this data set is missing, the device remains in Initialization mode and waits for the safe parameter data set to be imported.

[0048] In an advantageous embodiment, the operating state control can be configured to select the parameterization of the safety travel (SFR), and preferably different sets of transferability of operating state configurations based on the state and / or function of the wind turbine.

[0049] Alternatively or additionally, a selection can be made on the basis of an overall operating state of all pitch control units of the wind turbine, in particular on the basis of a grouped operating state of all pitch control units or on the basis of an individual operating state.

[0050] With regard to the previous embodiment, the parameterization of the safety run (SFR) can be selected based on the aging state, wear state of the wind turbine, and / or blade angle, tower inclination, blade vibration, load torque on the blade hub or pitch motor. This allows for a safety run adapted to the condition of the wind turbine and external environmental conditions.

[0051] In an advantageous embodiment, the operating state controller can be configured to select the parameterizations of the safety run (SFR), SFR), and preferably different sets of transferability of operating state configurations based on the request and / or execution of a safety run, in particular based on an external input signal. The request for a safety run, e.g., in the event of excessive wind load or failure of control components of the wind turbine, before or during the execution of the safety run, is given the highest priority, and its reliable execution is the essential basis of plant safety. Safety run requests can arise due to internal conditions, behavior, or function, or due to external requirements.In this case, other operating state transitions can be provided than those previously applicable, which are enabled, for example, in normal mode or in engineering mode.

[0052] In an advantageous embodiment, the operating state controller can be configured to select different sets of transferability of operating state configurations based on the request and / or execution of a service mode and / or engineering mode, in particular based on external input signaling. These operating states are usually assumed when the wind turbine is inactive or during safe operation. Due to increased wind load, grid failure, or other critical system conditions, a transition into or out of these states can be adaptively enabled.

[0053] In an advantageous embodiment, the operating state controller can be configured to enable a transition after acknowledgment of a previous operating state and / or request or non-request of a future operating state. This ensures that the previous operating state has been fully adopted or that a future operating state is actually requested.

[0054] Alternatively or additionally, it can be possible to transfer an operating state from service mode, engineering mode, feathering mode, or normal operation to the firmware update operating state when an externally transmitted firmware data set is available, in particular when a wirelessly transmitted firmware data set is available. This enables fast and uninterrupted updating of the firmware of the pitch control unit, and various non-system-critical operating states, as functions or behavior are assumed based on internal or external conditions. The firmware update can also include an update of firmware for sub-units that are directly controlled by the pitch control unit or can be assigned to it, such as the control software of an electronic controller for the pitch motor, the pitch gear, intelligent sensors and encoders, power supplies, etc.Preferably, a controller of the pitch control unit can initiate, execute, and check a firmware update of subsystems assigned to the pitch control unit through longitudinal communication between the pitch control unit and the subunits. In particular, a special functionality of the firmware update can be enabled through a wireless "on the air" (OTA) update, for example, via a mobile device such as a tablet, smartphone, or laptop. Transitioning the operating state and updating the firmware via a mobile network such as 4G or 5G is also easier.

[0055] In an advantageous embodiment, a higher-level pitch monitoring module can be comprised of a pitch control module and an internal safety module, wherein the higher-level pitch monitoring module can be configured to carry out complex pitch drive sequences, the pitch control module can be configured to directly control a pitch motor, and the internal safety module can be configured to carry out internal monitoring of the pitch control module and, in the event of a corresponding external input signal or an internal error, to select the safety drive or feathering mode operating state. The internal safety module can independently monitor and, if necessary, control the operating states and behavior of the pitch motor. It thus serves both for redundancy and for checking the pitch control module, which controls rudimentary movement sequences such as emergency drive, angle adjustment of the pitch motor, etc.In this respect, the safety module serves as a functional safety module that can also take over specific control tasks and operate autonomously.

[0056] In an advantageous embodiment, the pitch control module can be configured to monitor the higher-level pitch monitoring module and / or the internal safety module and, in the event of an error, to select the safety travel or feathering mode state and to independently move the pitch motor into a feathering position. This enables mutual monitoring of the pitch control module and the safety module, so that error-free operation can be further ensured. In the event of inconsistent behavior, a check for the source of the error and a mutual takeover of control and transition of the operating state can be initiated, depending on which module is affected by the source of the error. Advantageously, the safety module can also be configured to monitor the higher-level pitch monitoring module (PMM - Pitch Monitoring Module, CMM - Certified Automation Module) and to independently assume at least some of its functions.

[0057] In an advantageous embodiment, the parameterizations of the safety travel (SFR) and / or the operating state configuration and the transferability of operating state configurations in the pitch control module and the internal safety module can be designed identically and executed in parallel and independently of each other. This achieves consistent behavior with regard to the entry and transition of operating states. By comparing the transitions between the pitch control module and the safety module, a further verification option for consistent and error-free behavior of the pitch control unit is created in the spirit of functional safety.

[0058] In a secondary aspect, a method for operating a pitch control unit described above is proposed, wherein a parameterization of dynamic and / or static control variables of a safety travel (SFR) such as at least one of the control variables speed, torque, acceleration, travel time and / or end position, and preferably a transferability of operating state configurations, takes place on the basis of internal and external information signaling.

