WO2018206460A1

WO2018206460A1 - Reliability test of an electromagnetic operated actuator

Info

Publication number: WO2018206460A1
Application number: PCT/EP2018/061601
Authority: WO
Inventors: Tobias THEOPOLD; Thomas Wiesenthal
Original assignee: Moog Unna Gmbh
Priority date: 2017-05-10
Filing date: 2018-05-04
Publication date: 2018-11-15
Also published as: GB201707498D0; GB2562274A

Abstract

Method and arrangement for testing a controllable switching device for an mechanically operated device (4) wherein the mechanically operated device (4) rests in an actuated position at least as long as a controllable switching device supplies an electromagnetic actuator with a supply current. The method comprises the steps of measuring a first current flowing through the electromagnetic actuator when the controllable switching device is in a closed position (702); opening the contacts of the controllable switching device for a test time period, wherein the test time period is chosen as short as that the mechanically operated device rests in the actuated position (703); measuring a second current flowing through the electromagnetic actuator at the end of the test time period (704); calculate the ratio of the second current in relation to the first current (706); comparing the ratio with an expected range (707); indicating that the controllable switching device has not passed the test when the calculated ratio is outside the expected range (709).

Description

Reliability test of an electromagnetic operated actuator

The invention relates to checking proper functioning of electro mechanical device comprising an electromagnetic actuator. The invention further relates to a wind turbine comprising an electromagnetic operated brake as part of a safety function. The invention also relates to method steps for testing safe function of an electromagnetic operated safety system.

Based on IEC EN 61508 safety can be defined as freedom of a machinery from unacceptable risk. Part of the overall safety of a machinery depends on the machinery operating correctly in response to its inputs, including reducing or mitigating risks of hardware failures. For this purpose safety functions may be built into the machinery to react to a failure of the machinery. Without the safety function the machinery will operate normally, but in the event of a failure, the safety function, if it functions properly, will reduce or even prevent the risk originating from the failure. A safety function therefore usually comprises a sensor to detect a failure of the machinery, a logic, typically a relay circuitry or a microcontroller, that receives the data from the sensor and generates a decision in form of an output signal, and a kind of actuator controlled by the output signal for bringing operation of the machinery into a safe state, i.e. in a state in which the machinery will not expose people to physical injury or damage to the people's health. The actuator of such a safety function is for example a mechanical brake which, when not actuated, is automatically engaged for example by spring forces. In normal use of the machinery, e.g. when no malfunctions are detected, an electromagnetic actuator produces a force that surpasses the spring forces and consequently disengages the mechanical brake. Such electrically operated brakes are often operated by an electric switching device, which when in a switched on mode electrically connects an electromagnetic actuator with a supply voltage. The advantage of this arrangement is that in case of a power failure the electromagnetic actuator is no longer supplied with a supply voltage and falls back into a non-actuated position, in which the brake engages automatically. In the event a safety function detects a malfunction of the machinery, the brake can be engaged intentionally by switching the electric switching device in a switched off mode in order to interrupt the supply of electrical energy to the electromagnetic actuator.

As the proper operation of the safety functions is indispensable for the safety of a system relying on safety functions to work properly, it is common practice to test essential parts of the safety functions regularly, for example twice a day. However, in some installations invoking the safety function may shut down the whole installation and requiring a new start of the installation. In case of a wind turbine installation a test which shuts down the wind turbine may result in a down time of ten to fifteen minutes. Therefore such tests are sometimes postponed until time periods with no wind or weak winds in order not to lose out too much on energy production.

The object of the invention is to check the proper function of a switching device supplying an electromagnetic actuator with electrical energy, in particularly testing the proper functioning of switching-off the supply with electrical energy during normal operation of the electromagnetic actuator without provoking an interruption of the machinery it shall protect.

This object is achieved by a configuration of the controller device that when in a test mode switching off the supply of electrical energy by the switching device for a pre-defined time whereby this pre-defined time is chosen to be sufficiently short thus that the mechanically operated device, for example a brake, does not engage. Then the controller device measures an electrical parameter indicative of the electromagnetic actuator being supplied with no current and compares the measured electrical parameter with an expected value. If the value of the measured electrical parameter and the expected value differ then the controller device will indicate that the switching device is defect, i.e. does not interrupt any longer sufficiently the supply of electrical energy. As usual a tolerance will be applied to allow for measurement errors, temperature variances, and so on. If the difference between measured value and expected value is below a threshold accounting for the tolerances the controller device will assume that the switching device is working properly.

