Method and IED for executing an external additional program in an existing runtime environment

Abstract

The invention relates to a computer-implemented method for generating an external additional program (12), which provides an additional function within an existing runtime environment (8), on an IED, comprising the following steps: - creating a virtual machine environment (9) in the runtime environment (8) by means of a processor of the IED, - loading external program instructions (11) for generating an additional program (12) into the virtual machine environment (9), and - executing the external program instructions (12) by means of the virtual machine environment (9), thereby obtaining the additional function, said additional function being effective in the runtime environment (8). In order to be able to generate an external additional function with little effort and without interrupting the runtime program, it is proposed that the additional program (12) has a deterministic behaviour, wherein the runtime environment (8) checks the deterministic behaviour of the additional program (12) in a verification step before the additional function becomes effective.

Description

[0001] Description

[0002] Method and IED for executing an external add-on program in an existing runtime environment

[0003] The invention relates to a computer-implemented method for generating an external add-on program that provides an additional function within an existing runtime environment on an IED, comprising the steps of: creating a virtual machine environment in the runtime environment by means of a processor of the IED, loading external program instructions for generating an add-on program in the virtual machine environment, and generating the add-on program by the virtual machine environment while obtaining the additional function effective in the runtime environment.

[0004] The invention further relates to an intelligent electronic device, IED, for use in the field of electrical power supply, comprising a measurement data input for receiving measurement data, a memory area on which monitoring algorithms are stored, and a logic unit for processing the measurement data, wherein the logic unit determines, based on the measurement data and with the aid of the monitoring algorithms, whether an error condition exists and, upon detection of an error condition, generates an error signal, wherein a runtime environment can be generated on the IED, which is configured to create a virtual machine environment in the runtime environment by means of a processor of the IED, wherein the runtime environment is further configured to load external program instructions that generate an additional program in the virtual machine environment,and is configured to generate the additional program by the virtual machine environment by obtaining the additional function effective in the runtime environment (8).

[0005] Such a method and such an IED are already familiar to those skilled in the art. For example, commercially available browsers feature a virtual machine, or in other words, a machine environment, that allows external programs to be created and run within the browser. These programs are encoded in the binary format known as WebAssembly, also known as WASM.

[0006] A virtual machine environment is also used in conjunction with the eBPF (extended Berkeley Packet Filter) execution environment, which is specifically designed for running bytecode in the Linux kernel. Intelligent electronic devices (IEDs) for electrical power grids are commercially available and also familiar to those skilled in the art. They are responsible, for example, for protecting the electrical power grid from short circuits. Such IEDs can also be configured as automation devices that control and / or monitor the functionality of components of the electrical power grid. Such LEDs have a measurement data input for receiving measurement data. A logic unit checks the incoming measured values ​​or measurement data for the presence of error conditions using algorithms stored in memory.If such a fault condition is detected, a fault signal is generated so that the necessary steps to correct the fault can be initiated. Such steps include, for example, switching a circuit breaker in the electrical power grid, which isolates the faulty conductor line from the rest of the electrical power grid.

[0007] The method mentioned above has the disadvantage that it cannot be used to protect electrical power supply networks.

[0008] The additional programs that can currently be generated by virtual machines are of a non-deterministic nature and are therefore unsuitable for use in the field of automation and protection technology for electrical power grids.

[0009] The object of the invention is to provide a method and an IED of the type mentioned above which generates an external additional function with little effort without interrupting the runtime program.

[0010] The object is achieved on the basis of the above-mentioned method within the scope of the invention in that the additional program has a deterministic behavior, wherein before the additional function becomes effective, the runtime environment checks the deterministic behavior of the additional program in a verification step.

[0011] The object is achieved according to the invention starting from the above-mentioned IED in that a runtime environment is generated on the IED which provides a method according to one of the preceding claims.