[0059] The proposed method allows the safety run to be adapted to the current and historical state of the wind turbine and external environmental conditions such as wind load, mechanical and electrical loads such as wind load, power failure, mechanical vibrations, load torques on the pitch motor, etc. This allows for a high level of safety and a load-optimized course of the safety run. For this purpose, a transition of operating states can be parameterized, specifically whether or not it is provided, depending on the internal and external conditions of the wind turbine.

[0060] In an advantageous embodiment of the method, the parameterization can be changed during the safety travel sequence (SFR). It is conceivable that after the start of a safety travel sequence, an excessively high or low load is detected by an internal and / or external information signal, for example an external wind sensor, an internal current sensor, or similar, so that a switchover, offset shift, and / or scaling of the torque profile towards a reduced or increased load is carried out during the safety travel sequence. Thus, the safety sequence can be dynamically adjusted during the safety travel sequence based on internal or external signaling, so that an optimized safety travel sequence can be provided, taking into account any changed information signaling that occurs during the safety travel sequence.

[0061] As a rule, the safety travel SFR is stored as a predefined time- or distance-based, in particular pitch-angle-based profile of dynamic or static control variables on an ordinate over the course of the travel as an abscissa, which, for example, specifies a change in speed, torque, acceleration over the course of the safety travel SFR. This profile can be referred to as the basic profile BP of the safety travel SFR. In an advantageous embodiment of the method, the parameterization can comprise a switchover, an offset, and / or a scaling of a basic profile of the safety travel (SFR). A switchover means the use of a completely different profile than the basic profile, whereby the changed profile can be stored, for example, as a characteristic curve, in tabular form, or otherwise, or can be generated dynamically. An offset means at least a section-by-section, static abscissa and / or ordinate shift, i.e.a static offset, at least in sections, in the profile and / or in the profile value height. Scaling can be an at least partial multiplication of either the ordinate and / or abscissa of the base profile profile, so that either the path- or time-based profile is stretched or compressed, and / or the profile value heights are stretched or compressed. Thus, within the scope of parameterization, the base profile of the safety travel SFR can be changed, at least in sections, using relatively few manipulated variables such as scaling parameters, offset parameters, or sets of safety travel profiles.

[0062] In an advantageous embodiment of the method, the parameterization can comprise switching, offset generation, and / or scaling (sv1, sv2, sv3, sa1, sd1, sd2) of the safety travel (SFR), preferably in sections and separated by acceleration, deceleration, and speed, based on the base profile BP. Over the course of the safety travel, the applicable pitch motor speeds can be parameterized or scaled based on a base profile for acceleration sections, sections with constant speed, and deceleration sections within the scope of the safety travel.

[0063] In an advantageous embodiment of the invention, the profile switching, offset formation and / or scaling of the basic profile BP of the safety travel (SFR) can be defined between a maximum scaled profile SPmax and a minimum scaled profile SPmin, wherein the scaling parameters relate in particular to speed sv1, sv2, sv3, acceleration sa1 and deceleration sd1, sd2 of the safety travel SFR, which can preferably be scalable individually, and in particular in sections during the course of the safety travel (SFR), and which can further preferably exceed maximum normal travel parameters or fall below minimum normal travel parameters. By specifying maximum and minimum scaling parameters, a maximum and minimum safety travel profile SPmax, SPmin can be defined starting from a basic profile of the speed movement of a pitch motor during a safety travel.The maximum and minimum scaling values ​​can exceed the maximum and minimum standard values ​​of a safety run if necessary.

[0064] In an advantageous embodiment of the invention, the parameterization of the safety run (SFR) can be selected based on the aging state, wear state of the wind turbine, and / or blade angle, tower inclination, blade vibration, load torque on the blade hub or pitch motor (18). The parameterization can thus be adapted to the condition of the wind turbine, such as wear, aging, but also external factors such as wind load, etc. For this purpose, data from blade angle sensors, torque or braking force sensors in the pitch gearbox or pitch motor, vibration sensors, inclination sensors, etc. can be taken into account.

[0065] Advantageously, the parameterization can be adapted to the type of wind turbine, the location, and the typically prevailing weather conditions during installation, and can be further adapted during maintenance or updates, especially remote updates (OTA updates). Security-related barriers such as administrator access and separate security parameter editors are advantageous for accessing the parameterization.

[0066] Furthermore, a parameterized safety movement, especially a parameterized safety movement, can be selected alongside a static safety movement or activated via safe fieldbus access. It can also be activated when a so-called safety error occurs and / or via functional errors.

[0067] It is also advantageous if, with regard to a requirement, the parameterised safety travel can apply the switching profile, the offset value and / or the scaling factor with regard to speed, acceleration and deceleration at the start. With regard to a qualitative requirement, it can be advantageous if the parameterised safety travel currently applies updated parameterisations that are provided cyclically via a safe fieldbus, i.e. also adapts SFR during the course of the safety travel. With regard to functional safety, the safety travel can advantageously be monitored with regard to the SSR function and SCA_Timeout, the period until a middle travel section of the safety travel is reached. When these safety functions are triggered, a so-called watchdog reset (WDRST) can be triggered as a consequence, which mayan emergency reset in case of unforeseen malfunction, which can be detected by a watchdog monitoring module.

[0068] Preferably, a failure of the higher-level safety control should be detected and in this case the basic profile BP should be selected for a safety run, whereby no parameterization should be taken into account.

