Fail-safe disconnecting unit, rectifier having a fail-safe disconnecting unit, and method for operating a rectifier

Abstract

The invention relates to a fail-safe disconnecting unit (100, 200) having a DC connection (12) for connecting a DC load (30) and an AC connection (11) for connecting an AC network (20), wherein the disconnecting unit (100, 200) is designed to safely disconnect a power path between the DC connection (12) and the AC connection (11), wherein the disconnecting unit (100, 200) has an activatable and deactivatable alarm device (102) and two electromagnetic switch units (K1, K2) arranged in the power path between the AC connection (11) and the DC connection (12), wherein a first switch unit (K1) is arranged in a DC region of the power path and wherein a second switch unit (K2) is arranged in an AC region of the power path, wherein the disconnecting unit (100, 200) is designed, in an activated state of the alarm device (102), to control the first switch unit (K1) with a target state, to open a first main contact (K1.1) of the first switch unit (K1) in order to disconnect the power path in the DC region, and, depending on an actual state of the first main contact (K1.1), to separate the power path in the AC region by means of the second switch unit (K2). The invention also relates to a rectifier (10) and to a method for operating a rectifier (10).

Description

[0001] 24-063-P-WO - 1 - submitted version

[0002] Fail-safe disconnect unit, rectifier with a fail-safe disconnect unit and method for operating a rectifier

[0003] Technical field

[0004] The application relates to a fail-safe, redundantly constructed isolation unit, a rectifier with a redundantly constructed isolation unit for supplying a DC load, in particular an electrolyzer, from an AC network and a method for operating such a rectifier.

[0005] State of the art

[0006] In international standards according to IEC 61508 / IEC 61511, the safety integrity level (SIL) is a term from the field of functional safety. It is also referred to as the safety level or safety integrity level (SIL). It serves to assess the reliability of safety functions in electrical, electronic, and programmable electronic systems. The target SIL dictates safety-related design principles that must be adhered to in order to minimize the risk of malfunction.

[0007] Safety Integrity Level 2 (SIL 2) in hydrogen electrolysis includes a fail-safe disconnection of a power path assigned to the electrolyzer. The disconnection unit is therefore redundantly designed and comprises two switching elements arranged in series within the power path, so that a fault in only one of the switching elements can be mitigated.

[0008] It is known to arrange one switching element on the DC side (DC, direct current) and one on the AC side (AC, alternating current) of an electrolysis supply unit, which open simultaneously or redundantly to each other in a safety / alarm situation. If the fail-safe disconnect unit is in a 24-063-P-WO - 2 - submitted version

[0009] In the event of an alarm, the power path of the electrolyzer is to be disconnected. Under normal operating conditions, both switching elements of the isolation unit open simultaneously, interrupting the power path at two points, namely through each of the switching elements. In this way, even if only one of the two switching elements fails, the power path is disconnected by the other, still properly functioning switching element. Thus, in an alarm situation, the power path is interrupted in a fail-safe manner, even if one of the switching elements malfunctions. A simultaneous failure of both switching elements is considered so improbable that such a situation almost never occurs during normal operation and can therefore be disregarded. If both switching elements are open, no grid services, such as the provision of reactive power, can be provided.

[0010] WO01 / 27955A1 and WO01 / 27956A1 each describe an actuator unit consisting of a basic actuator and an additional actuator. An AC electrical circuit can be reliably opened and closed using the basic actuator and the additional actuator.

[0011] German patent application DE 10 2013 221 444 A1 discloses an inverter system and a power supply device with such an inverter system. The inverter system is designed so that an AC-side switch is set to an open switching state when a closing device of a housing is opened.

[0012] Task

[0013] The application is based on the objective of providing a fail-safe isolation unit. It also aims to demonstrate a rectifier with a fail-safe isolation unit, as well as a method for operating the rectifier.

[0014] Solution

[0015] The problem of providing a fail-safe isolation unit is solved by an isolation unit with the features of independent claim 1. The problem of providing a rectifier with an isolation unit is solved by the features of independent claim 14. The problem of providing a method for operating the rectifier is solved by the features of independent claim 24-063-P-WO - 3 - filed version

[0016] Claim 17 is solved. Advantageous embodiments are mentioned in the dependent claims.

[0017] Description

[0018] A fail-safe disconnect unit has a DC connection for connecting a DC load and an AC connection for connecting an AC network. The disconnect unit is designed to safely disconnect a power path located between the DC and AC connections. The fail-safe disconnect unit includes an activatable and deactivatable alarm device and two electromagnetic switching units located in the power path between the AC and DC connections. The first switching unit is located in the DC section of the power path. The second switching unit is located in the AC section of the power path.

[0019] The DC section of the power path is located between the DC terminal and the AC section of the power path. The DC section of the power path is configured to transfer DC power to and / or from the DC terminal. The AC section of the power path is located between the AC terminal and the DC section of the power path. The AC section of the power path is configured to transfer AC power to and / or from the AC terminal.

[0020] The isolation unit is designed, when the alarm system is activated, to control the first switching unit with a target state, opening the first main contact of the first switching unit in order to disconnect the power path in the DC section. The first main contact is thus controlled in such a way that the target state is achieved, i.e., assumed. In this target state, the first main contact should be open. The open first main contact should disconnect, i.e., interrupt, the power path in the DC section.

[0021] The desired state, in which the first main contact is open, can be assumed from a previously closed state and includes the opening of the first main contact. Additionally, the desired state, in which the first main contact is open, can also be assumed from a previously open state and include keeping the first main contact open, in particular keeping the first main contact permanently open. 24-063-P-WO - 4 - submitted version

[0022] The latter means that the first main contact is kept open if it is already open when activated.

[0023] The isolation unit is further designed, in the activated state of the alarm device, to disconnect the power path in the AC area by means of the second switching unit, depending on the actual state of the first main contact. Specifically, the isolation unit is designed, in the activated state of the alarm device, to disconnect the power path in the AC area by means of the second switching unit, depending on whether the actual state of the first main contact corresponds to its target state. The actual state of the first main contact is the actual switching state of the first main contact. With a properly functioning first switching element, the actual state of the first main contact corresponds to its target state. However, with a faulty first switching element, the actual state of the first main contact may deviate from its target state.Specifically, the separation unit can be designed to function in the activated state of the alarm device.

