COMMUNICATION BUS

FIELD OF THE INVENTION

The invention relates to a communication bus with at least one communication ring and a wind-turbine-converter system comprising inverters, inverter controllers, and a distributed error-handling system. The inverters of the wind-turbine-converter system are monitored by the inverter controllers and the inverter controllers are linked by the communication bus.

SUMMARY OF THE INVENTION According to a first aspect a method is provided of controlling a wind-turbine-converter system having a distributed error-handling system. The wind-turbine-converter system comprises at least two inverters and at least two of these inverters have an inverter controller. The inverter controllers are linked by a communication bus comprising at least one communication ring. The communication bus enables a control word to be circulated between the inverter controllers. The method, in response to detecting a fault in at least one of the inverters by the associated inverter controller, produces a control word indicative of the detected fault. The method, caused by the inverter controller of the faulty inverter, circulates the control word indicative of the detected fault to all other inverter controllers over the communication bus. The method causes the inverter controller of the faulty inverter and, in response to receiving the circulated control word indicative of the detected fault, the inverter controllers of the non-faulty inverters to perform a given fault-response action.

According to another aspect a wind-turbine-converter system having a distributed error- handling system is provided. The wind-turbine-converter system comprises at least two inverters having an inverter controller. The inverter controllers are linked by a communication bus comprising at least one communication ring. The communication bus enables a control word to be circulated between the inverter controllers. In response to detecting a fault in at least one of the associated inverters, the inverter controllers produce a control word indicative of the detected fault. The inverter controllers circulate the control word indicative of the detected fault to all other inverter controllers over the communication bus. The inverter controllers perform a given fault-response action, wherein the given fault-response action is performed in response to receiving the circulated control word indicative of the detected fault at least by the inverter controllers of the non-faulty inverters.

GENERAL DESCRIPTION, ALSO OF OPTIONAL EMBODIMENTS OF THE

INVENTION In some embodiments, the wind-turbine-converter system converts variable-frequency electrical power produced by a variable-speed wind turbine into fixed-frequency electrical power to be fed into an electrical grid.

For example, the converter system of a variable-speed wind turbine converts three-phase AC power with a variable frequency, produced by a wind-turbine generator depending on wind speed, to AC power of a fixed frequency, e.g. 50 Hz or 60 Hz, to be fed into an electrical grid.

The variable-frequency AC current is first converted to DC current by the converter system and then this DC current is converted to the AC current corresponding to the fixed-frequency electrical power. The DC current, for example, is turned back into a three-phase AC current by inverting the DC current, e.g. by using insulated-gate bipolar transistors (IGBTs). The AC current may be supplied to a transformer to produce high voltage, which can then be fed into the electrical grid, e.g. a local grid or utility grid.

The method disclosed is for controlling a wind-turbine-converter system having a distributed error-handling system. In some embodiments the wind-turbine-converter system comprises at least two inverters and each of these inverters has an inverter controller. In some other embodiments a plurality of inverters are controlled by a single inverter controller, which is associated with these inverters. The error-handling system comprises, for example, an individual error handler for each inverter, or more precisely an error handler for each inverter controller. One inverter, for example, is located in a nacelle of the wind turbine and another inverter is located at the base of the wind turbine tower. These inverters can therefore be called generator- side inverter and grid-side inverter, respectively. The inverter controllers are linked by a communication bus with at least one communication ring and the communication bus enables a control word, i.e. a data package, to be circulated between the inverter controllers. On an abstract level, the communication bus is a ring on which data packages, i.e. control words, are circulating. At each inverter controller the data packages might have a constant dwell time.

On a more detailed level one could say that the ring bus is not continuous but is broken at each inverter controller. In some embodiments a gap in the communication bus, for example, is created within each inverter controller by an interface connecting one end of the communication bus to an input of the interface and connecting the other end of the communication bus to an output of the interface. The data packages are then copied from the one end of the communication bus to the other end of the communication bus by the inverter controller, i.e. the data packages are copied from the input of the interface to the output of the interface.

If, in conjunction with this method, a fault in at least one of the inverters is detected by the associated inverter controller, a control word indicative of the detected fault is produced. The fault, for example, is detected using a volt meter, an ampere meter, or a combination thereof. The inverter controller surveils the associated inverters by evaluating voltage readings, current reading, or the like using sensors attached to the inverters. In some embodiments a different control word for each fault, that is to say, for each type of fault that may occur, is produced. Thereby, conclusions can be drawn on the basis of the control word produced as to what kind of fault has occurred and also what might be a root cause of the fault.

The method circulates the control word indicative of the detected fault to all other inverter controllers over the communication bus. The circulation is caused, i.e. initiated, by the inverter controller of the faulty inverter. In some embodiments all inverter controllers contacted through this circulation of the control word indicative of the detected fault work in unison, i.e. the inverter controller of the faulty inverter tells the other inverter controllers what to do.

