• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    The present disclosure provides apparatus, systems, and methods for preventing out-of-synchronism closing between power systems. An intelligent electronic device (IED) apparatus may include a control component and a delay component. The control component is configured to selectively control opening and closing of a breaker. The control component selectively outputs a close signal to cause the breaker to connect a first portion of a power delivery system to another portion of the power delivery system. The delay component is configured to delay output of the close signal to the breaker. The delay component includes circuitry independent from control by the control component and the delay component is inconfigurable from a remote location.
    公开号:ES2547467A2
    申请号:ES201590048
    申请日:2013-12-27
    公开日:2015-10-06
    发明作者:Z. KASZTENNY Bogdan；S. FINNEY Dale
    申请人:Schweitzer Engineering Laboratories Inc；
    IPC主号:
    专利说明:

    P201590048
    05-21-2015 DESCRIPTION
    Prevention of desynchronized reconnection between power systems 5 Technical field
    The present disclosure relates to the connection of energy distribution systems and more particularly it relates to the prevention of de-synchronized closing of a switch that connects a generator and an electrical energy distribution system.
    10 Brief description of the drawings
    Non-limiting and non-exhaustive embodiments of the disclosure are described herein, including various embodiments of the disclosure illustrated in the figures.
    15 listed below.
    Figure 1 is a schematic diagram illustrating an embodiment of a system to prevent the synchronized closure between a generator and an energy distribution system.
    20 Figure 2 is a schematic block diagram illustrating an embodiment of an IED generator to prevent desynchronized closure.
    Figure 3 is a schematic connection diagram illustrating an embodiment of external and internal logical interconnection of an IED generator.
    Figure 4 is a schematic flow chart illustrating an embodiment of a procedure to prevent desynchronized closure.
    In the following description, numerous details are provided for an understanding
    30 of the various embodiments disclosed in this document. The systems and procedures disclosed in this document can be implemented without one or more of the specific details, or with other procedures, components, materials, etc. In addition, in some cases, well-known structures, materials or operations cannot be shown or described in detail in order to avoid hiding aspects of the
    35 disclosure. In addition, the features, structures or features described can be
    P201590048
    05-21-2015
    combine in any appropriate manner in one or more alternative embodiments. Detailed description
    5 Connecting a synchronous generator to an energy system such as another generator or an energy distribution network requires careful correspondence of the generator frequency and generator voltage with those of the energy system. In other words, the angle and phase difference in voltage between the generator and the power system should be close to zero (ideally exactly zero) at the time of closing a
    10 switch to connect the generator to the power system. Otherwise, torsional stresses are imposed on the generator and its main impeller. This failure in proper synchronization before closing is known as desynchronized closing. The torsional tension resulting from the desynchronized closure can be several times the design classification of the machine, depending on the difference in voltage, frequency,
    15 and angle phase at the time of the synchronized closure. The resulting damage to the machine is also generally cumulative. For example, a machine may remain in operation after an initial unsynchronized shutdown event but may fail after several subsequent unsynchronous shutdown events. It should be noted that, as used herein, "close" and "close" may include "reconnect" and "reconnection"
    20 unless otherwise indicated.
    There are generally two procedures to properly synchronize a generator to the power system; Manual synchronization and autosynchronization. In manual synchronization, a plant operator sends commands to the generator voltage regulator and automatic controller to keep the voltage and frequency differences within acceptable limits. The plant operator then controls the phase angle between the generator and the power system using a syncroscope (phase difference indication meter). When the angle reaches zero the plant operator manually initiates a switch closing command using a push button, panel switch
    30 or through a man-machine interface such as a keyboard, a mouse or a touch screen. In autosynchronization, an autosynchronization device controls the voltage and frequency and initiates substantially the same control actions as a plant operator.
    35 Although proper implementation of the above procedures normally gives
    P201590048
    05-21-2015
    As a result, synchronization between the generator and the system at the time of closure, additional checks and protections are generally included in case of operator error or malicious closure attempts. For example, external synchronization equipment or checks, circuit breaker circuit relays, can be used,
    5 island logic or other devices or procedures to prevent desynchronized closing. These additional protection mechanisms help reduce the possibility of unsynchronized closing even if an error or an intentional attempt to close out of sync is made.
    10 However, recent studies have identified vulnerabilities that may allow an unauthorized individual to intentionally trigger an unsynchronized shutdown from a remote location despite previous protections. Specifically, a precisely timed opening and quick closing of a circuit breaker cannot be prevented by including hardware protections such as auto-synchronizers, battery testers
    15 synchronization, switch self-pumping circuits, and / or island logic. Although this rapid closure can be prevented through an IED, an unauthorized individual who has penetrated the protection and control system can reprogram the IED and thus exploit the previous vulnerability. For example, the autosynchronizer and / or the synchronization verifier relay are typically microprocessor controlled devices. Since
    20 are programmable, there is the possibility of an unauthorized individual reconfiguring or reprogramming these devices to allow a desynchronized closing operation to occur. After reprogramming, one or more opening and reclosing operations can be carried out to achieve a desynchronized closure.
    25 This type of intentional unsynchronized shutdown is often called “Aurora attack” or “Aurora vulnerability”. An Aurora attack could be used to intentionally damage a generator, turbine shaft, or other rotating machine through the multiple closure of a switch that connects the machine (or a small island of machines) to the power system. Generally, it is considered an Aurora attack as a cyber attack
    30 in which the penetration into the communication network protection mechanisms and the remote control socket on a relay that activates the switch is possible. For example, physical access is not necessary for sophisticated, coordinated and potentially large attacks. Aurora attacks could leave large regions without power for considerable periods of time and thus may present a risk of
    35 domestic or national security. Although Aurora attacks can usually be
    P201590048
    05-21-2015
    prevent by guaranteeing network security and based on the above verifiers, it may be difficult or impossible to guarantee total network security in absolute terms.
