DE102018007651A1 - Wind turbine remote access control - Google Patents

Abstract

Method for controlling access (5) from external users to at least one wind turbine (1) by means of a data network (9) from outside. Read accesses for reading out data of the wind energy installation (1) and write accesses for setting data of the wind energy installation (1) are included. At least the write accesses are controlled by means of a semaphore (6). Depending on its value, write access is enabled or blocked. A request for the semaphore is regulated here, specifically by means of an enable signal (70) from an external control room (2). The semaphore protects both against critical double access and, according to the invention, against unauthorized access. The invention achieves this with a special link, namely by providing a controlled requirement for the semaphore. This is done in such a way that the semaphore required by the external user to access the wind turbine is only activated as a request if the control room releases it. The invention also relates to corresponding wind turbines.

Description

The invention relates to a method for controlling remote access to wind turbines. More specifically, it relates to a method for controlling the access of external users to at least one wind energy installation by means of a data network from the outside, comprising read accesses for reading out data from the wind energy installation and write accesses for setting data of the wind energy installation. Furthermore, the invention relates to a wind farm networked with a corresponding control.

The importance of wind turbines for power generation continues to grow. They already have a significant share in total electricity generation. They therefore represent an important part of the energy supply infrastructure. Regardless of the type, there is a fundamental requirement that an infrastructure that is as critical for modern societies as the energy supply must be protected. Specifically, there is a requirement for operators to control access to the systems.

Basically, this is not a new problem. Wind turbines in particular have always been accessible via remote access. The classic approach is to regulate access using network technology measures, for example using a remote terminal with a login name / password combination.

In the case of wind turbines, however, there is an additional aspect to be considered, namely that a monitoring function is important. This is used by the manufacturer or, in particular, the companies entrusted with the maintenance of the wind energy installation, in order to take timely and, if necessary, even preventive measures in the event of an impending need for maintenance. This concept has proven itself and it has been possible to reduce the failure rates of the wind turbines. This weighs heavily, since wind turbines are often installed in remote regions or even at sea, where it is often not possible to react immediately in the event of a failure. Therefore, predictive maintenance taking into account the current state of the respective wind turbine is important.

There is thus a tension between securing access on the one hand and ensuring effective access, in particular for monitoring tasks (for example, for maintenance planning) on the other.

The invention is therefore based on the object of achieving effective protection against unauthorized access, but without making monitoring of the wind energy installation more difficult.

The solution according to the invention lies in the features of the independent claims. Advantageous further developments are the subject of the dependent claims.

In a method for controlling the access of external users to at least one wind energy installation by means of a data network from the outside, comprising read accesses for reading out data of the wind energy installation and write accesses for setting data of the wind energy installation, the invention provides that at least the write accesses are controlled by means of a semaphore, whereby depending on their value, the write access is enabled or blocked, and wherein
requesting the semaphore is regulated by means of a release signal from an external control room.

• Ein Semaphor ist eine mehrdimensionale Datenstruktur, die aus einer Ganzzahl und einer Nutzungsoperation zum Freigeben besteht. Sie eignet sich insbesondere zur Verwaltung beschränkter (zählbarer) Ressourcen. Sie dient dazu, um beispielsweise im Fall einer Konkurrenzsituation für ein Betriebsmittel dafür zu sorgen, dass das besagte Betriebsmittel nicht von mehreren Prozessen (insbesondere Benutzern) beliebig verändernd benutzt wird; eine Konkurrenzsituation wird damit kontrolliert behandelt.

Some terms used are explained below:

• A semaphore is a multidimensional data structure that consists of an integer and a usage operation for sharing. It is particularly suitable for managing limited (countable) resources. It is used to ensure, for example, in the event of a competitive situation for a piece of equipment, that the said equipment is not used in any way by several processes (in particular users); a competitive situation is dealt with in a controlled manner.

A control room is understood to be a higher-level entity that can decide on access to the wind turbine. Often, this can be the unit that is responsible for the operation and / or maintenance of the wind energy plants. However, it can also be the owner or operator of the system. Most of the time it means the authority that is legally entrusted with granting access to the wind turbine or not.