[0069] The position window of the base profile should preferably not be changeable by a scaled safety run. In an advantageous embodiment, neighboring pitch control units can be connected to each other via a communication interface for the exchange of pitch control information, directly or indirectly, for example, via a bus system. This can be referred to as cross-communication between the pitch control units. For this purpose, each pitch control unit can have a local communication port for cross-communication. The pitch control information can include, for example, but is not limited to, the following information:

[0070] Setpoints, in particular the control for the rotor blade position;

[0071] Actual values, in particular those of the rotor blade position control; measured values ​​received and / or recorded by sensors connected to the pitch drive control unit; calculated values, in particular from the received and / or recorded measured values;

[0072] Operating parameters of the pitch drive control unit, including the software version of application software and / or firmware or an installable data processing program with the application software and / or firmware or software updates;

[0073] Absolute or relative time information;

[0074] Data packets from safety modules of the pitch drive control units themselves, the pitch drive controller and / or the central control of the wind turbine.

[0075] Using the pitch control information exchanged through cross-communication, the pitch control units can advantageously organize, coordinate, monitor, and influence each other independently. It is also conceivable that a higher-level pitch control monitoring system could be dispensed with. Artificial intelligence can be used in this context in a self-organized network of cross-communicating pitch control units.

[0076] In an advantageous embodiment, coordination, monitoring, and control can be carried out by means of cross-communication between the pitch control units, at least for the operating states of safety travel and / or firmware update. Thus, the parameterization of the safety travel of the connected pitch control units can be coordinated, in particular synchronized, or even offset or cascaded, in order to achieve, for example, a specific system-wide behavior through the safety travel, such as a predetermined nacelle rotation or orientation, and / or a predetermined rotor blade position of the rotor axis. Within the scope of a firmware update, secure locking and retention of the locking of the pitch control units, e.g., in the flag position, can be ensured before and during the firmware update until successful completion.It is also possible to transmit firmware update states and firmware data packets to check and ensure a consistent or coordinated firmware state. It is conceivable that one pitch control unit could temporarily act as the master and the others as slave units, whereby this assignment can be dynamically varied.

[0077] In addition to cross-communication, longitudinal communication between the pitch control unit and connected subordinate units, such as sensors, encoders, and actuators such as pitch gears or pitch motors, can advantageously be provided. In addition to controlling and monitoring the unit's behavior, longitudinal communication can also advantageously be used by the pitch control unit to provide and implement firmware updates.

[0078] DRAWINGS

[0079] Further advantages will become apparent from the accompanying drawing description. The drawings illustrate exemplary embodiments of the invention. The drawings, the description, and the claims contain numerous features in combination. Those skilled in the art will also expediently consider the features individually and combine them into useful further combinations.

[0080] They show:

[0081] Fig. 1a,b each show a block diagram of a schematic structure of a pitch control system of a wind turbine according to two embodiments of the invention;

[0082] Fig. 2 shows an embodiment of a course of a parameterized safety trip;

[0083] Fig. 3 is an operating state transition diagram of a pitch control unit according to the prior art;

[0084] Fig. 4 is a block diagram of an embodiment of an operating state controller for controlling the transition between operating state configurations;

[0085] Fig. 5 is an operating state transition diagram of an embodiment of a pitch control unit;

[0086] Fig. 6 is a block diagram of an internal structure of an embodiment of a pitch control unit;

[0087] Fig. 7 is an operating state transition diagram of an embodiment of a pitch control unit.

[0088] In the figures, similar elements are numbered with the same reference numerals. The figures are merely examples and are not to be construed as limiting.

[0089] 1a and 1b each show a block diagram of a schematic structure of a pitch control system of a wind turbine 10, with the connecting lines representing a bidirectional flow of information and data between the networked devices, facilities, and units. The wind turbine 10 is controlled by a higher-level, system-wide control device (TCU - Turbine Control Unit) 12, which determines both power generation and rotor blade control at a higher-level level. In the embodiment according to Fig. 1a, a pitch control monitoring device (PSC - Pitch System Control Unit) 14 is connected to this via a line for system control information 30, which performs coordinated system-wide control of the position of all rotor blades 22. This is connected to the three pitch control units 16 via a bidirectional information data line for pitch control information 32. Alternatively, in the embodiment according to Fig.1b shows that the pitch control units 16 can also be connected directly to the system-wide control device 12, or, according to Fig. 1a, exchange information with this information indirectly via the pitch control monitoring device 14. It is also possible for the three pitch control units 16 to exchange pitch control information 3 directly with each other, as indicated by bidirectional arrows of the information flow between the pitch control units 16. In the embodiment according to Fig. 1b, the pitch control monitoring device 14 can be omitted, since the pitch control units 16 automatically exchange information with each other and with the system-wide control device 12, and can thus replace the function of the central pitch control monitoring device 14 autonomously and in bidirectional information exchange. A pitch motor 18 is connected to each pitch control unit 16 and is driven directly by the pitch control unit 16.The pitch motor 18 is mechanically coupled to a rotor blade 22 for adjusting the pitch angle via a gearbox 20, possibly with a holding brake. A conventional emergency power supply system, which provides at least one emergency run to a feathering position in the event of a grid power failure, is not shown for reasons of clarity.