Switching devices, which control the supply of energy to the electromagnetic device primarily fail either by not switching into a conductive state, which prevents the mechanically operated device from disengaging, or by not interrupting the conductive state, in which case the mechanically operated device cannot function, for example in a case of emergency. The first case will be remarked as soon as it appears, as the electromagnetic device engages without being instructed. The latter case will be detected naturally only when it is too late, i.e. when the safety function of the mechanically operated device is needed, but cannot be engaged. Therefore the latter case is the more critical for safe operation of a machinery. Mechanical switching devices may fail to open in case their contacts are burned and do not separate any more. Similarly electrodes of semiconductor switches may become short cut. The proposed test allows to detect these failures during normal operation. The present invention takes advantage of the fact that electromagnetic actuators have a delay period in which the collapsing magnetic field keeps the actuator in place before the actuator will return to its initial position, when there is no magnetic field. In case the switching device is deactivated, i.e. is switched off, it interrupts the current through the electromagnetic actuator. Due to the self-inductivity of the coil of the electromagnetic actuator the current initially will continue to flow, but will decrease over time following an exponential function. If the supply voltage is switched on again the current through the electromagnetic actuator will resume to its previous value as it was before the test had been started and the magnetic field is re-established to the previous strength. If the test period is chosen adequately short, the electromagnetic actuator will be kept disengaged, whilst by measuring an appropriate electrical parameter the controller device can evaluate if the switching device changed from closed, respectively conductive state to open, respectively interrupted state.

In principle the status of the switching device (conductive or non-conductive) may be measured with the voltage over the contacts of the switching device. In case of a semiconductor switching device for example the voltage over the contacts would be equivalent to the collector-emitter voltage. In case of a closed switching device the voltage over the switching device is equal to the voltage drop caused by the resistance of the closed switching device contacts, or the collector- emitter voltage when the transistor is in conducting state. In case the switching device has opened properly, or similarly the collector-emitter path of the transistor is in non-conductive state, the voltage theoretically would rise close to the supply voltage. However, with the inductivity of the electromagnetic actuator and induced voltages this may not give clear cut results for short test time periods. In one aspect of the invention therefore the electrical parameter indicative of the electromagnetic actuator being cut off from power supply is the current flowing through the electromagnetic actuator.

This current may be measured with a current sensor that is arranged close to the electromagnetic actuator. In another aspect of the invention the current flowing through the electromagnetic actuator is measured at a different location than the electromagnetic actuator, i.e. at a remote place, for example in the power supply. This allows to use a current sensor that might be available anyway and saves the costs to provide a current sensor only for the purpose of measuring the current directly at the electromagnetic actuator. In another aspect of the invention the controller device checks the voltage for supplying the electromagnetic actuator before initiating the test mode and does not enter into test mode if the measured voltage is below a threshold. This pre-check seeks to avoid the situation that the energy stored in the electromagnetic actuator is too low to keep the actuator in its place for the time of the test period. In such a situation the pre-check inhibits the test. Alternatively the controller device could increase the voltage for supplying the electromagnetic actuator to a pre-defined higher level before initiating the test mode. The increase of the supply voltage should be chosen sufficiently high to ensure that the actuator is kept in place for the time when the supply current is switched off. Thus the test can be performed without the risk of shutting down the whole installation, when the switching device is tested for proper insolation when in the switched off state.

In some installations the safety system may comprise at least a second switching device which is in series to the switching device and the electromagnetic actuator. In such an installation it is advantageous that the controller device tests the switching devices one after the other and not at the same time.

In one aspect of the invention part of a safety function is a mechanical operated brake, which is disengaged, when the switching device is closed and will automatically engage when the switching device is opened or the power supply fails. Other applications of the electromagnetic actuator are electromagnetic valves, either which fall back to a closed position when the safety function is invoked or which fall back from a closed position to an open position, when the safety function is invoked. In another aspect of the invention the controllable switching device is a semiconductor controlled by a control voltage. Semiconductor switches, such as an insulated-gate bipolar transistor (IGBT) are now-a-days available for high current applications and high voltages. Depending on the specific application in a lot of cases they are now from size, costs, and reliability superior to electromechanical switches.