The invention is based on the concept of the semaphore, which is known as such and therefore does not need to be described in more detail. In short, one area of application of the semaphore is to prevent multiple users logged on at the same time from acting on the same resource (usually a system to be controlled). A semaphore represents protection against competition, similar to the way it is achieved, for example, in the area of data processing through lock files or the like. However, a semaphore technically protects against critical ones Double access, but does not protect against unauthorized access. The invention overcomes this disadvantage with a special link, namely by providing a controlled requirement for the semaphore. This is done in such a way that the semaphore required by the external user to access the wind turbine is only activated on request if the control room releases it. The invention therefore shifts access protection to a requirement level. The invention thus creates a special concept, namely a semaphore with a regulated request, the request being able to be released or blocked by the control room. In other words, the invention uses the access to the anti-competition semaphore in a new way for access protection. This is unprecedented in the prior art.

This ensures that write access to the wind energy installation, in particular an access that controls the wind energy installation, cannot be authorized by the user alone, but must be released by another location, namely the control room, according to the invention by blocking or releasing of the requested semaphore by the control room.

It has proven to be useful if access is not granted unrestrictedly, but rather the release is time-limited. A corresponding time limit is preferably transmitted with the release signal, in particular a time window determining the validity. This limits the duration of access. Unnecessarily long open communication channels can thus be avoided, particularly in the security-critical area of write access.

According to the invention, however, the time limit can also be used for automatic release on the basis of order numbers. For this purpose, provision is preferably made for the validity to be released after checking an entered order number, the order number preferably being generated automatically and distributed to the users. In particular in connection with the automated generation and assignment of the order number, the entire process can be automated as part of digitization. The control center can thus be effectively relieved of the task of deciding on access or refusing access.

The access control preferably comprises several different access levels, which differ in terms of their access authorizations. In this way, it is possible to differentiate between the users and their access rights with regard to the control of the wind energy plant. The enable signal is preferably limited to one of the access levels. Examples of such differentiations are, on the basis of the highest privileged administrators, those who are responsible for maintenance, furthermore those who are responsible for regular operations, institutions which are responsible for monitoring and / or possibly also guest access ( which, as a rule, will only have read permissions and no write permissions). In this way, access security can be achieved that is fine-tuned to the specific requirements of the respective groups of people.

Furthermore, it can be expedient if the access levels differ with regard to the network addresses of the users. It is advantageously provided here that certain network addresses (in particular IP address ranges) have higher authorizations than others and / or enjoy other privileges, for example they are not time-limited. A fine adjustment to the different interests of the users versus the security needs of the system against unauthorized access can be achieved. Overall, it is usually useful if the access levels differ in terms of time limits. However, it has also proven effective if at least one of the access levels is unlimited in time.

Furthermore, it is expedient in many cases to additionally provide an override mode. It is particularly intended for the case that communication to the control room is interrupted. In order to enable access nevertheless, an effectively secured special rights access is provided, which preferably enables write access only for local access to the respective wind energy installation and particularly preferably only for a parameterizable time. This means that maintenance teams can access and work on the wind turbine on site, only when the communication link is completely down. This special rights access is preferably protected with standard security procedures, in particular using certificates (e.g. according to IEC 62443), and it is not available remotely (i.e. remotely). Furthermore, it can preferably be provided that local access is blocked when there is available remote access to the wind energy installation. This prevents unauthorized access.

The communication link to the control room is expediently monitored. If it is disturbed, it is advantageously provided that only local access to the respective wind energy installation is enabled, and preferably only after a preferably parameterizable safety time has expired. Remote access is then excluded. This ensures protection even in the event that the control room has a communication problem is not available. However, access for a maintenance team that is on site is still possible, at least after the security period has expired. It is also advantageously provided that the communication link to the control room is secured, preferably by restricting it to a predefined range of network addresses, certificate-based authentication (in particular in accordance with IEC 62443) and / or multi-factor authorization. An unauthorized intrusion of third parties into this communication link can be prevented. It is also expediently provided that in the event of a fault, only local access to the respective wind energy installation is enabled. In this way, the risk of unauthorized remote access is eliminated in the event of a compromised signal connection, and yet the wind turbine remains accessible via the local access.

