WO2015047123A1

WO2015047123A1 - Fault detection in dual microprocessor electronic trip unit

Info

Publication number: WO2015047123A1
Application number: PCT/RU2013/000836
Authority: WO
Inventors: Johann Dorrer; Stanislav Sergeyevich PARFENOV; Sergey Valerievich Vinogradov; Maxim Alexandrovich NIKOLAEV
Original assignee: Siemens Aktiengesellschaft
Priority date: 2013-09-25
Filing date: 2013-09-25
Publication date: 2015-04-02

Abstract

The invention relates to a fault detection method and system in an Electronic Trip Unit (ETU). An ETU includes a Protection Function (PF) and a Metering Function (MF), each of the PF and MF measuring in parallel the same one or more power line parameters. A comparator compares the first measurement and the second measurement and outputs a fault signal when a disagreement is detected with a given level of accuracy between the first measurement and the second measurement. At least one further comparator may be used that compares the first measurement and the second measurement, and a voter circuit that collects signals resulting from each said comparing and detects a fault when at least one fault signal exists among said collected signals.

Description

FAULT DETECTION IN DUAL MICROPROCESSOR ELECTRONIC TRIP

UNIT

Field of the invention

The invention relates to fault detection methods and systems, preferably to a fault detection method in an Electronic Trip Unit (ETU).

Background art

Electronic Trip Units (ETU) are known in the art as microprocessor controlled multi-function overcurrent protection devices to be used in electric circuit breakers. ETUs monitor the current levels e.g. in a power circuit and, in the event of an overcurrent condition, microprocessor(s) included in the ETU determines whether and when the circuit breaker should trip to prevent damage that may be caused by said overcurrent condition, and the ETU sends a trip command to the circuit breaker that causes it to trip.

ETUs are subject to different faults, timely detection of which is desirable to ensure appropriate and reliable operation of a ETU while preventing its failures or false operation. The proposed invention aims at detecting faults in a dual microprocessor ETU of a circuit breaker. The detected faults may be software or hardware ones, including the faults in input circuits, e.g. analog front-end or analog-to-digital converter (ADC).

US 6,434,715 describes a method of systemic fault detection by maintaining a history of all faults taken place in an intelligent device (e.g. an ETU). The history is analyzed and it is decided whether a fault is systemic or not. However, the method of US 6,434,715 does not describe how a single fault is detected but rather is directed to analyzing faults to identify their nature, whether systemic or otherwise.

US 6,262,871 and US 6,330,141 disclose another approach to ETU failure detection. This approach consists in employing a watchdog circuit to continually monitor the status of a microcontroller of a circuit breaker. If the watchdog circuit fails to receive a pulse signal from the microcontroller at a regular interval, then it generates a fault signal and resets the microcontroller. This approach detects the microcontroller fault/hang but does not provide for detecting faults of other ETU components such as ADC, sensing circuit etc.

Therefore, the object of the present invention consists in providing a fault detection method in an Electronic Trip Unit (ETU), as well as a respective system, which avoid any or all of the above-mentioned drawbacks and provide for reliable fault detection in various components of an ETU.

Summary of the invention

This summary is provided to outline the aspects of the claimed invention and what is presently considered to be its preferred embodiments, and is not intended for defining the essential features of the claimed invention and/or limiting its scope. It should be understood that any combinations of features mentioned in any mutually different dependent claims are possible unless expressly stated otherwise. Other modifications and variations to the claimed invention will become apparent to persons skilled in the art within the scope of the present invention.

The object of the claimed invention consists in providing a fault detection method and system for detecting faults in an Electric Trip Unit (ETU), which enable a reliable detection of faults in various ETU components.

This object is achieved by means of the fault detection method in an Electronic

Trip Unit (ETU) and the fault detection system for detecting a fault in an Electronic Trip Unit (ETU).

In one aspect, a fault detection method in an Electronic Trip Unit (ETU) is provided, the method comprising performing, by a first measurement module PF MM, a first measurement of at least one power line parameter; performing, by a second measurement module MF MM, a second measurement of the same at least one power line parameter; comparing, by a comparator, the first measurement to the second measurement; and outputting, by the comparator, a fault signal when a disagreement is detected with a given level of accuracy between the first measurement and the second measurement.