    The present application discloses an apparatus, system and procedures to prevent attempts to
    5 desynchronized reconnection. In one embodiment, an intelligent electronic device (IED) such as a microprocessor-based relay includes a control component and a delay component. The control component can be configured to selectively control the opening and closing of a switch and selectively sends a closing signal to close the switch to connect a first portion of a system
    10 energy to a second portion of the energy system. In one embodiment, the delay component is configured to delay the emission of the closing signal to the switch. The delay component includes circuits that are independent of the control by the control component. The delay component can be unconfigurable from a remote location.
    15 The delay provided by the delay component within the IED can provide a robust and simple prevention of Aurora attacks. The delay can cause any Aurora attacks to fail because reconnection attempts are delayed for a long enough time until other protection mechanisms can prevent closure.
    20 out of sync. In addition, the delay component integrated within an IED provides unsynchronized closure protection without requiring additional devices or having a negative impact on reliability. The prevention mechanism is integrated in an IED or other device that is used for other purposes, and in this way the complexity, wiring or possible points of failure are not increased.
    25 As used herein, the term IED may refer to any microprocessor-based device that monitors, controls, automates, and / or protects monitored equipment within a system. Although the present disclosure provides embodiments of an IED generator, other embodiments may include any IED or device that
    30 controls the operation of a switch or synchronization between systems or devices. Equipment monitored by an IED can include conductors such as transmission lines, distribution lines, buses and the like, transformers, autotransformers, voltage regulators, tap-changers, capacitor banks, static VAR compensators, reactors, static synchronous compensators, inverters generators island
    35 generators, inertia, circuit breakers, switches, motors, fuses, loads, and
    P201590048
    05-21-2015
    Similar. The term IED can be used interchangeably to describe an individual IED or a system comprising multiple IEDs.
    Aspects of certain embodiments described herein may be implemented.
    5 document such as software components or hardware component. As used herein, the software component document may include any type of computer instruction or computer executable code located within or on a computer-readable storage medium or a computer-readable storage medium in a non-transient manner, and may Include microprograms A component of
    The software can, for example, comprise one or more physical or logical blocks of computer instructions, which can be organized as a routine, program, object, component, data structure, etc., which performs one or more tasks or Implement particular types of data.
    15 Some of the infrastructure that can be used with the embodiments disclosed in this document are already available, for example: general purpose computers, computer programming tools and techniques, digital storage media, and communication networks. A computer may include a processor, such as a microprocessor, a microcontroller, logic circuits, or the like. The processor can
    20 include a special use processing device, such as an ASIC, PAL, PLA, PLD matrix of on-site programmable doors (FPGA), or other programmable or custom device. The computer may also include a computer readable storage device, such as nonvolatile memory, static RAM, dynamic RAM, ROM, CD-ROM, disk, tape, magnetic memory, optical, ultrafast, or other storage media
    25 readable by computer.
    The terms "connected to" and "in communication with" refer to any form of interaction between two or more components, including mechanical, electrical, magnetic and electromagnetic interaction. Two components can be connected to each other, even if they are not in direct contact with each other, and even if there may be intermediate devices between the two components. For example, in many cases, a first component may be described herein as "connected" to a second component, when in fact the first component is connected to the second component by a third component, a cable section, an electrical trace , another first
    35 component, another second component, and / or another electrical component.
    P201590048
    05-21-2015
    Embodiments of the disclosure will be better understood by reference to the drawings, in which similar parts are designated by similar numbers throughout them. The components of the disclosed embodiments, described and generally illustrated in the figures herein, could be arranged and designed in a wide variety of different configurations. Thus, the following detailed description of the embodiments of the disclosure systems and procedures is not intended to limit the scope of the disclosure, as claimed, but is merely representative of possible embodiments. In other cases, well-known structures, materials or operations
    10 are not shown or described in detail to avoid hiding aspect of this disclosure. In addition, the steps of a procedure do not necessarily need to be executed in a specific order, or even sequentially, nor do they need the steps to be executed only once, unless otherwise specified.
    Turning to the figures on time, Figure 1 is a schematic diagram illustrating an embodiment of a control system 100 for selectively connecting or isolating a first portion of an electric power distribution system, which, as illustrated, comprises a generator 106 to or from a second portion of the power distribution system
    110. Control system 100 includes IED generator 102 and switch 104. The
    Generator 106 may be a synchronous generator or an induction generator such as a diesel generator, turbine generator, or other rotary electric generator. The power distribution system 110 may include electric power transmission systems, electric power distribution system, or the like along with associated equipment for electric power distribution. The power distribution system 110 can be activated
    25 by generator 106 and / or one or more additional generators.
    The IED generator 102 is configured to control the switch 104. The switch 104 is configured to selectively connect and isolate the generator 106 of the power distribution system 110. The IED generator 102 can also control the
    30 operation of the generator 106, for example the voltage and frequency of the electrical energy generated by the generator 106. The IED generator 102 can be configured to communicate in a network 108 with another device. For example, the IED generator 102 can be updated, programmed, and / or remotely controlled by the network 108. A further description of the IED generator 102 will be provided in relation to Figure 2.
    35
    P201590048
    05-21-2015
    Although the control system 100 is illustrated as the control connection between the generator 106 and the power distribution network 110, other power distribution and / or consumption systems may be included instead of the generator. For example, control system 100 can be used to connect a first generator to a second generator. In addition, the system
    Control 5 100 can be used to connect an island of generators to a power distribution system or a subset of a power distribution network to the rest of a power distribution network.
    Figure 2 is a schematic block diagram illustrating an embodiment of
    10 LED generator 102. The IED generator 102 includes the control component 202 and the delay component 204. In some embodiments, the IED generator 102 may include a counter component 206 and the communication component 208. The IED generator 102 can be configured to control the operation of switch 104 and / or generator 106 of Figure 1.