A further semaphore is expediently provided, which can optionally be activated by the control center and, when activated, ignores queries from external users outside the address area of the control room, preferably blocking the IP connection at the network level. This ignoring or blocking, particularly if it is already taking place at the network level, can effectively ward off attacks coming from outside, for example the dangerous "denial of service" attacks.

It is particularly advantageous if the external users are accessed via a public network, in particular a wide area network such as the Internet. In this way, on the one hand, a circle of authorized users can be integrated or handled over a wide area. On the other hand, an efficient implementation is ensured, because nowadays there is usually also a suitable network access at remote wind turbine locations. The virtual private network creates an environment for secure access, which can then be secured in the manner according to the invention, as already explained above.

The invention also relates to methods for access control of a number of wind energy plants, which can preferably also be combined in groups (in particular as a wind farm, but possibly also groups within a wind farm or large groups which comprise a plurality of wind farms). In such cases, it has proven useful to provide a sub-control room for each of the groups, which takes over the function of the control room for transmitting a release signal for a specific one of the groups. This avoids unnecessary centralization. This can be used, for example, to divide the wind turbines user-specifically between different sub-control rooms. This is particularly advantageous in cases such as when a maintenance organization takes care of wind turbines from different (large) customers in order to operate their own (sub) control room for them.

Furthermore, it can be provided that the control room (or sub-control room) itself does not have write access to the wind power plant. It can only give another (authorized) user access or deny it. A desired separation is thus achieved. The control room does not become omnipotent, but can only deny or grant access to others; but she cannot do it herself. This is particularly advantageous compared to mostly dangerous attacks on the integrity of the wind turbine by an inland offender (for example, a person employed by the control room). Since the control room is not granted write access, such an internal attack is effectively excluded.

The invention further relates to a wind energy installation and a group of wind energy installations according to the independent device claims. For a more detailed explanation, reference is made to the above description.

• 1 eine Übersichtsdarstellung mit mehreren an ein Weitverkehrsdatennetz angeschlossenen Windenergieanlagen; und
• 2 ein Funktionsblock-Diagramm für eine Zugangssteuerung auf eine der Windenergieanlagen.

The invention is explained below with reference to the accompanying drawing using an advantageous exemplary embodiment. Show it:

• 1 an overview with several wind turbines connected to a wide area data network; and
• 2nd a functional block diagram for access control to one of the wind turbines.

In 1 Shown are several wind turbines to which access is enabled or blocked using the access control according to the invention. The individual wind turbines are marked with the reference number 1 designated. Some of these wind turbines 1 can join a group 1' summarized, which stands for example for a wind farm. It goes without saying that the groups can also be formed differently, for example by area, by user or by manufacturer, etc.

The single wind turbine 1 in itself is essentially conventional (see 2nd ). It shows a tower 10th at the top of which is a gondola 11 is pivotally arranged in the azimuth direction. At one end is a wind rotor 12th rotatably arranged of a generator 13 drives. This works with an inverter 14 together to generate electrical energy (this is via lines, not shown fed into an electrical transmission network, also not shown). To control and control the operation of the wind turbine 1 is an operational control 2nd intended. They can be accessed from outside via signal connections 19th working at a remote access entrance 51 the wind turbine is connected. Furthermore, the operational control 2nd another local access entrance 50 which is only accessible on site.

Access to the wind turbine 1 takes place in the illustrated embodiment over a wide area data network, alternatively over the Internet 9 . User for access to the wind turbine 1 include maintenance teams 41 , Operators 42 , Manufacturer 43 or possibly guest access 44 for any user (in 2nd symbolized by "?") for general information about the operating status of the wind turbine, each via data connections 91 , 92 , 93 respectively. 94 over the internet 9 with the wind turbines 1 Can connect. Here, access to the wind turbine 1 controlled by means of an access control 5 . You can on each individual wind turbine 1 be provided together for several wind turbines 1 or in summary for a whole group of wind turbines 1' . The access control 5 controls (at least) controlling access to the wind turbine 1 . It should be noted that in technical terms, access that controls the operation or behavior of the wind turbine is often referred to as "write" access. In the present case, controlling and writing accesses are to be regarded as synonymous. Furthermore, it can optionally be provided that a purely reading access for information acquisition is not recorded, but can take place freely (see signal connection 59 in 2nd ).