In another aspect, a fault detection system for detecting a fault in an Electronic Trip Unit (ETU) is provided, the system comprising a first measurement module PF MM for performing a first measurement of at least one power line parameter; a second measurement module MF MM for performing a second measurement of the same at least one power line parameter; a comparator for comparing the first measurement to the second measurement and for outputting a fault signal when a disagreement is detected between the first measurement and the second measurement. In an embodiment of the claimed invention, the first measurement module is included in a Protection Function (PF), and the second measurement module is included in a Metering Function (MF). The comparator may be included in the PF or in the MF. The PF and the MF are connected by means of their respective communication modules (CM), which, in turn, are connected via a bi-directional communication bus.

In an embodiment of the claimed invention, the first measurement and the second measurement may be time stamped. Outputting the fault signal may trigger resetting the ETU or an alert via a human machine interface (HMI). The first measurement and/or second measurement may be transferred to the comparator together with information redundancy data to provide for reliable data transfer from the measurement modules to the comparator without causing an output of a fault signal due to a communication fault when no real ETU component fault is in fact detected. The information redundancy data may be a line code or a cyclical redundancy code (CRC). In an embodiment, the first measurement may be further compared to the second measurement by at least one further comparator included in the other one of the PF microcontroller or MF microcontroller; signals generated as a result of each comparing may be collected in a voter circuit; and then a fault may be detected based on the presence of at least one fault signal among the collected signals. This may be done by a voter circuit implemented e.g. as an AND gate or as an OR gate, or may be implemented using a more complex logic involving the collection of several sequential measurements and generating a fault signal depending on the measurement/fault history etc.

Brief description of the drawings

Implementations and embodiments of the claimed invention are illustrated by accompanying drawings, where:

Fig. 1 schematically shows the first implementation of the ETU fault detection system where a comparator is a part of the Protection Function (PF);

Fig. 2 schematically shows the second implementation of the ETU fault detection system where a comparator is a part of the Metering Function (MF);

Fig. 3 schematically shows the third implementation of the ETU fault detection system where comparators are included both in the Protection Function (PF) and the Metering Function (MF) and a voter circuit (VC) is connected to both comparators;

Fig. 4 schematically shows an embodiment of the third implementation, where a voter circuit (VC) is embodied as an AND gate.

Description of embodiments

The above mentioned features, steps, elements and/or advantages of the claimed invention and the manner of achieving them will become more apparent and clear with the following description of implementations and embodiments of the claimed invention in conjunction with the accompanying drawings. The description of embodiments and the accompanying drawings are intended only to illustrate exemplary embodiments of the claimed invention and should not be construed as limiting its scope.

The inventive fault detection method and system are implemented in an Electronic Trip Unit (ETU), which is connected to a power line. The ETU has two components: Protection Function (PF) and Metering Function (MF), each of which measures one or more power line parameters. In an exemplary embodiment, each of the Protection Function and the Metering Function are implemented as microcontrollers (hereinafter referred to as Protection Function microcontroller (PF C) and Metering Function microcontroller (MF μC) respectively). Both of the Protection Function and the Metering Function include at least one measurement module (MM) (hereinafter referred to as first measurement module (PF MM) and second measurement module (MF MM) respectively), and each of the Protection Function includes a communication module (CM) to communicate with another one of the Protection Function and the Metering Function. Communication between the CMs may be implemented using a communication line or link. In an exemplary embodiment, a communication bus is used for a bi-directional communication between the CMs of the Protection Function and the Metering Function, respectively, although many other embodiments of said communication line or link, both wired and wireless, will be readily apparent for those skilled in the art.

The first measurement module PF MM and the second measurement module MF MM each measure one or more parameters of the power line, such as current or voltage. It is important that the PF MM and MF MM should measure the same one or more parameters so as to compare them by means of a comparator. Besides, the parameters to be compared, which are measured by PF MM and MF MM, should be synchronized such that the comparator would compare the parameters measured by the two functions at or about the same time instant. For this purpose, in an exemplary embodiment the first and second measurements obtained by the first measurement module PF MM and the second measurement module MF MM respectively may be time stamped so as to define the respective first and second measurements to be compared. Alternatively, measurements carried out by PF MM and MF MM may be synchronized such that each of the functions performs a measurement of the same one or more parameters at the same time instant.