[0024] - to disconnect the power path in the AC area by means of the second switching unit if the actual state of the first main contact deviates from its target state, i.e., the open state, and / or

[0025] - to suppress a separation of the power path in the AC area by means of the second switching unit if the actual state of the first main contact corresponds to its target state, i.e. the open state.

[0026] By "disconnection of the power path," we mean, in particular, a permanent disconnection of the power path, which can last for several minutes, several hours, or possibly even until a release signal is received, which transfers the activated state of the alarm device to its deactivated state. A disconnection of the power path that only exists temporarily, on the way to a target state, is not a disconnection of the power path within the meaning of the invention. For example, the second switching unit may initially open simultaneously with the first switching unit, but then close again depending on the current state of the first switching unit. In this context, "opening and closing" of the first and second switching units means interrupting the power path by opening the respective main contact. For example,The second switching unit, if it was initially opened simultaneously with the first switching unit (24-063-P-WO - 5 - submitted version), can be closed again once it has been ensured that the first main contact is correctly opened.

[0027] By providing for the switching of the second switching unit depending on the actual switching state, i.e., the current state, of the first switching unit, it is possible to provide the isolation unit as a SIL-2 compliant isolation unit for a rectifier that supplies a DC load, in particular an electrolyzer. This also applies if the switching of the second switching unit depends on whether the current state of the first switching unit matches its target state. The rectifier can, in particular, include the SIL-2 compliant isolation unit. Furthermore, an AC / DC converter of the rectifier can be arranged in the power path of the isolation unit between the AC and DC sections. In particular, a double interruption of the power path is maintained to ensure a fail-safe state when the power path between the AC network and the DC load is disconnected.At the same time, the isolation unit can also enable grid-supportive operation of the rectifier in the event of an alarm, i.e., when the alarm system is activated. Specifically, the second main contact of the second switching unit assigned to the AC section can be in the closed state and / or remain closed if the separation of the power path in the DC section is already ensured by the open first main contact of the first switching unit. Thus, power exchange between an AC / DC converter of the rectifier and the AC grid connected to the AC terminal can occur via the closed second main contact of the second switching unit, in order to support the AC grid.

[0028] An electromagnetic switching unit can be used to control electrical switching operations through the action of an electromagnetic field. This allows electrical circuits to be opened or closed by an electrical signal. For this purpose, the switching unit may include a coil that generates an electromagnetic field when current flows through it. The electromagnetic field attracts a movable armature or core that is mechanically connected to switching contacts of the switching unit. When the armature moves, the switching contacts open or close, thereby opening or closing the circuit (24-063-P-WO - 6 - submitted version) and interrupting or enabling the flow of electrical current.

[0029] The first and / or second switching unit can, for example, include a relay. The relay can be used to switch a low electrical load, e.g., for signal transmission.

[0030] The first and / or second switching unit may, for example, include a contactor: A contactor is a more powerful version of a relay that can be used for switching high electrical loads.

[0031] Advantageous embodiments are specified in the following description and dependent claims, the features of which can be applied individually and in any combination.

[0032] In one embodiment, the disconnection unit is designed to disconnect the AC section of the power path by opening a second main contact of the second switching unit. The disconnection of the AC section of the power path occurs particularly when, with the alarm device activated, the DC section of the power path is not disconnected or is not disconnected correctly. Here, reliable disconnection is thus linked to the simultaneous fulfillment of two conditions. Firstly, the opening of the second main contact of the second switching unit, when the alarm device is activated, depends on the actual switching state, i.e., the current state, of the first switching unit. Secondly, it is also checked whether the current state of the first switching unit is indeed correctly assumed.Thus, when the alarm device is activated, the second main contact of the second switching unit is opened depending on whether i) the actual state of the first main contact of the first switching unit corresponds to its target state and ii) the actual state corresponding to the target state is also free of a fault, for example, in the form of an arc. Specifically, the second main contact of the second switching unit is opened if the first main contact of the first switching unit is not opened at all or is opened incorrectly. Only when it is ensured that the first main contact of the first switching unit is open correctly can the second main contact of the second switching unit remain closed or be brought into its closed state. As long as the second main contact is closed, grid-serving electrical power, e.g., power, can be supplied by a rectifier that includes the isolating unit 24-063-P-WO - 7 - submitted version.B. Reactive power, which is made available to the AC network via the AC connection of the isolation unit.

[0033] In one embodiment of the disconnecting unit, the first main contact is configured as a normally open contact and / or the second main contact is configured as a normally open contact. When switching, for example, by supplying electrical power to a corresponding actuating coil, such a normally open contact can then be closed, thereby enabling power flow in the relevant section of the power path. Maintaining the closed state also occurs with a normally open contact when electrical power is supplied to the relevant actuating coil. If the supply of electrical power to the actuating coil is suppressed, the normally open contacts return to their normal state, also called the rest state, and interrupt the electrical connection in the section of the power path assigned to the respective switching unit.

[0034] In one embodiment, the isolating unit is designed to disconnect the power path in the AC section by means of the second switching unit if the first main contact is not open or is open incorrectly. This ensures that the power path between the AC and DC terminals of the isolating unit is reliably disconnected, even if the first switching unit is not open or is open incorrectly. An incorrect opening could, for example, include only partial opening, where the electrical resistance at the disconnection point falls below a predefined limit. However, an incorrect opening of the first main contact could also refer to a first main contact that is actually open, but through which current continues to flow even in the open state, meaning it is at least temporarily unable to suppress the current flow.This can occur, for example, if an arc is present across the open first main contact, through which current flows despite the open first main contact. In one embodiment of the disconnecting unit, the first switching unit can therefore have a sensor designed to detect a de-energized state of the first main contact of the first switching unit, particularly when the first main contact is in its open state. In this way, a properly opened first main contact, which is in a de-energized state, can be distinguished from a faultily opened first main contact, through which current still flows even in the open state. (24-063-P-WO - 8 - submitted version.)

[0035] Current flow occurs, and a distinction must be made. The isolation unit can be designed to disconnect the power path in the AC area by means of the second switching unit when the alarm device is activated, if the sensor detection still indicates a current flow through the first main contact even when the first main contact is open.

