WO2014202079A1

WO2014202079A1 - A wind turbine control system

Info

Publication number: WO2014202079A1
Application number: PCT/DK2013/050207
Authority: WO
Inventors: Peter Fogh Odgaard
Original assignee: Kk Wind Solutions A/S
Priority date: 2013-06-21
Filing date: 2013-06-21
Publication date: 2014-12-24

Abstract

The invention relates to a wind turbine control system (WTCS) for controlling a wind turbine (WT), said wind turbine control system (WTCS) comprising a wind turbine controller (WTC) configured for controlling said wind turbine (WT) within a plurality of operation limits (OL).The Wind turbine control system (WTCS) furthermore comprises a protection controller arrangement (PCA) comprising a wind turbine model (WTM) representing at least a part of said wind turbine (WT), a second control software (SCSW) being substantially identical to at least a part of the first control software (FCSW) of said wind turbine controller (WTC), anda wind turbine simulation arrangement (WTSA). The wind turbine simulation arrangement is configured for simulating the operation of said wind turbine (WT) by means of said wind turbine model (WTM) and said second control software (SCSW), based on at least a part of the data input (DI). The wind turbine control system (WTCS) furthermore comprises evaluation means (EM) configured for evaluating a simulation result (SR) of said simulation by means of a set of protective operation limits (POL), so as to estimate if one or more of said protective operation limits (POL) are likely to be violated. The wind turbine control system (WTCS) is configured for adapting the operation of said wind turbine (WT) so as to prevent said one or more protective operation limits (POL) from being violated. The invention moreover relates to a wind turbine and a method of controlling a wind turbine.

Description

A WIND TURBINE CONTROL SYSTEM

Technical field

The present invention relates to a wind turbine control system, a method of controlling a wind turbine, use of a wind turbine control system, and to a wind turbine.

Background art

New types and variants of wind turbines continue to turn up on the market. Additionally, the setup of different wind turbines may vary significantly, and there is a tendency towards that at least some wind turbine manufacturers uses more and more third party components and applications in their products.

Additionally, the customer and/or operator demands to the setup and operation of wind turbines on the market may vary significantly. These situations create needs for flexible and at the same time safe and reliable wind turbine control systems. For example, a wind turbine may be exposed to various conditions that are hard to predict. This problem may be aggravated by the fact that more and more wind turbines are manufactured by components originating from a plurality of different third parties. For example, different third parties may provide bearing solutions, tower, wind turbine blades, wind turbine control system or at least a part of it such as hardware and/or software and so on. Hence, the resulting wind turbines collected by components/solutions from such third parties may not have been heavily tested in details.

The present invention provides a solution to the above mentioned issues. Brief description of the invention

The invention relates to a wind turbine control system for controlling a wind turbine, said wind turbine control system comprising: a wind turbine controller configured for controlling said wind turbine within a plurality of operation limits, said wind turbine controller comprising a data processing arrangement comprising a first control software for controlling at least a part of said wind turbine by processing data input so as to provide one or more data outputs to control said part of said wind turbine,

wherein said wind turbine control system furthermore comprises a protection controller arrangement comprising:

a wind turbine model representing at least a part of said wind turbine, a second control software being substantially identical to at least a part of the first control software of said wind turbine controller, and

a wind turbine simulation arrangement,

wherein said wind turbine simulation arrangement is configured for simulating the operation of said wind turbine by means of said wind turbine model and said second control software, based on at least a part of said data input, wherein said wind turbine control system furthermore comprises evaluation means configured for evaluating a simulation result of said simulation by means of a set of protective operation limits, so as to estimate if one or more of said protective operation limits are likely to be violated, and wherein said wind turbine control system is configured for adapting the operation of said wind turbine so as to prevent said one or more protective operation limits from being violated. The present invention provides several advantages in this relation. For example, the operation of the simulation results in a "on the fly" simulation based on the actual input to the wind turbine controller during power production. Hence a more safe prediction of the estimated forthcoming conditions of the wind turbine may be achieved. The data input to the protection controller arrangement may in aspects of the invention be considered as real time data, and reflects conditions of the wind turbine at the time of the simulation. This may e.g. be facilitated by collecting data input for the simulation while the wind turbine produces power, and "freezing" the values of these during the simulation. Alternatively, the data input for the simulation by means of the protection controller arrangement may be continuously updated over time during the simulation. This may in aspects be combined by adapting the data input, e.g. with a predetermined deviation from the actual data input as described in more details below.

A flexible control system for a wind turbine may moreover be provided by the present invention in that the operator of the wind turbine is allowed freedom to optimize the first control software and/or operation limits knowing that the consequences of the optimizations are evaluated and compared to the protective operation limits. This provides a guarantee and safety that the optimizations will not damage the wind turbine due to e.g. erroneous settings. Additionally, it gives the possibility of more reliably estimating and simulating e.g. input values that may occur in the near future since the actual input may be used as a reference on the go so that the simulation arrangement may estimate a resulting likely condition of the wind turbine. Especially due to that one or more data inputs for use in said simulation may be determined based on the actual data input for the wind turbine controller during the present circumstances that appears in/at the wind turbine. This facilitates a more reliable simulation that takes the actual state and conditions of the wind turbine into consideration during power production by the wind turbine. For example, the input may comprise that the wind speed at the wind turbine is presently measured to XX m/s, and the wind direction is measured to be YY° compared to a predefined reference. The simulation arrangement may then use these values for estimating e.g. a 5% higher wind speed than the measured wind speed, and/or a 10% change in the wind direction. Hence the result of the simulation indicates how the wind turbine would react with these conditions which are likely to come. The result may advantageously also be based on an actual operation, condition and/or setup of the wind turbine such as present measured or estimated conditions of the wind turbine. For example measured torque values such as e.g. a measured main shaft torque and/or blade root torque, measured vibration values such as measured tower vibrations and/or blade vibrations and/or the like. So hence the forecast is made more reliable. In any case, the result of the simulation is evaluated by the evaluation means and if necessary the wind turbine control is adapted if e.g. a protective operation limits is violated.

The protection controller arrangement is preferably located in the wind turbine in aspects of the invention. However, it might also be located at a location external to the wind turbine, e.g. at a server such as web server or the like.

A purpose of the present invention may among others be to ensure that e.g. a less experienced operator or another person does not make any changes in control software, e.g. during optimisation of the power production, which may result in that one or more design limits are violated. This may be done onsite by simulation of the updated / changed control software before this control software is allowed to control the wind turbine. As described in this document this may be done by simulating the updated control software by means of a wind turbine model and inputs from the real/actual wind turbine during power production. The simulation result is then evaluated by e.g. correlating the result(s) with a set of predefined protective operation limits which are preferably defined by an experienced control system designer, e.g. based on the mechanical / electrical design of the wind turbine.

Also, wind turbine manufacturers who mainly only uses their own solutions over time provides new wind turbines and variations of such to the market which has not been tested over a larger time span compared to the lifetime of the turbine, and such entities may also updates their existing solutions by updating hardware and/or software over time. Also such entities may have an advantage of the present invention. As mentioned the wind turbine control system may change control strategy (also referred to as adapt control or simply by taking action) in the event that protective operation limits is expected or simulated to be violated. This is preferably done either by predefined algorithm(s) or rule(s) which initiates operations of data processors(s) e.g. of the wind turbine controller or the protection control arrangement. Such operations may e.g. be changing at least part of the control software code, change parameters or any type of operation limits, stop the wind turbine, send alarm or request for maintenance or software update etc.