    15 Control component 202 can be configured to selectively control the opening and closing of switch 104. Control component 202 can control the closing of switch 104 by providing a closing signal to cause switch 104 to connect a generator to a system of Energy Distribution.
    20 Control component 202 may include a processor and memory storage instructions executable by the processor. In one embodiment, the control component 202 determines, using the processor, whether to issue a close signal based on the instructions stored in memory. The instructions in memory
    25 may include one or more software components to implement a variety of functions such as verifying if the generator 106 is synchronized with a power distribution system 110, synchronizing a generator 106 with a power distribution system 110, determining that the Switch 104 should close, and the like. In one embodiment, the control component 202 may emit a closing signal based on a
    30 one or more of the following, frequency level, voltage, phase angle, operator input or the like. Additionally, the control component 202 may emit a closing signal in response to information received from another device in the network 108.
    In one embodiment, the control component 202 can be programmed and / or reprogrammed to add or change the functionality. For example, the microprogram of the IED generator 102 is
    P201590048
    05-21-2015
    You can upgrade to add functionality or repair faults or errors. Such programmability can allow considerable improvements and functionality when errors are located or new functionality is created.
    5 The delay component 204 is configured to delay the emission of the closing signal to the switch 104. The delay component 204 can receive the closing signal from the control component 202 and delay the emission of the closing signal to the switch
    104. In one embodiment, the delay component 204 delays the emission of the closing signal for a delay time. The delay time may be sufficient to allow protective mechanisms of the IED generator 102m, the generator 106, or other protective mechanisms sufficiently to protect the synchronous reconnect generator 106. For example, one or more hardware or software components of the generator 106, the IED generator 102, or another device may provide insufficient protection for a short period after reconnection, and the delay time
    15 may be sufficient to delay the emission of the closing signal until the short period of vulnerability has passed. In one embodiment, the delay time may be ten seconds or more, for example between one minute and ten minutes. In one embodiment, the delay time is adjustable between absence of delay and ten minutes.
    In one embodiment, the delay component 204 delays the emission of the closing signal for a delay time measured from the reception of the closing signal from the control component 202.
    In another embodiment, the delay component 204 delays the emission of the closing signal
    25 during a delay time measured from an isolation of the generator 106 of the power distribution system 110. For example, the delay time can be measured from an isolation time of the generator 106 of the power distribution system 110, by example when switch 104 has been opened. This may provide a delay amount of the delay time or less between the moment the closing signal is
    30 emitted by the control component 202 and the moment in which the closing signal is emitted to the switch 104. In other words, if the closing signal is emitted for a time longer than the delay time following the isolation of the generator 106 , delay component 204 cannot delay the closing signal at all. However, if the closing signal is emitted by the control component 202 very shortly after isolation, the
    The closing signal can be delayed at most during the entire delay time.
    P201590048
    05-21-2015
    In one embodiment, the delay component 204 includes circuits independent of the control by the control component 202. In one embodiment, the delay component 204 may include circuits independent of the control by the control component 202 in 5 which the circuits are not controlled by a processor or other component of the control component 202. For example, the control component 202 cannot control the operation of the delay component 204. Also, the control component 202 cannot set a delay time, deactivate a delay. , and 7 or allow a delay provided by the delay component 204. In one embodiment, the delay component 204 may include a hardware-based timer such as an analog time circuit that cannot be controlled or configured by the control component.
    202. For example, hardware-based timing can be configurable only by physically modifying a hardware-based timing circuit or by physically modifying physical connections or switches. In another embodiment, the component of
    Delay 204 may include a software or digital timer but the control component 202 cannot provide electrical connections to the delay component 204 that allow the control component 202 to configure or control the delay component
    204.
    In one embodiment, a timer of the delay component 204 is actually hardware based. For example, in one embodiment, the timer is not implemented in an on-site programmable door array (FPGA) or any other reprogrammable environment. The timer can be an analog timer circuit. In one embodiment, the timer starts with the operation of a switch opening contact that
    25 can be triggered when switch 104 is opened by control component 202 or by an operator. For example, an operator can use the switch opening contact to isolate a generator 106 while using the supervised time output for closing. Alternatively, the timer can be started with the operation of a closing contact that closes in response to receiving the closing signal from the
    30 control component 202 or an operator. This embodiment may allow rapid reconnection and further prevent subsequent attempts to reconnect quickly.
    In one embodiment, the delay component 204 is configurable from a remote location. For example, delay component 204 cannot be configurable using a device 35 in communication with the IED generator 102 in a network. The delay component 204
    P201590048
    05-21-2015
    it can only be configurable in person by adjusting by physically modifying or otherwise configuring delay component 204.
    In one embodiment, delay component 204 includes a configuration component.
    5 hardware and delay component 204 is configurable on site using the hardware configuration component. For example, the hardware configuration component may include a dual in-line packet switch (DIP), bridge terminals, and / or other physical components that require physical manipulation to modify a delay time, disable the delay of the closing signal. , and / or allow the delay of the closing signal. By
    For example, a DIP switch with multiple switches can be set in a delay state by setting all the switches to an activated position. An intermediate delay can be set by setting some of the switches in a deactivated position and some of the switches in a deactivated position. In one embodiment, the hardware configuration component is the only way to allow,
    15 deactivate, or otherwise configure the delay component 204. In another embodiment, a bridge can be placed through a bridge terminal to enable or disable the delay and thus allow a "regular" or "Aurora" operation. "
    The delay component 204 that is not controllable by the control component 202 and / or
    20 unconfigurable from a remote location can provide strong protection against an Aurora attack. For example, if the control component 202 cannot control the delay component 204, a remote user cannot instruct the control component 22 to cancel or modify the operation of the delay component 204. Also, a remote user cannot reprogram. or modify the control component
    25 202 to disable the delay provided by the delay component 204 and any reconnection attempt will be delayed until other mechanisms can avoid and prevent any unynchronized closures. Thus, any individual who attempts to cause an unsynchronized shutdown must physically access the IED generator 102 to attempt to initiate the unsynchronized shutdown. Because physical security can be easier to guarantee
    30 that the security of the network and / or because an individual cannot be found in multiple power generation sites at the same time, any attempt to close out of sync can be blocked or have a limited range externally.