[0012] Within the scope of the invention, a virtual machine environment is provided for the first time within a runtime program that provides methods for protection or automation in the field of electrical power supply. To this end, the additional program must exhibit deterministic behavior, which is guaranteed after successfully completing a verification step. Within the scope of the invention, a deterministic additional program is understood to be an algorithm or program in which only defined and reproducible states occur. For the purposes of the present invention, a deterministic additional program is understood to be an algorithm or program in which, with a view to ensuring the security and stability of the overall system, all processes and state transitions are defined in advance and designed to be reproducible.In particular, determinism is to be interpreted according to the invention as referring to the terminal property of the program, which ensures that each execution is completed after a finite time in order to exclude uncontrolled or infinite computational processes and guarantee predictable system integrity. This approach is applied, for example, in eBPF, in which certain constructs such as loops or the like are prevented by a check step. Given the same input, the same output always follows, and in addition, the program passes through the same sequence of intermediate states. At any point in time – assuming a specific input – the processing steps of the algorithm or program are clearly defined. Thus, all intermediate results within the algorithm are always the same.Such deterministic behavior is necessary to integrate an additional external monitoring function into an existing runtime environment using the machine environment. This allows the functionality of the runtime program to be easily expanded without the need for a complex, hardware-dependent compilation of the entire runtime program, in which the additional function was added based on the source code.

[0013] To ensure deterministic behavior, the invention uses a verification step. This verification step compares the states passed through during various algorithm runs. If these states are always identical, the verification step has been successfully completed, so the deterministic behavior of the additional function is considered proven. The additional function can now take effect within the existing runtime environment.

[0014] A monitoring function within the scope of the invention is, for example, a protective function that serves to protect an electrical power supply network from faults such as short circuits in said network. Alternatively, the monitoring function serves to monitor the status of components of the electrical power supply network. The monitoring function can also serve to control components of said network. Advantageously, the IED is a protection device or an automation device. Such devices are typically used in the field of electrical power supply. For example, several protection devices are required in a substation to monitor various feeders or components of the substation, such as a transformer, for the presence of fault conditions. For example, a short circuit may occur in a feeder of the substation.This short circuit is detected using a protection algorithm that is usually provided by the manufacturer as part of a runtime program.

[0015] An automation device, on the other hand, is used to monitor the status of devices and their control, for example, in a substation. Within the scope of the invention, the runtime environment is advantageously generated on a protection device or an automation device used in the electrical power grid. In this area, the deterministic behavior explained above is absolutely necessary.

[0016] According to a further expedient variant of the method according to the invention, the protection device is a central protection device that monitors multiple feeders and / or components of the electrical power grid for the presence of fault conditions. In other words, the runtime program provides all functions for a central protection device (CPC). Such central protection devices combine several or all field-side protection devices into a single protection device, which is only connected to field-side measuring points and / or merging units. The central protection device, for example, simultaneously monitors all or at least several components and / or feeders of a substation for the presence of fault conditions such as short circuits using distance protection, differential protection, or the like.

[0017] To offer a method in the form of a central runtime program for protecting substations independent of the hardware, the source code of such a central runtime or protection program is compiled in such a way that it can be run on the existing hardware at the user's site. The hardware may vary from user to user. If the method according to the invention runs on the said hardware, the provision of a virtual machine environment completely decouples the inclusion of additional protection functions from the question of which hardware is available at the user's site.

[0018] Advantageously, the additional function is a protective function that

[0019] The electrical power grid is monitored for the presence of fault conditions. According to a preferred variant of the method according to the invention, the external program instructions are programmed to obtain a source code in any programming language. The source code is then compiled to obtain a byte code, which is loaded into the virtual machine environment. According to this advantageous further development of the invention, a user of the method according to the invention, whose steps are provided by a runtime program, is also able, for example, to generate such an additional function in the runtime program using any source code.

[0020] The corresponding bytecode interpreted by the virtual machine is designed to be platform-independent, thus enabling its application in diverse execution contexts. This enables universal applicability of the additional function without adaptation to specific target platforms, ensuring considerable flexibility and extensibility of the inventive technology in different system environments and under varying technical requirements.