The wind turbine may be exposed to various failures that are hard, if not impossible to foresee, e.g. in that the wind turbine control may be amended over time due to software updates or other events. For example, an introductory testing of a wind turbine may seem acceptable. But at a later time, an operator adjusts an operation limit or some of the software of the wind turbine, and this may cause that when certain criteria are complied with, the wind turbine may be exposed to influences that the wind turbine is not designed for. For example, an operation limit may be set erroneously so that the wind turbine may be exposed to forces that it is not designed for in that the wind turbine may operate according to this operation limit. Alternatively, different operation limits may be considered as individually acceptable, but the first control software may however be adapted to operate erroneously so that the resulting operation may actually result in that the wind turbine is exposed to influences that the wind turbine is not designed to withstand. Moreover, different operation limits may be considered as individually acceptable, but given the complexity and vast amount of control applications that a modern wind turbine may comprise, mutual influences of the different control applications may result in that the wind turbine may be exposed to forces that it is not designed for. Such issues may however be remedied by the present invention in that the simulation and the protective control limits facilitates an "autonomous" surveillance which takes the present conditions of the wind turbine into consideration.

In preferred aspects of the invention, said wind turbine model represents a part of said wind turbine to be controlled by said first control software. For example, the first control software may comprise a control application for controlling the pitch angle of the wind turbine blades. In this example, the wind turbine model preferably comprises at least a model of the components of wind turbine which may be subjected to the result of the pitching. For example a model of the wind turbine tower so as to determine tower vibrations and/or loads that may be generated as a result of the pitching, a model of the wind turbine blades so as to determine blade vibrations and/or loads that the blades may be subjected to as a result of the pitching, a model of the main shaft of the wind turbine to determine the loads acting on the shaft and/or the generator as a result of the pitching and/or the like.

Also, in preferred aspects of the invention, said simulation is configured for operating simultaneously with the operation of said wind turbine controller. According to preferred aspects of the invention, the simulation is conducted at the same time as the actual operation of the wind turbine when the wind turbine produces electric power. Thus, during power production by said wind turbine, the wind turbine may be monitored based on the simulation. Hence, situations caused by e.g. erroneous and/or critical operation limits, which under certain conditions during operation may be critical to the wind turbine e.g. in relation to mechanical design, may be handled efficiently and e.g. earlier so that the wind turbine is not, or is only in a limited way exposed to e.g. the consequence of the erroneous and/or critical parameter settings. Also, situations where the first control software suddenly performs some actions that may cause damages within a short time only when a series of conditions are fulfilled may be discovered and prevented efficiently. For example, if a first control software that seems to be approvable, but which is not sufficiently tested is used, such software may cause unintended violations that are hard to predict. This may be prevented in aspects of the invention due to the simulation during power production. In aspects of the invention, a simulation may be initiated when predetermined criteria are complied with. For example, if a value of a measured parameter is above (or below) a predefined value such as e.g. a measured torque value, a measured vibration value or the like is above a predefined value. In the same way, a simulation may be initiated if an operator of the wind turbine is changing a parameter or part of the control software above or below a predetermined trigger value.

In advantageous aspects of the present invention, one or more simulation data inputs for use in said simulation are configured so as to deviate with a predefined amount such as a predetermined percentage from the corresponding data input provided to said wind turbine controller.

Hence, a well-controlled simulation may be facilitated where the simulation is based on the actual conditions of the wind turbine so that an even more reliable estimation of future conditions that the wind turbine may be exposed to. In aspects of the invention it may be a predefined amount above or below a specific data input value. For example if an input value for the wind turbine controller is a temperature value of X°C, the deviation may be set to X°C+k, where k is a constant value added to the actual temperature. The deviation may also be an array of values so as to simulate a scenario which based on the data input is likely to occur. For example an estimated wind speed and/or wind direction scenario that is based on e.g. collected weather forecast and/or a predefined scenarios stored at a data storage.

In further advantageous aspects of the present invention, one or more simulation data inputs for use in said simulation are identical to the data input used by said data processing arrangement so as to control said wind turbine.

This may increase the validity of the simulation in that the specific conditions of the wind turbine and/or the ambient conditions that the wind turbine is subjected to, can be used. For example, the conditions of the generator of the wind turbine such as estimated or measured shaft rotation speed(s), generator temperature, output voltage, current values etc. may be used as input for the simulation. These, together with e.g. a model of the generator of the wind turbine may be used to establish a more valid simulation for the estimation of violation of protective operation limits. For example the result(s) of a simulated pitching by adjusting the pitch angle based on the actual pitch angle of the blade. The reason for this may be that conditions of the generator may influent on the pitching of the blade due to e.g. vibrations and vice versa.

In advantageous aspects of the present invention, said first control software may comprise a plurality of individual control applications for handling different functionalities of said wind turbine, and said wind turbine simulation arrangement may be configured for simulating at least one of said plurality of control applications.

The individual control applications may be set to handle individual tasks. For example, the wind turbine controller WTC may comprise a kind of modular control system which is built by means of "building blocks" comprising different

functionalities. E.g. a pitch controller may be a first individual control application, a power stack controller for controlling a converter of the wind turbine may be a second individual control application and so on. Such control application solutions may be especially advantageous for simulation in that the control software of such applications may be well defined and implemented so as to facilitate an easy duplication and establish the necessary interfaces for the simulation. Furthermore it also underlines the flexibility of the protective control arrangement of the wind turbine control system in that only the relevant blocks of application software needs to be simulated and evaluated decreasing the resources needed for developing, operating and updating the protective control arrangement. In advantageous aspects of the invention, the individual control applications may comprise an individual control application for controlling the pitch angle of wind turbine blades of said wind turbine. Moreover, in advantageous aspects of the invention, said individual control applications may comprise an individual control application for operating a converter of said wind turbine.

In preferred aspects of the present invention, said adaption of the operation of said wind turbine comprises that said wind turbine control system shifts to operating at least a part of said wind turbine by means of a third control software.

Hence, by shifting to the third control software, which is a more conservative or at least a well-tested software solution, errors due to the design/layout of the first control software should be handled. Such third control software is preferably implemented in the wind turbine controller before optimising of the wind turbine takes place, typically before commercial operation of the wind turbine.

In advantageous aspects of the invention, said third control software provides a control facility corresponding to the functionality of at least a part of said first control software.

For example, if the first control software is a pitch control software facility and this is used for the simulation, the third control software preferably comprises a pitch control facility that should be able to substitute the pitch controlling provided by the first control software. The third control software may in aspects of the invention comprise additional control functionalities compared to the simulated control software. So even if a pitching application is simulated, the third control software may, beyond facilitating pitch control, also comprise e.g. power/speed control, yaw control, and/or the like. This may be advantageous in that the cause of a simulated violation may extend to other parts of the simulated control system, and hence, to assure a more safe control, it may be advantageous that the third control software may comprise additional control functionalities compared to the simulated control software. In advantageous aspects of the invention, said estimation regarding if one or more of said protective operation limits are to be violated is facilitated by means of a correlation of said simulation result and said protective operation limits.

This facilitates an advantageous and reliable way of evaluating the result(s) of the simulation.

In aspects of the invention, said plurality of protective operation limits may be considered to be violated if said simulation result deviates with a predetermined value such as a predetermined percentage from said protective operation limits For example, if a maximum rated load limit for e.g. a blade is X [kN], violation of this load limit is considered as taking place if the simulated load limit exceeded X. Alternatively if the protective operation limit is defined as 5% blow X, violation of the load limit is considered as taking place if the simulated load limit exceed X-5%. In aspects of the invention, said one or more protective operation limits and/or operation limits are predefined operation limits.

The operation limits my e.g. have been set before putting the wind turbine into operation or even before the wind turbine component is provided to a manufacturer, if it is a third party solution.

In advantageous aspects, the above mentioned third control software may provide a control at least corresponding to a control provided by the simulated first control software of said wind turbine controller, and said wind turbine control system may be configured for shifting from operating according to the simulated part of said first control software to operate according to a third control software if said one or more protective operation limits, based on said simulation result, are likely to be violated.

It should be noted that in aspects, if a protective operation limit is violated not only the software application in which the violation origins is taken over by the third control software but the entire control of the wind turbine may be taking over by the third control software.