An application for a safety system as described is a wind turbine with at least one pitch drive for setting a pitch angle of a rotor blade. In such an installation a brake is part of the safety function which blocks the movement of the rotor blade. The safety function tries to hinder that the rotor blade may me turned by wind forces or gravity to a pitch angle, where the wind facing the rotor blade may start the rotor of the wind turbine to rotate again.

In another aspect of the invention, when the controller device detects a defect switching device the controller device invokes an emergency procedure, such as a feathering run. The feathering run will turn all rotor blades of a wind turbine into a neutral position which finally will stop the rotation of the hub, to which the rotor blades are attached to. Especially in cases where per brake are at least two switching devices for interrupting the current flow through the electromagnetic actuator, the wind turbine will be stopped of the first occurrence of a fail function of either the first or the second switching device before the other switching device may become defective too. Thus the brake will still work to keep each rotor blade of the wind turbine, once the hub has come to a halt, in a safe position.

The invention will now be described in more detail with reference to the drawings.

Figure 1 shows an aspect of the invention with a single safety line switching device and a current sensor between a power supply and safety line the switching device

Figure 2 shows a diagram current versus time for a test procedure with an arrangement according to the embodiment shown in Figure 1

Figure 3 shows another aspect of the invention with a single safety line switching device and a current sensor arranged close to an electromagnetic actuator

Figure 4 shows a diagram current versus time for a test procedure with an arrangement according to the embodiment shown in Figure 3

Figure 5 shows an embodiment of the invention with two safety line switching devices

Figure 6 shows another embodiment of the invention with pulse width modulation of the safety line switching devices

Figure 7 shows method steps for performing the invention Figure 8 shows a wind turbine

The following embodiments show an application of the invention on the technical field of wind turbines. Figure 8 shows a side view of a horizontal axis wind turbine 100 according to the invention. The wind turbine 100 is used for converting a wind's kinetic energy into electrical energy. A tower 101, supporting a nacelle 102 and a rotor 103, 104a, 104b, is fixed to the ground. Evidently the invention is not limited to on-shore installations, where the tower is fixed to the ground but could also be used in connection with so-called off-shore installations where the tower is fixed to a structure in the sea or a structure floating in the sea. The rotor 103, 104a, 104b substantially comprises a hub 103 with three rotor blades 104a, 104b extending outwards with respect to the hub 103, from their root end, which is revolvably connected by a toothed ring to the hub 103.

The wind turbine 1 of this embodiment comprises three rotor blades 104a, 104b whereby in Fig. 8 only two rotor blades 104a, 104b are visible. The third rotor blade is not visible as it happens to be concealed by the hub 103. The rotor 103, 104a, 104b is rotationally connected to the nacelle 102 by a substantially horizontally orientated generator shaft 108. A yaw drive (not shown) is used to rotate the nacelle 102 around its axis TA in order to keep the rotor 103, 104a, 104b facing into the wind as the wind direction changes. An electric current generator 109 coupled by the generator shaft 108 to the rotor 103, 104a, 104b produces electrical energy which may be fed into an energy distributing net (not shown).

The speed at which the rotor 103, 104a, 104b rotates must be controlled for efficient power generation and to keep the stress on structure and components of the wind turbine 100 within design limits. Each rotor blade 104a, 104b therefore can be pivoted by a pitch drive unit 105a, 105b. As the wind turbine 100 in this example has three rotor blades 104a, 104b, there are three pitch drive units 105a, 105b. Similarly to the third rotor blade, which is concealed by the hub 103, the third pitch drive unit is not shown in Fig. 1. The three pitch drive units 105a, 105b are controlled by one common pitch system controller 106. Each pitch drive unit 105a, 105b is connected to an input of a gear box (not shown). An output pinion (not shown) of each gear box is in constant mesh with the toothed ring (not shown) of each rotor blade 104a, 104b. The combination of pitch drive 105a, 105b, gear box and toothed ring turns each rotor blade 104a, 104b around a rotor blade axis BA. By turning the rotor blades 104a, 104b around their axis BA the angle of attack of the rotor blades 104a, 104b to the wind can be set to an angle substantially between 0 and 90 degrees. The angle of attack can be chosen thus that the rotor blades 104a, 104b even with strong wind produce no lift at all, or produce lift as a function of the wind speed. The produced lift is transformed into a rotation of the hub 103 around a rotor axis A and eventually by the generator 109 into electrical energy. A turbine controller 107 sends command to the pitch system controller 106 for continuously setting the pitch angle of each rotor blade 105a, 105b individually, or commanding to turn the rotor blades 104a, 104b into the feathering position. Pitch angles and yaw angle of the nacelle eventually control the rotation speed of the rotor 103, 104a, 104b and thus also the amount of energy produced by the generator 109.