[0090] An essential operating state of each pitch control unit 16 is the "feathering mode", i.e. the transfer of the rotor blades 22 into a feathering position as part of a safety run, in which the wind cannot exert any torque on the wind turbine 10. In an emergency, e.g. in the event of a power failure, the rotor blades 22 of the wind turbine 10 are moved into the so-called "feathering position" by means of a pitch motor 18 per rotor blade 22 as part of a reset movement which generally lasts several seconds, in order to brake the rotor of the wind turbine 10. In the case of AC pitch motors 18, this is carried out with the aid of an inverter in the pitch control unit 16, in which inverters, due to their high complexity, numerous possible causes of failure can interrupt this reset movement.Therefore, the implementation of the "feathering mode" is usually monitored by the higher-level control device 12 or the cross-rotor blade pitch controller monitoring device 14, which intervenes in the event of a fault and, for example, performs a fault acknowledgement or a restart of the converter control of the pitch controller unit 16 in order to continue the "feathering mode".

[0091] If this is not possible, the pitch motor 18 is shut down by the monitoring control device 12 or the pitch controller monitoring device 14 in a further fallback mode, i.e., its torque is switched off (STO), and the faulty blade 22 is braked by means of a holding brake on the pitch motor 18 or mechanically in the pitch gear 20. With the two pitch controller units 16 still functioning, the "feathering mode" can be continued to brake the rotor of the wind turbine 10.

[0092] The approval guidelines for wind turbines (e.g., GL2010 from Germanischer Lloyd) require a safety assessment (Safety Integrity Level, SIL) for the "Feathering Mode" function in accordance with relevant standards for the functional safety of machinery or programmable electronic systems (e.g., EN 13849 or IEC 61508 from 2010). A fundamental principle of functional safety is the partitioning of a complex system into a safe and an unsafe part. To implement the "Feathering Mode" function, the pitch controller monitoring device 14 and / or the pitch controller unit 16 can advantageously be divided into an "unsafe" converter controller and a "safe" monitoring controller.

[0093] The pitch control unit 16 thus includes the safety run (SFR) as an integrated safety function. This safety function is intended to bring the wind turbine 10 into a safe operating state as quickly as possible in the event of a malfunction. Malfunctions can include, for example, excessive rotor speed, overvoltage, or other electrical or mechanical faults.

[0094] The rotor is decelerated via the pitch system, consisting of three axes, each with a pitch control unit 16, i.e., a pitch servo controller in the drive train. To decelerate the rotor safely, at least two of the three blades 22 must be set to the wind vane position. This means that if one blade 22 fails, e.g., due to a mechanical problem, the remaining two blades 22 can stop the rotor.

[0095] A safety movement requested from outside or triggered by an error can be passed on via a secure cross-communication of the pitch control information 32 between all three pitch control units 16, so that in principle all pitch control units 16 of the group initiate the safety movement.

[0096] For mechanical reasons, it may be advisable for all three axes to start the safety run synchronously. The maximum synchronization time between the three pitch control units 16 can be defined using a specific operating state parameter. If the synchronous start command for all three rotor blades 22 is not received within this waiting time, e.g., due to a communication failure, the axes start the safety run independently of each other.

[0097] In the prior art, the safety run was defined as a fixed base profile. The present invention proposes parameterization and adaptability of the safety run to internal and external conditions of the wind turbine. An embodiment of this is described below in Fig. 2.

[0098] Fig. 2 illustrates one embodiment of a time-dependent progression of a parameterized safety run. The upper diagram shows the position or angle progression of the rotor blade during the safety run, beginning with a position SFM Pos LL, Lower Limit, i.e., the starting position of the safety run. The neutral position, or flag position FP, is reached at the end of the safety run. However, the progression can also be plotted against the current pitch angle or the rotor blade position as the abscissa, with torque, speed, or similar dynamic variables being plotted on the ordinate.

[0099] Three points in time are identified during the safety run: The start of the safety run, during which an acceleration sal is applied to the pitch motor 18 up to a constant speed sv1, is marked with the time SSR Pos LL. The speed sv1 is transferred to a lower speed sv2 with a subsequent deceleration phase sd1. The middle of the duration of the second constant speed range sv2 is designated with the time SFM Pos UL, the upper limit of the rotor blade position during the safety run, and is reported back to the pitch control unit 16. This is followed by a second deceleration range with deceleration sd2 down to a third, lower constant speed range sv3, which is maintained until the feather position FP is assumed. The middle of the third constant speed range sv3 is designated with the time SSR Pos UL.

[0100] The lower diagram shows the speed curves rpm of the pitch motor 18. The solid line shows the base profile BP. A scaling range is specified in the individual acceleration phases sa1, constant speed phases sv1, sv2, sv3 and deceleration phases sd1, sd2. A maximum scaling of up to 200% down to a minimum scaling of up to 0% can be assumed for each scaling parameter. An upper speed curve with a higher scaling is shown as SPmax (dash-dotted line), a lower curve with a lower scaling is shown as SPmin (dashed line). In between, further scaled safety driving profiles are conceivable; these can be selected under different trigger conditions and also adapted dynamically. A specified maximum speed value SSR rpm max for normal travel of the pitch motor 18 can also be exceeded if necessary.