In advantageous aspects of the present invention, said wind turbine control system may be configured for changing said operation limits by means of a set of secure operation limits if said protective operation limits are likely to be violated according to said simulation.

The operation limits used by the first control software may for example be set erroneously compared to the actual setup of the wind turbine. For example a maximum (max) generator temperature may not fit the rated temperature of the generator used in the wind turbine or the like. However, it should be possible to estimate a lower common border representing a conservative temperature limit that the most generators used for wind turbines should be able to handle. Hence, if the operation limit for the generator temperature is set to high, and the system find that a protective operation parameter is violated, the conservative temperature limit may be used instead i.e. the protective control arrangement replaces such parameter with a predetermined parameter. In aspects of the present invention, said first control software of said a wind turbine controller and/or said operation limits is/are configurable by a first entity at a first lower safety level, and wherein said third control software and/or said secure operation limits and/or said protective operation limits is/are configurable by a second entity at a second higher safety level. Hence, more freedom to change and/or optimise control software may be provided to a person with expert skills i.e. an entity at a second higher safety level. A more limited freedom may be provided to a person with service skills i.e. an entity at a first lower level. This is in order to prohibit changes which may lead to damaging the wind turbine. So the first entity is not able to configure the protective operation limits

In aspects of the present invention, said third control software and/or said secure operation limits is/are conservative when compared to said first control software and/or said operation limits.

The third control software and/or said secure operation limits hence facilitates a less aggressive control of the wind turbine so that the power output of the wind turbine may e.g. be reduced compared to the power output with the first control software and/or the operation limits, but as a result, it is assured that design limits are not violated, and it is avoided that the wind turbine is shut down so that it produces no power at all. So in aspects of the invention, third control software and/or said secure operation limits may reduce the power output from the wind turbine when used.

In preferred aspects, said wind turbine model comprises a model of one or more wind turbine components of said wind turbine. For example, the model may comprise one or more transfer functions representing the respective component(s) of said wind turbine. The transfer function(s) may provide an adequate estimate of how a component or components of the wind turbine would react based on different data inputs.

In further aspects of the invention, said wind turbine model may comprises a model of a composition of two or more wind turbine components of said wind turbine. Such a model of a composition of two or more wind turbine components may for example comprise a resulting transfer function or the like of the drive train comprising gear and generator. In advantageous aspects of the invention, the data input for the protective control arrangement is updated during simulation by means of said protective control arrangement (PCA) and/or power production by the wind turbine WT.

Hence, the simulation result will be based on updated data reflecting the conditions of the wind turbine during operation to produce power. For example, if the simulation performed by means of the protective control arrangement is an on-going simulation that is conducted with predetermined time intervals and/or continuously without intermediate time delays, the data input will hence be updated and therefore the simulation result will be based on an updated set of data compared to a previous simulation result.

The invention moreover relates to a wind turbine with a wind turbine control system according to any of claims 1-19. Such wind turbine may comprise components and/or solutions such as a plurality of components combined in one system e.g. a pitch system wherein the components and/or solutions are provided by a plurality of different third parties.

Also, the invention relates to a method of controlling a wind turbine by means of a wind turbine control system, said method comprising the steps of:

controlling at least a part of said wind turbine within a plurality of operation limits by means of a first control software, which first control software processes data input so as to provide one or more data outputs to control said part of said wind turbine, simulating the operation of said wind turbine by means of a protection controller arrangement comprising:

a wind turbine simulation arrangement, wherein said simulation is furthermore based on at least a part of said data input provided to said first control software, evaluating a simulation result of said simulation by means of a set of protective operation limits so as to estimate if one or more of said protective operation limits are likely to be violated, and adapting the operation of said wind turbine so as to prevent said one or more protective operation limits from being violated.

In aspects of the invention, the method of controlling a wind turbine, is facilitated by means of a wind turbine control system according to one or more of claims 1-19.

The invention moreover relates to use of a wind turbine control system according to any of claims 1-19 and/or a method of controlling a wind turbine according to claim 21 or 22 for controlling a wind turbine during power production by means of said wind turbine.

Also, the invention relates to a wind turbine being configured for operating according to the method of claim 21 or 22.

It is generally understood that the wind turbine control system of any of the claims of this application may be utilised and implemented in relation to methods and uses according to the present invention to provide further aspects of the invention. For example, the use of the third control software and/or secure operation limits, the access restrictions relating to the protective operation limits and the third control software and/or secure operation limits may be implemented in methods and uses to provide further aspects of the invention.

Figures

The invention will be explained in further detail below with reference to the figures of which: : illustrates an electrical power generating system in form of a wind turbine according to embodiments of the invention,

: illustrates an embodiment of a wind turbine control system according to embodiments of the invention, fig. 3 : illustrates a further embodiment of a wind turbine control system according to embodiments of the invention,

: illustrates the operation of a wind turbine control system according to embodiments of the invention,

: illustrates an embodiment of preventing a protective operation limit from being violated,

: illustrates a further embodiment of preventing a protective operation limit from being violated,

. 7a-7c: illustrates a possible control scenario according to embodiments of the invention, and

: illustrates embodiments of the principle of utilizing a plurality of individual control applications. Detailed description of the invention

Fig. 1 illustrates an electrical power generating system in form of a wind turbine WT according to an embodiment of the invention. The wind turbine WT comprises a plurality of wind turbine components of which some such as tower TW, a nacelle NC, a hub HU and two or more wind turbine blades WTB are illustrated in fig. 1. The blades WTB of the wind turbine WT are rotatable mounted on the hub HU, together with which they are referred to as the rotor. The rotation of a blade WTB along its longitudinal axial is referred to as pitching and may be controlled by a pitch arrangement PA and pitch controller PC.

The wind turbine WT moreover comprises a power generator, and in some embodiments preferably also a gear arrangement, and a converter arrangement.

These wind turbine components as well as others are however not illustrated. In a typical wind turbine the rotor is driving a generator which converts the kinetic energy obtained from the wind by the rotor to electric energy which via a converter is fed to the utility grid

The wind turbine WT furthermore comprises a wind turbine control system WTCS configured for controlling the wind turbine WT.

Fig. 2 illustrates a wind turbine control system WTCS according to embodiments of the invention. The wind turbine control system WTCS comprises a wind turbine controller WTC configured for controlling the wind turbine WT. This control is performed so as to keep the wind turbine WT within a plurality of operation limits OL. The wind turbine controller WTC comprises a data processing arrangement DPA comprising a first control software FCSW for controlling at least a part of the wind turbine WT. This is done by processing data input DI thereby providing one or more data outputs OP for controlling the part of the wind turbine WT.

The operation limits OL are preferably operation limits OL that may be accessed and adjusted/set by e.g. an owner, operator, a manufacturer, etc. of the wind turbine WT. The same may be the case with regard to at least a part of the first control software FCSW where the operator may be able to adjust at least a part of the first control software FCSW. The first control software FCSW comprises a set of rules/ algorithms also referred to as control software that is used to control the wind turbine WT. Typically this is accessed to optimise the power production of the wind turbine. For example, the control software may comprise software code written in e.g. a high level programming language such as C++ or C#, and comprise a plurality of classes, functions and/or the like. The input to the control software may be from sensors, meters and the like of the wind turbine WT and the operation limits OL. The operation limits OL may be adapted to the specific wind turbine WT so as to reflect the configuration of the wind turbine WT. The operation limits OL may e.g. comprise limits relating to:

• Max. (and/or min.) allowed temperature values that components such as the generator, gear, converter and/or the like is/are allowed to be subjected to.

• Max. vibration values that components such as the generator, gear, main shaft, tower, wind turbine blades WTB and/or the like is/are allowed to be subjected to.

• Max. load values. As an example, the wind turbine blades WTB, main shaft, generator, tower and/or the like are often rated to be able to withstand a certain load. If this load is exceeded safety may not be assured, and/or an increased risk of damaging one or more wind turbine components is increased.