The only efficient way to stop the rotation of the rotor 103, 104a, 104b is known as feathering, i.e. to increase the pitch angle of the rotor blades 104a, 104b so that they are orientated parallel to the airflow. As feathering is critical for stopping the rotor 103, 104a, 104b during emergency shutdowns, the pitch drives 5a, 5b usually are supplied by an emergency power source (not shown in Fig. 8) allowing feathering of the rotor blades 104a, 104b even when power supply from the power grid is interrupted.

When the pitch drives 5a, 5b had been ordered to turn the blades 104a, 104b into the feathering position, limit switches (not shown) arranged for example at the toothed ring of the rotor blades 104a, 104b, signal that the rotor blade 104a has reached its feathering position. In order to secure the rotor blade in this position, a disc brake, which is for example arranged at the input of the gear box, engages and blocks any rotation of the rotor blade 104a. In order to block the rotation when neither power is supplied from the grid nor from the emergency power supply, the disc brake is arranged as a self-blocking brake. For this purpose a spring presses disc pads onto the disc of the disc brake. In order to loosen the brake during normal operation of the wind turbine an electro magnet is powered with a supply voltage and exercises a force to overcome the spring force, thus retracting the disc pads from the disc. Once the electro magnet is no longer sufficiently supplied with electrical power, the spring force prevails and the disc pads engage with the disc. The embodiments following embodiments disclose arrangements and methods to test the proper operation of the self-engaging disc brake in normal operation of the wind turbine 100 without disturbing the operation of the wind turbine 100. The person skilled in the art will readily appreciate that the invention can be applied to any technical field where electromagnetic actuators are used as part of a safety function for a machinery or a system of machinery elements. In the following embodiments sensors or other logical inputs to a safety function are represented by safety switches 9a, 9b, 9c. The safety switches 9a, 9b, 9c are connected in series and their contacts are in a closed position to allow an idle current to flow through the line of safety switches 9a, 9b, 9c. The safety switches 9a, 9b, 9c may be distributed in various locations of a machine installation as a last resort in case other safety functions or controls fail. Each safety switch 9a, 9b, 9c may be activated, i.e. forced into an open position either by mechanical actuation, for example a limit switch, a manually operated emergency switch-off button or by switch off signals from controls of the machine installation. The safety switches thus form a logical AND combination. If only one safety switch 9a is opened, the current flowing through the line of safety switches 9a, 9b, 9c is interrupted. This either directly interrupts the power supply for example to the engine of a machine to stop it, or indirectly by controlling a switching device 5, and the switching device 5 controlling an actuator 1. In the following examples the line 9 of safety switches 9a, 9b, 9c is connected at one end to a safety power supply voltage Us and with the other end to a safety switching device input 71 of a controller device 7. The controller device 7 surveys the voltage on its safety switching device input 71. As long as the voltage at the safety switching device input indicates that all safety switches 9a, 9b, 9c are closed, the controller device 7 generates at an actuator control signal output 72 an actuator control signal which switches the switching device 5 into an on state. If only one of the plurality of safety line switches 9a, 9b, 9c opens its contacts, the controller device 7 interrupts the actuator control signal and the switching device 5 is forced into an off state.