The method causes the inverter controllers to perform a given fault-response action. In some embodiments this fault-response action comprises a power-output reduction of at least one of the inverters, in some other embodiments the fault-response action comprises a shutdown of at least one of the inverters and, in still other embodiments, the fault-response action comprises a combination thereof. In some embodiments the shutdown of the at least one inverter is performed by a shutdown procedure, which is one of a plurality of shutdown procedures associated with the detected fault.

In some embodiments the shutdown of the faulty inverter is performed directly, i.e. by the error-handling system associated with the inverter controller of the faulty inverter, while at the same time the other inverter controllers are contacted by the circulating control word indicative of the detected fault. In a second step the other inverters are also shut down by the respective inverter controllers.

In some embodiments all inverters are shut down by the associated inverter controllers by means of the control word indicative of the detected fault. The faulty inverter is not treated differently, i.e. the control word produced which is indicative of the detected fault is responsible for the shutdown of all inverters. This inverter shutdown should comprise giving shutdown commands to an already disabled, i.e. inoperable, inverter. The faulty inverter, for example, is disabled due to a catastrophic failure of semi-conductor switching elements of the inverter such as insulated-gate bipolar transistors (IGBTs).

In some embodiments the communication bus comprises at least two independent communication rings each enabling a control word to be circulated. The communication rings are unidirectional and are arranged in opposite directions. The communication bus is fault tolerant to a disruption of at least one of the communication rings. If all communication rings are disrupted at any one location, the control words, i.e. the data packages, can still travel back and forth in the remaining communication bus. If there are four inverter controllers and there is a disruption of all communication rings between two of the inverter controllers, bidirectional communication in the remaining 3/4 of the communication bus is still possible. In some embodiments, as already discussed above, each inverter controller comprises at least one interface connected to the communication bus. The input and output of the interface are connected to at least one of the communication rings, thereby routing the circulating control words, i.e. the data packages, through the interface. This routing comprises copying the data packages, i.e. the control words, from the input of the interface to the corresponding output of the interface of the same communication ring.

In some embodiments the at least two independent communication rings are synchronized by interrupts in each inverter controller. The inverter controllers run on an internal clock, which determines these interrupts. Thereby a constant dwell time of all data packages within the inverter controllers is ensured. Transmission of the data packages in both directions over the at least two opposing, i.e. antisymmetric, communication rings is synchronized by the interrupts.

In some embodiments the inverter controllers comprise a data-storage unit, e.g. a flash memory, for temporary data storage. A locally produced control word or a received circulating control word can be stored in the data-storage unit. During the interrupts of inverter controllers the locally stored control word and the currently circulating control word are compared to one another. The data packages, i.e. the control words, for example, are evaluated while being copied from the input of one of the interfaces to the output of the interface and are compared to the locally stored control word.

In the embodiments with synchronized communication rings all control words can be evaluated and compared to each other simultaneously. If, for example, a control word indicative of a fault is circulating in one direction over a first communication ring, this control word can be compared to a control word circulating in the opposite direction in a second communication ring and to a local control word, i.e. a control word locally stored in the inverter controller where the two circulating control words coincide. Several control words, i.e. data packages, may be circulating in one and the same communication ring at any given moment, so that several inverter controllers can compare at least three control words in one evaluation during the same interrupt.

In some embodiments the control words are prioritized according to a given hierarchy list, which is based on the severity of the detected faults. A voltage breakthrough of a semiconductor switching element, for example, is prioritized higher than an overheating of one of the inverters. The hierarchy list, for example, can be preprogrammed into the inverter controller. The hierarchy list can also be changed later on during operation, if, for example, a particular fault proves to have more dire consequences for the wind-turbine-converter system or the entire wind turbine than previously expected. The fault-response action corresponding to the control word with the highest priority is performed. The fault-response actions are, for example, different wind-turbine shutdown procedures. If, for example, the fault-response action corresponding to the overheating of one of the inverters comprises changing an angle of attack of wind-turbine rotor-blades by pitching the rotor-blades out of the wind for a slow and gradual shutdown of the wind turbine and the fault-response action corresponding to the voltage breakthrough of the semiconductor switching element comprises immediate stop of all switching activities and active energy dissipation to protect the faulty inverter from secondary damage, the latter fault- response action is chosen since the control word associated with this fault has a higher priority according to the hierarchy list.

In some embodiments the at least one communication ring comprises optical-fiber- communication lines with a delay that is shorter than 1 ms. In other embodiments the delay is shorter than 500 μβ, and in yet other embodiments the delay is shorter than 250 μβ. If a severe fault, for example, a voltage breakthrough of a semi-conductor switching element in an inverter, is detected by the associated inverter controller a fast reaction time is essential to protect the converter system or other parts of the wind turbine, e.g. a generator drive-train, from secondary damage or the like.