[0021] Further advantages and variants of the invention are the subject of the following description of embodiments with reference to the figures of the drawings, wherein the same reference numerals refer to components with the same function and wherein

[0022] Figure 1 shows an embodiment of the LED according to the invention and the method according to the invention and

[0023] Figure 2 schematically illustrates a compilation step within the scope of the invention.

[0024] Figure 1 schematically illustrates an embodiment of the method according to the invention and the LED 1 according to the invention. The IED 1, which is designed as a central protection device, has two data inputs 2 and 3, via which it is connected to a process bus 4. In contrast, the protection device is a field-side, i.e., decentralized, protection device. The process bus supplies the measured values ​​provided by measuring sensors (not shown in the figure), which have been preprocessed and digitized by one or more merging units (also not shown in the figure), in the form of digital vector variables.

[0025] A merging unit is typically used to convert analog measured values ​​into digital vector values. A merging unit thus separates the analog from the digital world. Analog measured values ​​from a measuring sensor are preprocessed using the merging unit. The analog signal is sampled at a sampling rate to obtain sample values, which are then digitized and converted into digital vector measured values. A vector measured value includes not only the amplitude of a current measured in one conductor phase of a three-phase line in the electrical power grid, but also its phase position with respect to the currents measured in the other conductor phases.

[0026] From the measured value inputs 2 or 3, the digital pointer measured values ​​reach a storage unit 5 of the LED 1 , on which they are stored for a certain period of time.

[0027] The measured values ​​in the form of digital pointer variables are made available to a logic unit 6. This can be done in various ways within the scope of the invention. The logic unit 6 can access the memory unit and thus obtain the measured values. Alternatively, it is possible within the scope of the invention for the measured values ​​to be sent directly from data inputs 2 and / or 3 to the logic unit. In the illustrated embodiment, the measured values ​​are sent from the memory unit to the logic unit upon request from the logic unit.

[0028] After receiving the measured values, the logic unit checks them for the presence of error conditions. For this purpose, the logic unit uses protection algorithms 7 that are provided to it. The number of protection algorithms 7 stored, for example, on the memory unit 5 as protection programs is limited.

[0029] The protection algorithms 7 are distance protection, differential protection, or similar. The protection algorithms are known to those skilled in the art.

[0030] If a runtime program has been started on such a protection or automation device in accordance with the state of the art, external add-on programs can only be added to the existing runtime environment with great effort. To do this, the runtime program must first be interrupted. The additional source code of the add-on program must then be integrated into the source code of the existing runtime program. The thus extended source code is then compiled again to create a new runtime program. The compilation process depends on the user's hardware. However, a lengthy interruption of the runtime program to incorporate new protection functions is undesirable. Particularly with complex runtime programs, recompiling the extended runtime program depending on the hardware of a user of the runtime program is disadvantageous.

[0031] Furthermore, within the framework of the procedure described, it is possible that

[0032] Functional enhancements can be implemented independently of the original manufacturer without requiring the installation of new versions of the runtime program on the corresponding device. This approach is particularly important for systems that have already undergone certification, as it allows for the maintenance of certification standards while providing the flexibility to add new functions without the need for recertification.

[0033] In principle, within the scope of the invention, it is also possible for the method according to the invention to run on a conventional intelligent electronic device (IED), for example, a commercially available protection device. The virtual machine environment 9, like the protection device 7, is connected to the storage unit or the logic unit (or is capable of receiving and processing measured values).

[0034] A runtime program 8 according to the invention, which provides the method steps according to the invention, runs on the central protection device 1 shown in the drawing. The runtime program 8 was made available to a user of the method according to the invention by a developer of the runtime program. The hardware is available on the user side. With the help of the runtime program 8, a runtime environment is created which, according to the exemplary embodiment shown, ensures continuous protection of an electrical power supply network against faults, for example, short circuits in one of its components or one of its branches. This can take place, for example, in a transformer substation.