[0036] In one embodiment of the disconnecting unit, the first electromagnetic switching unit has a first switching contact that is positively guided to the first main contact for querying the current state of the first main contact. By providing the positively guided first switching contact, a reliable query of the actual switching state, i.e., the current state, of the first main contact can be achieved.

[0037] In one embodiment of the disconnect unit, the first main contact is configured as a normally open contact, and the first switching contact is configured as a normally closed contact. By supplying electrical power to an actuator of the first switching unit, for example, an actuating coil, such a normally open first main contact can be closed and held in the closed position. The power path in the DC domain can thus be closed. When the normally open first main contact closes, the positively driven first switching contact is then opened. When the supply of electrical power to the actuator of the first switching unit is suppressed, the normally open first main contact returns to its normal state and interrupts the power flow in the DC domain. The positively driven first switching contact is then closed.If, however, a fault occurs when the first main contact opens and it does not open, the first switching contact, which is thus forcibly opened, also remains open. The actual state of the first main contact can therefore be queried via the first switching contact.

[0038] In one embodiment of the disconnecting unit, the first switching unit has a first actuating coil for actuating the first main contact. In this embodiment, the second electromagnetic switching unit has the normally open second main contact and a second actuating coil for actuating the second main contact. The electromagnetic fields for actuating the respective main contact can thus be generated via the respective actuating coil (24-063-P-WO - 9 - submitted version). The first switching contact is actuated via the first main contact, with which it is positively guided. Therefore, the first switching contact can also be actuated via the first actuating coil via the first main contact.

[0039] In one embodiment, the disconnecting unit has a supply terminal that can be connected to a supply voltage for the electrical supply of the first actuating coil and the second actuating coil. The alarm device has an alarm switch that is open when the alarm device is activated and closed when the alarm device is deactivated. When the alarm device is activated, the alarm switch is open, thus interrupting the circuit in which it is located. When the alarm device is deactivated, the alarm switch is closed, thus closing the circuit in which it is located.

[0040] The first actuating coil is connected to the power supply via an electrical connection path leading through the alarm switch, such that current flow between the power supply and the first actuating coil is permitted when the alarm device is deactivated and prevented when the alarm device is activated. The first actuating coil can also be connected to the power supply via a second connection path, for example, a connection path that includes the normally closed first switching contact. However, it must be ensured that current flow through the second connection path is suppressed when the alarm device is activated. This can be achieved by an additional switch located in the second connection path. This additional switch can be a component of the alarm unit and coupled to the alarm unit's alarm switch.Alternatively, the additional switch can be part of the first switching unit and, for example, be designed as another first switching contact positively guided to the first main contact. It is also possible for the additional switch to be designed as a diode in the second connection path. Various variants of the additional switch are explained in more detail in conjunction with Figures 1a and 1b, for which reference is made to Figures 1a and 1b. The second actuating coil of the second switching unit can be connected to the supply terminal via either a first connection path leading through the alarm switch or a second connection path leading through the normally closed first switching contact. The version submitted for the first time is 24-063-P-WO - 10.

[0041] The connection paths assigned to the first actuating coil and those assigned to the second actuating coil can coincide with each other in at least paired sections, but in other sections they can run separately from each other, at least paired, and in particular parallel to each other. When the alarm switch is closed, the respective actuating coils are connected to the power supply. In this case, they can be supplied with the electrical power necessary to actuate their respective main contacts, i.e., to close the normally open first main contact and the normally open second main contact. As long as the alarm switch remains closed, the respective main contacts also remain in their closed state. If the alarm switch is now opened, for example, when the alarm device is activated, the power supply to the first actuating coil is interrupted.Subsequently, with proper operation of the switching device, the first normally open main contact assumes its open state, and the first switching contact, due to its positive guidance, assumes its normally closed state. Thus, with the alarm device activated and a properly operating first switching unit, the second actuating coil is supplied with electrical power from the supply connection via the first positively guided, normally closed switching contact, and the second main contact of the second switching unit can be closed and / or held in the closed state.

[0042] In one embodiment of the isolation unit, the alarm device includes a sensor, in particular a gas sensor, a pressure sensor, and / or a temperature sensor, that actuates the alarm switch. Alternatively or additionally, the alarm switch can be designed for manual actuation. In this embodiment, an alarm, and thus a fail-safe isolation of the power path, can therefore be triggered automatically via one or more sensors and / or manually by a person.

[0043] In one embodiment, the disconnecting unit can include an energy storage device, in particular a capacitor, connected to the second actuating coil. The energy storage device is designed to delay the switching operation of the normally open second main contact of the second switching unit after the second actuating coil is disconnected from the supply connection. 24-063-P-WO - 11 - submitted version

[0044] The energy storage device thus prevents an unstable or transient state of the second main contact, in which it would briefly revert to its normally open state due to a transient interruption of the electrical supply to the second actuating coil. The energy storage device stabilizes the switching state of the second main contact, keeping it closed and bridging any brief interruption in the power supply from the connection.

[0045] In one embodiment of the disconnect unit, the first switching unit is designed as a DC load disconnect unit and / or the second switching unit is designed as an AC load disconnect unit. Load disconnect units allow electrical loads to be safely disconnected and galvanically isolated even under load, i.e., at a current equal to or exceeding the nominal current. For this purpose, load disconnect units typically include at least one contactor and usually comprise one or more arc-quenching chambers that extinguish any arc that occurs during a switching operation. Load disconnect units are therefore usually more complex in design than disconnect units that merely interrupt the circuit when de-energized or when the current is relatively small compared to the nominal current.

[0046] In some embodiments, the first switching unit and / or the second switching unit of the isolation unit can each be configured to control a corresponding load break switch, with the load break switches being arranged outside the isolation unit. Since no large currents flow through the respective switching units in this configuration, they can then incorporate relays in such an embodiment.

[0047] In one embodiment of the disconnecting unit, the first switching unit is designed to disconnect all poles, and the first main contact has two normally open first partial contacts. Alternatively or additionally, the second switching unit can also be designed to disconnect all poles, and the second main contact has several, in particular three, normally open second partial contacts. This allows all poles, i.e., all conductors in the respective AC and DC sections, to be disconnected, thus enabling particularly reliable disconnection. The three normally open second partial contacts are specifically intended for a three-phase AC section. With a different number of phase conductors in the AC section (as per the version submitted in 24-063-P-WO - 12), the second main contact can also have a number of partial contacts corresponding to the number of phase conductors.