In some embodiments the distributed error-handling system comprises a dedicated error handler for each inverter. The dedicated error handlers are located in the associated inverter controllers and are enabled to communicate with a turbine-level handler comprised by a turbine-level controller. The turbine-level controller, as the name suggests, controls functions pertaining to the entire wind turbine and also communicates with subordinate controllers, e.g. inverter controllers, rotor-blade controller, generator controller, and the like. An inverter controller, for example, communicates in response to detecting a fault in one of the associated inverters with the turbine-level controller (via the error and turbine-level handlers), which in turn communicates with the rotor-blade controller to pitch the rotor-blades according to a chosen shutdown procedure, i.e. the shutdown procedure corresponding to the control word with the highest priority.

All inverter controllers are equal and comprise identical hardware and software components, e.g. an interface, a monitoring system, an error handler, and the like. Therefore, each of the inverter controllers can communicate with the turbine-level controller. The communication, for example, is initiated by the inverter controller of the faulty inverter.

In some embodiments the wind-turbine-converter system comprises at least one generator- side inverter, at least one grid-side inverter, and a DC-link. The DC-link connects the generator-side inverter(s) to the grid-side inverter(s). In addition, the DC link is used for voltage balancing between the generator- side inverter(s) and the grid-side inverter(s) by use of capacitors. In some embodiments the DC-link comprises at least two stacked strings, i.e. at least one string with a positive potential and at least one string with a negative potential. In some of these embodiments the DC-link also comprises a centerline at substantially zero potential. In some other embodiments one of the at least two strings is at substantially zero potential. In some embodiments the at least one generator- side inverter and the at least one grid-side inverter are arranged at distant locations. The at least one generator- side inverter is located in a nacelle of the wind turbine and the at least one grid-side inverter is located at a tower base of the wind turbine. The DC-link is provided by an elongated conductor arrangement comprising at least one positive conductor, at least one negative conductor, and a centerline conductor with essentially zero voltage.

Embodiments with a plurality of generator- side inverters and grid-side inverters comprise, for example, a common DC-link for all the generator- side and grid-side inverters, which are connected in series or are connected in parallel, or a combination thereof. The generator- side inverter(s), for example, turn a three-phase AC current received from the wind-turbine generator into DC current by rectifying the individual phases. In some embodiments each generator- side inverter is connected to an individual set of generator windings.

The wind-turbine-converter system disclosed has a distributed error-handling system. The wind-turbine-converter system comprises at least two inverters and each of these inverters has an inverter controller. The inverter controllers are linked by a communication bus comprising at least one communication ring. The communication bus enables a control word to be circulated between the inverter controllers. The inverter controllers produce, in response to detecting a fault in at least one of the associated inverters, a control word indicative of the detected fault. The inverter controllers circulate the control word indicative of the detected fault to all other inverter controllers over the communication bus. The inverter controller of the faulty inverter performs a given fault-response action. The inverter controllers of non- faulty inverters perform the given fault-response action in response to receiving the circulated control word indicative of the detected fault.

In some embodiments the wind-turbine-converter system is suitable for performing any combination of the methods claimed herein.

BRIEF DESCRIPTION OF THE DRAWINGS

Exemplary embodiments of the invention are now described, also with reference to the accompanying drawings, wherein

Fig. 1 illustrates an exemplary wind turbine equipped with a nacelle mounted on a wind- turbine tower, a rotatable hub, and three rotor blades,

Fig. 2 illustrates a stacked inverter topology for an exemplary wind-turbine-converter system, forming a positive string, a negative string, and a common centerline,

Fig. 3 illustrates a flow chart of an exemplary fault-response-action-notification propagating from an inverter controller of a faulty inverter to all other inverter controllers,

Fig. 4 illustrates an exemplary monitoring of an inverter by the associated inverter controller,

Fig. 5 illustrates an exemplary fault-response-action-notification propagating from an inverter controller of a faulty inverter over a communication bus to all other inverter controllers, Fig. 6a illustrates another exemplary fault-response-action-notification propagating from an inverter controller of a faulty inverter over the communication bus to all other inverter controllers with an additional communication bus fault,

Fig. 6b illustrates an attempted exemplary fault-response-action-notification propagating from an inverter controller of a faulty inverter over the communication bus to other inverter controllers with two additional communication bus faults,

Fig. 7 illustrates an exemplary prioritizing scheme of control words indicative of an inverter fault based on a hierarchy list of different inverter faults.

The drawings and the description of the drawings are of examples of the invention and are not of the invention itself.

DESCRIPTION OF EMBODIMENTS

In the exemplary embodiment illustrated by Fig. 1, a wind turbine 100 with a wind-turbine tower 101, a nacelle 102 on top of the tower 101, a rotatable hub 103 connected to the nacelle 102, and three rotor blades 104 connected to the hub 103 is shown.