[0035] Figure 1 also schematically shows that a machine environment 9 is generated by the runtime program 8. The virtual machine environment 9 is connected to the memory unit or the logic unit in the same way as the protection 7, in other words it is able to receive and process measured values. In the machine environment 9, in other words a virtual machine, a byte code is loaded which is compiled by the virtual machine to generate an additional program. The additional program provides an additional function. This additional function is, for example, another protection function that is generated in addition to the already existing protection functions. Since the byte code is compiled for the virtual machine, the additional function can be created independently of the hardware conditions. Further additional functions of the runtime environment are provided.Before the additional function can be provided, however, the additional program 8 must undergo a test in the form of a verification step. This verification step is generated by the runtime program 8. In this verification step, it is checked whether the additional program exhibits deterministic behavior. In this context, reference is made to the above explanations. Figure 2 shows a flow chart of how the additional function can be generated starting from source code 10 programmed in any programming language. First, the source code is converted into bytecode 11. This is done using a compiler. The bytecode 11 generated in this way is loaded into the virtual machine 9 of the runtime program 8. The virtual machine 9 is designed such that it executes the bytecode according to specified parameters.The virtual machine includes an interface that allows access to input data. Additionally, the virtual machine is capable of generating output data or output signals based on the execution of the bytecode, which can be used for further processing or to control external processes. The interface thus enables the virtual machine to interact with its environment by supporting bidirectional data transfer, which allows the virtual machine to be flexibly applied in various technical contexts.

Claims

Patent claims 1. Computer-implemented method for generating an external additional program (12) which provides an additional function within an existing runtime environment (8) on an IED, comprising the steps: Creating a virtual machine environment (9) in the runtime environment (8) by means of a processor of the IED, Loading external program instructions (11) to create a additional program (12) into the virtual machine environment (9) and Execution of the external program instructions (12) by the virtual machine environment (9) while obtaining the additional function effective in the runtime environment (8), characterized in that before the additional function becomes effective, the runtime environment (8) checks the deterministic behavior of the additional program (12) in a verification step.

2. Computer-implemented method according to claim 1, characterized in that the runtime environment (8) is generated on a protection device (1) or an automation device for an electrical power supply network.

3. Computer-implemented method according to claim 2, characterized in that the protective device is a central protective device (1) which monitors a plurality of branches and / or components of the electrical power supply network for the presence of fault conditions.

4. Computer-implemented method according to claim 2 or 3, characterized in that the additional function is a protective function that monitors the electrical power supply network for the presence of fault conditions.

5. Computer-implemented method according to one of the preceding claims, characterized in that a source code for the additional program is programmed in any programming language, the source code is then compiled to obtain a byte code and the byte code is loaded into the virtual machine which generates the additional program (12).

6. Intelligent Electronic Device, IED, (1) for use in the field of electrical power supply, comprising a measurement data input (2, 3) for receiving measurement data, a memory area (5) on which monitoring algorithms are stored, and a logic unit (6) for processing the measurement data, wherein the logic unit determines, based on the measurement data and with the aid of the monitoring algorithms (7), whether an error condition exists and, upon detection of an error condition, generates an error signal, wherein a runtime environment (8) can be generated on the IED, which is configured to create a virtual machine environment (9) in the runtime environment (8) by means of a processor of the IED, wherein the runtime environment is further configured to load external program instructions (11) that generate an additional program (12) in the virtual machine environment (9),and is set up to generate the additional program (12) by the virtual machine environment (9) by obtaining the additional function effective in the runtime environment (8), characterized in that the additional program (12) has a deterministic behavior, wherein before the additional function becomes effective, the runtime environment (8) checks the deterministic behavior of the additional program (12) in a verification step.

7. To provide a method for generating an external additional program (12) for providing an additional function within an existing runtime environment (8) with the steps: Creating a virtual machine environment (9) in the runtime environment (8), loading external program instructions (11) to create an additional program (12) in the virtual machine environment (9) and To provide for the generation of the additional program (12) by the virtual machine environment (9) by obtaining the additional function effective in the runtime environment (8), which generates an external additional function with little effort without interrupting the runtime program, it is proposed that the additional program (12) has a deterministic behavior, wherein before the additional function becomes effective, the runtime environment (8) checks the deterministic behavior of the additional program (12) in a verification step.

Images