[0048] A rectifier according to the invention for supplying a DC load from an AC network comprises such a described isolation unit, as well as a transistor-based AC / DC converter arranged in the power path between the first and the second electromagnetic switching unit for converting AC power into DC power. The rectifier has an AC rectifier connection for connection to the AC network, which is connected to or identical with the AC connection of the isolation unit. The rectifier further comprises a DC rectifier connection for connection to the DC load, which is connected to or identical with the DC connection of the isolation unit. The isolation unit thus enables a safe separation of the power flow in the power path in which the AC / DC converter is located.

[0049] The rectifier converts the AC electrical power supplied by the AC grid into DC power with a DC voltage to supply the DC load. The power conversion takes place in the rectifier's AC / DC converter, for example, using a bridge circuit which includes controllable power switches, such as transistors. The power conversion can be controlled by switching, in particular by clocking, the power switches of the bridge circuit. This control is performed by a control unit within the rectifier. The rectifier, and especially its AC / DC converter, can be designed for bidirectional power conversion to convert and transfer electrical power in either direction. It can therefore also be operated as an inverter and feed AC power into the AC grid as active power. Furthermore, it can be designed to exchange reactive power with the AC grid, for example...for network-serving purposes.

[0050] In one embodiment of the rectifier, the second switching unit, in addition to its normally open second main contact, has a positively guided, normally closed second switching contact for monitoring the actual state of the second main contact. The ability to monitor the actual state, i.e., the real state, of the second main contact further increases the safety of the isolating unit and the rectifier. 24-063-P-WO - 13 - submitted version

[0051] In one embodiment of the rectifier, a switch controllable by the rectifier's control unit is arranged in a connection path between the first actuating coil and the supply terminal of the first switching unit. Alternatively or additionally, a switch controllable by the rectifier's control unit is arranged in a connection path between the second actuating coil and the normally closed first switching contact of the first switching unit. This allows the control unit to further interrupt the current supply to the first and / or second actuating coil. The rectifier's control unit can thus influence the switching state of the switches in the isolation unit. This can be advantageous, for example, during the start-up of an electrolyzer as a DC load.

[0052] The described rectifier is designed and usable for supplying a DC load, in particular an electrolyzer, from an AC network. A method for operating the rectifier comprises the following steps:

[0053] • Operating the rectifier with the alarm device deactivated in a normal operating state, with the first main contact of the first switching unit and the second main contact of the second switching unit each in a closed state and the DC load being supplied via the power path by power converted from the AC mains.

[0054] • Suppression of power flow between the AC network and the DC load in response to activation of the alarm device, whereby the first switching unit is controlled with a set state to open the first main contact in order to disconnect the DC load from the AC / DC converter.

[0055] When the alarm device is activated, the second switching unit disconnects the AC network from the AC / DC converter depending on whether the actual state of the first switching unit corresponds to its target state.

[0056] If the first switching unit is activated with the target state, it is expected to assume that state. However, it is possible that the target state of the first switching unit will not be reached, or will only be reached insufficiently, if, for example, a fault occurs. Within the scope of this procedure, the target state of the first main contact corresponds to an open first main contact and, consequently, an interrupted power flow in the DC section of the disconnect unit. 24-063-P-WO - 14 - submitted version

[0057] The rectifier according to the invention, in particular its control unit, is designed and configured to carry out the method according to the invention.

[0058] In one embodiment of the method, the second switching unit is activated to open its main contact when the actual state of the first switching unit deviates from its target state. For reliable isolation, the second main contact in the AC circuit is then activated with a target state corresponding to an open state of the second main contact if isolation was not possible using the first main contact. The power flow is then suppressed by opening and / or holding open the second main contact in the AC circuit.

[0059] In one embodiment of the method, the second switching unit is operated with its second main contact closed to allow power exchange between the AC network and the AC / DC converter when the actual state of the first switching unit corresponds to its target state during an activated alarm. This allows electrical power to continue to be exchanged with the AC network via the rectifier, even when the DC load is disconnected from the AC network. The rectifier can then still operate in a grid-supporting or grid-serving capacity even in the event of an alarm, i.e., when the alarm device is activated, and, for example, exchange reactive power with the AC network. In this case, the second main contact can be operated continuously, particularly even while the first main contact is opening.This is the case, for example, when an energy storage device is connected to the second actuating coil, which continues to supply the second actuating coil in the event of a brief interruption of power flow from the supply connection. However, within the scope of the invention, it is also possible that the second main contact of the second switching unit is initially opened together with the first main contact of the first switching unit, but shortly thereafter is operated in a permanently closed position again. This can occur, for example, if the second actuating coil is not connected to an energy storage device to buffer a brief interruption of power from the supply connection.

[0060] In one embodiment of the method, the second switching unit is controlled to open and / or keep its main contact permanently open in order to suppress power exchange between the AC / DC converter and the AC network when, with the alarm device activated, the actual state of the first 24-063-P-WO - 15 - submitted version

[0061] The switching unit deviates from its target state. Therefore, if suppressing the power flow via the first main contact in the DC range was not possible when the alarm device was activated, the power flow via the second main contact in the AC range is suppressed. This ensures a fail-safe disconnection of the power path.

[0062] Keeping the second main contact permanently open means that the second main contact is kept open if it is already open when the device is activated or is already in the open state. This permanent open state differs from a merely temporary or transitional open state, such as can occur during a switching operation in electromagnetic switching units from an initial state to a final state due to a brief interruption of power.

[0063] In one embodiment of the method, when the alarm device is activated and the first main contact of the first switching unit is open, the rectifier exchanges grid-supporting electrical power with the AC grid, wherein the grid-supporting power particularly includes reactive power. Therefore, even if the DC load is disconnected from the AC grid for safety reasons, it is still possible to support the AC grid by means of the rectifier.

[0064] In one embodiment of the method, the alarm device is triggered manually. Alternatively or cumulatively, the alarm device can be activated by at least one sensor, in particular a gas sensor, a pressure sensor, a sound sensor, and / or a temperature sensor. In the latter case, one or more potentially hazardous conditions are continuously monitored, and the alarm device is activated when such a condition occurs.