[0101] Fig. 3 shows a state transition of the operating modes of a prior art pitch control unit. This unit has a central device state machine that establishes fixed transitions to previously parameterized code words. These cannot be adaptively changed due to dynamically changing conditions, states, function, and behavior of the wind turbine 10. Furthermore, no adjustment of the basic profile can be made within the operating modes, at least not in the safety mode. If such a pitch control unit is replaced, numerous adjustments must be made both in the internal code word assignment and in the higher-level control system of the wind turbine. Dynamic adaptation of the internal state changes based on external changes in the function, state, or behavior of the wind turbine 10 is not possible or provided.

[0102] Fig. 4 shows a block diagram of an embodiment of an operating state controller 52 for controlling the transition between operating state configurations 50.1 to 50.6. The individual operating states are explained in more detail with reference to Figs. 4 and 6, including conditions for adaptive state transitions between an operating state 50.x to an operating state 50.y. Typically, the operating state controller 52 is configured as a software-implemented state space machine and, in the adaptive selection of available operating state transitions, takes into account system control information 30, pitch controller information 32, pitch monitoring information 34, and external input signaling (EIS) 36.

[0103] The system control information 30 can be taken from a system-wide control device 12 and contains basic information on the function, condition, and behavior of the wind turbine 10. For example, weather data can also be taken into account, which, in the event of a critical weather forecast, prevents the implementation of a firmware update or the entry into service mode (i.e., maintenance mode). This can advantageously influence the safety travel.

[0104] Pitch controller information 32 can originate from both the pitch controller monitoring device 14 and neighboring pitch controller units 16, and is particularly important for interconnected operation. Thus, the indication of the failure of a neighboring pitch controller unit 16 can request transition to a safety run or termination of a safety-critical operating state via a data line for pitch controller information 32, and enable modified state transitions. If one pitch controller unit 16 fails, the safety run can be executed differently by the remaining pitch controller units 16 than if the safety run is performed by all functioning pitch controller units 16. In this respect, the pitch controller units can communicate directly with each other via pitch controller information 32. Higher-level pitch monitoring information 34 can be obtained from, as shown in Fig.1, a safety-monitoring component of the pitch control such as a cross-rotor blade pitch control unit (PSC - Pitch Control Unit) 14, see Fig. 6. This can be designed to independently monitor the function and behavior of the pitch control monitoring unit 14 and can instantiate changed operating state transitions in one or all pitch control units 16 in the event of a fault.

[0105] An external input signaling (EIS) 36 can be a variably used external signaling, for example for connecting external sensors, or can represent a configuration option of the pitch system accessible by a worker.

[0106] Figs. 5 and 7 illustrate operating state transition diagrams of state transitions between the operating states of various embodiments of a pitch control unit 16, whereby specific triggers and environmental conditions must be present for each state transition. The same applies, for example, when selecting different scaling values ​​during a safety run, which is shown in Figs. 5 and 7 as "Feathering Mode." The following list is intended to provide a rough overview of these conditions and better understand the functionality of the pitch control unit:

[0107] 1. Initialization -> Normal Operation

[0108] Initialization is complete, the pitch control unit 16 is grouped into a three-unit network, and there are no requests for a safety run, e.g., via an external input signal 36.

[0109] 2. Initialization -> Service Mode

[0110] Initialization is complete, the pitch control unit 16 is not grouped into a Ser network, and there are no requests for a safety run, e.g., via an external input signal 36.

[0111] 3. Initialization -> Feathering Mode

[0112] Initialization is complete. A request for a safety run is pending, e.g., via external input signal 36, or a safety run that has already started has not yet been acknowledged. 4. Normal Operation -> Service Mode

[0113] The pitch control unit 16 is not grouped into a three-unit system and there is a request for service mode, e.g., via an external input signal 36.

[0114] 5. Service Mode -> Normal Operation

[0115] The request for service mode has been canceled and service mode has been acknowledged.

[0116] 6. Normal Operation -> Feathering Mode

[0117] There are no requirements for Service Mode and at least one of the following points is met:

[0118] - External request for safety travel (SFR), e.g. via a safe input or the safe fieldbus

[0119] - Configured error reaction of another safety function or last safety travel not yet acknowledged.

[0120] - External error, e.g. failure of the axis cross communication or failure of a limit switch

[0121] - Internal error, e.g. detected failure of a component

[0122] 7. Feathering Mode -> Normal Operation

[0123] There are no requirements for Service Mode and all of the following conditions are met:

[0124] - All causes of errors have been fixed.

[0125] - The safety drive has been completed.

[0126] - The safety travel request (SFR) has been removed, e.g. via a safe input or the safe fieldbus.

[0127] - The safety movement was acknowledged via the standard error acknowledgment mechanisms (e.g., fieldbus or input EIS 36). 8. Feathering Mode -> Service Mode

[0128] A request for service mode is pending, e.g., via an external input signal 36, and all other pitch control units 16 in the three-unit system are in the wind vane position. If the pitch control unit 16 is not part of a three-unit system, simply requesting service mode is sufficient.

[0129] 9. Service Mode -> Engineering Mode

[0130] Engineering mode has been requested.

[0131] 10. Engineering Mode -> Service Mode

[0132] The engineering mode request was withdrawn and engineering mode was acknowledged.