• Electric operation limits such as power, current and/or voltage limits. These may e.g. include limits relating to how much electric power the generator and/or converter are allowed to provide (or capable of handling) including handling active/reactive power. It may comprise voltage related limits such as maximum rated voltages, limits relating to how to convert voltage from the input side to the output side of the converter and/or the like. It may comprise limits for rated electric current of a component such as the generator, a converter, a cable, a switch gear and/or the like. The electric operation limits may also comprise rated values of other components of the wind turbine WT such as cables for establishing an electric connection to the utility grid to provide power to the grid from the wind turbine, it may comprise limits defined by a switch gear of the wind turbine WT and/or the like.

• Max (and/or min.) speed values such as generator speed and rotor speed limits • Any other operation limits OL relevant for controlling a wind turbine WT.

Hence during normal operation of the wind turbine the wind turbine is controlled based on these operation limits OL to ensure maximal or optimal output of the wind turbine in its entire lifetime.

Often the operation limits OL may be substantially identical to a set of the protective operation limits POL which are described in more details below. The protective operation limits POL may be determined based on the design of the wind turbine WT. When designing a wind turbine WT the designer calculates or defines the mechanical and electrical construction so as to comply with a set of design limits. Hence if a design limit is violated this may result in serious damages such as damage on tower, electrical system, foundation, etc. These may be extremely difficult and expensive to fix if they are even possible to fix. In order to ensure that the design limits are not violated, protective operation limits POL may according to the invention be used to assure that the wind turbine is not overloaded as will be described below.

During normal operation of the wind turbine the operation limits OL may be defined as a trade-off between maximum produced power and as long as possible lifetime of the wind turbine. The operation limits OL and protective operation limits POL may in embodiments of the invention be substantially identical and if not, the operation limits OL should preferably be set to be conservative (also referred to as less aggressive) compared to the protective operation limits POL.. As long as the wind turbine is controlled within the operation limits OL the wind turbine WT is operated safely with regard to violation of design limits.

However, if an operation limit OL is erroneously set too high to a value or the result of a plurality of operation limits resulting in that the wind turbine can be exposed to too high mechanical forces and/or electrical exposures, the protective operation limits POL may in embodiments of the invention help to detect this error before severe damage to the wind turbine WT occur in that the simulation is preferably based on the protective operation limits POL instead of the operation limits that the wind turbine operates according to. The wind turbine control system WTCS may be designed based on operation limits OL and/or protective operation limits POL as mentioned above to provide a wind turbine WT having components that are compatible and dimensioned in relation to each other and costumer demands. Also, the operation limits OL are used during operation of the wind turbine WT where the wind turbine WT is operated within the operation limits OL in order to secure safe operation and preferably also to be able to meet an expected end of life time of the wind turbine WT of maybe 20-30 years.

Additionally, the wind turbine control system WTCS comprises a protection controller arrangement PCA. This protection controller arrangement PCA comprises a wind turbine model WTM representing at least a part of the wind turbine WT. Also, the protection controller arrangement PCA comprises a second control software SCSW which is identical to at least a part of the first control software FCSW of the wind turbine controller WTC. Moreover, the protection controller arrangement PCA comprises a wind turbine simulation arrangement WTSA.

The wind turbine simulation arrangement WTSA is configured so as to simulate the operation of the wind turbine WT by means of the wind turbine model WTM and the second control software SCSW, based on at least a part of the data input DI provided to the data processing arrangement DPA for the wind turbine controller WTC.

Simulation data input DI from the wind turbine WT for use during the simulation, may be changed so that second control software SCSW is simulated with a wind speed of maybe a range starting from a real-time data input DI representing the actual wind speed of e.g. lOm/s to 15m/s. This range of wind speed is then simulated based on the second control software SCSW (and preferably also the actual settings of the operation limits OL) and the wind turbine model WTM may hence comprise one or more models of the wind turbine that may be exposed to such wind speed. The simulation result SR may be data relating to the operation limits OL or protective operation limits POL which may be relevant in relation to simulations of wind speed. The simulation result SR may indicate if protective operation limits POL of the data processing arrangement DPA or even design limits are in risk of being violated.

For example, the simulated wind speed may influent on the loads acting on the tower. So the simulation result SR may comprise simulated tower loads, and the relevant protective operation limits POL may hence e.g. relate to maximum allowable tower loads.

Simulation data input DI for the simulation may hence comprise data input corresponding to the data input for the wind turbine controller WTC, and some of this data input may moreover in embodiments be amended by the protective control arrangement PC A for use in the simulation. The simulation data input may hence, in embodiments, be provided to the second control software SCSW from the wind turbine simulation arrangement WTSA (e.g. as illustrated where the data input is provided to the simulation arrangement which then provides simulation data input to the second control software based on this data input), but it is understood that at least a part of the data input may also in embodiments be provided to the second control software SCSW directly.

The second control software SCSW may be identical to the first control software FCSW or may be change e.g. by including only part of the first control software FCSW.

It is preferred that the wind turbine model WTM comprises a model representing the characteristics of a wind turbine component. For this purpose, the wind turbine model may comprise one or more models describing the relation between a set of inputs and output, given e.g. a last state of a model. The model(s) may hence in embodiments of the invention comprise transfer functions / system functions describing the system and/or any other suitable models. These models are mathematical functions relating the output or response of the component(s) of the wind turbine to an input, and hence the transfer function may be considered as a representation of the input/output behavior of a WT component or a collection of WT components.

It is generally understood that the protection controller arrangement PCA may be implemented in a plurality of different ways within the scope of the present invention. The wind turbine model WTM may in embodiments transmit and/or receive data to and from the wind turbine model(s) to the second control software SCSW as may the wind turbine simulation arrangement. It is also understood that the wind turbine model(s) WTM may be considered as a part of the wind turbine simulation arrangement WTSA. The wind turbine control system WTCS furthermore comprises evaluation means EM configured for evaluating a simulation result SR of the simulation. These evaluation means are preferably a part of the protective control arrangement PCA. This evaluation may be based on a plurality of protective operation limits POL. The evaluation means EM may thus correlate the simulation result SR and suitable protective operation limits POL so as to estimate if one or more of said protective operation limits POL are likely to be violated.

The protective operation limits POL correspond in embodiments of the invention to the operational limits OL used by the data processing arrangement DPA of the wind turbine controller WTC in the sense that they relate to/represent the same parameter. For example, if an operation limit relates to a tower load parameter, a "corresponding" protective operation limits POL may relate to the same tower load parameter all though the settings of the protective operation limits and the operation limit may not necessarily be the same. The protective operation limits POL may also relate to other software related limits such as variables for use in the control software FCSW, SCSW to process the data input DI, including e.g. predefined constant/variables used during calculations, variables which may be automatically influenced by the setting of the operational limits OL and/or the like.

An example of this may be that if the maximum allowable temperature of cooling fluid in the converter is A (i.e. A is a value of an operation limit OL) then the wind turbine WT is controlled so as to keep the temperature of the cooling fluid of the converter below A. Such control may be restricted by one or more variables which are automatically (or manually) set in the control software used to control the wind turbine WT.

If the simulation result SR shows that the protective operation limits POL are likely to be violated in the near future, the wind turbine control system WTCS adapts the operation of the wind turbine WT so as to prevent the one or more protective operation limits POL from being violated as will be described later on below.

With reference to the example above relating to the temperature of cooling fluid in the converter, the wind turbine control system WTCS will adapt the operation of the wind turbine WT if the evaluation means EM finds that the simulated temperature is likely to increase above a protective operation limit.