[0065] For example, the sensor can detect a malfunction of the DC load, such as the electrolyzer. The DC load can then be automatically disconnected from the AC network via the alarm system to identify and resolve the problem. The sensors can also detect safety issues, such as leaks, unusual noises, or overheating, and the DC load can be automatically disconnected from the AC network via the isolation unit's alarm system. Manual disconnection in the event of a malfunction is also possible by activating the alarm system if signs of malfunctions or operational disruptions are detected, for example, by operators of the electrolyzer (see version 24-063-P-WO - 16). Manual activation can be achieved, for example, via an emergency stop actuator.

[0066] Even in an emergency, such as a fire or other hazard, the DC load can be disconnected from the AC network via the alarm system. Such dangerous situations, like fires or other hazards, can be detected by suitable sensors and / or personnel.

[0067] Brief description of the characters

[0068] The registration process is illustrated below using figures. These show

[0069] Fig. 1a schematically shows a first embodiment of a separation unit according to the invention;

[0070] Fig. 1b schematically shows a second embodiment of a separation unit according to the invention;

[0071] Fig. 2 schematically shows an embodiment of an electrolysis plant;

[0072] Fig. 3 schematically shows a flowchart of a method according to the invention for operating a rectifier in one embodiment.

[0073] The same reference symbols are used in the figures for identical or similar elements. The representations in the figures cannot be to scale.

[0074] Figure description

[0075] Figure 1 schematically shows a first embodiment of a separation unit 100 according to the invention. The separation unit 100 has a first switching unit K1 and a second switching unit K2.

[0076] The first switching unit K1 has a first main contact K1.1, which is connected to a DC terminal 12 of the disconnecting unit 100 and is configured to switchably interrupt a DC power flow PDC on a DC power path. The first switching unit K1 is designed to disconnect all poles. For this purpose, the first main contact K1.1 has two sub-contacts, each sub-contact being able to switchably interrupt one conductor of the DC power path. If the first main contact K1.1 is open, the DC power flow PDC is interrupted. If the first main contact K1.1 is closed, the DC power flow PDC is possible.

[0077] The first switching unit K1, in particular the first main contact K1.1, is designed as a load break switch and can therefore interrupt the DC power flow even at a current equal to or exceeding the nominal current of the DC load. For this purpose, it has, for example, a first partial contact and a second partial contact. Furthermore, the first switching unit K1 can have an arc-quenching chamber for extinguishing a switching arc (not explicitly shown in Fig. 1b).

[0078] The first main contact K1.1 is normally open. When not actuated, the normally open first main contact K1.1 remains in its normal open state. The first main contact K1.1 is actuated by a first actuating coil K1.S. When the first actuating coil K1.S is not energized, it does not actuate the first main contact K1.1, and it remains in its normal open state. When the first actuating coil K1.S is energized, it actuates the first main contact K1.1, causing it to close and / or operate in a closed state. In the normal state of the first main contact K1.1, i.e., without actuation by the first actuating coil K1.S, the DC power flow PDC is interrupted.

[0079] The first switching unit K1 has a first switching contact K1.2, which is positively guided to the first main contact K1.1. The first switching contact K1.2 is designed as a normally closed switching contact. When the first main contact K1.1 is open, the first switching contact K1.2 is closed. When the first main contact K1.1 is closed, the first switching contact K1.2 is open. The first switching contact K1.2 is therefore indirectly actuated via the positive guidance with the first main contact K1.1 through the first actuating coil K1.S.

[0080] The second switching unit K2 has a second main contact K2.1, which is connected to an AC terminal 11 of the disconnecting unit 100 and which is configured to switchably interrupt an AC power flow PAC on an AC power path. The second switching unit K2, and in particular the second main contact K2.1, is designed for all-pole disconnection of the AC power path. For this purpose, the second main contact K2.1 has three sub-contacts, each sub-contact being able to switchably interrupt one phase of the three-phase AC power path. If the second main contact K2.1 is open, the AC- 24-063-P-WO - 18 - submitted version

[0081] Power flow PAC interrupted. If the second main contact K2.1 is closed, then AC power flow PAC is possible.

[0082] The second main contact K2.1 is designed as a load break switch and can therefore interrupt the AC power flow even at a current equal to or exceeding the nominal current flowing during normal operation. For this purpose, it has, for example, a first, a second, and a third partial contact. Furthermore, the second switching unit K2 can have an arc-quenching chamber for extinguishing a switching arc (not explicitly shown in Fig. 1b).

[0083] The second main contact K2.1 is normally open. When the normally open second main contact K2.1 is not actuated, it remains in its normal open state. The second main contact K2.1 is actuated by a second actuating coil K2.S. When the second actuating coil K2.S is not energized, it does not actuate the second main contact K2.1, and it remains in its normal open state. When the second actuating coil K2.S is energized, it actuates the second main contact K2.1, causing it to close and / or operate in the closed state. In the normal state of the second main contact K2.1, i.e., without actuation by the second actuating coil K2.S, the AC power flow PAC is therefore interrupted.

[0084] The second switching unit K2 has a second switching contact K2.2, which is positively guided to the second main contact K2.1. The second switching contact K2.2 is designed as a normally closed switching contact and is therefore the opposite of the second main contact K2.1. When the second main contact K2.1 is open, the second switching contact K2.2 is closed. When the second main contact K2.1 is closed, the second switching contact K2.2 is open. The second switching contact K2.2 is thus indirectly actuated via the positive guidance with the second main contact K2.1 through the second actuating coil K2.S.

[0085] The separating unit 100 has a supply connection 101 to which a supply voltage +V is applied. The supply voltage +V can be used to supply electrical power to the first actuating coil K1.S and the second actuating coil K2.S.

[0086] The separation unit 100 is connected via connection terminals 105, 106 to an alarm device 102, which includes an alarm switch 103 and a sensor 104, e.g. a gas sensor, a pressure sensor, a noise sensor and / or a 24-063-P-WO - 19 - submitted version

[0087] The device includes a temperature sensor. When the alarm device 102 is activated, the alarm switch 103 is open, thus interrupting the circuit in which it is located. When the alarm device 102 is deactivated, the alarm switch 103 is closed, thus closing the circuit in which it is located. The alarm switch 103 can be actuated automatically by the sensor 104 and / or manually.

