US20130058140A1

US20130058140A1 - Method for limiting the generator voltage of a photovoltaic installation in case of danger and photovoltaic installation

Info

Publication number: US20130058140A1
Application number: US13/667,532
Authority: US
Inventors: Matthias Victor; Gerd Bettenwort; Frank Greizer; Adrian Haering; Joachim Laschinski
Original assignee: SMA Solar Technology AG
Current assignee: SMA Solar Technology AG
Priority date: 2010-05-03
Filing date: 2012-11-02
Publication date: 2013-03-07
Also published as: DE102010017746A1; CN102939661B; JP5830802B2; JP2013534125A; EP2567405A1; WO2011138314A1; JP2013530664A; US8837098B2; WO2011138319A1; CN102939660B; EP2567406B1; CN102939660A; EP2567405B1; CN102939661A; US20130057989A1; DE102010017747A1; EP2567406A1

Abstract

An inverter operable to interface with a generator that has a number of partial strings includes an inverter bridge circuit configured to connect to the partial strings, and a control device operably associated with the inverter bridge circuit. The inverter further includes a series-connection switching device configured to selectively connect the partial strings in series in response to a control signal from the control device such that the series-connection switching device interrupts the series connection of the partial strings in case of a hazard condition detected by the control device.

Description

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of International Application number PCT/EP2011/057035 filed on May 3, 2011, which claims priority to German Application number 102010016753.3 filed on May 3, 2010, and German Application number 102010017746.6 filed on Jul. 5, 2010.

FIELD

The present invention relates to a photovoltaic installation with a device for the limitation of voltage in case of a hazard. In particular, the invention relates to a device that ensures that voltages or voltage differences in an installation of this type will not exceed a given hazard limit value, in case of a hazard or potential hazard to persons or property. The invention also relates to a method for limiting a generator voltage in case of a hazard.

BACKGROUND

As decentralized energy supply facilities become more widespread, specifically solar power installations, which are installed on the roofs of houses, on commercial buildings or on open ground, there is increasing awareness of the fact that, in case of a hazard such as fire or storm, or for the conduct of maintenance operations, a reliable facility must be available for the conductive parts of these installations to be made safe at any time. The accessibility or effectiveness of disconnection devices may be compromised in case of a hazard, in that preliminary damage associated e.g. with the effects of heat and smoke may preclude the reliable and sustainable action of safety measures or prevent access to tripping mechanisms. In consequence, for example, extinguishing measures on the roof frame of a burning house cannot be undertaken when there is a risk that fire fighters might be injured by the high d.c. (direct current) voltages associated with a photovoltaic installation, which may still be operational.
For the protection of persons and for the prevention of material damage by high d.c. voltages in a photovoltaic installation, DE 102005018173 proposes a device whereby the generator of the installation is short-circuited by means of a protective device that is arranged close to the generator. A disadvantage of this embodiment is the fact that, in the case of a fire, the protective device will rapidly get damaged and can no longer be activated. Furthermore, over the course of time, the device will be exposed to considerable stresses by the extreme weather conditions and temperature fluctuations, which may impair the functionality. A further disadvantage of this embodiment is that the delivery of energy, to the building and consequently to an electricity grid via an inverter that is connected to the generator, is no longer possible.
Publication DE 102006060815 discloses a switching element, associated with a respective photovoltaic module, that is arranged in such a way that when the switching element is activated the associated module is de-energized. The switching element is activated by means of a high-frequency signal that is modulated on the d.c. line. Here too it is a disadvantage that over the course of time the switching element is exposed to considerable stresses by the extreme weather conditions and temperature fluctuations, which may impair the functionality, and in the case of a fire will rapidly become damaged and possibly can no longer be activated. Furthermore, in the solutions described in DE 102006060815, the delivery of energy to an electricity grid via an inverter is likewise precluded, given that, in all disclosed embodiments, the generator is de-energized. Moreover, the arrangement of a switching element at each module in a potentially multiple number of strings is associated with a not inconsiderable level of expenditure on circuitry.