Figure 1 shows a simplified schematic to illustrate the principles of the invention. In Figure 1 the electromagnetic actuator 1 is represented by a coil 2 referring to its inductivity L and a resistor 3 referring to its resistance . The electromagnetic actuator 1 is in operative connection with a disc brake 4. In case the switching device 5 is in an on state it supplies the electromagnetic actuator 1 with a supply voltage U. If the supply voltage U is chosen sufficiently high, so that a current I is allowed to flow through the electromagnetic actuator 1 that is above an opening current level l_0Pen the magnetic force of the magnetic field generated by the coil 2 is strong enough to engage with the disc brake 4 and to unblock the disc brake 4. The current I flowing in the circuit of the magnetic actuator can be measured by a current sensor 6, which is located in between a source of the supply voltage U and the switching device 5. A protection element 8 protects the switching device 5 against surges produced by the collapsing magnetic field of the coil 8 when the switching device 5 cuts off the power supply U. The use of protection elements 8 is known in prior art and the person skilled in the art will chose an appropriate protection element 8 such as a voltage dependent resistor (VD ) or a freewheeling diode.

The person skilled in the art will appreciate that the level of the opening current l_0Pen depends on the force needed by the specific construction of the disc brake to unblock the disc brake 4, the geometry and electric parameters of the coil 2, the supply voltage U, and from other parameters such as the temperature of the coil 2. In the specific embodiment of the invention in a wind turbine the inductivity of the coil is for example 37H, the resistor is 490 Ohm, and the current l_0Pen is approximately 0.1A. That means that approximately a supply voltage U of 50V has to be applied to the electromagnetic actuator 1 to unblock the disc brake 4. To have some margin, for example in case of voltage fluctuations of the supply power, the electromagnetic actuator 1 is designed to be operated at a higher permanent voltage, for example 80V, causing a nominal current l_n0m to flow, without the risk of overheating the coil 2. Due to the magnetic hysteresis the magnetic actuator 1 rests in the actuated position, even when the current I should fall below l_0Pen. Only when the current I falls further down to loose the magnetic actuator 1 will fall back to the non-actuated position.

The controller device 7 controls the switching device 5 which is electrically connected in series to the electromagnetic actuator 1. When switched into an off state, the switching device 5 will interrupt the supply of the supply voltage U and thus will interrupt the current I flowing through the coil 2. The magnetic field that has been maintained by the coil 2 will collapse and by self- induction generate a current that declines over time, still maintaining for a short time a magnetic field strong enough to hold the magnetic actuator in an actuated position, ensuring that the disc brake 4 does not engage in this time period. Once the magnetic field has weakened to a certain level, the disc brake 4 will engage and block, for example the rotor blade of the wind turbine. The delay between switching off the supply current U and the disengagement of the disc brake 4 depends on various parameters and can be evaluated in tests. In the present embodiment the delay time until the disc brakes 4 engages was measured to be about 0.2s. In order to have margin for tolerances the test period t_te≤t should be limited below the delay time, for example to 50% of the delay time. This provides enough safety margin to avoid that the disc brake 4 engages during a test period t_test of 0.1s.

In the embodiment of Figure 1 the current sensor 6 is located between a power source and the switching device 5. In this embodiment the coil 2 and the current sensor 6 are on the opposite sides of the switching device 5, so that the self-induced current of the coil 2 cannot flow through the current sensor 6, once the actuator switching device 5 is opened. In this arrangement the current lexp expected to be measured is substantially zero. To allow for tolerances the controller device 7 will assume that any measured current I at the end t₃ of the test period t_tes_t that is below a threshold lexp of for example 5% of the nominal current l_n0m is considered to prove that the switching device 5 opens without failure.

Fig. 2 shows in a diagram the course of the measured current I during different time periods. Before time event to the actuator switching device 5 is in a switched off position and the measured current I should be below the threshold l_exp. At time to the safety line 9 is activated and the switching device 5 is set into a switched on state. Due to self-induction the current I raises in an e-function until at time ti it reaches asymptotically its nominal current l_n0m. During its raise, the measured current I will pass over the threshold l_0Pen at which current level the magnetic field of the coil 2 is strong enough to disengage the disc brake 4. At a time t₂ when the controller device 7 tests the proper switch off function of the switching device 5, and interrupts the control signal to the switching device 5, the switching device 5, provided it functions properly, cuts off the power supply U from the coil 2. As in this first embodiment the current sensor 6 is located between the current source U and the switching device 5, the current drops immediately below the threshold l_exp for validating a switched off condition of the switching device 5. In case the measured current I is above the threshold of 5% of the nominal current l_n0m the controller device 7 will assume that the actuator switching device 5 is not functioning properly and will take appropriate measures, which in the worst could comprise shutting down the wind turbine by activating a feathering run. Maintenance personal then has to come to change for example the printed card board with the switching device 5 before the wind turbine can be restarted.