[0088] The first actuating coil K1.S and the second actuating coil K2.S are each connected to the supply terminal 101 via an assigned first connection path through the alarm switch 103. Additionally, they are each connected to the supply terminal 101 via an assigned second connection path through the normally closed first switching contact K1.2. Furthermore, a second switch 109 is arranged in the second connection path of the first actuating coil K1.S. This switch is designed to suppress current flow from the supply terminal 101 to the first actuating coil K1.S when the first switching contact K1.2 is closed. In Fig. 1a, the second switch 109 is shown, by way of example, coupled or positively driven to the alarm switch 103 of the alarm device 102, which is symbolized by a dashed line. It can be a component of the alarm device 102.Alternatively, it is also possible that the further switch 109 is coupled or positively guided to the first main contact K1.1 and is therefore part of the first switching unit K1.

[0089] If the alarm device 102 is deactivated, the alarm switch 103 and the other switch 109 are both closed. Both actuating coils K1.S and K2.S are thus connected to the supply terminal 101 and actuate the respective main contacts K1.1 and K2.1. Both AC power flow (PAC) and DC power flow (PDC) are therefore possible. When the alarm device 102 is deactivated, the respective switching contacts K1.2 and K2.2, which are positively driven by the main contacts K1.1 and K2.1, are open.

[0090] When the alarm device 102 is activated, both the alarm switch 103 and the coupled switch 109 are opened. The first actuating coil K1.S is no longer energized, and the first main contact K1.1 is controlled to open or assume the open state. 24-063-P-WO - 20 - submitted version

[0091] If the first main contact K1.1 is actually opened, its actual state corresponds to its target state. The first switching contact K1.2, which is positively guided by the first main contact K1.1, closes, and the second actuating coil K2.S is connected to the supply terminal 101 via the closed first switching contact K1.2.

[0092] When the alarm switch 103 is opened, the second actuating coil K2.S is also briefly disconnected from the supply connection 101. This can lead to a momentary interruption of the electrical supply to the second actuating coil and thus to a brief opening and closing of the second main contact K2.1. To prevent such a potentially undesirable switching change, the embodiment shown in Fig. 1a includes a capacitor 107 as an energy storage device, which can supply the second actuating coil K2.S with electrical power via the resistor 108 during the brief power interruption.

[0093] Once the first switching contact K1.2 is closed as described above, the second actuating coil K2.S is reconnected to the supply voltage +V and can continue to be supplied with electrical power via the supply terminal 101. The second main contact K2.1 can thus be kept permanently in the closed state. The AC power flow PAC therefore remains possible even with the alarm device 102 activated and the DC power flow PDC reliably interrupted.

[0094] If, however, the first main contact K1.1 does not open despite being actuated by the first actuating coil K1.S in the target state "open", its actual state differs from its target state. The first switching contact K1.2, which is positively driven by the first main contact K1.1, remains open, and the second actuating coil K2.S is disconnected from the supply terminal 101. The second main contact K2.1 therefore returns to its normal state and opens, or is operated in its open state. The AC power flow PAC is thus permanently interrupted.

[0095] Additionally, the isolating unit 100 in Fig. 1a has switches 110, 111, which can be controlled by a control unit 15 of a rectifier (not shown in Fig. 1a, but see Fig. 2). The switches 110, 111 are optional components that may be present but are not mandatory (24-063-P-WO - 21 - submitted version). These switches allow the actuating coils K1.S, K2.S to be disconnected from the supply connection 101. This can be advantageous in specific operating conditions of a DC load 30 (Fig. 2), e.g., a brief interruption of the electrolysis process in an electrolyzer.

[0096] Figure 1b schematically shows a second embodiment of a separation unit 100 according to the invention. The second embodiment is similar in many aspects to the first embodiment shown in Figure 1a. Therefore, only the differences from the first embodiment will be explained below. For similar aspects, reference is made to the description of Figure 1a.

[0097] In contrast to the first embodiment, the alarm unit 102 of the isolating unit 100 in Fig. 1b includes the alarm switch 103, but not a further switch 109 coupled to it. Instead, the isolating circuit 100 of the second embodiment in Fig. 1b has a diode as a further switch 109 to suppress an electrical supply to the first actuating coil K1.S from the supply terminal 101 when the switching contact K1.2 is closed. In this embodiment as well, the diode is arranged in the second connection path between the first actuating coil K1.S and the supply terminal 101, which leads via the first switching contact K1.2. However, unlike in Fig. 1a, the diode in Fig. 1b is arranged in a section of the second connection path that is separate from and parallel to the first connection path.Within the second connection path, the diode is arranged such that it suppresses current flow from the supply terminal 101 to the first actuating coil K1.S when the first switching contact K1.2 is closed. The additional switch 109, also designed as a diode, is simultaneously located in a first connection path to the supply terminal 101, which leads to the second actuating coil K2.S via the alarm switch 103. In this first connection path, the diode is oriented such that it allows current flow from the supply terminal 101 to the second actuating coil K2.S via the closed alarm switch 103.

[0098] Although the additional switch 109 is shown as a diode in Fig. 1b, it is also possible for the additional switch 109 to be designed as a mechanical switch. For example, the additional switch 109 can be a switch coupled to the first main contact K1.1. In this case, it can be part of the first switching unit K1 24-063-P-WO - 22 - submitted version. Alternatively, the additional switch 109 can also be designed as a switch coupled to the alarm switch 103 and, in particular, be part of the alarm unit 102. While a diode is designed to suppress the current flow for a DC voltage applied to the supply terminal 101, but not for an AC voltage applied there, a mechanical switch as the additional switch 109 is able to suppress the power flow from the supply terminal 101 for both a DC voltage and an AC voltage applied there.

[0099] Figure 2 schematically shows an embodiment of an electrolysis plant 300. The electrolysis plant 300 has a DC load 30, which can, for example, include an electrolyzer 32. The DC load 30 is supplied with electrical power at a DC voltage UDC from a three-phase AC network 20 via a power path of the rectifier 10.