It is generally understood that the second control software SCSW and/or other parts of the protective control arrangement such as the wind turbine models WTM, simulation arrangement WTSA, evaluation means EM and/or the like may be implemented so as to be operated on the same hardware as the first control software FCSW, i.e. using the same central processing unit, data storage(s) etc. and/or the like. However, in preferred embodiments, the protective control arrangement PCA or at least parts thereof is/are implemented by means of a further data processing arrangement (not illustrated) separate to the data processing arrangement DPA comprising the first control software. This further data processing arrangement my hence comprise one or more central processing units, data storages, input and output modules and/or the like to facilitate the simulation. It is generally understood that in embodiments of the invention, the protective control arrangement PCA and the wind turbine controller WTC may communicate, this is however not illustrated in fig. 2. Such communication may initiate that a third control software TCSW and/or Secure operation limits SOL are used for further operation by the wind turbine WT as described in more details later on. The data communication may e.g. in embodiments comprise that the wind turbine controller is shut down so that the protective control arrangement PCA can take over operation of the wind turbine. Alternatively, it may comprise that the wind turbine controller is instructed to (optionally) shut down the wind turbine, introduce a third control software TCSW as a replacement for the first control software FCSW and/or introduce Secure operation limits SOL as a replacement for the operation limits.

Fig. 3 illustrates that the first control software FCSW according to embodiments of the invention may comprise one or more control applications CAl-CAn for controlling the wind turbine WT. Such control applications CAl-CAn may for example comprise:

• A first control application CA1 to control data collection and/or data logging of the wind turbine WT. For example values of some output parameters controlled by the first control software FCSW, measured values from sensors/meters of the wind turbine WT such as accelerometers for measuring oscillations and/or loads on the wind turbine components, wind speed, wind direction, parameters measured at the utility grid at the location of the wind turbine WT.

• A second control application CA2 for controlling a cooling system of one or more components of the wind turbine WT.

• A third control application CA3 for controlling the pitching of the wind turbine blades WTB based on data input DI.

• A fourth control application CA4 for controlling the generator of the wind turbine WT.

• A n'th control application CAn for controlling the yawing of the nacelle. • Etc.

It is generally understood that the first control software FCSW may comprise a plurality of further control applications and that the above is just examples of such. For example, control applications for controlling gear, converter, heating systems for de-icing purposes, cooling applications, switch gear, and/or the like.

The control applications CAl-CAn together provide a plurality of data outputs OP so as to control the different parts/components of the wind turbine WT. These outputs may comprise, pitch signals to pitching arrangements PA for rotating the blade WTB (or a part of the blade) around it's longitudinal direction, yaw signals to control the angular orientation of the nacelle dependent of e.g. the wind speed and/or direction, control signals to switch gear, converter, generator, cooling applications for cooling parts of the wind turbine, heating systems and/or the like.

It is understood that the control applications CAl-CAn may be distributed into different controllers of the wind turbine WT so as e.g. that a first controller is located in the hub HU and provides e.g. a blade pitch arrangements PA, another is located in the nacelle NC and provides other control functionalities, a third is located at the bottom of the tower TW, e.g. providing control of the converter and/or the like. So in embodiments of the invention, the wind turbine controller WTC may comprise a central controller handing a plurality of the control functionalities CAl-CAn, and/or it may be a controller in the sense that it comprises distributed control units in the wind turbine which collectively controls the wind turbine.

The different control applications CAl-CAn may together be referred to as the control software which operates according to a set of operation limits OL.

In the illustrated embodiment, the third control application CA3 of the first control software FCSW is used for simulation by means of the protection controller arrangement PCA. It should be understood that any of the above mentioned control applications CAl-CAn may be utilised. Hence, the second control software SCSW of the protection controller arrangement PCA comprises only the control application SCA3 substantially similar to the control application CA3 of the first control software FCSW.

It is generally understood that the second control software SCSW moreover may comprise additional software so as to enable operation of the second control software SCSW, in this embodiment the control application SCA3 corresponding to control application CA3. Such additional control software may establish execution, input/output interface making the control application SCA3 compatible with the wind turbine model WTM so as to facilitate the simulation by using the model WTM. Additionally, the underlying software may comprise software that is substantially similar to an underlying software of the first control software which provides "core" features such as interface features to, from and/or between the different control applications CAl-CAn.

Since the third control application CA3, i.e. the pitch controller is utilised for the simulation in this embodiment, the wind turbine model WTM is set up so as to represent at least parts of the wind turbine WT which may be subjected to consequences of the pitching of the blades. For example, the wind turbine model WTM may comprise a model of the tower WTTWM, wind turbine generator WTGM, gear WTGEM, blade(s) WTBM, main shaft and/or the like. It is understood that the wind turbine model WTM may comprise more or less of such models. It is understood that the wind turbine model WTM may also comprise a configuration of models which together constitutes a resulting part of the wind turbine WT. For example, it may be a model of the drive train and/or a rotor of the wind turbine WT and/or other configurations of the wind turbine components.

Hence, the data input DI used for the simulation by means of the protective control arrangement PCA at least receives the data input DI provided to the third control application CA3 of the first control software FCSW. This data input DI may thus be provided to the second control software SCSW, SCA3 of the protective control arrangement PCA directly, and/or to the wind turbine simulation arrangement WTCS where it may be adapted to e.g. deviate with a predefined amount before being supplied to the second control software and/or the wind turbine model.

It is generally understood that the data input DI for the protective control arrangement PCA as disclosed in e.g. figs 2, 3 5 and 6 may be updated a plurality of times, such as continuously, e.g. with a predetermined time interval or the like, during a simulation and power production by the wind turbine WT so as to provide a simulation result SR that is based on updated data from the wind turbine.

It is understood that the other examples as described in relation to e.g. figs. 2, 5 and 6 may also comprise a wind turbine model WTM comprising one or of the models as described above.

The operation of the above setup is described in more details with regard to fig. 4. It is understood that the invention is not limited to the specific example of the pitch control the described wind turbine model and/or the like but that any other suitable setup may be used in other embodiments of the invention.

Fig. 4 illustrates a more detailed view of an embodiment of the simulation and evaluation described in relation to fig. 3. It is generally to be understood that the evaluation means EM also may be referred to as evaluation arrangement. The example is illustrated by means of a flow chart.

Step SI : in step 1, a second control software SCSW identical to a part of the first control software FCSW of the data processing arrangement DPA is established. E.g. by simply copying the part of the first control software FCSW. As mentioned, a pitch control application CA3 of the first control software FCSW is selected for explanatory purposes. The second control software may be automatically initiated by a trigger criteria as described below. In step S2, a wind turbine model (or models) is selected. Due to the selection of the pitch control application CA3, it might be interesting to see the resulting impact acting on a wind turbine blade WTB when pitching it. So the wind turbine model WTM is set so as to at least comprise a model of the wind turbine blade WTB. It is however understood that further models of the wind turbine WT may be necessary so as to facilitate a valid and proper simulation. For example, it might be preferred to implement a wind turbine rotor model so as to incorporate the impact of the angular orientation and the rotation of the wind turbine rotor in the simulation.

It is understood that in embodiments of the invention, the wind turbine model WTM may also include uncertainty models that help to improve the validity of the wind turbine models WTM and hence the overall simulation. Such uncertainty models may comprise "Robust control" which deals with uncertainty in the approach to controller design, H_ infinity methods and/or mu-control methods.

In step S3, data input DI from measuring means and/or other input facilities providing input to the third control application CA3 of the data processing arrangement DPA is collected.

In step S4 a first part of this data input DI is used directly as input for the second control software SCA3. For example, the present load(s) acting on the wind turbine blade(s) WTB to be simulated, vibration data of the blade(s) WTB, the yaw angular of the wind turbine rotor, the rotational speed of the wind turbine rotor, and/or the like.

A second part of the data input DI is however manipulated in step S5. The manipulation may e.g. comprise manipulating a part of the data input DI from the measuring means and/or other input facilities providing input to the first control software FCSW of the data processing arrangement DPA. The manipulation is preferably made in the protective control arrangement PCA and is used to set up a simulation to predict possible, relevant outcomes in the future operation of the wind turbine WT in relation to pitching of the blade WTB.