At a time t₃ the controller device 7 ends the test by supplying again the actuator control signal and the switching device 5 is switched in a switched on state again. In this embodiment, as the current sensor 6 and the coil 2 are of opposite sides of the switching device 5 the sensor 6 cannot see the self-induced current of the coil 2. However, when the switching device 5 is closed at t₃, the current I raises immediately to the level of the self-induced current of the coil 2 at time t₃, and from there in an e-function back to the nominal current l_n0m. It is essential, that the controller device 7 choses the test period t_te≤t, i.e. the time between the begin of the test t₂ and the end of the test t₃ short enough, so that the collapsing magnetic field is still strong enough to keep the disc brake 4 disengaged. In the second embodiment shown in Fig. 3, which is identical to the first embodiment shown in Fig. 1 apart that the current sensor 6 and the coil 2 are now located on the same side of the actuator switching device 5. Same reference numbers are used to refer to identical elements in Fig. 1 and Fig. 3. When the controller device 7 starts a test at the time ti the magnetic field that has been maintained by the coil 2 will gradually collapse generating by self-induction a declining current. This current will decrease according to an e-function and can be calculated. At the end of the test period t_te≤t it will have fallen substantially to an expected value l_exp. As the current sensor 6 is in the same circuit as the coil 2, the self-induced current this time can be measured by the current sensor 6. The controller device 7 compares the measured current I with the expected current l_exp by allowing a tolerance of 5% to the higher end and 5% to the lower end. If the measured current I is within this bandwidth of 0.95 times the expected current l_exp and 1.05 times the expected current lexp the controller device assumes that the switching device 5 was set properly into a switched off state and therefore has passed the test.

In general the measured current I can be evaluated in a plausibility check and other thresholds may be chosen to analyse in more detail any deviations. For example if the measured current at the end of the test period is above a level of 90% of the nominal current l_n0m the controller device may conclude that the switching device is completely dysfunctional, i.e. does not transit into a switched off state at all, whereas below this level it is only partially dysfunctional, i.e. the switching device 5 is switched off only partial, allowing a small current to flow. Obviously the current sensor 6 in this embodiment has to be in between the terminal of the protection element 8, or the current through the protection element 8 may falsify the test result, if not taken into account. In another aspect of the invention the controller device 7 measures the current h just before the test procedure is started at t2 and stores the value of the measured current. It then interrupts the supply of the control voltage to the safety main switching device 5 for the pre-defined delay time and measures the current I3 at the end t3 of the test period t_te≤t. The controller device 7 then calculates the ratio I3/I2 between the current I3 measured at the end t3 of the test period and the current I2 measured at the begin t2 of the test period t_te≤t and compares that ratio with an expected ratio, again preferably again applying a margin for tolerances. This allows for individually taking into account deviations due to fabrication tolerances of the coil, variations due to temperatures or power supply fluctuations, etc. The person skilled in the art will appreciate that the embodiments of figure 1 and 2 and the embodiments of figure 3 and 4 can be combined in a single embodiment.

Fig. 5 shows a circuit diagram wherein the electromagnetic actuator 1 is supplied by a voltage converter 10. The voltage converter converts an input voltage in a range between 50V and 400 V to the supply voltage U that is needed to safely operate the electromagnetic actuator 1. For reasons of conciseness the safety line switches and the disc brake are not shown in Fig. 5.