The access control 5 is provided with a semaphore module 6 . It includes a counter 61 , which is designed for counting up or down and a zero comparison unit 60 . These work together in a manner known per se to encapsulate access to the resource “wind turbine 1”, in the present case only one user being allowed to access at a time. This means that the counter 61 is initialized with the value "1". (If several accesses should be possible at the same time, the corresponding number of simultaneous accesses is set as the initialization value.) If access is requested, the counter becomes 61 counted down by 1 and at the end of the request it is increased again by 1 for approval. Overall, the counter must not fall below zero, which is done using the zero comparison unit 60 is checked. Alternatively, other implementations of the semaphore module can also be provided, for example those with a status indicator, with “O” as the initial value for available and “1” for active status. If this check is positive, access is given, ie there can be (also) write access via the signal connection 19th on the operation control 2nd the wind turbine 1 be taken; otherwise access will be blocked if the check is negative.

According to the invention, however, the semaphore cannot always be requested, ie access to the semaphore module 6 is limited. This is done using a request switch 7 which corresponds to the input of the semaphore module 6 is connected upstream. The request switch 7 can activate the request of the semaphore upon a release signal and thus the requesting user 4th (here operator 42 ) access to the semaphore module 6 release, or lock it accordingly. The release signal is transmitted via an release line 70 from a control room 2nd .

The method of operation of the method according to the invention is explained on the basis of full access, that is to say both reading and writing access by an operator 42 as a user 4th . This wants over his data connection 92 Contact with the wind turbine 1 record, tape. To simplify matters, it is assumed that read access is freely possible by means of the signal connection 59 . However, in this simple case, the write access required for control is by the access control according to the invention 5 initially blocked. The user 42 sends a request over its data connection 92 . However, this does not directly affect the semaphore module 6 , but the request is made by the request switch 7 only activated upon an enable signal. This release signal is from the control room 2nd unlock. It is the responsibility of the control room 2nd to decide whether access to the wind turbine 1 to be granted or not. If it grants access, the release signal 70 issued and the request switch 7 switches through with what the user 4th (here the operator 42 ) Access to the semaphore module 6 is given. This then gives access to the signal connection in the manner known per se with protection against double access 19th for wind turbine control 2nd free. The operator 42 can now on the wind turbine in the usual way 1 act. Variants are possible. Thus, it can be provided that a specific user switches the request switch within a predetermined time window during a planned use 7 unlock. This can be done, for example, by entering an order number (which is preferably only valid to a limited extent), possibly by the user himself. This means that extensive automation can be achieved, which relieves the control center.

The same applies if the manufacturer 43 Access to the wind turbine 1 want to take. The control room decides on its requirements 2nd accordingly by means of a request switch 7 ' . This can be done from the control room 2nd be activated, depending solely on whether the manufacturer 43 is generally authorized or not. About a possible double access to the wind turbine 1 (by operator 42 and manufacturers 43 ) the control room needs 2nd no need to worry, because according to the invention this is a matter of the semaphore module 6 is. For example, is already the operator 42 access through the semaphore module 6 granted and is therefore the counter 60 already at the value zero, so the request by the manufacturer 43 by means of the request switch 7 ' must be activated, but the semaphore module is blocked 6 access to the operational control 2nd the wind turbine 1 .

The access control 5 can also monitor the communication link to the control room 2nd be provided. This also includes a time module 56 . It is designed so that if the communication link to the control room fails 2nd after a security period, approval for access to the wind turbine 1 is granted. This is done using an override mode 8th , which is preferably limited to local access to the wind turbine 1 access to the operational control 2nd enables. With local access is meant here that a maintenance team 41 on site at the wind turbine 1 located.