The ETU consisting of two components (PF and MF) according to the invention employs a Duplication With Comparison active redundancy scheme for detecting faults within the ETU. The main function of the Protection Function is to measure one or more power line parameters and to trip the circuit breaker (i.e. to break the power line circuit) if parameters are out of certain predefined ranges. The main function of the Metering Function is to measure the one or more power line parameters and to present them to the ETU operator e.g. by means of Human Machine Interface (HMI) or by means of any suitable communication interface. Each of the PF and MF comprises a microcontroller (PF μC and MF μC respectively) that implements the respective modules of the PF and MF, in particular the measurement module (MM) and communication module (CM) in each of the functions. It will be appreciated by ones skilled in the art that each of said modules may be implemented in the form of software and/or firmware components, as well as in the form of hardware components, and each module may consist of or comprise such software (analog-to-digital converter (ADC) driver, communication driver), firmware and/or hardware (e.g. analog-to-digital converter (ADC), communication hardware) components. Any feasible combination of hardware, firmware and/or software elements that implements the above-mentioned PF and MF components falls within the scope of this invention.

In all embodiments of this invention, the PF and MF measure the same one or more physical quantities that characterize the power line (e.g. currents, voltages etc.). The level of accuracy of the measurements performed by the PF and MF may be the same or may differ to a certain predefined extent. The same one or more parameters are measured by the PF and MF in parallel. The measurement results are compared by a comparator. If the measurement results of the first measurement and the second measurement of the same one or more power line parameters performed in parallel disagree with a given level of accuracy, the comparator outputs a fault signal. When the first fault occurs in a DWC system, the comparator detects a disagreement between the first measurement and the second measurement of the same one or more power line parameters and the normal functioning of the system stops. In such case, a fault signal output by the comparator may trigger resetting the ETU or e.g. an alert may be output by means of a respective HMI or a communication interface, depending on a particular application of the ETU and the fault detection system.

The fault detection system for detecting a fault in an ETU may be implemented in at least three different ways depending on where the comparator is located in the system. In the exemplary implementations, a comparator may be a part of the PF, MF or both. A typical comparator suitable for use in the fault detection system according to the invention will now be described, for the sake of simplicity, with reference to a case where the comparator is located in the PF firmware. Nevertheless, other alternative implementations of a comparator suitable for use in the fault detection system according to the invention, e.g. as a separate software, firmware and/or hardware component or as a part of another software, firmware and/or hardware component, will be readily apparent to ones skilled in the art. In the exemplary embodiment, the comparator is a PF firmware component that takes one input value from the Protection Function measurement module (PF MM) and the other input value from the Protection Function communication module (PF CM), which other input value is actually obtained from the Metering Function via the Metering Function communication module (MF CM) and the communication bus. The PF CM supplies the comparator with the value received from the MF CM over a bi-directional communication interface that took the value measured by the Metering Function measurement module (MF MM). Time synchronization of the values is required, which may be implemented, for example, by time stamping the measurements performed by the MF MM and PF MM to ensure that the values compared by the comparator have been measured at or about the same time stamp. The values to be compared by the comparator in each case may be the ones measured at the same time instant or at time instants that are within a certain predefined time window.

If the comparator determines that the compared values differ significantly, e.g. when the difference between them is beyond a predefined limit or threshold, this indicates a faulty operation of either PF or MF. In such case a fault signal is generated and output e.g. by the comparator. Fault signals may be implemented in different ways that are apparent to ones skilled in the art; by way of an example, a fault signal may be a software entity (event, flag etc.) or hardware entity (microcontroller output port etc.). The system and/or operator may react to the fault signal(s) in different ways that are readily apparent to ones skilled in the art depending on a particular application of the fault detection system and method according to the invention, for instance the fault signal may trigger an ETU reset due to the fact that the ETU stops functioning normally when a fault is detected, and/or an alert may be triggered, in particular to inform the operator of the fault in the ETU.

Communication between MF and PF, which is implemented by means of their respective communication modules (CMs) connected via a communication bus, must be reliable enough so that the fault detection system would not erroneously detect a fault when e.g. both the MF and the PF function properly but a fault detected by the comparator is due to inappropriate communication. In other words, reliable communication in the context of the present invention means that if the comparator detects a difference between the first measurement and the second measurement of the same one or two power line parameters, said difference must not be caused by communication faults. For this purpose, measured values may be communicated together with redundancy data, which is added to the transferred payload data to eliminate or reduce errors during data transfer. Redundancy data suitable for use in the present invention may have different forms and be processed by different methods that are apparent to ones skilled in the art. By way of an example but not limitation, redundancy data may be in the form of a cyclic redundancy code (CRC) or a line code.