The nacelle 102 is connected to the tower 101 by a yaw bearing allowing the nacelle 102 and thereby the rotor blades 104 to be turned into the wind. The base of the rotor blades 104, connecting the rotor blades 104 to the hub 103 is pitchable, i.e. the rotor blades 104 can be rotated in an axis perpendicular to the main axis through the hub 103 and the wind-turbine generator along a drive shaft. By pitching the rotor blades 104, an angle of attack can be chosen so that a given rotational speed of the hub 103, which is connected to the generator, is achieved.

By adjusting the rotational speed of the generator by pitching the rotor blades 104, a given output voltage is delivered to one or more generator- side inverters 2 of a wind-turbine converter system 1. An exemplary wind-turbine-converter system 1 with an extended DC-link 4 and with stacked inverter strings is illustrated in Fig. 2. Generator-side inverters 2a and 2a' and grid-side inverters 3a and 3a' form a first inverter string, whereas generator- side inverters 2b and 2b' and grid-side inverters 3b and 3b' form a second inverter string. Generator- side inverters 2a and 2a' are connected in parallel, as are generator- side inverters 2b and 2b'. The two strings are connected in series. The grid-side inverters 3a, 3a', 3b, and 3b' are arranged in an analogous manner.

The DC-link 4 comprises a positive conductor line 4a, which is connected to the first string, a negative conductor line 4b, which is connected to the second string, and a centerline conductor 4c, which is at substantially zero potential and, for example, is connected to ground by a capacitor. This capacitor allows unwanted AC-current components, e.g. produced by high frequency gating in the generator- side inverters 2, to be discharged. The parallel inverters, i.e. 2a and 2a', 2b and 2b', 3a and 3a', 3b and 3b', share a common inverter controller 12a, 12b, 13a, and 13b, respectively, as shown in in figures 5, 6a, and 6b. In an alternative embodiment each of the inverters 2a - 3b' has an individual inverter controller. The inverter controllers control the operation of the associated inverter(s). The inverter controllers 12a, 12b, 13a, and 13b of the exemplary converter system 1 illustrated by Fig. 2 stay in contact to each other over a communication bus 14. For redundancy reasons the inverter controllers 12a, 12b, 13a, and 13b use two independent communication channels, i.e. two communication rings 14a and 14b, simultaneously, as shown in figures 5, 6a, and 6b.

An exemplary fault-response-action-notification propagating from an inverter controller 12, 13 of a faulty inverter 2, 3 to all other inverter controllers 12, 13 of the converter system 1 is illustrated by Fig. 3 in form of a flow chart. The inverters 2 and 3 represent all generator- side inverters and grid-side inverters, respectively. The inverter controllers 12 and 13 represent the associated inverter controllers, i.e. applied to the exemplary wind-turbine-converter system 1 shown in Fig. 2, inverters 2 includes generator-side inverters 2a, 2a', 2b, and 2b' and inverter controllers 12 includes generator-side-inverter controllers 12a and 12b. The same applies to grid-side-inverters 3 and grid-side-inverter controllers 13 analogously.

Both the generator-side inverters 2 and the grid-side inverters 3 are monitored by the associated inverter controllers 12, 13, denoted by step 301 in Fig. 3. The monitoring is performed substantially continuously, but can in other exemplary embodiments be performed at given intervals, e.g. every 10 seconds. As long as no fault is detected by the inverter controllers 12, 13, (compare to "No"-path of step 302,) the continuous monitoring of the inverters 2, 3 is maintained. If a fault in an inverter 2, 3 is detected by the associated inverter controller 12, 13, (compare to "Yes"-path of step 302,) an error handler 5 affiliated with that inverter controller 12, 13 is contacted, denoted by step 303 in Fig. 3.

The error handler 5 first determines and then produces a control word 21 indicative of the detected fault, denoted by step 304 in Fig. 3. The control word 21 is, for example, an eight-bit data package, which allows up to 2 ⁸ = 256 different fault events to be encoded with this control word 21.

The control word 21 produced is circulated, denoted by step 306 in Fig.3, by the inverter controller which has detected the fault, e.g. the grid-side inverter controller 13a, to all the other inverter controllers 12, 13 over the communication bus 14, also shown in Fig. 5. Circulating in this context indicates that the inverter controller of the faulty inverter, which sends out the control word 21, also receives the sent control word 21 after it has completed a round trip through the communication bus 14. With receipt of the same control word 21 as the control word 21 sent, the sending inverter controller, e.g. 13a, gets confirmation that every inverter controller 12, 13 was reached and informed of the fault.

The control word 21 indicative of the fault is transmitted simultaneously in both directions of the communication bus 14, i.e. it is transmitted concurrently over communication rings 14a and 14b in opposite directions. Thereby, reaction time of all involved inverter controllers 12, 13 is reduced considerably as a signal -transmission path and therewith a signal -transmission time from the inverter controller of the faulty inverter, e.g. 13a, to the other inverter controllers 12, 13 is minimized. Without the two opposing communication rings 14a and 14b the control word 21 produced would have to take a round-trip in order to reach all inverter controllers 12, 13, as can be seen in Fig. 6a. When two identical control words 21 are sent in opposing directions through the communication rings 14a and 14b the signal-transmission path can be halved, as shown in Fig. 5.