[0100] Rectifier 10 has an AC rectifier terminal 21, which is connected to the AC network 20. Rectifier 10 has a DC rectifier terminal 22, which is connected to the DC load 30. Rectifier 10 has an AC / DC converter 14, which converts AC power supplied via AC rectifier terminal 21 into DC power and outputs it via DC rectifier terminal 22. For power conversion, the AC / DC converter 14 has a bridge circuit comprising transistors. The power conversion can be controlled, for example, by clocking the transistors of the bridge circuit. This control is effected by a control unit 15 of rectifier 10. Rectifier 10 can be configured, in particular, to convert and transfer electrical power in any of the possible directions.It can therefore also be operated as an inverter and / or feed AC power, for example reactive power, into the AC network 20 or exchange it with the AC network 20, e.g. for grid-serving purposes.

[0101] The rectifier 10 further comprises the isolating unit 200, which includes the first switching unit K1, the second switching unit K2, and the alarm device 102. The AC connection 11 of the isolating unit 200 is identical to the AC rectifier connection 21 in Fig. 2. The DC connection 12 of the isolating unit 200 is also identical to the DC rectifier connection 22 in Fig. 2. However, within the scope of the invention, it is also possible that the DC connection 12 is identical to the DC rectifier connection 22. [24-063-P-WO - 23 - submitted version]

[0102] 22 is connected and / or the AC terminal 11 is connected to the AC rectifier terminal

[0103] 21 is connected.

[0104] The power path of rectifier 10 has a DC section between the DC terminal 12 and the AC / DC converter 14. The first switching unit K1 is located in this DC section. The power path of rectifier 10 also has an AC section between the AC terminal 11 and the AC / DC converter 14. The second switching unit K2 is located in this AC section.

[0105] The isolating unit 200 enables a fail-safe isolation of the DC load 30 from the AC network 20. Even with the alarm device 102 activated, it is still possible to exchange AC power with the AC network 20, provided that the first switching unit has reliably isolated the DC load 30 from the AC / DC converter 14.

[0106] Fig. 3 schematically shows a flowchart for an embodiment of a method according to the invention for operating a rectifier 10, for example the rectifier from Fig. 2.

[0107] The process starts in the first step, S1.

[0108] In a second step S2, it is checked whether the alarm device 102 is activated.

[0109] If, in the second step S2, the alarm device 102 is not activated (path "no"), then in S3 the rectifier 10 is operated normally with the main contacts K1.1 and K1.2 closed. Normal operation can include supplying the DC load 30 with electrical power from the AC network 20. Normal operation can also include, possibly simultaneously, the network-supporting exchange of AC power, for example reactive power, with the AC network 20 by the rectifier 10.

[0110] If, however, the alarm device 102 is activated in the second step S2, path “yes”, then in a fourth step S4 the first main contact K1.1 is controlled with its target state “open”.

[0111] In a fifth step, S5, it is then checked whether the actual state of the first main contact K1.1 corresponds to its target state "open". This check can be carried out in particular using the first switching contact K1.2.

[0112] If, in the fifth step S5, the actual state of the first main contact K1.1 does not correspond to its target state, i.e., the first main contact K1.1 is closed or only insufficiently open, then in an eighth step S8 the second main contact 24-063-P-WO - 24 - submitted version

[0113] K2.1 is open, meaning the second main contact K2.1 is controlled with the target state "open".

[0114] If, however, in the fifth step S5 the actual state of the first main contact K1.1 corresponds to its target state, i.e., the first main contact K1.1 is open, then in a sixth step S6 the second main contact K2.1 is closed and / or kept closed.

[0115] In a seventh step S7, an exchange of electrical AC power, particularly for grid support, is then possible via the closed second main contact K2.1.

[0116] This method thus enables the safe disconnection of the DC load 30 from the AC network 20, whereby a fault in the first main contact K1.1, e.g., due to stuck moving parts, can be intercepted. Nevertheless, even in an alarm situation with the alarm device 102 activated, it is possible that the rectifier 10, at least if the first switching unit K1 is operating correctly, supports the AC network connected to it by exchanging AC power.

[0117] 24-063-P-WO submitted version

[0118] Reference sign

[0119] 10 rectifiers

[0120] 11 AC connection

[0121] 12 DC connector

[0122] 14 AC / DC converters

[0123] 15 Control unit (of the rectifier)

[0124] K1, K2 switching unit

[0125] K1.1 , K2.1 Main contact

[0126] K1.2, K2.2 positively guided switching contact

[0127] K1.S, K2.S Actuating coil

[0128] 20 AC network

[0129] 30 DC load

[0130] 32 Electrolyzer

[0131] 100, 200 separation unit

[0132] 101 Supply connection

[0133] 102 Alarm system

[0134] 103 alarm switches

[0135] 104 Sensor

[0136] 105, 106 Connection terminal

[0137] 107 Capacitor

[0138] 108 resistance

[0139] 109 switches

[0140] 110, 111 switches

[0141] 300 electrolysis plant

[0142] +V Supply voltage

[0143] S1-S8 Process step

[0144] PDC DC power flow

[0145] PAC AC power flow

Claims

24-063-P-WO - 26 - submitted version PATENT CLAIMS 1. A fail-safe disconnecting unit (100, 200) comprising a DC terminal (12) for connecting a DC load (30) and an AC terminal (11) for connecting an AC network (20), wherein the disconnecting unit (100, 200) is configured to safely disconnect a power path between the DC terminal (12) and the AC terminal (11), wherein the disconnecting unit (100, 200) comprises an activatable and deactivatable alarm device (102) and two electromagnetic switching units (K1, K2) arranged in the power path between the AC terminal (11) and the DC terminal (12), wherein a first switching unit (K1) is arranged in a DC section of the power path and wherein a second switching unit (K2) is arranged in an AC section of the power path, wherein the disconnecting unit (100, 200) is designed to, in an activated state of the alarm device (102), - to control the first switching unit (K1) with a target state, to open a first main contact (K1.1) of the first switching unit (K1) in order to disconnect the power path in the DC area, and - depending on whether the actual state of the first main contact (K1.1) corresponds to its target state, to separate the power path in the AC area by means of the second switching unit (K2).

2. Separation unit (100, 200) according to claim 1, wherein the separation unit (100, 200) is designed to separate the AC area of ​​the power path by opening a second main contact (K2.1) of the second switching unit (K2).

3. Separating unit (100, 200) according to claim 1 or 2, wherein the first main contact (K1.1 ) is designed as a normally open contact and / or wherein the second main contact (K2.1 ) is designed as a normally open contact.