Referring now to Fig. 1, in the first exemplary implementation the Electronic Trip Unit (ETU) comprises a Protection Function (PF) and a Metering Function (MF), each of which measures the same one or more power line parameters in parallel. For this purpose, each of the PF and MF include a measurement module (MM) respectively. In the exemplary implementation, the measurement modules are included in the Protection Function microcontroller (PF μC) and Metering Function microcontroller (MF μϋ) respectively. Besides, both PF and MF each have a communication module (CM), their CMs being also included in the PF μC and the MF μC respectively. The CMs are intended, in particular, for communicating measurement results, in this case from the MF to the PF, and are connected for this purpose by a communication bus. In this exemplary implementation, a comparator is a part of the Protection Function (PF) and is also included in the PF μC. The comparator (designated by a "=" sign on Fig. 1) takes one measurement value from the Protection Function measurement module (PF MM) and one from the Protection Function communication module (PF CM), the latter measurement value being obtained from the MF via the MF CM and the communication interface. The comparator compares the two measurement values and outputs a fault signal when a difference between the measured values e.g. exceeds a predefined threshold.

Referring to Fig. 2, in the second exemplary implementation the Electronic Trip Unit (ETU) comprises a Protection Function (PF) and a Metering Function (MF), each of which measures the same one or more power line parameters in parallel. For this purpose, each of the PF and MF include a measurement module (MM) respectively. In the exemplary implementation, the measurement modules are included in the Protection Function microcontroller (PF μC) and Metering Function microcontroller (MF μC) respectively. Besides, both PF and MF each have a communication module (CM), their CMs being also included in the PF μC and the MF μC respectively. The CMs are intended, in particular, for communicating measurement results, in this case from the PF to the MF, and are connected for this purpose by a communication bus. In this exemplary implementation, a comparator is a part of the Metering Function (MF) and is also included in the MF μC. The comparator (designated by a "=" sign on Fig. 2) takes one measurement value from the Metering Function measurement module (MF MM) and one from the Metering Function communication module (MF CM), the latter measurement value being obtained from the PF via the PF CM and the communication interface. The comparator compares the two measurement values and outputs a fault signal when a difference between the measured values e.g. exceeds a predefined threshold.

Referring to Fig. 3, in the third exemplary implementation the Electronic Trip Unit (ETU) comprises a Protection Function (PF) and a Metering Function (MF), each of which measures the same one or more power line parameters in parallel. For this purpose, each of the PF and MF include a measurement module (MM) respectively. In the exemplary implementation, the measurement modules are included in the Protection Function microcontroller (PF μC) and Metering Function microcontroller (MF μC) respectively. Besides, both PF and MF each have a communication module (CM), their CMs being also included in the PF μC and the MF μθ respectively. The CMs are intended, in particular, for communicating measurement results, in this case from the PF to the MF, and are connected for this purpose by a communication bus. In this exemplary implementation, unlike the first and second implementations, each of the PF and MF has its own comparator, by way of an example being also included in the PF μC and the MF μC respectively. The PF comparator (each of the comparators is designated by a "=" sign on Fig. 3) takes one measurement value from the PF MM and one from the PF CM, the latter measurement value being obtained from the MF via the MF CM and the communication interface. The MF comparator takes one measurement value from the MF MM and one from the MF CM, the latter measurement value being obtained from the PF via the PF CM and the communication interface. Each of the comparators compares the respective two measurement values and outputs a signal as a result of each comparison, which in this exemplary implementation is an error or fault signal in the form of a hardware signal via each of the microcontrollers' (PF μC and MF μC) output ports. In this exemplary implementation, each of the comparators is connected to a voter circuit (VC), which collects at its inputs the signals output by each of the comparators. The resulting fault signal output by the voter circuit indicates the detection of fault in this implementation. This exemplary implementation may be more reliable as compared to the first and second exemplary implementations as fault detection is be ensured in case of one of the microcontrollers' hanging. More specifically, in case one of the two microcontrollers (PF μΰ or MF μC) hangs, the other one will still detect the fault due to missing valid values at one of its comparator inputs.

Referring to Fig. 4, an embodiment of the third exemplary implementation is shown where the voter circuit (VC) is implemented as an AND-gate. This embodiment advantageously protects the system from random comparator failure, wherein the fault signal is generated if both comparators produce fault signals. However, ones skilled in the art shall appreciate that implementing the voter circuit in the system according to the invention as an AND-gate is only one example of possible implementations of the VC. In other implementations, the voter circuit may, by way of an example and not limitation, collect several sequential inputs from comparators, and generate the fault signal based on history and/or a more complex logic. In such case, a fault will be also detected if one of the two microcontrollers (PF μC or MF μC) hangs. The voter circuit (VC) may be implemented with an OR-gate; in case one of the microcontrollers hangs, one of the OR-gate inputs will be supplied with a fault signal, and the fault signal will be eventually output. The voter circuit suitable for use in the present invention may be implemented in different forms, e.g. hardware, software and/or firmware, which will be readily apparent for a person skilled in the art. By way of a non-limiting example, this may be a hardware or software logic, an integrated circuit etc. All such possible implementations of the voter circuit fall within the scope of this invention. It is important to note, however, that in any case the voter circuit is implemented outside of any of the PF or MF or their respective microcontrollers to ensure the proper functioning of the fault detection system in the ETU when one of the microcontrollers hangs.