    In one embodiment, the IED generator 102 can be configured to detect changes in the delay component, and trigger an alarm when changes are made. For example, him
    P201590048
    05-21-2015
    The control component processor 202 can be configured to read the position of the DIP switch or jumper before activating a close command. If the position has been changed from a previous position, then the processor may issue an alarm. In another embodiment, the processor can be configured to periodically read the position of the DIP switch or bridge, read the position according to a program, or in case of an event such as, for example, a reception of an opening command, reception of a closing command, detection of a fault, reception of an alarm from another IED, or similar, and the issuance of an alarm if the position has changed. In another embodiment, the IED can be configured to, after detecting a change in the position of a DIP switch or bridge, take
    10 an action such as, for example, issuing an alarm, deactivating network access, deactivating front panel access, requiring a password before accepting a command, entering a secure mode, deactivating manual closing, or the like.
    Thus, delay component 204 implements a closing delay within the
    15 IED generator 102 which however cannot be circumvented due to the independence of the delay component 204 from the control component 202. If the delay component 204 was not independent, an unauthorized user who took control of the IED generator 102 could also set or disable the delay provided by delay component 204. Thus, the IED generator 102 of Figure 2 provides mitigation
    20 “Aurora” even if the entire delay has been attacked or reprogrammed remotely.
    In one embodiment, component 204 may include counter component 206. Counter component 206 may count a number of reconnection attempts. In one embodiment, the counter component 206 may allow a fixed number of attempts to reconnect in a specific period of time before delaying the emission of a closing signal to the switch 104. For example, the delay component 204 cannot provide any delay to a closing signal until the counter component 206 counts three attempts to reconnect within a period of one minute. Thus, the inclusion of the counter circuit can be used to allow a fixed number of rapid closing operations 30, which may be desirable in some settings, such as when a portion of a power distribution network is connected to another portion of The power distribution network. Any other fixed number of reconnection attempts and specific time period may be used in other embodiments. Like the delay component 204, the counter component 206 may be independent of the control of the
    Control component 202 and / or can be unconfigurable from a remote location.
    P201590048
    05-21-2015
    The IED generator 102 may include a communication component 208 to communicate with other devices. In one embodiment, the communication component 208 may allow the IED generator 102 to communicate with another device either directly or over a communication network such as the network 108. For example, an automation controller that controls the operation of the IED generator 102 and / or one or more additional systems or IEDs can communicate with the IED generator 102 by the communication component 208. Control commands, updates or other commands or signals can be sent to the IED generator 102 by the controller.
    10 automation or other device. In one embodiment the control component 202 may send instructions or other information to another device through the communication component 208.
    The IED generator 102 with the integrated delay component 204 prevents opening and
    15 Rapid closing of generator switch 104 which allows other mitigation procedures and devices to operate to prevent desynchronized closure. The delay provides considerable protection against Aurora attacks. Because Aurora attacks take advantage of the vulnerability of other protection mechanisms in a short period of opening time, the reconnection delay can give
    20 as a result of rapid reconnection, and thus the impossible Aurora attacks, the delay cannot be deactivated remotely and thus physical access may be necessary to carry out any desynchronized attack on a generator or other energy system. The delay provided by delay component 204 generally does not reduce performance because generators are normally not
    25 necessary to quickly reconnect to the power system after disconnection. In the worst case, even when a generator is accidentally disconnected, the shortest time for normal reconnection will often be of the order of several minutes. However, even if rapid reconnection is sometimes necessary, such as when a portion of the power distribution network is reconnected to another portion
    30 of the power distribution network, the counter component 206 may allow a fixed number of reconnection attempts before providing the delay. This can provide protection while still allowing for optimal rapid reconnection capability if necessary.
    35 An exemplary embodiment in which the rapid reconnection capability can be
    P201590048
    05-21-2015
    necessary is one in which one or more switches connect a portion of an energy distribution system that does not include rotating machinery to the rest of the energy distribution system. For example, two or more switches may be able to isolate the portion of the power distribution system that does not include rotating machinery and, if it is isolated or closed, may cause a synchronized closure between the portion of the power distribution system and the rest of the energy distribution system. This causes a fault in the line and could damage the rotating equipment, such as generators or electric motors, connected to the power distribution system in other places outside the portion of the power distribution system that does not include rotating machinery. Though
    10 It may be desirable to quickly reconnect different portions of the power distribution system, it may also be desirable to limit multiple openings and closures of a switch. In this case, the counter component 206 in one or more of the switches allows a fixed number of number of reconnection attempts before delaying any reconnection attempt.
    15 Figure 3 is an exemplary schematic diagram 300 illustrating the internal and external logical connection by way of example of an IED generator 102. IED generator 102 is shown which includes a control component 202 and a delay component 204. The component Control 202 includes an internal autosynchronizer 302 and a synchronizer 302. The
    20 delay component 204 includes a time delay on pick-up delay (TPDU) 306, a DIP switch 308, and a switch closure output switch
    310. Diagram 300 also illustrates external components that include an insulation component 312, an external autosynchronizer 314, a manual closing indicator 316, and a switch closing coil 318.
    25 The isolation component 312 is connected to a first input 320 of the IEP generator 102. The isolation component 312 can detect that an IED generator has been isolated from a power distribution system and provide a signal to the IED generator 102 indicating the isolation. In one embodiment the insulation component 213 detects
    30 Isolation of the generator or other power distribution system by detecting the opening of a switch. The insulation component 312 may be included within the IED generator 102 in one embodiment.