SUMMARY

In one embodiment the present invention comprises a device/method that provides, in case of a potential hazard, the possibility for the reliable and permanent limitation of the voltages or voltage differences generated by the generators of a photovoltaic installation on the electric power lines of the installation, to the extent that measures for the control of the hazard concerned can be undertaken with no risk of injury to the emergency service personnel deployed for this purpose. At the same time, in one embodiment it is still possible to feed power into an electricity grid at a reduced voltage via an inverter that is connected to the generator.
The photovoltaic installation according to one embodiment of the invention comprises an inverter for feeding electrical energy generated by a generator of the installation into an electricity grid, in particular an a.c. (alternating current) grid. The generator is divided into a number of partial strings that can be connected in series by means of a series-connection switching device that is integrated in the inverter and is controlled by a control device. Each of the partial strings has a number of modules or individual solar cells that are configured such that the value of the open-circuit voltage at each partial string does not exceed a hazard limit value (e.g., such as one defined by the statutory authorities). In case of a hazard, the series-connection switching device ensures that the electrical connection between the partial strings is opened, such that voltages or voltage differences at the electrical lines between the inverter and the partial strings can no longer exceed the hazard limit value.
A partial string generally comprises series-connected modules, which in turn comprise series-connected solar cells. Depending upon the type of module used, the voltage rating of the module may be such that the hazard limit value will be exceeded if two modules are connected in series. In this case, a partial string may also comprise a single module. A partial string may also comprise a number of parallel-connected strings, the voltage rating of which does not exceed the hazard limit value.
The statutory hazard limit value may be subject to regional variations, although a voltage of e.g. 120 V is possible, other limiting values may be stipulated within a range of 60 V and 150 V, e.g. 100 V.
In one embodiment of the invention, the generator connected to the inverter has at least three partial strings that are to be switched in series by the series-connection switching device. With this configuration the value of the overall generator voltage may exceed the peak voltage of the electricity grid (e.g. 350 V) at the optimum operating point of the generator, such that feeding power to the electricity grid is possible without the use of a step-up converter in the inverter. At the same time, the open-circuit voltage of the individual partial strings can remain below the hazard limit value specified above. If three partial strings are used, however, it will frequently be necessary for the generator to operate at a higher voltage than that associated with the maximum power output of the generator concerned, in order to ensure that the peak voltage of the electricity grid is exceeded. Accordingly, it may be advantageous to connect a minimum of four partial strings in series, thereby allowing the generator to operate at the operating point for maximum power output, whereby the open-circuit voltage of the individual partial strings can remain below a hazard limit value of 120 V. When different hazard limit values apply, the number of partial strings required for achieving this effect may be defined accordingly.
In one embodiment the series-connection switching device has a number of switches that are controllable by means of a control device such that, when the photovoltaic installation is in operating condition, an electrical connection is closed between adjacent partial strings, and this connection is opened under potentially hazardous conditions. The switches may be, for example, mechanical switches, such as relays, or semi-conductors, specifically power semi-conductors such as MOSFETs, IGBTs or thyristors.
By integrating the series-connection switching device in an inverter housing, a straightforward installation of the safety system can be achieved. At the same time, the reliable tripping of the safety system in case of a hazard is significantly enhanced, specifically if all associated components are arranged in the inverter housing where, for a considerable time at least, these components will be protected not only from damage associated with the effects of smoke and heat, but also from the effects of weathering, which are typically encountered in the vicinity of a generator. It goes without saying that the series-connection switching device may also be housed in a separate box that is positioned close to the inverter. The term inverter therefore also covers an inverter device in which subcomponents of the inverter, for example due to retrofitting, upgrading or conversion of an existing installation, are housed in separate housings that are then arranged close to one another, for example in a common switchgear cabinet or in the same room of a building.