The above-described invention provides a novel way of detecting faults in an Electronic Trip Unit (ETU). Existing software, firmware and/or hardware components may be advantageously used to implement the invention, with no or minimal additional components (voter circuit) in accordance with certain embodiments. The claimed invention advantageously provides a reliable method for detecting faults in the ETU, which is realized at low costs due to only minor modifications being necessary to the elements of an existing ETU, preferably to firmware or software components, such as PF μC and/or MF μC firmware. The claimed invention may be also advantageously implemented in an ETU with PF and MF, which uses "heartbeat messaging" to identify whether either of the PF and MF is available or not (e.g. when the respective PF or MF microcontroller hangs). For this purpose, "heartbeat messages" are transferred between the PF and MF; in accordance with the invention, such "heartbeat messages" may be substituted by measured value communications as described above, which may be considered as "heartbeat messages" in such a system if transferred regularly between the PF and MF. In such case, besides the ability to detect microcontroller hang, the system can also detect failures in input circuits of the PF and MF, for instance in their analog- to-digital converters (ADC). The method and system according to the present invention may detect faults in the power circuit of the PF and MF or current or voltage analog front-end of each of the PF and MF, ADC circuit of the PF and MF, either embedded in the respective microcontroller or implemented as an external integrated circuit; ADC driver in the PF and MF; any PF and MF firmware component that causes the respective microcontroller(s) to hang.

While the invention has been illustrated and described in detail with the help of preferred implementations, the invention is not limited to the disclosed examples. Other variations may be readily apparent to those skilled in the art without departing from the scope of protection of the present invention. Ones skilled in the art shall appreciate that any of the components of the claimed invention may be implemented using suitable hardware, software and/or firmware elements or combinations thereof. The above- described embodiments and implementations are provided as an aid in understanding the essence of the invention and should not be construed as limiting or defining its scope in any way. The scope of protection of the present invention is defined by the claims that follow. Any modifications or variants of the present invention that do not depart from the scope of the appended claims or equivalents thereof shall be construed as encompassed by the claims.

Claims

1. A fault detection method in an Electronic Trip Unit (ETU), the method comprising:

performing, by a first measurement module (PF MM), a first measurement of at least one power line parameter,

performing, by a second measurement module (MF MM), a second measurement of the same at least one power line parameter,

comparing, by a comparator, the first measurement to the second measurement; and

outputting, by the comparator, a fault signal when a disagreement is detected with a given level of accuracy between the first measurement and the second measurement.

2. The method of claim 1, wherein the first measurement module is included in a Protection Function (PF), the second measurement module is included in a Metering Function (MF).

3. The method of claim 2, wherein the comparator is included in the Protection Function (PF) or in the Metering Function (MF).

4. The method of claim 2, wherein each of the Protection Function (PF) and the Metering Function (MF) includes a communication module (CM), said communication modules (CM) being connected by a bi-directional communication bus.

5. The method of claim 1, wherein the first measurement and the second measurement are time stamped.

6. The method of claim 1, wherein outputting the fault signal triggers resetting the ETU and/or an alert via a human machine interface (HMI).

7. The method of claim 1 , wherein the first measurement and/or second measurement are transferred to the comparator together with redundancy data, wherein the redundancy data is preferably a line code and/or a cyclical redundancy code (CRC).

8. The method of claim 1 , further comprising the steps of:

comparing the first measurement to the second measurement by at least one further comparator;

collecting signals generated as a result of each said comparing in a voter circuit; and

detecting a fault based on the presence of at least one fault signal among the collected signals.

9. The method of claim 8, wherein the voter circuit is implemented as an AND gate.

10. A fault detection system for detecting a fault in an Electronic Trip Unit (ETU), the system comprising:

a first measurement module (PF MM) for performing a first measurement of at least one power line parameter,

a second measurement module (MF MM) for performing a second measurement of the same at least one power line parameter,

a comparator for comparing the first measurement to the second measurement and for outputting a fault signal when a disagreement is detected with a given level of accuracy between the first measurement and the second measurement.