In the described embodiments the switching device 5 could be implemented for example as an electromechanical device such as a relay or a contactor 5 with contacts 5a and 5b. In the embodiments of Fig. 5 and Fig. 6 the switching device 5 is implemented by two semiconductor switching devices Ti, Ti, which are insulated gate bipolar transistors (IGBTs). In this case the contacts 5a, 5b of the switching device 5 are the collector C and the emitter E of the transistors Ti, T2. IGBTs can be used for high voltages and high currents. For applications with medium currents for example field effect transistors, such as MOSFET could be considered as switching devices. Further two clamping diodes Di, D2 protect the semiconductor switching devices Ti, T2 against induction voltages generated by the self-induction of the electromagnetic actuator 1 when one, or both of the switching devices Ti, T2 are switched off. The two semiconductor switching devices Ti, T2 operate as a so-called half H-bridge and if functioning properly cut off the current on the both sides of the electromagnetic actuator 1. With two switching devices this embodiment provides for redundancy in case one of the switching devices Ti, T2 fails. The other switching device then still will be able to cut off the current through the electromagnetic actuator 1. In this embodiment the controller device is configured to test first one of the semiconductor switching devices Ti and then the other semiconductor switching device T2. In case the test result is that only one of the two switching devices has not passed the test, the controller device may only generate a warning to the maintenance personnel, as with the other semiconductor switching device T2 the brake still can be invoked. This allows to continue the operation of the wind turbine as the disc brake 4 still could be engaged with the other semiconductor switching device. Only if both semiconductor switching devices Ti, T2 are dysfunctional the controller device 7 may decide generate the signal to shut down the wind turbine.

In a further aspect of the invention the controller device is 7 adapted to control the output voltage of the power converter 10. When the test procedure is started, the controller device increases the output voltage of the power converter 10 for example by 10%. The short time period in which the output voltage of the power converter is increased does not risk overheating the electromagnetic actuator 1. The test is started by measuring the current lo flowing through the electromagnetic actuator. Due to the higher supply voltage this current will be higher than the nominal current l_n0m flowing through the electromagnetic actuator when the nominal voltage U_n0m is applied. Then the controller device interrupts the control voltage of the first switching device, i.e. the gate voltage of the first IGBTTi for a test period t_te≤t. The test period t_te≤t may be chosen that the expected magnetic force for disengaging the brake is in the range of the magnetic force that is applied when the electromagnetic actuator is applied with its nominal supply voltage U_n0m. Thus the risk that the electromagnetic actuator is invoked unintentionally by the test procedure is minimized. The test period t_te≤t may be chosen to be longer, so that the drop of the measured current li at the end of the test period is significantly lower compared to the current lo measured at the begin of the test period. This allows choosing the test period t_te≤t sufficiently long to provide margin for measurement errors and to allow higher tolerances, as the ratio of the current measured at the end of the test period compared to the begin of the test period can be chosen higher than in the other embodiments.

Figure 6 shows a variation of the embodiment of Figure 5 wherein the supply voltage of the electromagnetic actuator 1 is generated by pulse width modulation of the control inputs, i.e. the gates of the safety actuator switching devices Ti, T₂. A pulse width modulator 11 for example would generate pulse width modulated control signals at a switching frequency of 8 kHz. A duty cycle of around 20% for example would reduce an input voltage U of 400V down to 80V. In this case the test procedure initiated by the controller device 7 will change the duty cycle of the pulse width modulated signals PWMi and PWM₂ during the test period down to 0%. Figure 6 also shows two safety switches 9a, 9b each controlled by a second controller device 12 and a third controller device 13. These safety switches 9a, 9b are for example relays or transistors which are closed by idle currents produced by the second controller device 12, and the third controller device 13. Figure 6 also shows an implementation where the first controller device 7 and the pulse width modulator are arranged on a first printed card board 14. The second controller device 12, the third controller device 13, and both safety switches 9a, 9b are arranged on a second printed card board 15, especially designed to comprise controller device for safety functions. The first transistor Ti, the second transistor T₂, the two clamping diodes Di, D₂ and the current sensor 6 are arranged on a third printed circuit board 16. The electromagnetic actuator 1 for a disc brake (not shown in this embodiment) for example may be integrated into a pitch drive motor of a wind turbine. The distance between the third printed card board 16 and the actuator 1 could be for example lm or longer.

In the following the functions performed by the controller device 7 are summarized as process steps performed by a test software. At the beginning (701) of the test procedure the software is initialized and ensures for example that the test is run only when the voltage (U) of the power source for supplying the electromagnetic actuator with the current (I) before is above a threshold, thus insuring that a too low supply voltage U may inadvertently engage the disc brake during the test period. Then the software measures as a first current value the current flowing through the electromagnetic actuator (702). The software then switches the switching device for a test time period into a switched off state, wherein the test time period is chosen as short as that the mechanically operated device rests in the actuated position (703) and as described in more detail above. Then the software measures as a second current value the current flowing through the electromagnetic actuator at the end of the test time period (704). The software then calculates the ratio of the second current in relation to the first current (706) and compares the ratio with an expected range (707). In case the comparison reveals that the calculated ratio is outside the expected range (709) the software indicates that the switching device has not passed the test. It may commence further actions, such as ordering from a higher level controller a feathering run of the wind turbine. In case the switching device has passed the test, the software goes dormant and repeats for example the test 12 hours later.