[0133] 11. Service Mode -> Firmware Update

[0134] A firmware update has been started.

[0135] 12. Engineering Mode -»Firmware Update

[0136] A firmware update has been started.

[0137] 13. Feathering Mode -> Firmware Update

[0138] A firmware update has been started.

[0139] 14. Normal Operation -> Engineering Mode

[0140] The device is not grouped into a 3-unit network and engineering mode has been requested.

[0141] 15. Feathering Mode -> Engineering Mode

[0142] The device is not grouped into a 3-unit network and engineering mode has been requested.

[0143] 16. Normal Operation -> Firmware Update

[0144] The device is not grouped into a 3-way network and a firmware update has been started.

[0145] 17. Engineering Mode -> Normal Operation

[0146] The device is not grouped into a 3-unit network and all of the following conditions are met:

[0147] - There are no requirements for service mode.

[0148] - The requirement for engineering mode has been withdrawn.

[0149] - Engineering mode has been acknowledged.

[0150] Fig. 6 shows a block diagram of an internal structure of an embodiment of a pitch control unit 16. This comprises a higher-level pitch monitoring module (PMM - Pitch Monitoring Module, CAM - Certified Automation Module) 40, a pitch control module (CCM - Certified Control Module) 42 and an internal safety module (SM - Safety Module) 44. The higher-level pitch monitoring module 40 is designed to carry out complex control tasks of the rotor blade 22, the pitch control module 42 is used for direct control of the pitch motor 18 and the safety module 44 is used to monitor the safety function and the proper operation of the pitch control unit 16.

[0151] Externally, the pitch control unit 16 is connected both to a higher-level, cross-rotor blade pitch control monitoring device 14 via a data line for pitch monitoring information 34, and to a data line to neighboring pitch control units 14 for exchanging pitch control information 32. Due to the autonomous capabilities of the pitch control unit 14, it is conceivable that a separate pitch control monitoring device 14 can be dispensed with, so that the pitch control unit 16 can be directly connected to a system-wide control device TCU 12 via a data line for system control information 30. The internal safety module 44 is connected to a pitch control monitoring device (PSC - Pitch System Control Unit) 14, which is configured to monitor and control the pitch control monitoring device 14.

[0152] In addition, the safety module 44 can be connected to an external input signaling system (EIS) 36. As shown in Fig. 6, the internal safety module (SM) 44 and the pitch control module (Certified Control Module CCM) 42 can be centrally located in the pitch control unit 16 for the specific pitch control. The internal safety module 44 can perform a monitoring function and monitor the connected pitch control module 42 during the drive of the pitch motor 18 and the correct execution of an operating state.

[0153] In the pitch control unit 16, the request for the "Safe Feathering Run" (SFR) safety run function can be made via an externally accessible digital input, e.g., an external input signal EIS 36 of the internal safety module SM 44, or via the error response of a monitoring function of the internal safety module SM 44, or from the pitch control module CCM 42. For this purpose, switching profiles, offset values, and / or scaling parameters can be transmitted, which can be adjusted based on the state of the wind turbine or environmental influences. These can also be changed dynamically during the safety run, for example, if it is detected that asynchronous processes are occurring between the pitch control units 16. In any case, the state machine of the internal safety module SM 44 in the pitch control unit 16 assumes the "Feathering Mode" state immediately after a valid request for the SFR function.The current state of the internal safety module SM 44 is signaled via an internal serial communication interface from the internal safety module SM 44 to the pitch control module CCM 42, whereupon the state machine of the pitch control module CCM 42 immediately and without further conditions transitions to the "Feathering Mode" state. If errors occur in the parameterization of the safety travel, the basic profile BP can be used.

[0154] The pitch control module CCM 42 controls the drive autonomously and without additional external control signals so that the rotor blade 22 is moved towards the feathering position. As soon as the feathering position is reached during the safety travel, e.g., detected by a position sensor or by a limit switch mounted in the feathering position, the pitch motor 18 stops until it comes to a standstill and is switched off. This can be done by activating STO and removing the control signal for releasing a holding brake. The internal safety module SM 44 and the pitch control module CCM 42 remain in "feathering mode" even in the feathering position until a system-wide control device 12 or a cross-rotor blade pitch control monitoring device 14 sends an acknowledgment signal to one or all pitch control units 16, e.g.,via a fieldbus interface or via an external input signal 36, the rising edge of which is evaluated as an input signal by the pitch control module CCM 42 and the internal safety module SM 44 and triggers the transition from the “Feathering Mode” state to normal operation in both modules 42, 44.

[0155] It is crucial that the edge detection of the acknowledgment signal for exiting feathering mode and re-entering normal operation is only enabled after the feathering position has been reached and is ignored during the ongoing reset movement. Without an active change to the "second input condition" (acknowledgment signal) of the internal safety module SM 44 after reaching the (first) "target state," the internal safety module SM 44 remains in the "second target state" "feathering mode," which it already entered immediately after the SFR function is requested.

[0156] Thus, the pitch control unit 16 implements safety monitoring through an internal safety module SM 44 and a pitch control module CCM 42. Selected states of the internal safety module SM 44 and the pitch control module CCM 42 are provided, which could be assigned to each other if necessary. The pitch control module CCM 42 can directly receive, evaluate, and respond to higher-level control processes, although the safety module SM 44 does not necessarily have to be involved.