Optionally, the inverter can additionally comprise a parallel-connection switching device that has, like the series-connection switching device, also a number of switches that are configured in such a way that they connect the individual partial strings with each other in parallel in the closed state. The type of possible switches corresponds to those of the series-connection switching device in one embodiment.
The parallel-connection switching device is typically actuated when the series-connection switching device has opened the electrical connection between adjacent partial strings. In this state, it is also guaranteed that voltages or voltage differences occurring in the installation will not exceed the hazard limit value. Additionally, in this state, it is also possible for the generator to continue the feeding of electric power to the electricity grid at a reduced voltage via the inverter. In this case, for feeding power to the electricity grid, it will at first be necessary for the generator voltage to be converted to a sufficiently high d.c. voltage by means of a step-up converter. In this way, for example, the feeding of power can be continued during the execution of prolonged maintenance operations in the vicinity of the generator, as the risk to persons undertaking the execution of maintenance can be sufficiently restricted by the reduction of the generator voltage. In case of the occurrence of spurious alarms, the continuation of power feeding can also help to avoid unnecessary loss on the energy output of the photovoltaic installation concerned. Even in case of fire, the continuing feeding of power from a photovoltaic installation according to the invention would pose no hazard to emergency service personnel.
It is also possible that the switches of the series-connection switching device and the parallel-connection switching device might be closed simultaneously, such that, under these conditions, the connected partial string will be short-circuited, thereby also eliminating any hazard associated with the generator voltage.
Alternatively, the short-circuiting function can also be achieved by means of an additional short-circuiting device in the inverter that is arranged between the electric lines connecting the generator and the inverter.
A d.c. disconnecting device may additionally be provided, by means of which an inverter bridge of the inverter and the generator may be disconnected from each other. The short-circuiting device and the d.c. disconnecting device may also be provided with switches of the type listed with reference to the series-connection switching device.
As an option, the photovoltaic installation may also additionally comprise a grounding device that has, just like the series-connection switching device and the parallel-connection switching device, a number of switches that are configured such that when being in the closed position at least one of the terminals of at least one of the partial strings is connected to ground. The grounding device may comprise switches of the type listed with reference to the series-connection switching device.
Typically, the grounding device is actuated when the series-connection switching device has opened the electrical connection between adjacent partial strings. In this state, depending upon the presence or absence of a ground connection for the components of the photovoltaic installation, voltages at the partial string with respect to ground may exceed the hazard limit value. This is prevented by establishing a specific potential on one terminal of the partial string by means of the grounding device. The grounding device can also be activated in conjunction with the parallel-connection switching device.
Using the switches of the grounding device, it is also possible that both terminals of the partial string may simultaneously be connected to ground such that, in this state, the connected partial string is short-circuited via ground, thereby also eliminating any hazard associated with the generator voltage. A safe condition can also be achieved by establishing a connection to ground between all the partial strings.