While the control word 21 indicative of the detected fault is circulated, the error handler 5 also communicates with a turbine-level handler 9, denoted by step 305 in Fig. 3. The error handler 5 informs a turbine-level controller, which runs the turbine-level handler 9, of the detected fault and negotiates an appropriate fault-response action on a turbine level, e.g. a change in generator speed, a pitching of rotor-blades 104, or the like. Each inverter controller 12, 13 has such a communication path to the turbine-level handler 9, i.e. to the turbine-level controller. However, to avoid a communication jam, in this exemplary embodiment only one communication path between the turbine-level handler 9 and a single error handler 5 is active at any given time, which is the error handler 5 of the inverter controller that detected the fault.

Each inverter controller 12, 13 has a hierarchy list of potential fault events 20 and prioritizes control words 21 upon receipt according to this hierarchy list 20, denoted by step 307 in Fig. 3. A control word 21 corresponding to a major fault is assigned a higher priority than a minor fault, as it has a higher (hierarchical) ranking in the hierarchy list 20. Only the control word 21 with the highest priority is further evaluated by an inverter controller 12, 13, more precisely by the corresponding error handler 5.

Each inverter controller 12, 13 has a software logic 6 and the error handler 5 in each inverter controller 12, 13 communicates with the respective software logic 6 whenever a control word 21 is received with a priority higher than the priority of a previously received control word 21, denoted in step 308 in Fig. 3. The previous control word 21 corresponds to the fault- response action, which is currently executed by the software logic 6. The case where no fault- response action was executed by the software logic 6, i.e. when no fault had previously been detected, is also included. In that case, for example, an idle action is performed by the software logic 6, which corresponds to a control word 21 of the lowest priority, as shown in Fig. 7. Thereby, the execution of the most urgent fault-response action according to the fault- hierarchy list 20 by the software logic 6 is ensured.

The different fault-response actions facilitate different shutdown procedures of the converter system 1 and the wind turbine 100. The detection of a more severe fault, for example, demands a more rapid shutdown of the wind turbine 100 than a minor fault would. A small amount of overheating, for example, is not as urgent as a spark in one of the inverters 2, 3. The shutdown procedures are carried out by an interaction of the fault-response action performed by the software logic 6, triggered by the control word 21 corresponding to the detected fault, and the fault-response action performed by the turbine-level handler 9, denoted by step 309 in Fig. 3. An exemplary generator-side-inverter controller 12, labeled "Machine Side Inverter Controller (MSIC) 12, which monitors an associated generator- side inverter 2 by a monitoring device 11, is illustrated in Fig. 4. The inverter controller 12 has a volatile memory unit 30, labeled RAM 30, to store control words 21 locally. Alternatively, the inverter controller 12 can have a non-volatile memory device, e.g. a hard disc, to store the control word 21. The inverter controllers of the other inverters, both generator side and grid side, are issued the same as generator-side-inverter controller 12. The monitoring device 11 measures, for example, current and voltage input values of the generator- side inverter 2, current and voltage output values of the generator-side inverter 2, temperature values of the generator- side inverter 2, or a combination thereof. When the monitoring device 11 of the generator-side-inverter controller 12 detects signals which lie outside an allowed range and thereby indicate a fault of the generator- side inverter 2, the monitoring device 11 sends an output signal to an embedded- software framework 7 of the generator-side-inverter controller 12. More precisely the monitoring device 11 sends an error message that a fault was detected to an error handler 5 within the embedded-software framework 7. The error handler 5 produces a control word 21 indicative of the detected fault based on the received message from the monitoring device 11 and a previously stored hierarchy list 20 of faults corresponding to different error messages. The control word 21 produced is then circulated to all other inverter controllers of the wind-turbine-converter system 1 over a communication bus 14 in opposite directions. The generator-side-inverter controller 12 is connected to the communication bus 14 by an interface 10, which is linked to two individual communication rings 14a and 14b of the communication bus 14, see figures 5, 6a, and 6b. The links are labeled "Fast Link Ch. 1 " and "Fast Link Ch. 2". Both links are each connected to both communication rings 14a and 14b with individual inputs and outputs, enabling bidirectional communications between the inverter controllers of the wind-turbine-converter system 1. Depending on the inverter controller, i.e. the location of the inverter controller in the wind-turbine-converter system 1, e.g. the generator-side-inverter controller of the positive string 12a, the control word 21 produced is transmitted over communication ring 14a via the Fast Link Ch. 2 and transmitted over communication ring 14b via the Fast Link Ch. 1, or vice versa. The control word 21 produced causes a software logic 6 to perform the fault-response actions necessary to protect the wind-turbine-converter system 1 and the wind turbine 100 as a whole from secondary faults and damage. The software logic 6 initiates, for example, a shutdown procedure according to the severity of the detected fault. Furthermore, the error handler 5 contacts a turbine-level handler 9 controlling the wind turbine 100 on a higher level. The turbine-level handler 9, for example, controls the generator speed, pitching of rotor-blades, and energy dissipation in the DC-link. In an alternative setup the turbine-level handler 9 can also communicate with the software logic 6 to coordinate a smooth shutdown procedure.