For example, a data input DI comprising information of the current wind speed measured at (or near) the wind turbine WT may be utilised as a basis for determining a simulation wind speed value or scenario that should be used during simulation of the pitch control SCA3 to simulate the resulting influence on the wind turbine WT. As an example, the measured wind speed may be measured to be 20m/s and a calculated mean wind speed may be determined to be 13 m/s. This input may e.g. be used by the wind turbine simulation arrangement WTSA to establish a likely upcoming scenario: e.g. the measured wind speed increases e.g. 20% of the present wind speed to approx. 24m/s and the mean wind speed over a predetermined period increases e.g. about 10% to approx. 14.5 m/s. So the difference between the max. wind speed and the mean wind speed increases. This input is utilised as simulation data inputs for the second control software SCSW i.e. the pitch control application SCA3 in order to simulate the effect of such increase in wind speed.

In embodiments, the simulation means may automatically utilise weather forecasts so as to determine and provide simulation data inputs and/or to initiate a simulation.

In step S6, the simulation is initiated. Hence, the second control software SCSW (which may comprise only the pitch control application SCA3) is executed with the measured and / or the manipulated data input DI based on the wind turbine model WTM.

The wind turbine model WTM hence acts according to the executed second control software SCSW. Hence, the manipulated increase in wind speed may have an impact on the pitching of the blades, and thus the result of the simulation. The result of the simulation SR may be reflected by the state or value of one or more parameters of the wind turbine model WTM when subjected to the control by the second control software SCSW. For example, from the wind turbine model WTM, when subjected to control from the second control software SCSW, it may be possible to obtain loads and/or vibrations etc. acting on the wind turbine blades WTB. Preferably the second control software SCSW is using the manipulated data input DI and the simulation result SR is then the expected loads and/or vibrations etc. acting on the wind turbine blade WTB.

The simulation result SR may also be used as further input to the wind turbine simulation arrangement WTSA to determine further impacts on the wind turbine WT.

The simulation result SR is in step S7 used by the evaluation means EM so as to determine whether a set of protection operation limits POL are violated or are likely to be violated. The evaluation means EM may hence correlate the protection/protective operation limits POL and the simulation result SR.

If for example, the loads on the root of the blade WTB according to the simulation result SR of the simulation with manipulated data input DI will exceed the corresponding protective operation limit POL, the wind turbine control system WTCS acts accordingly so as to prevent the protective operation limit POL from being violated (step S8). Different embodiments of such actions from the wind turbine control system WTCS is explained in more details below.

If the evaluation means EM finds no protective operation limits POL being violated, a new simulation may be initiated.

It is understood that the simulation at least in steps S3-S7 may be evaluated continuously over time so as to continuously evaluate whether a violation of protective operation limits POL are likely to take place. In embodiments, the simulation may be initiated when predefined criteria(s) are complied with. For example, a trigger criteria such as a weather forcast, a non- critical alarm or another internal state of the wind turbine WT and/or the like may start a simulation as disclosed in e.g. steps S3-S8 or steps S4-S8. Preferably at least the second control software SCSW (SI) and the wind turbine model(s) WTM (S2) are pre-established and ready for receiving input before the trigger criteria is fulfilled.

The system may also comprise different predefined criteria being configured for initiating different simulations so as to simulate different scenarios. For example, a first predefined criterion may initiate a blade pitch simulation, another predefined criteria may initiate a generator temperature simulation, etc.

Further a simulation as described above may be initiated by changed made to the first control software FCSW or change in parameters of the first control software FCSW.

Fig. 5 discloses an embodiment of preventing the protective operation limit POL from being violated i.e. the wind turbine control system WTCS adapts the control of the wind turbine. In this embodiment, the wind turbine control system WTCS comprises a third control software TCSW. This third control software TCSW may be stored in a data storage and is normally not in use as long as the operation by means of the first control software FCSW controls the wind turbine WT within the operation limits OL. An example where the third control software TCSW might take over control of the wind turbine could be if an operator of the wind turbine WT has made one or more changes to the first control software FCSW and a simulation of these changes results in that the evaluation means EM find it likely that e.g. with an increase of wind speed from e.g. 20m/s to 23m/s, one or more protective operation limits POL are violated. The third control software (TCSW) provides a control facility corresponding to the functionality of the simulated part of the first control software FCSW. For example, if the pitching of the blades is simulated, the third control software TCSW may be an alternative pitch controller compared to the pitching facility of the first control software FCSW, and third control software TCSW will facilitate pitching of the blades WTB if set into operation.

Alternatively the third control software TCSW may be a further control system for controlling at least parts of the wind turbine. Hence, if a protective operation limit POL is simulated to be violated in the near future, the protection controller arrangement PC A may exchange substantially the entire control software for operating the wind turbine with the third control software TCSW, although it is only a limited part of the first control software that may result in the violation. It is generally understood that the third control software TCSW will be considered as a conservative control software when compared to the first control software FCSW.

So the wind turbine control system hence adapts the operation of the wind turbine by implementing the third control software instead of the first control software.

Generally, it is understood that the first control software FCSW of said a wind turbine controller WTC is configurable by first entities at a lower safety level, and the third control software TCSW is configurable by second entities at a second higher safety level. The first lower safety level should be understood as persons not having expert knowledge in the specific type of wind turbine or in wind turbines in general whereas the second higher safety level should be understood as persons with expert knowledge.

These first entities will not be able to access the third control software TCSW.

However, the third control software TCSW may be accessible by the second entities which may be a third party providing the wind turbine control system WTCS or at least parts of this such as e.g. parts of the first control software, the wind turbine controlled s) and/or the like. The second entity may also be an expert within the field of the specific setup of the wind turbine control system and/or the hardware used for the wind turbine control system WTCS.

Hence, the third control software may be considered as a conservative, safe backup control solution if the first control software FCSW is not properly designed, amended and/or implemented at the wind turbine WT.

If the protective control arrangement PCA of the wind turbine control system WTCS estimates that the protective operation limits POL (which preferably neither are accessible by the first entities) may be violated within a short time, the wind turbine control system WTCS adapts control e.g. by switching to control at least a part of the wind turbine WT by using the third control software instead of the first control software. This may be achieved by replacing the part of the first control software FCSW with the third control software TCSW in the data processing arrangement DP A. Alternatively, it may comprise initiating a control of the relevant part of the wind turbine WT by means of a further control data processing arrangement (not illustrated) configured for executing the third control software TCSW. The further control data processing arrangement may in embodiments be a part of a further essentially redundant wind turbine controller (not illustrated) for receiving and processing the data inputs DI and providing output data OP and thereby controlling the wind turbine.

The third control software TCSW may e.g. comprise control applications CAl-CAn providing a control facility corresponding at least to a control facility of the simulated control software FCSW of the wind turbine controller WTC. For example, if a pitch control software is simulated and is to be exchanged due to a violation, the third control software TCSW may at least comprise pitch control software. Although, it is understood that the third control software TCSW may also comprise further software such as e.g. monitoring software, generator control and converter control software, yaw control software etc.

The wind turbine control system WTCS is thus configured for shifting from operating according to the first control software FCSW to operate according to said third control software TCSW if the one or more protective operation limits POL, based on the simulation result SR, are likely to be violated. In this situation the third control software may be loaded to the wind turbine controller WTC or the wind turbine controller WTC may execute the third control software TCSW from the location e.g. at the data storage.