[0157] A transition of a state of the pitch control module CCM 42, in particular the assumption of a feathering position of the rotor blade through a parameterized safety movement, can occur due to a setting instruction from the internal safety module SM 44, after which both the pitch control module CCM 42 and the internal safety module SM 44 immediately assume the "feathering position" state. Any time-based monitoring of the feathering position movement of the pitch control module CCM 42 by the internal safety module SM 44 does not occur. Also, there is no transition of the "feathering position" state of the internal safety module SM 44 after the feathering position movement of the pitch control module CCM 42 has been completed; instead, the internal safety module SM 44 immediately transitions to the feathering position state after the setting instruction is issued to the pitch control module CCM 42. The internal safety module SM 44 therefore does not directly monitor the state transition of the pitch control module CCM 42.

[0158] Furthermore, the pitch control module CCM 42 can receive setting specifications from an external pitch control monitoring device 14 through the pitch control information 32 without the internal safety module SM 44 being interposed, so that at least in some cases there is no interposition of the internal safety module SM 44 in setting specifications to the pitch control module CCM 42 and, in this respect, internal state transitions of the pitch control module CCM 42 are not influenced by state transitions of the internal safety module SM 44.

[0159] Ultimately, a further state transition of the internal safety module SM 44 in the pitch controller unit 16 can only occur after an external acknowledgment signal from a pitch controller monitoring device 14 or system-wide control device 12, so that a state transition occurs in the absence of monitoring by the internal safety module SM 44 according to an external specification.

[0160] Fig. 7 shows operating states 50 and possible state transitions that can be implemented in the form of an identical state machine, i.e., a state machine, on both the internal safety module 44 and the pitch control module 42. In Fig. 7, the identical top-level states are implemented in the pitch control module 42 and the internal safety module 44 of the pitch control unit 16, which can be assumed independently of one another and in parallel. These are:

[0161] • Init Mode (0): Initial state after reboot

[0162] • Service Mode (1): Manual control e.g. with hand-held control unit

[0163] • Feathering Mode (2): Emergency mode for moving the rotor blades into the feathering position by means of a parameterized safety run

[0164] • Normal Operation (3): Pitch operation; control and setpoint specification via external control

[0165] • Engineering Mode (4): Laboratory / test bench operation

[0166] • Firmware Update (5): Update firmware

[0167] The abbreviations in Fig. 7 mean:

[0168] - STO: “Safe Torque OFF” Safe torque shutdown of the pitch drive

[0169] - SFR: "Safe Feathering Run" for safe movement of the rotor blades into feathering position. List of reference symbols

[0170] 10 wind turbines

[0171] 12 Plant-wide control unit (TCU - Turbine Control Unit)

[0172] 14 Pitch control monitoring device (PSC - Pitch System Control

[0173] Unit)

[0174] 16 Pitch control unit (PDU - Pitch Drive Unit)

[0175] 18 Pitch motor

[0176] 20 pitch gears

[0177] 22 rotor blades

[0178] 30 System control information

[0179] 32 Pitch control information

[0180] 34 Pitch monitoring information

[0181] 36 External Input Signaling (EIS)

[0182] 40 Superior Pitch Monitoring Module (PMM - Pitch Monitoring

[0183] Module, CAM - Certified Automation Module)

[0184] 42 Pitch control module (CCM - Certified Control Module)

[0185] 44 Internal Safety Module (SM - Safety Module)

[0186] 50 Operating state configuration

[0187] 52 Operating state control

[0188] SFR Safety travel BP Base profile SPmax Maximum scaled profile SPmin Minimum scaled profile sv1,sv2,sv3 Speed ​​scaling parameters 1 ,2,3 sa1 Acceleration scaling parameters 1 sd1,sd2 Deceleration scaling parameters 1 ,2 FP Flag position

[0189] SFM Pos LL Start position Lower Limit of the safety travel

[0190] SSR Pos LL Start time of the safety travel to the start position SFM Pos UL Time to reach the position Upper Limit SSR rpm max Maximum speed of the pitch motor during normal travel

Claims

Claims 1. Pitch controller unit (16) for a wind turbine (10) comprising a plurality of operating state configurations (50) which can be at least partially converted into one another, characterized in that an operating state controller (52) is included which enables a parameterization of dynamic and / or static control variables of a safety travel (SFR), with at least one of the control variables speed, torque, acceleration, travel duration and / or end position, and preferably a convertibility of operating state configurations (50) on the basis of internal and external information signaling (30, 32, 34, 36).

2. Pitch control unit (16) according to claim 1, characterized in that a change in the parameterization can be carried out during the course of the safety travel (SFR).

3. Pitch control unit (16) according to claim 1 or 2, characterized in that the parameterization comprises a switching, an offset and / or a scaling of a basic profile of the safety travel (SFR).

4. Pitch controller unit (16) according to claim 3, characterized in that the operating state controller (52) is set up to define a parameterization of a safety run (SFR) at least in sections on the basis of external information signaling (30, 32, 34, 36) relating to one or more scaling parameters of the safety run (SFR), which can be defined by a system-wide control device (TCU - Turbine Control Unit) (12) and / or a pitch controller monitoring device (PSC - Pitch System Control Unit) (14).