In one embodiment the series-connection switching device, the parallel-connection switching device, the grounding device, the short-circuiting device and the d.c. disconnecting device are controlled by a central control device, depending upon the existence of an operating state or signal that is associated with a given hazard situation. To this end, the control device can be configured to recognize operating states of the photovoltaic installation that are associated with a hazard condition, such as variations in the electrical parameters of the photovoltaic installation that are typically indicative of a hazard. The control device can also be configured to receive a signal that is associated with a given hazard condition and that may be generated by the inverter itself, e.g., when the latter detects an islanding situation. The signal may, however, also be generated outside the inverter, for example, by a separate sensor device or by a manual emergency shutdown device and may be transmitted to the inverter. The transmission of the signal to the control device may be carried out by means of an electrical control cable, by a wireless connection, or via the existing d.c. or a.c. lines routed to the control device. Although wireless connection may be provided in the form of a radio link, other options for wireless signal transmission are also possible, like infrared, acoustic or ultrasound transmission, mechanical actuators, hydraulic actuators or pneumatic actuators.
In a method according to the invention, the installation is initially operated at a generator voltage that exceeds the hazard limit value. In this operating state, the installation will typically operate with a special efficiency. Immediately when a hazard condition is detected, the installation is restricted to a generator voltage that lies below the hazard limit value.
A hazard situation or hazard condition may exist in case of an islanding situation, i.e. when the inverter is disconnected from the electricity grid or when the electricity grid is shut down, when an electric arc or ground fault is detected on the electrical lines of the photovoltaic installation, or when a generator disconnection device, e.g. a so-called “electronic solar switch”, is tripped on the inverter. A hazard situation or hazard condition may also occur when a manual emergency shutdown device is actuated, when variations in electrical parameters of the photovoltaic installation are detected that are typically indicative of a hazard, or in case of the response of external sensors, such as temperature sensors, smoke detectors or infrared detectors. If the photovoltaic installation forms part of a data network with other adjoining photovoltaic installations or inverters, or with other communication units, a signal associated with a hazard situation may also be transmitted from one installation to the next, such that the installations can respond jointly to the hazard situation concerned.
A continued feeding of electric power into an electricity grid to which the photovoltaic installation is connected can be achieved, despite the reduction of the generator voltage, provided that the generator voltage that has been reduced below the hazard limit value is at first raised by means of a step-up converter to a d.c. value that is sufficiently high for an inverter bridge to generate an a.c. voltage that can be fed into the electricity grid. For example, the step-up converter can raise a generator voltage of less than 120 V to an intermediate circuit voltage in excess of 325 V, thereby allowing the direct feeding of electric power into a public electricity grid.
In one embodiment of the method according to the invention, the individual partial strings of the generator, in case of the operation of the photovoltaic installation above the hazard limit value, will operate in a series connection, which may be provided, e.g., by the series-connection switching device described above, whereas the reduced generator voltage is achieved by the operation of the partial strings in a parallel circuit arrangement, which may be provided, e.g., by the parallel-connection switching device described above. Accordingly, upon the detection of a hazard condition, there is a switchover of the partial strings from series connection to parallel connection.
As an option, the method may be extended to include a further act, in which, in response to the detection of a hazard condition, an electrical connection is established between at least one of the terminals of at least one of the partial strings and ground, thereby establishing a specific potential on this terminal with respect to ground. A ground connection of this type may be established, e.g., by the grounding device described above.
According to a further embodiment of the method, the generator voltage can be set by the current or voltage control system of an inverter to a voltage that lies below the hazard limit value.
In another embodiment of the method according to the invention, the setting of the generator voltage to a value below the hazard limit value is achieved by the short-circuiting of at least one partial string of the generator, including short-circuiting via ground. This short-circuiting of at least a part of the generator can also be applied as an additional measure after the generator voltage has been reduced to a level that lies below the hazard limit value, e.g., when the further feeding of electric power into an electricity grid is no longer possible. In this case, in the absence of short-circuiting, the generator voltage would otherwise possibly rise to a value that exceeds the hazard limit value. This short-circuiting function may be actuated, for example, in case of the detection of an islanding situation by the inverter.