Claims

An arrangement for actuating an electromagnetic actuator (1) of a mechanically operated device (4), the actuating arrangement comprising a controller device (7) configured to control a switching device (5) such that

— in a first use mode the switching device (5) supplies the electromagnetic actuator (1) with an electric current (I) in order to actuate the mechanically operated device (4) into an actuated position and

— in a second use mode the switching device ceases to supply the electric current (I) to the electromagnetic actuator (1) in order to allow the mechanically operated device (4) to transit into a non-actuated position,

— wherein the controller device (7) in a test mode is configured to

— switch the switching device (7) for a pre-defined time into the second use-mode

— measure an electrical parameter indicative of the electromagnetic actuator (1) being supplied with no electrical current;

— compare the electrical parameter with an expected value;

— indicate that the switching device (5) is defect when the value of the measured electrical parameter differs from the expected value.

The arrangement of claim 1 wherein the pre-defined time is chosen sufficiently short thus that the mechanically operated device (4) rests in the actuated position;.

The arrangement of claim 1 or 2 wherein the current (I) flowing through the electromagnetic actuator (1) is measured at a different location than the electromagnetic actuator (1).

The arrangement of claim 1, 2 or 3 wherein the controller device (7) checks the voltage (U) of a power source for supplying the electromagnetic actuator with the current (I) before initiating the test mode and does not enter into test mode if the measured voltage is below a threshold.

5. The arrangement of one of claims 1 - 4 wherein the controller device (7) before initiating the test mode increases the voltage (U) for supplying the electromagnetic actuator (1).

6. The arrangement of one of claims 1-5 wherein the system comprises a second switching device (T2) which is in series to the switching device (Tl) and the electromagnetic actuator (1) and that the controller device (7) is configured to test the switching devices (Tl, T2) one after the other.

7. The arrangement of claim 6 wherein the switching devices (Tl, T2), the electromagnetic actuator (1) and a current sensor (6) for measuring the electrical parameter are arranged in the order of a first switching device (Tl), the electromagnetic actuator (1), the current sensor (6), the second switching device (T2).

8. The arrangement of one of claims 1-7 wherein the mechanically operated device (4) is a mechanically operated brake, particularly of the type of a disc brake.

9. The arrangement of claim 8 wherein the mechanical brake disengages the brake when it is actuated by the electromagnetic actuator (1) into the actuated position and wherein the mechanical brake engages when the electrometrical actuator (1) transits to a non-actuated position.

10. The arrangement of one of claims 1-9 wherein the switching device (5) is a semiconductor switch (Ti), particularly of the type of an insulated gate bipolar transistor.

11. The system of claim 10 wherein a pulse width modulator generates a pulse width modulated signal which is supplied to at least one switch (Tl) to control the supply voltage (U) of the electromagnetic actuator.

12. An electrical motor with an integrated electromagnetic actuated brake according to claim 8 or 9.

13. Wind turbine with at least one pitch drive for setting a pitch angle of a rotor blade comprising an arrangement according to one of claims 1 - 12 wherein the mechanically operated device (4) blocks the movement of the rotor blade.

14. Wind turbine according to claim 13 wherein the controller device (7) is configured to perform an emergency procedure, such as a feathering run when a defect switching device is detected.

15. Method for testing a switching device (5) for an mechanically operated device (4) wherein the mechanically operated device (4) rests in an actuated position at least as long as a controllable switching device supplies an electromagnetic actuator with a supply current, the method comprising steps of

— Measuring a first current flowing through the electromagnetic actuator when the controllable switching device (5) is in a switched off mode (702)

— Setting the switching device (5) for a test time period into a switch off mode (703);

— Measuring a second current flowing through the electromagnetic actuator at the end of the test time period (704);

— Calculate the ratio of the second current in relation to the first current (706) ;

— Comparing the ratio with an expected range (707);

— Indicating that the switching device (5) has not passed the test when the calculated ratio is outside the expected range (709).