It should be mentioned that an alternative to shifting to a third control software TCSW is automatically replacing relevant parameters of the first control software FCSW. Such replaceable parameters (also referred to as conservative operation limits SOL) may be located in a data base and if the evaluation means EM finds that something is or are going to be wrong the protective control arrangement PCA facilitates replacing one or more relevant parameters based on information from the evaluation means EM. This will be described in further details below. The switching to the third control software may be done automatically and/or an alarm may be provided/set and the wind turbine is stopped or derated to comply with the operation limits OL. Later on a service person may fix the problems with the first control software and again let the first controls software control the wind turbine. If this is not possible the service person may switch the control of the wind turbine to the third control software.

Fig. 6 illustrates another embodiment of preventing the protective operation limit POL from being violated. In this embodiment, the wind turbine control system WTCS stores a set of secure operation limits SOLl-SOLn. These may also be stored at other locations in other embodiments. These secure operation limits SOLl-SOLn are accessible by second entities in a way corresponding to the restricted access control of the third control software TCSW as disclosed above.

Hence, if a protective operation limit POL is in danger of being violated according to the simulation, the operation limits OL of the data processing arrangement DPA which is used by the first control software FCSW are replaced by the secure, conservative operation limits SOL, e.g. by overwriting the values of the operation limits OL that the first control software FCSW has used previously. Thus, the first control software FCSW is the same as before the replacement, but the operation limits OL that the first control software FCSW uses have been changed into to more conservative and secure operation limits SOL.

So the wind turbine control system WTCS may hence adapt the operation of the wind turbine WT by implementing the secure operation limits SOL into the first control software FCSW.

The replacement by the third control software TCSW as disclosed in relation to fig. 5 and/or the operation limits OL as disclosed in relation to fig. 6 may be performed after a temporary shutdown of the wind turbine WT or during power production of the wind turbine dependent on the circumstances.

Also, it is understood that both the exchange of operation limits and control software as disclosed with regard to e.g. figs. 5 and 6 above may be used in further aspects of the invention.

As an alternative to figure 5 and 6, if protective operation limits POL is/are expected to be violated, also simple parameter replacement, alarms to operator, etc. may be initiated alone or in combination with the above.

Fig. 7a illustrates an example of the difference between protective operation limits POL, operation limits OL and secure operation limits SOL as a function of time. The example concerns output power of a IMW wind turbine. Further the example may be change of operation limits OL, but may also have concerned exchange of first control software FCSW with a third control software TCSW. On fig 7a the rated power of the IMW wind turbine is IMW and thereby the normal operation limit(s) OL (including parameters etc.) (dashed, horizontal line) will limit power production of the wind turbine WT to IMW when the wind speed allows so. In this example the protective operation limit POL (Dash/doted horizontal line) is 1. IMW in that it is assumed that the wind turbine could be overloaded for a short period of time to this value. It should be noted that the operation limit OL and the protective operation limit POL in other examples could be identical, in this example they would hence be IMW. Further in this example the secure operation limit SOL (dotted line) is 0,8MW. This allows the wind turbine control system WTCS to derate the power production if necessary by operating according to the secure operation limit SOL.

Fig. 7b illustrates a simulation result SR of the output of the wind turbine obtained by means of the protection controller arrangement PCA, operation limit OL and a predetermined protective operation limit POL. The search result SR is obtained as described above by means of a simulation based on the first control software, data input from the wind turbine and a simulation arrangement/means. To prevent that the protective operation limit(s) POL are violated, the evaluation means EM, as described earlier, monitors if the simulation result SR violates the protective operation limit POL. In this example the simulated power production is estimated to exceed the protective operation limit POL at a time somewhere after time Tl more precise at time T2. This may be due to increase in wind speed, component failure, etc.

. 7c illustrates the output power of the wind turbine WT as a function of time. Now, as illustrated in figs. 7a-7c, until the time Tl, the wind turbine control system WTCS operates the wind turbine WT by means of the operation limits OL. During this, the protective control arrangement PCA simulates a part of the wind turbine WT as described earlier, so as to predict whether the present circumstances, which may vary significantly over time due to a plurality of reasons, may cause the protective operation limit POL to be violated in the near future. Illustrated is a situation where the evaluation means EM estimates that the protective operation limit POL is likely to be violated within a short time after time Tl (the protected operation limit is actually exceeded at the time T2). It is understood that the simulation arrangement SA may not necessarily predict when a violation will happen, but it may predict that it is likely that it will happen. So the simulation result SR indicates a likely occurrence or condition in the near future i.e. from Tl .

Now, at the time Tl (i.e. before the estimated occurrence of the violation of the protective operation limit POL), the wind turbine control system WTCS initiates an operation to change the operation limits OL (e.g. by changing values of parameter or variables, etc.) used by the first control software FCSW with the secure, conservative operation limits SOL. This exchange is initiated because the simulation as described above indicates that the output power of the wind turbine WT is going to exceed the protective operation limit POL. This is in the presented example achieved by temporarily shutting down the wind turbine WT, exchanging the operation limits, and then starting up the wind turbine again shortly after. Alternatively it may be done while the wind turbine WT is producing power. It should be mentioned that the exchange of operation limits OL (or software code) may preferably done first when it has been observed that the circumstances resulted in the simulated exceeding of the protective operation limits POL are observed to happen in reality. As can be seen from fig. 7c, the output from the wind turbine in this embodiment of the invention may be higher while using the operation limits OL compared to when using the secure operation limits SOL. The reason for this is that the secure operation limits SOL are conservative in the sense that they may e.g. not be set so as to optimize the power production. They may however be set so as to assure that the wind turbine components are not overloaded. For example, while the operation limits OL may be set close to the design limits or at the rated value e.g. 95% of the design limit to ensure the most power produced from the wind turbine, the secure operation limits SOL may be set to e.g. to 60% of a rated value or design limit. Depending on the type of operation limit it may be set to 80% to 95% of a rated value or design limit of e.g. a component of a wind turbine WT. As an example, the root of a wind turbine blade WTB may be pre-rated to be able to sustain a force of X [kN]. Hence, the secure operation limit SOL may be set to e.g. 0.8*X [kN] (80% of the rated value). This may cause a less aggressive pitching of the blade WTB which protects the wind turbine WT but at the same time, it may also cause a lower power output as illustrated in fig. 7c.

It should be noted that the protective operation limit POL and the secure operation limit SOL in embodiments may be equal or at least close to the same value. This may however depend on what is simulated. For example, the simulation result SR may estimate that a given temperature will most likely be above e.g. 100°C in the near future, and a protective operation limit POL may define a temperature limit of 100°C and that a violation will occur if the given temperature is above the 100°C. This may trigger exchange of operation limits by means of the secure operation limits SOL, but the secure operation limits SOL may not necessarily comprise the temperature limit alone, if at all. The secure operation limits SOL may hence comprise limits relating to e.g. power output of the wind turbine, pitch angle limits, main shaft rotation speed limits and/or the like. These secure operation limits SOL may have influence on the given temperature, and in that the secure operation limits are conservative, this may induce the temperature to reduce. It should be mentioned that the limits of fig 7a-7c is only for explanatory purpose and a plurality of other examples may be established. Another example (which is not illustrated) may for example be that an operation limit OL may erroneously have been set to high (or low) compared to what is actually safe. For example, an operation limit OL relating to a maximum allowable output power may erroneously have been set too high so that the first control software operates according to an erroneous operation limit or (part of) software / parameters for a wrong type of wind turbine may be used by mistake. This may trigger a situation where the wind turbine control system WCTS, even though the first control software FCSW is generally acceptable, may control the wind turbine into a situation where the components may be unintentionally overloaded. However, the protective operation limits POL, which the protective control arrangement PCA operates and simulates according to, should be set correctly so they constitute an extra safety. For example, say that in the example of fig. 7c, the operation limit OL was erroneously set to e.g. 1.5 MW, the protective operation limit POL (1.1 MW) constitute backup safety means so that the wind turbine control system WTCS can adapt the control of the wind turbine WT. In this case, the wind turbine control system WTCS may overwrite the values of the operation limits OL with the values of the secure operation limits SOL, it may start to operate according to a third control software TCSW which (in embodiments of the invention) may comprise a conservative set of rules that may help to prevent a violation, and/or both.