It can also be provided that if there is a fault in the signal connection, be it to the control room 2nd or the signal connection 19th at all, local access 50 is released. This makes it possible for a user, such as a fitter, located in the wind energy installation 40 , Has access to the operational control 2nd , even if authorization is lacking in the signal connection 19th is not possible at all. The remote access input is preferred 51 disabled and write access using the semaphore module 6 are blocked.

An additional semaphore in the form of an extension is also shown 6 ' the semaphore module 6 . This can be activated and deactivated on request. If it is activated, requests from external users 49 (ie from a different address range than that of the control room) ignored. The wind turbine 1 becomes virtually invisible to these external users 49 .

Claims (15)

Method for controlling access (5) from external users to at least one wind energy installation (1) by means of a data network (9) from the outside comprising read accesses for reading out data from the wind energy installation (1) and write accesses for setting data of the wind energy installation (1), characterized in that that at least the write accesses are controlled by means of a semaphore (6), the write access being enabled or blocked depending on its value, and wherein requesting the semaphore is regulated, specifically by means of an enable signal (70) from an external control room (2 ). Procedure according to Claim 1 , characterized in that the release is time-limited, wherein preferably a time window determining the validity is transmitted with the release signal. Procedure according to Claim 1 or 2nd , characterized in that the release takes place after checking an entered order number for validity, the order number preferably being generated automatically and distributed to the users. Method according to one of the preceding claims, characterized in that the access control comprises a plurality of different access levels, which differ in terms of their access authorizations, the release signal being limited to one of the access levels. Procedure according to Claim 4 , characterized in that the access levels differ with regard to time limitation, preferably at least one being unlimited; and / or the access levels differ in terms of user privileges; and / or the access levels differ with respect to the network addresses of the users, certain network addresses having higher authorizations. Method according to one of the preceding claims, characterized in that an override mode is provided which bypasses the semaphore (6), preferably limited to local access to the respective wind energy installation (1). Method according to one of the preceding claims, characterized in that when remote access to the wind energy installation (1) is available, local access to the respective wind energy installation is blocked. Procedure according to Claim 6 or 7 , characterized in that a communication link to the control room (2) is monitored, the local access being released only after a security period. Method according to one of the preceding claims, characterized in that a communication link to the control room (2) is secured is, preferably by restricting it to a predefined range of network addresses, certificate-based authentication and / or multi-factor authentication. Method according to one of the preceding claims, characterized in that a communication connection to the control room (2) is monitored and, in the event of a fault, only local access to the respective wind energy installation (1) is enabled. Method according to one of the preceding claims, characterized in that a further semaphore (6 ') is provided which can optionally be activated and, when activated, ignores queries from external users (49) from an address area other than that of the control room (2), specifically preferably by blocking the IP connection. Method according to one of the preceding claims, characterized in that in the case of a plurality of wind energy plants (1) there are sub-control rooms (2 ') which take over the function of the control room (2) for sending the release signal for each group of wind energy plants, and / or the control room (2) itself has no write access to the wind turbine (1). Wind energy plant with a wind rotor (12), a generator (13) driven by it, with a converter (14) for generating electrical energy, and an operating control (2) which is provided with an interface for remote access via a data network comprising read accesses for reading out data of the wind energy installation and write accesses for setting data of the wind energy installation , characterized in that an access control (5) cooperating with the interface for remote access is provided, which is designed to control at least the write accesses by means of a semaphore (6), depending on them Value takes place via a release or blocking of the write accesses, and a request of the semaphore (6) is regulated, namely by means of a release signal from an external control room (2). Group of wind energy plants (1) with a wind rotor (12), a generator (13) driven by it, with a converter (14) for generating electrical energy and an operating control (2) which is provided with an interface for remote access via a data network Read accesses for reading out data of the respective wind energy installation and write accesses for setting data of the respective wind energy installation , characterized in that an access control (5) cooperating with the respective interface for remote access is provided, which is designed to at least write accesses by means of a semaphore (6 ) to control, depending on their value via a release or blocking of the write access, and wherein requesting the semaphore (6) is regulated, namely by means of a release signal from an external control room (2). Device after Claim 13 or 14 , characterized in that the access control (5) according to one of the Claims 2 to 12th is trained.

Images