5. Pitch controller unit (16) according to claim 4, characterized in that the switching profile(s), offset value and / or scaling parameter(s) define(s) a parameterization of the base profile (BP) of the safety travel (SFR) between a maximum scaled profile (SPmax) and a minimum scaled profile (SPmin), wherein the scaling parameters relate in particular to speed (sv1, sv2, sv3), acceleration (sa1) and deceleration (sd1, sd2) of the safety travel (SFR), which are preferably scalable individually, and in particular in sections during the course of the safety travel (SFR), preferably in a range from 0% to 200% of the base profile (BP), and which furthermore preferably can exceed maximum normal travel parameters or fall below minimum normal travel parameters.

6. Pitch control unit (16) according to one of the preceding claims, characterized in that the operating state configuration (50) comprises at least the operating states normal operation, service mode, engineering mode and feathering mode, in particular further comprises the states firmware update and initialization.

7. Pitch controller unit (16) according to one of the preceding claims, characterized in that the operating state controller (52) is set up to define a parameterization of the safety travel (SFR), and preferably different sets of transferability of operating state configurations (50) on the basis of the state and / or the function of the wind turbine (10) and / or an overall operating state of all pitch controller units (16) of the wind turbine (10), in particular on the basis of a grouped operating state of all pitch controller units (16) or on the basis of an individual operating state.

8. Pitch control unit (16) according to claim 7, characterized in that the parameterization of the safety travel (SFR) is selected on the basis of the aging state, the wear state of the wind turbine (10), and / or the blade angle, tower inclination, blade oscillation, load moment on the blade hub or pitch motor (18).

9. Pitch control unit (16) according to one of the preceding claims, characterized in that the operating state control (52) is configured to select the parameterization of the safety travel (SFR), and preferably different sets of transferability of operating state configurations (50), on the basis of the request and / or execution of a safety travel (SFR), in particular on the basis of an external input signal (36).

10. Pitch control unit (16) according to one of the preceding claims, characterized in that the operating state controller (52) is configured to select different sets of transferability (50) on the basis of the request and / or execution of a service mode and / or engineering mode, in particular on the basis of an external input signaling (36), and / or the operating state controller (52) is configured to enable transferability after acknowledgment of a previous operating state and / or request or non-request of a future operating state, and / or the operating state controller (52) is configured to enable transferability of an operating state Service Mode, Engineering Mode, Feathering Mode, or Normal Operation into the operating state Firmware Update when an externally transmittable firmware data set is present, in particular when a wirelessly transmittable firmware data set is present.

11. Pitch controller unit (16) according to one of the preceding claims, characterized in that it comprises a higher-level pitch monitoring module (40), a pitch controller module (42) and an internal safety module (44), wherein the higher-level pitch monitoring module (40) is configured to carry out complex pitch drive sequences, the pitch controller module (42) is configured to directly control a pitch motor (18), and the internal safety module (44) is configured to carry out internal monitoring of the pitch controller module (42) and, in the event of a corresponding external input signal (36) or an internal error, to select the operating state safety drive (SFR) or feathering mode, wherein preferably the pitch controller module (42) is configured to monitor the higher-level pitch monitoring module (40) and / or the internal safety module (44),and in the event of an error, to select the safety travel mode (SFR) or feathering mode and to autonomously transfer the pitch motor (18) to a feathering position within the framework of a parameterized safety travel (SFR), and / or wherein preferably the parameterization of the safety travel (SFR) and / or the operating state configuration (50) and / or the transferability of operating state configurations (50) in the pitch controller module (42) and the internal safety module (44) are designed identically and can be executed in parallel and independently of one another.

12. Method for operating a pitch control unit (16) according to one of the preceding claims, characterized in that a parameterization of dynamic and / or static control variables of a safety travel (SFR) such as at least one of the control variables speed, torque, acceleration, travel time and / or end position, and preferably a transferability of operating state configurations (50), takes place on the basis of internal and external information signaling (30, 32, 34, 36).

13. Method according to claim 12, characterized in that a change in the parameterization takes place during the course of the safety drive (SFR).

14. Method according to claim 12 or 13, characterized in that the parameterization comprises a switching, an offset and / or a scaling of a basic profile of the safety travel (SFR).

15. The method according to claim 14, characterized in that the parameterization comprises a switching, offset formation and / or scaling (sv1, sv2, sv3, sa1, sd1, sd2) of the safety travel (SFR) starting from the basic profile (BP), preferably in sections and separately according to acceleration, deceleration and speed.

16. The method according to claim 15, characterized in that the switching, offset formation and / or scaling of the basic profile (BP) of the safety travel (SFR) are determined between a maximum scaled profile (SPmax) and a minimum scaled profile (SPmin), wherein the scaling parameters relate in particular to speed (sv1, sv2, sv3), acceleration (sa1) and deceleration (sd1, sd2) of the safety travel (SFR), which are preferably scalable individually, and in particular in sections during the course of the safety travel (SFR), and which furthermore can preferably exceed maximum normal travel parameters or fall below minimum normal travel parameters.

17. Method according to one of claims 12 or 16, characterized in that the parameterization of the safety travel (SFR) is selected on the basis of the ageing state, the wear state of the wind turbine (10), and / or the blade angle, tower inclination, blade oscillation, load moment on the blade hub or pitch motor (18).

Images