As stated above, all these functions are provided by the other inverter controllers in an analogous manner.

An exemplary communication network consisting of four inverter controllers, namely the generator-side-inverter controllers 12a and 12b and the grid-side-inverter controllers 13a and 13b which are like the inverter controller 12 shown in Fig. 4, with a communication bus 14 between the inverter controllers 12a, 12b, 13a, and 13b is illustrated in Fig. 5. The generator- side-inverter controllers 12 are labeled MSIC (Machine Side Inverter Controller) and the grid- side-inverter controllers 13 are labeled LSIC (Line Side Inverter Controller). As described in conjunction with Fig. 2, the inverters 2a, 2b, 3a, and 3b and thereby the associated inverter controllers 12a, 12b, 13a, and 13b are divided into a positive string and a negative string.

The generator-side-inverters 2a and 2b and therefore the generator-side-inverter controllers 12a and 12b are located in the nacelle 102 of the wind turbine 100, while the grid-side- inverters 3a and 3b and therefore the grid-side-inverter controllers 13a and 13b are located in the base of the wind-turbine towerlOl .

The communication bus 14 consists of two independent and unidirectional communication rings 14a and 14b which provide a bidirectional communication between the inverter controllers 12 and 13, i.e. between the generator-side-inverter controllers 12a and 12b and the grid-side-inverter controllers 13a and 13b. The communication rings 14a, 14b are fiber-optic cables connected to the four inverter controllers 12a, 12b, 13a, and 13b. Control words 21 indicative of an "idle state" circulate continuously through the communication rings 14a and If an active supervision 8 of the wind-turbine-converter system 1 by one or more of the inverter controllers 12a, 12b, 13a, or 13b occurs, a control word 21 indicative of the supervision 8, i.e. indicative of a supervision message such as a fault-related over-current, is produced. The active supervision 8 is carried out, for example, by a monitoring device 11, which is detecting a voltage-output signal outside the allowed range and is therefore addressing the corresponding error handler 5 (see Fig. 4). The error handler 5 is producing the control word 21 in response to being addressed by the active supervision 8. In the exemplary communication network illustrated in Fig. 5, the grid-side-inverter controller 13a of the positive string executes an active supervision 8 of the wind-turbine-converter system 1. Upon receipt of an error message (line-dotted arrow) the error handler 5c in the embedded-software framework 7c of the grid-side-inverter controller 13a produces a control word 21 indicative of the detected fault and circulates the control word 21 produced to the other three inverter controllers, i.e. the other grid-side-inverter controller 13b located at the base of the wind-turbine tower 101 and the two generator-side-inverter controllers 12a and 12b located in the nacelle 103 of the wind turbine 100.

After producing the control word 21 the error handler 5c injects the control word 21, in order to circulate the control word 21 produced, in both communication rings 14a and 14b in opposite directions by means of the interface 10c, which is represented by two continuous arrows from the error handler 5c to the two links. A shortest, i.e. fastest, connection between the inverter controllers 12a, 12b, 13a, and 13b is indicated by continuous arrows, while a return path, i.e. the opposite direction of the communication bus 14, is indicated by dotted arrows.

The control word 21 indicative of the detected fault replaces the control word 21 indicative of the "idle state". The control word 21 indicative of the detected fault is also stored locally in the respective volatile memories RAM 30a, RAM 30b, RAM 30c, and RAM 30d.

The circulating control words 21, i.e. one control word 21 for each communication ring 14a, 14b, are copied at each interface 10a, 10b, 10c, and lOd from an input of the interface to an associated output of the interface for each of the communication rings 14a and 14b. Each interface 10a, 10b, 10c, and lOd has two inputs and two outputs; one input and one output for each communication ring 14a, 14b. The sections labeled "Fast Link Ch. 1 " and "Fast Link Ch. 2", each have an input of the associated interface connected to one communication ring and an output of the associated interface connected to the other communication ring, e.g. the "Fast Link Ch. 1 " of interface 10c has an output connected to communication ring 14a and an input connected to communication ring 14b and the "Fast Link Ch. 2" of interface 10c has an output connected to communication ring 14b and an input connected to communication ring 14a, as indicated by the arrows.