    The external autosynchronizer 314 and the manual closing indicator 316 are connected to the second input 322 of the IED generator 102. The external autosynchronizer 314 can be
    P201590048
    05-21-2015
    set to adjust one or more of the voltage, frequency and phase angle of the generator 106 with respect to the power distribution system 110 to synchronize the generator 106 and the power distribution system 110. The external autosynchronizer 314 can emit a signal indicating that the generator 106 is synchronized with the system of
    5 power distribution 110. Manual closing indicator 316 may indicate that an operator has attempted to initiate reconnection of switch 104 using a switch or other man-machine interface.
    The second input 322, connected to the external autosynchronizer 314 and the closing indicator
    10 manual 316 is arranged in the synchronization verifier 304 of the control component 202. The synchronization verifier 304 can determine if the generator 106 is synchronized with a corresponding power distribution system 110. The synchronization verifier 304 can receive the input of a variety of different sensors and / or devices to determine if the generator 106 is synchronized. If the verifier of
    Synchronization 304 determines that the generator 106 and the power distribution system 110 are sufficiently synchronized and / or receive a signal from the external synchronizer car 314 or the manual closing indicator 316 to close the switch 104, the synchronization checker 304 emits a authentic signal
    20 The internal autosynchronizer 302 of the control component 202, similar to the external autosynchronizer 314, can be configured to adjust one or more of the voltage, frequency, t phase angle of the generator 106 with respect to the power distribution system 110 to synchronize the generator 106 with respect to the power distribution system 110. The internal autosynchronizer 302 can emit an authentic signal indicating that the generator
    25 106 is synchronized.
    The output of the internal autosynchronizer 302 and the synchronization verifier 304 are combined through the O 330 function to create a closing signal line 324. The closing signal line 324 is configured to provide a closing signal to the component of
    30 delay 204, when the input of both the internal autosynchronizer 302 and the synchronization verifier 304 is authentic. In one embodiment, the closing signal comprises an "authentic" signal as output of function O.
    The first input 320 is connected to the TDPU delay 306. Upon receipt of the isolation indication of the generator 106, the TDPU delay 306 starts m timer. For example,
    P201590048
    05-21-2015
    When the input on the TDPU 306 delay is activated, a hardware-based timer is started and the TDPU 306 delay output is set to false until a delay time has elapsed.
    5 A delay time of the TDPU delay 306 is controlled by the DIP switch 308. The DIP switch 308 may include one or more switches that can be manipulated to set the delay 306 in two or more states. For example, the states may include a deactivated state, an activated state, and / or one or more delay time states. In one embodiment, the delay time is adjustable between 1 and 10 minutes or the
    10 delay can be deactivated completely. In one embodiment, DIP switch 308 can only be physically accessed by removing hardware from the IED generator chassis 102. DIP switch 308 also provides an output to control component 202 so that the current state of delay component 204 can be read by the control component 202 or a remote device.
    15 When the output of the delay TDPU 306 and the function O of the control component 202 are both authentic, and the function Y of the delay component 204 triggers the operation of the switch closing output switch 310. The output closing switch of switch 310 is connected to switch closure coil 318 that closes the switch
    20 104 in response to the delay component 204 that closes the switch closure output switch 310.
    As mentioned above the control component 202 can be implemented in microprogram or other instructions that can be executed by a processor, for example, the internal autosynchronizer 302, the synchronization checker 304, and / or the function O 330 can be Implement as code stored in memory. Also, the delay component 204 may be implemented independently of the control component 202 and may be unconfigurable by the control component 202. In one embodiment, the TDPU delay 306, the Y 332 function, the DIP switch 308, and / or the 30 switch closure output switch 310 can be implemented in non-programmable hardware. Because delay component 204 is implemented independently of control of control component 202, such as hardware, IED generator 102 prevents "Aurora" attacks even if an individual is able to achieve full control of IED generator 102 and reprogram the settings and / or the microprogram. For example, the IED generator 102 prevents unwanted closing of a switch under any
    P201590048
    05-21-2015
    Remote cyber attack scenario of up to and including the loading and execution of a modified microprogram image.
    Figure 4 is a schematic flow chart illustrating a method 400 for
    5 prevent desynchronized closing. The method 400 can be used by an IED that connects a power system to another power system. In one embodiment, the method 400 can be used to prevent the desynchronized closure between a generator and an energy distribution system. In another embodiment, the method 400 can be used in multiple IEDs to prevent the synchronized closure between a first portion of a
    10 energy distribution system and a second portion of the energy distribution system.
    The method 400 includes the selective emission 402 of a closing signal to cause a switch to connect a portion of an energy distribution system (such as, for example, a generator) to another portion of the energy distribution system. In one embodiment, the closing signal is emitted 402 by a control component of an IED generator. The control component can be configured to selectively control the opening and closing of the switch. The switch can be electrically placed between the first portion of an energy distribution system and another portion of the power distribution system.
    20 power distribution.
    Method 400 includes delay 404 of the output of the output signal to a switch using a delay component. The delay component may be a delay component of an IED generator. The delay component may include
    25 independent circuits of the control by the control component and the delay component can be unconfigurable from a remote location. In one embodiment, method 400 also includes counting a number of reconnection attempts using a counter component before delay 404 of the emission of the closing signal by the delay component.
    30 The above description provides numerous specific details for a thorough understanding of the embodiments described herein. However, the person skilled in the art will recognize that one or more of the specific details may be omitted, modified, and / or substituted by a similar procedure or system.
    35
    权利要求:
    Claims (17)
    [1]

    1.-An intelligent electronic device (IED) comprising:
    5 a control component configured to selectively control the opening and closing of a switch, in which the control component selectively emits a closing signal to cause the switch to connect a first portion of an energy distribution system to another portion of the distribution system of
    10 energy, and
    a delay component configured to delay the emission of the closing signal to the switch, in which the delay component comprises circuits independent of the control by the control component, and in which the component
    Delay 15 is unconfigurable from a remote location.