Also, even though figs 7a-7c relates to operation limits OL, protective operation limits POL and secure operation limits SOL that defines limits for output power, and that the simulation also relates to this, this is only explanatory and it is understood that the limits OL, POL, SOL may also relate to other parameters as described above in relation to e.g. fig. 2.

Fig. 8 illustrates an example of a setup of a wind turbine control system WTCS for controlling a wind turbine WT by means of individual control applications/control application CAl-CAn e.g. as described previously, e.g. in relation to fig. 3. The solution comprises an underlying "core" software US which facilitates the operation of the control applications CAl-Can. The control applications may in embodiments be distributed in one or more hardware components at different locations of the wind turbine WT, but the underlying "core" software US may provide necessary interfaces between the control applications CAl-CAn, exchange of data such as logged data and/or data inputs DI as described above and/or the like. The underlying software US may in aspects be located at a main controller (not illustrated) while at least some of the control applications CA are located at other wind turbine controllers in the wind turbine WTC.

It is generally understood that the invention is not limited to the above examples but may be combined in a multitude of varieties as specified e.g. in the claims. Additionally, it is understood that different embodiments of the figures and/or the description above may be combined to obtain further embodiments.

Claims

1. A wind turbine control system (WTCS) for controlling a wind turbine (WT), said wind turbine control system (WTCS) comprising:

a wind turbine controller (WTC) configured for controlling said wind turbine (WT) within a plurality of operation limits (OL), said wind turbine controller (WTC) comprising a data processing arrangement (DP A) comprising a first control software (FCSW) for controlling at least a part of said wind turbine (WT) by processing data input (DI) so as to provide one or more data outputs (OP) to control said part of said wind turbine (WT),

wherein said wind turbine control system (WTCS) furthermore comprises a protection controller arrangement (PCA) comprising:

a wind turbine model (WTM) representing at least a part of said wind turbine (WT),

a second control software (SCSW) being substantially identical to at least a part of the first control software (FCSW) of said wind turbine controller (WTC), and

a wind turbine simulation arrangement (WTSA),

wherein said wind turbine simulation arrangement (WTSA) is configured for simulating the operation of said wind turbine (WT) by means of said wind turbine model (WTM) and said second control software (SCSW), based on at least a part of said data input (DI), wherein said wind turbine control system (WTCS) furthermore comprises evaluation means (EM) configured for evaluating a simulation result (SR) of said simulation by means of a set of protective operation limits (POL), so as to estimate if one or more of said protective operation limits (POL) are likely to be violated, and wherein said wind turbine control system (WTCS) is configured for adapting the operation of said wind turbine (WT) so as to prevent said one or more protective operation limits (POL) from being violated.

2. A wind turbine control system (WTCS) according to claim 1, wherein said wind turbine model (WTM) represents a part of said wind turbine (WT) to be controlled by said first control software (FCSW).

3. A wind turbine control system (WTCS) according to claim 1 or 2, wherein said simulation is configured for operating simultaneously with the operation of said wind turbine controller (WTC).

4. A wind turbine control system (WTCS) according to any of the preceding claims, wherein one or more simulation data inputs for use in said simulation are configured so as to deviate with a predefined amount such as a predetermined percentage from the corresponding data input (DI) provided to said wind turbine controller (WTC).

5. A wind turbine control system (WTCS) according to any of the preceding claims, wherein one or more simulation data inputs for use in said simulation are identical to the data input (DI) used by said data processing arrangement (DP A) so as to control said wind turbine.

6. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said first control software (FCSW) comprises a plurality of individual control applications (CAl-CAn) for handling different functionalities of said wind turbine (WT), and wherein said wind turbine simulation arrangement (WTSA), is configured for simulating at least one of said plurality of control applications (CAl-CAn).

7. A wind turbine control system (WTCS) according to claim 6, wherein said individual control applications (CAl-CAn) comprises an individual control application for controlling the pitch angle of wind turbine blades of said wind turbine.

8. A wind turbine control system (WTCS) according to claim 6 or 7, wherein said individual control applications (CAl-CAn) comprises an individual control application (CAn) for operating a converter of said wind turbine (WT).

9. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said adaption of the operation of said wind turbine (WT) comprises that said wind turbine control system (WTCS) shifts to operating at least a part of said wind turbine (WT) by means of a third control software (TCSW).

10. A wind turbine control system (WTCS) according to claim 9, wherein said third control software (TCSW) provides a control facility corresponding to the

functionality of at least a part of said first control software (CSW).

11. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said estimation regarding if one or more of said protective operation limits

(POL) are to be violated is facilitated by means of a correlation of said simulation result (SR) and said protective operation limits (POL).

12. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said one or more protective operation limits (POL) and/or operation limits

(OL) are predefined operation limits.

13. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said third control software (TCSW) provides a control at least

corresponding to a control provided by the simulated first control software (FCSW) of said wind turbine controller (WTC), and wherein said wind turbine control system (WTCS) is configured for shifting from operating according to the simulated part of said first control software (FCSW) to operate according to a third control software (TCSW) if said one or more protective operation limits (POL), based on said simulation result (SR), are likely to be violated.

14. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said wind turbine control system(WTCS) is configured for changing said operation limits (OL) by means of a set of secure operation limits (SOL) if said protective operation limits (POL) are likely to be violated according to said simulation.

15. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said first control software (FCSW) of said a wind turbine controller (WTC) and/or said operation limits (OL) is/are configurable by a first entity at a first lower safety level, and wherein said third control software (TCSW) and/or said secure operation limits (SOL) and/or said protective operation limits (POL) is/are configurable by a second entity at a second higher safety level.

16. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said third control software (TCSW) and/or said secure operation limits

(SOL) is/are conservative when compared to said first control software (FCSW) and/or said operation limits (OL).

17. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said wind turbine model (WTM) comprises a model of one or more wind turbine components of said wind turbine (WT).

18. A wind turbine control system (WTCS) according to any of the preceding claims, wherein said wind turbine model (WTM) comprises a model of a composition of two or more wind turbine components of said wind turbine (WT).

19. A wind turbine control system (WTCS) according to any of the preceding claims, wherein data input (DI) for the protective control arrangement (PC A) is updated during simulation by means of said protective control arrangement (PCA) and/or power production by the wind turbine WT.

20. A wind turbine (WT) with a wind turbine control system (WTCS) according to any of the preceding claims.

21. A method of controlling a wind turbine (WT) by means of a wind turbine control system (WTCS), said method comprising the steps of:

controlling at least a part of said wind turbine (WT) within a plurality of operation limits (OL) by means of a first control software (FCSW), which first control software (FCSW) processes data input (DI) so as to provide one or more data outputs (OP) to control said part of said wind turbine (WT), simulating the operation of said wind turbine (WT) by means of a protection controller arrangement (PCA) comprising:

a wind turbine model (WTM) representing at least a part of said wind turbine

(WT),

a wind turbine simulation arrangement (WTSA), wherein said simulation is furthermore based on at least a part of said data input (DI) provided to said first control software (FCSW) evaluating a simulation result (SR) of said simulation by means of a set of protective operation limits (POL) so as to estimate if one or more of said protective operation limits (POL) are likely to be violated, and adapting the operation of said wind turbine (WT) so as to prevent said one or more protective operation limits (POL) from being violated.

22. A method of controlling a wind turbine (WT) according to claim 21, said method comprising controlling the wind turbine by means of a wind turbine control system according to any of claims 1-19.

23. Use of a wind turbine control system (WTCS) according to any of claims 1-19 and/or a method of controlling a wind turbine (WT) according to claim 20 or 21 for controlling a wind turbine (WT) during power production by means of said wind turbine (WT).

24. A wind turbine (WT) being configured for operating according to the method of claim 21 or 22.