At each inverter controller the circulating control words 21 indicative of the detected fault are compared with the control word 21 stored locally in the volatile memory 30 while being copied from the input of the interface 10 to the output of the interface 10. If the received control word 21 indicative of the detected fault has a higher priority than the local control word 21, than the control word 21 received is passed on to a software logic 6, i.e. at generator-side-inverter controllers 12a the control word 21 is passed on to software logic 6a, at generator-side-inverter controllers 12b the control word 21 is passed on to software logic 6b, and at grid-side-inverter controllers 13b the control word 21 is passed on to software logic 6d. As described in conjunction with Fig. 4, the software logic 6 performs the fault-response actions necessary to protect the wind-turbine-converter system 1 and the wind turbine 100 from secondary faults. The shortest, i.e. the fastest, path from the error handler 5c, which produces the control word 21 indicative of the detected fault, to all four software-logic blocks 6a, 6b, 6c, and 6d within the four respective embedded-software frameworks 7a, 7b, 7c, and 7d, which perform the corresponding fault-response actions, are indicated by paths containing only continuous arrows. The error handler 5c also addresses the turbine-level handler 9 (line-dotted arrow), which controls functions of the wind turbine 100 on a higher level, as described in conjunction with Fig. 4. The circulating control words 21 are reset to the control word 21 indicative of the "idle state" after a given time has passed, e.g. after 10 seconds. The local control words 21, stored in RAM 30, that cause the software logic 6 to perform the corresponding fault-response actions remain unchanged since the control word 21 indicative of the "idle state" has the lowest priority according to the hierarchy list 20. The circulating control word 21 does not overwrite the local control words 21 during comparison of the two control words 21 when the circulating control word 21 is copied from the input of the interface 10 to the output of the interface 10. The exemplary communication network shown in Fig. 5 in the event of a disruption 15 of both communication rings 14a and 14b of the positive string of the wind-turbine-converter system 1 between the generator-side-inverter controller (MSIC) 12a and the grid-side-inverter controller (LSIC) 13a is illustrated in Fig. 6a.

Both fiber-optic cables of the communication bus 14 are broken at the disruption site 15 and therefore a direct communication between the grid-side-inverter controller 13a and the generator-side-inverter controller 12a is interrupted, which is indicated by dashed arrows.

The shortest, i.e. the fastest, communication path between the grid-side-inverter controller 13a, which executes an active supervision 8 of the wind-turbine-converter system 1, and the other inverter controllers 12a, 12b, and 13b, more precisely between the error handler 5c of the grid-side-inverter controller 13a and the software logic blocks 6a, 6b, and 6d, have changed accordingly.

Since control words 21 indicative of the "idle state" circulate continuously through the communication rings 14a and 14b, a disruption 15 of one or more of the communication rings 14a, 14b is immediately recognized by the inverter controllers adjacent to the disruption 15 as no control words 21 are any longer received over the damaged communication path, i.e. the section of the communication ring 14a, 14b between two inverter controllers where the fiber-optic cable is broken.

In the event of a disruption 15 as illustrated in Fig. 6a, the four inverter controllers 12a, 12b, 13a, and 13b stay in contact over the communication buses' 14 other route. However, the reaction time of the inverter controller 12a increases, i.e. the software logic 6a can perform the fault-response action corresponding to the control word 21 indicative of the detected fault only with a delay commensurate with an increased signal-transmission time of a longer route. The response that every inverter controller was reached with the control word 21 indicative of the detected fault also arrives at the inverter controller 13a, i.e. the sending inverter controller, with a delay.

The exemplary communication network shown in Fig. 5 in the event of a first disruption 15' of the communication ring 14a between the generator-side-inverter controller (MSIC) 12a and the grid-side-inverter controller (LSIC) 13a and a second disruption 15" of the communication ring 14b between the grid-side-inverter controller (LSIC) 13a and the grid-side-inverter controller (LSIC) 13b is illustrated in Fig. 6b. In that case, the grid-side-inverter controller 13a is isolated from the other inverter controllers 12a, 12b, and 13b as control words 21 produced by the error handler 5c of the grid-side- inverter controller 13a do not reach the software-logic blocks 6a, 6b, and 6d of the respective inverter controllers 12a, 12b, and 13b. The grid-side-inverter controller 13a is still reachable by the other inverter controllers 12a, 12b, and 13b as control words 21 produced by the respective error handlers 5a, 5b, or 5d can still reach the software-logic 6c of the grid-side- inverter controller 13 a.

As described in conjunction with Fig. 5, the inverter controllers adjacent to the disruptions 15' and 15", in the case illustrated by Fig. 6b the generator-side-inverter controller 12a and the grid-side-inverter controller 13b recognize these disruptions 15', 15" since no control words 21 indicative of the "idle state" are continuously circulating anymore.

If an inverter controller other than the grid-side-inverter controller (LSIC) 13a detects a fault of the associated inverter, a corresponding control word 21 could still be distributed to all inverter controllers, i.e. the control word 21 corresponding to the detected fault would still reach all four software logic blocks 6a, 6b, 6c, and 6d. Therefore, the wind-turbine-converter system 1 would shut down accordingly as if there were no disruptions 15', 15" of the communication rings 14a and 14b. However, the grid-side-inverter controller 13a could not confirm that an order to perform a given fault-response action (namely the fault-response action determined by the distributed control word 21) has been received and is being carried out accordingly.