    [2]
    2. The IED of claim 1, wherein the delay component comprises a hardware configuration component and wherein the delay component is configurable in situ using the hardware configuration component.
    The IED of claim 2, wherein the hardware component comprises a switch.
    [4]
    4. The IED of claim 2, wherein the hardware component comprises a bridge terminal.
    [5]
    5. The IED of claim 2, wherein the delay component is configurable to a non-delay state in which the emission of the closing signal is not delayed.
    The IED of claim 2, wherein the emission of the closing signal is delayed by a delay time, in which the delay time is configurable by the hardware component.
    [7]
    7. The IED of claim 2, wherein the control component issues an alarm upon detecting a change in the configuration of the hardware configuration component.

    [8]
    8. The IED of claim 1, wherein the delay component comprises an analog timer circuit.
    The IED of claim 1, wherein the delay component comprises a time delay over the collection delay (TDPU).
    [10]
    10. The IED of claim 1, wherein the delay component comprises a counter component that allows a fixed number of reconnection attempts before delaying the emission of the closing signal.
    [11]
    11. The IED of claim 1, further comprising an isolation component for detecting the isolation of the first portion of the energy distribution system of the second portion of the energy distribution system.
    12. The IED of claim 11, wherein the insulation component detects the opening of the switch.
    [13]
    13. The IED of claim 11, wherein the first portion of the distribution system
    20 comprises a portion of an insulated power distribution network by opening the switch and one or more additional switches and in which the isolation component detects the opening of the switch and the one or more additional switches.
    [14]
    14. The IED of claim 1, wherein the delay component is configured to delay the emission of the closing signal for a delay time.
    [15]
    15. The IED of claim 14, wherein the delay time is measured from an isolation time of the first portion of the energy distribution system of the second portion of the energy distribution system.
    16. The IED of claim 1, wherein the control component is configured to communicate over a communication link with a remote device.
    [17]
    17.-A control system for controlling the connection of a first portion of an energy distribution system 35 to a second portion of the energy distribution system,

    comprising the control system:
    a switch; Y
    5 a microprocessor based relay comprising:
    a control component configured to selectively control the opening and closing of a switch, in which the control component selectively emits a closing signal to the switch to connect the
    10 first portion of the energy distribution system to the second portion of the energy distribution system; Y
    a delay component configured to delay the emission of the closing signal to the switch, in which the delay component comprises circuits 15 independent of the control by the control component and in which the delay component is unconfigurable from a remote location.
    [18]
    18. The control system of claim 17, further comprising a synchronization component.
    19. The control system of claim 17, wherein the synchronization component is internal to the IED.
    [20]
    20. The control system of claim 17, wherein the synchronization component 25 is external to the IED.
    [21]
    21. The control system of claim 17, wherein the first and second portions of the power distribution system are insulated by the switch and one or more additional switches.
    22. The control system of claim 17, wherein the first portion of the power distribution system comprises a rotary machine.
    [23]
    23. The control system of claim 17, wherein the rotary machine comprises a generator.

    [24]
    24. The control system of claim 17, wherein the delay component comprises a hardware configuration component and wherein the delay component is configurable in situ using the hardware configuration component.
    25. The control system of claim 24, wherein the control component issues an alarm upon detecting a change in the configuration of the hardware configuration component.
    10 26.-A procedure to prevent desynchronized closing, the procedure comprising:
    selectively control the opening and closing of a switch using a control component of an IED, in which the control component emits
    15 selectively a closing signal to cause the switch to connect a first portion of an energy distribution system to another portion of the energy distribution system; Y
    delay the emission of the closing signal to the switch using a component of
    IED delay, in which the delay component comprises circuits independent of the control by the control component and in which the delay component is unconfigurable from a remote location.
    类似技术:
    公开号 | 公开日 | 专利标题
    ES2547467B1|2017-12-15|Prevention of desynchronized reconnection between power systems
    ES2550501B1|2016-11-29|Detection and response to unauthorized access to a communication device
    CA2868859C|2015-04-28|Network access management via a secondary communication channel
    ES2556145B1|2017-01-26|Protection and control assisted by adaptive topology of electric power supply systems
    Zeller2011|Myth or reality—Does the aurora vulnerability pose a risk to my generator?