4. Separation unit (100, 200) according to one of claims 1 to 3, wherein the separation unit is designed to separate the power path in the AC area by means of the second switching unit (K2) when the first main contact (K1.1) is not open or is open incorrectly. 24-063-P-WO - 27 - submitted version 5. Separation unit (100, 200) according to one of the preceding claims, wherein the first electromagnetic switching unit (K1 ) has a first switching contact (K1.2) forcing the first main contact (K1.1 ) to query the actual state of the first main contact (K1.1 ).

6. Separating unit (100, 200) according to claim 5, wherein the first main contact (K1.1 ) is designed as a normally open contact and the first switching contact (K1 .2) is designed as a normally closed contact.

7. Separating unit (100, 200) according to one of the preceding claims, wherein the first switching unit (K1 ) has a first actuating coil (K1.S) for actuating the first main contact (K1.1 ) and the first switching contact (K1.2) and the second electromagnetic switching unit (K2) has the normally open second main contact (K2.1) and a second actuating coil (K2.S) for actuating the second main contact (K2.1 ).

8. Separation unit (100, 200) according to one of the preceding claims, wherein the separation unit (100, 200) has a supply terminal (101) connectable to a supply voltage (+V) for the electrical supply of the first actuating coil (K1.S) and the second actuating coil (K2.S), wherein the alarm device (102) has an alarm switch (103) which is open in the activated state of the alarm device (102) and closed in the deactivated state of the alarm device (102), wherein the first actuating coil (K1.S) and the second actuating coil (K2.S) are each connected to the supply terminal (101) via a first connection path leading through the alarm switch (103) and via a second connection path leading through the normally closed first switching contact (K1.2).

9. Separation unit (100, 200) according to claim 8, wherein the alarm device (102) comprises a sensor (104) actuating the alarm switch (103), in particular a gas sensor, a pressure sensor and / or a temperature sensor, and / or wherein the alarm switch (103) is designed for manual actuation. 24-063-P-WO - 28 - submitted version 10. Separation unit (100, 200) according to one of the preceding claims, further comprising an energy storage device connected to the second actuating coil (K2.S), in particular a capacitor (107), which is designed to delay a switching operation of the normally open second main contact (K2.1) in the second switching unit (K2) after separation of the second actuating coil (K2.S) from the supply connection (101).

11. Disconnecting unit (100, 200) according to one of the preceding claims, wherein the first switching unit (K1 ) is designed as a DC load disconnecting unit and / or wherein the second switching unit (K2) is designed as an AC load disconnecting unit.

12. Disconnecting unit (100, 200) according to one of the preceding claims, wherein the first switching unit (K1) is designed to disconnect all poles and the first main contact (K1.1) has two normally open first partial contacts and / or wherein the second switching unit (K2) is designed to disconnect all poles and the second main contact (K2.1) has several, in particular three, normally open second partial contacts.

13. Separating unit (100, 200) according to one of the preceding claims, wherein the first switching unit (K1 ) has a sensor, in particular a current sensor, a voltage sensor and / or a temperature sensor, which is designed to detect a currentless state across the open first main contact (K1 .1 ).

14. Rectifier (10) for supplying a DC load (30) from an AC network (20), comprising a separation unit (100, 200) according to one of claims 1 to 13, and a transistor-based AC / DC converter (14) arranged in the power path between the first and the second electromagnetic switching unit (K1, K2) for converting AC power into DC power.

15. Rectifier (10) according to claim 14, wherein the second switching unit (K2) has, in addition to its normally open second main contact (K2.1), a positively guided normally closed second switching contact (K2.2) for querying an actual state of the second main contact (K2.1 ). 24-063-P-WO - 29 - submitted version 16. Rectifier (10) according to claim 14 or 15, wherein in a connection path between the first actuating coil (K1.S) and the supply terminal (101) and / or in a connection path between the second actuating coil (K2.S) and the normally closed first switching contact (K1.2) of the first switching unit (K1) a switch (110, 111) which can be controlled by a control unit (15) of the rectifier (10) is arranged.

17. Method for operating a rectifier (10) according to one of claims 14 to 16 for supplying a DC load (30), in particular an electrolyzer (32), from an AC network (20) comprising the steps: Operating the rectifier (10) with the alarm device deactivated (102) in a normal operating state, wherein the first main contact (K1.1 ) of the first switching unit (K1 ) and the second main contact (K2.1 ) of the second switching unit (K2) are each in a closed state and the DC load (30) is supplied via the power path by power converted from the AC network (20), Suppression of a power flow between the AC network (20) and the DC load (30) in response to activation of the alarm device (102), wherein the first switching unit (K1) is controlled with a setpoint state to open the first main contact (K1.1) in order to disconnect the DC load (30) from the AC / DC converter (15), and wherein the second switching unit (K2), when the alarm device (102) is activated, disconnects the AC network (20) from the AC / DC converter (14) depending on whether the actual state of the first switching unit (K1) corresponds to its setpoint state.

18. Method according to claim 17, wherein the second switching unit (K2) is activated to open its main contact (K2.1) when an actual state of the first switching unit (K1) deviates from its target state.

19. Method according to one of claims 17 to 18, wherein the second switching unit (K2) is operated with the second main contact (K2.1) closed to allow power exchange between the AC network (20) and the AC / DC converter (14) when, with the alarm device (102) activated, the actual state of the first switching unit (K1) corresponds to its target state. 24-063-P-WO - 30 - submitted version 20. Method according to one of claims 17 to 19, wherein the second switching unit (K2) is controlled to open and / or keep its main contact (K2.1) permanently open in order to suppress power exchange between the AC / DC converter (14) and the AC network (20) when, with the alarm device (102) activated, the actual state of the first switching unit (K1) deviates from its target state.

21. Method according to one of claims 17 to 20, wherein the rectifier (10) exchanges a grid-supporting power with the AC grid (20) when the alarm device (102) is activated and the first main contact (K1.1) of the first switching unit (K1) is open, wherein the grid-supporting power in particular comprises reactive power.

22. Method according to one of claims 17 to 21, wherein the alarm device (102) is activated manually and / or via a sensor (104), in particular a gas sensor, a pressure sensor and / or a temperature sensor.

Images