An exemplary hierarchy list 20 and the according prioritizing of control words 21, i.e. overwriting of control words 21 with lower priority by control words 21 of higher priority, as implemented in the embodiments depicted in the figures 4, 5, 6a, and 6b is illustrated in Fig. 7.

The hierarchy list 20 depicted in Fig. 7 contains four types of fault states: no fault, minor fault, moderate fault, and major fault. Furthermore, the hierarchy list 20 contains three different wind-turbine-shutdown procedures: "RunDown", "RunDownStop", and "Stop". In an alternative embodiment a finer subdivision of fault types can be made. Also the direct faults, e.g. overheating, overcurrent, or the like, can be assigned a fault-response action, i.e. no type subsumption into minor, moderate, and major is done beforehand. Alternatively a combination of fault types and direct faults can be listed in the hierarchy list 20. Similarly the fault- response action can also be a smaller action that does not affect the entire wind turbine 100 such as, for example, homogenously reducing power output of all inverters of the wind- turbine-converter system 1 in the event of increased heat production in one of the inverters. In the exemplary hierarchy list 20 shown in Fig. 7, an increasing priority from 1 to 4 is assigned to an increasing severity of faults, respectively. An idle state when no fault has been detected is assigned the lowest priority of 1. Even the slightest fault in one of the inverters 2a, 2b, 3a, or 3b can change this idle state 22, 23, 24 should a fault-response action be required, i.e. if this fault is detected and has an entry and a corresponding fault-response action in the hierarchy list 20 or is subsumed under one of the fault types in the hierarchy list 20. Only a control word 21 of a higher priority can overwrite another control word 21.

If a minor fault is detected in the exemplary embodiment illustrated in Fig. 7, then the idle- state-control word 21 with a priority of 1 is changed 22 to a control word with a priority of 2 corresponding to a "RunDown"-shutdown procedure of the wind turbine 100. If a moderate fault is detected, then the idle-state-control word 21 with a priority of 1 is changed 23 to a control word with a priority of 3 corresponding to a "RunDownStop"-shutdown procedure of the wind turbine 100. If a major fault is detected, then the idle-state-control word 21 with a priority of 1 is changed 24 to a control word with a priority of 4 corresponding to a "Stop"- shutdown procedure of the wind turbine 100. In the exemplary embodiment illustrated in Fig. 7 there are four different control words 21 namely: an Idle-control word 211, a RunDown-control word 212, a RunDownStop-control word 213, and a Stop-control word 214. Incremental increases in priority can also occur, for example, when grid-side-inverter controller 13b detects a minor fault in the grid-side-inverter 3b and generator-side-inverter controller 12a subsequently detects a moderate fault in the generator-side-inverter 2b. In that case the circulating Idle-control word 211 is changed 22 in a first step to the circulating RunDown-control word 212 and is subsequently changed 25 in a second step to the circulating RunDownStop-control word 213. Similarly the circulating RunDownStop-control word 213 can be changed 27 to the circulating Stop-control word 214. The circulating RunDown-control word 212 can also be changed 26 to the circulating Stop-control word 214 directly.

These circulating control words 21 also overwrite any control words 21 stored locally in the volatile memories RAM 30a, RAM 30b, RAM 30b, or RAM 30d of the corresponding inverter controllers 12a, 12b, 13a, and 13b, if the local control words 21 have a lower priority than the circulating control word 21 received.

The circulating control words 21 are reset 28, i.e. the circulating control words 21 are changed back to the Idle-control word 211, after a given time expires. After, for example, ten seconds the circulating control word 21 is reset 28 to the Idle-control word 211 unless a new fault with a higher priority than the current control word 21 is detected within the given time.

Only the circulating control words 21 have such a timer function, e.g. by a predetermined bit sequence determining the time to live (TTL) of the circulating control words 21 with a priority higher than 1. This TTL is, for example, reduced by one while the circulating control word 21 is copied from an input to an output at an interface 10.

The local control words 21 stored in the volatile memories 30 remain unchanged until a circulating control word 21 with a higher priority than the priority of the local control word 21 is received by the corresponding inverter controller. The locally stored control word 21 causes the software-logic 6 to carry on with the fault-response action, i.e. the wind-turbine-shutdown procedure, corresponding to the local control word 21 while the circulating control words 21 are reset 28 to the Idle-control word 211.

With the reset control words 21 corresponding to an "idle state", i.e. the Idle-control words 211, the communication rings 14a and 14b can again be monitored for potential disruptions 15 by the inverter controllers 12a, lb, 13a, and 13b.

Although certain products constructed in accordance with the teachings of the invention have been described herein, the scope of coverage of this patent is not limited thereto. On the contrary, this patent covers all embodiments of the teachings of the invention fairly falling within the scope of the appended claims either literally or under the doctrine of equivalents.