    KR101206095B1|2012-11-28|Intelligent Electric Device, network system including the device and the protecting method for the network
    RU2603012C2|2016-11-20|Device for protection of power compartments and method of protecting power compartments
    US10826324B2|2020-11-03|Mitigation of gratuitous conditions on electric power delivery systems
    US10469447B2|2019-11-05|Network access gateway
    Salmon et al.2009|Mitigating the aurora vulnerability with existing technology
    EP3224754A1|2017-10-04|Computer control system security
    Wang et al.2018|Cyber-attacks related to intelligent electronic devices and their countermeasures: A review
    CN107332864B|2020-01-03|Substation automation system directional collaborative network attack protection method based on global synchronous clock differentiation management
    US11108737B2|2021-08-31|Secure electric power delivery system protection during cyber threats
    Zeller2011|Common questions and answers addressing the aurora vulnerability
    US20130086680A1|2013-04-04|System and method for communication in a network
    ES2738685T3|2020-01-24|Device and procedure for monitoring the activity of processing units in an electric trigger
    CN210199556U|2020-03-27|Electrical device
    KR20190080604A|2019-07-08|Battery management sytem and battery pack incuding the same
    Burchill2018|Smart metering and its use for distribution network control
    Chan et al.2021|Toward Safe Integration of Legacy SCADA Systems in the Smart Grid
    同族专利:
    公开号 | 公开日
    US9478378B2|2016-10-25|
    BR112015015047A2|2017-07-11|
    AU2013371418A1|2015-06-04|
    MX2015006700A|2015-08-05|
    ES2547467R1|2017-02-28|
    CA2892275A1|2014-07-10|
    WO2014107415A1|2014-07-10|
    ES2547467B1|2017-12-15|
    US20140191591A1|2014-07-10|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US4249088A|1979-07-19|1981-02-03|General Electric Company|Automatic device for synchronization of prime mover with electrical grid|
    US4492874A|1982-04-26|1985-01-08|General Electric Company|Synchronization fuel control for gas turbine-driven AC generator by use of maximum and minimum fuel signals|
    US4829298A|1983-04-13|1989-05-09|Fernandes Roosevelt A|Electrical power line monitoring systems, including harmonic value measurements and relaying communications|
    SE441138B|1984-02-01|1985-09-09|Asea Ab|DIGITAL IMPEDANCE RELEASE|
    US4672501A|1984-06-29|1987-06-09|General Electric Company|Circuit breaker and protective relay unit|
    US4715000A|1985-08-06|1987-12-22|General Electric Company|Digital phase-locked loop and frequency measuring device|
    US5006846A|1987-11-12|1991-04-09|Granville J Michael|Power transmission line monitoring system|
    US5224011A|1991-04-19|1993-06-29|Gas Research Institute|Multifunction protective relay system|
    US5369356A|1991-08-30|1994-11-29|Siemens Energy & Automation, Inc.|Distributed current and voltage sampling function for an electric power monitoring unit|
    US6446682B1|1995-06-06|2002-09-10|James P. Viken|Auto-loading fluid exchanger and method of use|
    JP2508616B2|1992-12-21|1996-06-19|日本プレシジョン・サーキッツ株式会社|Sampling rate converter|
    CA2106357A1|1993-07-07|1995-01-08|Murty V. V. S. Yalla|Method for implementing selectable protective relay functions|
    US5534782A|1993-11-17|1996-07-09|Controlled Power Limited Partnership|Automatic reclosing circuit breaker using controllable feeder transducer|
    US5446682A|1994-03-21|1995-08-29|Square D Company|System for calibrating a line isolation monitor|
    US5473204A|1994-06-16|1995-12-05|Temple; Thomas D.|Time delay switch|
    US5721689A|1995-12-18|1998-02-24|Abb Power T&D Company Inc.|System and method for phasor estimation and frequency tracking in digital protection systems|
    US5825164A|1995-12-21|1998-10-20|Adb-Alnaco, Inc.|Inductance controller with load regulator|
    US5809045A|1996-09-13|1998-09-15|General Electric Company|Digital current differential system|
    US5805395A|1996-12-13|1998-09-08|Abb Power T&D Company Inc.|Half-cycle summation V/Hz relay for generator and transformer over-excitation protection|
    US5995911A|1997-02-12|1999-11-30|Power Measurement Ltd.|Digital sensor apparatus and system for protection, control, and management of electricity distribution systems|
    US6426856B1|1997-08-12|2002-07-30|Siemens Aktiengesellschaft|Method for monitoring a protective gear|
    US6324039B1|1997-10-15|2001-11-27|Schweitzer Engineering Laboratories, Inc.|Circuit for protection against slow circuit breaker closure during synchronization of a generator and an associated electrical system|
    US6148267A|1998-01-02|2000-11-14|General Electric Company|Method and apparatus for transmission line phase angle comparisons|
    SE511265C2|1998-01-21|1999-09-06|Abb Ab|Method and apparatus for controlling a secondary voltage of a winding switch transformer device|
    US6141196A|1998-03-02|2000-10-31|General Electric Company|Method and apparatus for compensation of phasor estimations|
    DE19818054A1|1998-04-22|1999-10-28|Siemens Ag|Protective switching device especially difference current protective circuit-breaker|
    US6366864B1|1999-05-05|2002-04-02|General Electric Company|Adaptive sampling rate based on power system frequency|
    US6121886A|1999-05-18|2000-09-19|General Electric Company|Method for predicting fault conditions in an intelligent electronic device|
    US6593520B2|2000-02-29|2003-07-15|Canon Kabushiki Kaisha|Solar power generation apparatus and control method therefor|
    JP3420162B2|2000-03-23|2003-06-23|西芝電機株式会社|Power grid connection protection device|
    GB2370702B|2000-09-19|2003-07-09|Toshiba Kk|Line linkage protective device for electricity generation equipment|
    US6815932B2|2000-10-12|2004-11-09|Capstone Turbine Corporation|Detection of islanded behavior and anti-islanding protection of a generator in grid-connected mode|
    US6590397B2|2000-10-19|2003-07-08|Schweitzer Engineering Laboratories, Inc.|Line differential protection system for a power transmission line|
    US6603298B2|2001-07-06|2003-08-05|Schweitzer Engineering Laboratories, Inc.|System for estimating the frequency of the power signal on a power transmission line|
    JP2003180036A|2001-10-01|2003-06-27|Canon Inc|Power converter, power conversion system, and method of detecting single operation|
    US6717394B2|2002-03-21|2004-04-06|Eaton Corporation|Method and apparatus for determining frequency of an alternating current signal of an electric power system|
    GB0208600D0|2002-04-15|2002-05-22|Nottingham University|Power converter|
    US6662124B2|2002-04-17|2003-12-09|Schweitzer Engineering Laboratories, Inc.|Protective relay with synchronized phasor measurement capability for use in electric power systems|
    US20030217293A1|2002-05-17|2003-11-20|Lee Tony J.|System for permitting access to an electronic device when the password is not known|
    US6934654B2|2003-03-21|2005-08-23|Schweitzer Engineering Laboratories, Inc.|System and method for exact compensation of fundamental phasors|
    WO2005076431A1|2004-01-11|2005-08-18|Michael Von Seidel|Switching system for controlling electrical loads|
    CA2476030A1|2004-06-09|2005-12-09|Wilsun Xu|A power signaling based technique for detecting islanding conditions in electric power distribution systems|
    US7230809B2|2004-06-21|2007-06-12|Schweitzer Engineering Laboratories, Inc.|System for checking synchronization of AC voltage sources before closing a power circuit breaker|
    CA2484951A1|2004-09-27|2006-03-27|Veris Industries, Llc|Method and apparatus for phase determination|
    US7432618B2|2005-04-07|2008-10-07|Pv Powered, Inc.|Inverter anti-islanding method|
    US7444248B2|2005-04-29|2008-10-28|General Electric Company|System and method for synchronized phasor measurement|
    JP4701024B2|2005-07-07|2011-06-15|株式会社日立国際電気|Amplifier with predistortion distortion compensation|
    US7480580B2|2005-10-18|2009-01-20|Schweitzer Engineering Laboratories, Inc.|Apparatus and method for estimating synchronized phasors at predetermined times referenced to an absolute time standard in an electrical system|
    US7328114B2|2005-12-09|2008-02-05|General Electric Company|Methods and systems for measuring a rate of change of frequency|
    US7906870B2|2006-10-13|2011-03-15|Pv Powered, Inc.|System and method for anti-islanding, such as anti-islanding for a grid-connected photovoltaic inverter|
    US7377184B1|2007-02-06|2008-05-27|Schlachter Raymond W|Multipurpose centralized flow detector|
    US7453674B2|2007-03-20|2008-11-18|Battelle Energy Alliance, Llc|Method for protecting an electric generator|
    US7904266B2|2007-05-22|2011-03-08|Abb Technology Ag|Method and apparatus for calculating the separation time of arcing contacts of a high-volume switchgear|
    WO2009042966A1|2007-09-28|2009-04-02|Schweitzer Engineering Laboratories, Inc.|Systems and methods for power swing and out-of- step detection using time stamped data|
    US8198753B2|2007-10-31|2012-06-12|Caterpillar Inc.|Power system with method for adding multiple generator sets|
    CN101866787B|2007-11-01|2013-06-19|湖北盛佳电器设备有限公司|Circuit interrupter with delayed function|
    US7557655B2|2007-11-05|2009-07-07|Schweitzer Engineering Laboratories, Inc.|Systems and methods for isolating an analog signal|
    EP2068336A1|2007-12-05|2009-06-10|ABB Technology AG|Protective relay and human-machine interface there for|
    US20100132916A1|2008-11-28|2010-06-03|Clean Burn, Inc.|Supplemental Transport Heater for Tanker Trailers|
    US8140283B2|2008-12-24|2012-03-20|Schweitzer Engineering Laboratories, Inc.|Independent frequency measurement and tracking|
    US20110241354A1|2010-03-31|2011-10-06|University Of Southern California|Multi-segment weight in wellbore energy storage and retrieval|
    EP2593952B1|2010-06-04|2015-03-18|ABB Technology AG|Control arrangement|
    ITVR20100168A1|2010-08-06|2012-02-07|Nice Spa|AUTOMATION SYSTEM|
    US20120181342A1|2010-08-12|2012-07-19|Jacqueline Richards-Fabian|Automatic HVAC energy saver control unit|
    BR112013007861A2|2010-10-01|2016-06-21|Abb Technology Ltd|dip switch change detection on a self-powered relay|
    JP4799712B1|2011-01-12|2011-10-26|三菱電機株式会社|Power switching control device and its closing control method|
    ES2746040T3|2011-03-03|2020-03-04|Abb Schweiz Ag|Control device to control a circuit breaker and corresponding methods|
    EP2664045B1|2011-04-08|2015-07-22|ABB Research Ltd.|Method for operating a recloser|
    US8718733B2|2011-06-09|2014-05-06|Varian Semiconductor Equipment Associates, Inc.|Superconducting fault current limiter recovery system|
    US9024472B2|2011-08-31|2015-05-05|Kimball P. Magee, Jr.|Power strips|
    US9287695B2|2012-02-15|2016-03-15|Consolidated Edison Company Of New York|Breaker control switch with a time-delay close function to mitigate an aurora event|
    US20140029152A1|2012-03-30|2014-01-30|Semisouth Laboratories, Inc.|Solid-state circuit breakers|EP3012420A1|2014-10-24|2016-04-27|Siemens Aktiengesellschaft|Method for synchronising a turbine with the power network|
    US10063124B2|2015-12-10|2018-08-28|Schweitzer Engineering Laboratories, Inc.|Shaft mounted monitor for rotating machinery|
    CN106936121B|2017-03-28|2021-12-10|四川大学|Direct-current line fault isolation and reclosing strategy mainly based on direct-current circuit breaker|
    WO2019212595A1|2018-05-01|2019-11-07|Sunbeam Technologies, Llc|Method and apparatus for torsional magnetic reconnection|
    US11245266B2|2018-11-13|2022-02-08|Kohler Co.|Offline synchronization of generators|
    CN109524997A|2018-11-16|2019-03-26|国家电网有限公司|A method of preventing water power station control system relay tip malfunction|
    US11239659B2|2019-06-10|2022-02-01|Schweitzer Engineering Laboratories, Inc.|Microgrid autosynchronizing using remote recloser inputs and outputs|
    US11218023B2|2019-06-10|2022-01-04|Schweitzer Engineering Laboratories, Inc.|Recloser control fast open circuit detection|
    法律状态:
    2017-12-15| FG2A| Definitive protection|Ref document number: 2547467 Country of ref document: ES Kind code of ref document: B1 Effective date: 20171215 |
    2018-06-12| FA2A| Application withdrawn|Effective date: 20180606 |
    优先权:
    申请号 | 申请日 | 专利标题
    US13/734,041|2013-01-04|
    US13/734,041|US9478378B2|2013-01-04|2013-01-04|Preventing out-of-synchronism reclosing between power systems|
    PCT/US2013/078093|WO2014107415A1|2013-01-04|2013-12-27|Preventing out-of-synchronism reclosing between power systems|
    [返回顶部]