BRIEF DESCRIPTION OF THE DRAWINGS

Further properties, features and advantages of the invention will arise from the following detailed description of embodiments of the invention, with reference to the attached drawings.

FIG. 1 shows a photovoltaic installation according to one embodiment of the invention,

FIG. 2 shows a further photovoltaic installation according to one embodiment of the invention, with an additional parallel-connection switching device and an additional grounding device,

FIG. 3 shows a flow chart illustrating a method according to one embodiment of the invention for the limitation of the generator voltage in case of a hazard, and

FIG. 4 shows a graph illustrating examples of power curves, for illustrating displacements in the operating point.

DETAILED DESCRIPTION

FIG. 1 shows the design of a photovoltaic installation 1 according to the invention with an inverter 150 that is, on the a.c. side, connected to an electricity grid 30, e.g., a public a.c. grid. On the d.c. side of the inverter 150, the latter is connected to a generator 70 by means of connecting lines 120, 130. The generator 70 is divided into two partial strings 70 a, 70 b that can be connected in series to each other by means of a switch 50 assigned to the inverter. The switch 50 is controlled by means of a control device 40 such that, in case of the normal operation of the inverter, the partial strings 70 a, 70 b of the generator 70 are connected to an inverter bridge 20 in a series connection. In case of a hazard, the control device 40 controls the switch 50 such that it opens the electrical connection between the two partial strings 70 a, 70 b. By this configuration, voltages or voltage differences on the lines to the generator 70 are substantially reduced, specifically to the effect that, by an appropriate configuration of the two partial strings 70 a, 70 b, any contact of persons with hazardous voltages or voltage differences on the electrical lines to the generator 70 can be precluded.
As an option, a short-circuiting device 110 may be arranged between the connecting lines 120, 130 that is also controlled by the control device 40 and that, in case of a hazard, can be used to connect the connecting line 120 with the connecting line 130. The photovoltaic installation may also be provided with a d.c. disconnecting device 80 on the connecting lines 120, 130, which is also controlled by the control device 40, in order to allow the generator 70 to be isolated from the inverter bridge 20.
In one embodiment the switch 50, the short-circuiting device 110, the d.c. disconnecting device 80 and the control device 40 are arranged in the interior of the housing of the inverter 150, as a result of which the reliability of the functioning of these components in case of a hazard is considerably increased.
The control device 40 is configured to analyze operating states of the photovoltaic installation, or receive a signal that is transmitted to the control device from within or from outside the photovoltaic installation. Specifically, signals may be generated e.g. by an emergency tripping device or by a monitoring component of the photovoltaic installation. Upon the detection of an operating state that is associated with a hazard condition, or upon the reception of a signal that is associated with a hazard condition, by the control device 40, the latter will actuate a corresponding control function on the switches in the series-connection switching device, the short-circuiting device and the d.c. disconnecting device.
FIG. 2 shows a further variant of the embodiment of the device according to the invention. In this case, the generator 70 comprises three partial strings 70 a, 70 b, 70 c, that can be connected together in series by means of a series-connection switching device 50. The individual partial strings 70 a, 70 b, 70 c may alternatively also be connected in parallel to each other by means of an optional parallel-connection switching device 60. By means of an optional grounding device 140, the terminals of the partial strings may also be connected to ground. The series-connection switching device 50, the parallel-connection switching device 60 and the grounding device 140 are controlled by the control device 40. By this configuration, in case of the normal operation of the inverter 150, it is achieved that the operating voltages of the partial strings 70 a, 70 b, 70 c are combined to give a value that exceeds the peak voltage of the electricity grid 30 connected to the inverter bridge 20. In case of a hazard, as a result of the series connection of the partial strings 70 a, 70 b 70 c being opened by means of the series-connection switching device 50 and the parallel arrangement of the partial strings 70 a, 70 b, 70 c by means of the parallel-connection switching device 60, it can be achieved that only voltage differences that pose no hazard to persons occur on the electrical lines between the inverter 150 and the generator 70, and at the same time the photovoltaic installation can continue to feed power into the electricity grid. For this purpose the inverter 150 typically has a step-up converter (not shown), which can convert the operating voltage of the parallel-connected partial strings into a sufficiently high voltage to permit the feeding of power to the electricity grid 30. This way the photovoltaic installation can be transferred into a safe-to-touch condition, without the need for the complete shut-off of the operation of said installation. By means of the grounding device 140, it can also be ensured that the terminals of the partial strings will show defined potentials with respect to ground. This can be achieved by the actuation of the corresponding switches as a subset of the switches of the grounding device 140 represented in FIG. 2. It is evident that by connecting both terminals of a given partial string to ground the partial string can be effectively short-circuited. In the embodiment according to FIG. 2, all the switches of the grounding device are connected to ground via a common line. Alternatively, each of the switches of the grounding device may be connected to ground individually.
FIG. 3 shows a flow chart that corresponds to a method according to the invention. At 200, the photovoltaic installation is operating at a voltage at the generator 70 that exceeds a hazard limit value. As soon as a hazard condition is detected at 210, the voltage at the generator 70 is controlled to a value that lies below the hazard limit value at 220. The control of the generator voltage can be achieved by the switching of the series configuration of the partial strings 70 a, 70 b, 70 c of the generator 70 to a parallel configuration, e.g., by means of the series-connection switching device 50 and the parallel-connection switching device 60. Alternatively, the control of the generator voltage may also be achieved by means of the appropriate control of a step-up converter that is part of an inverter that is provided for the feeding energy generated by the generator 70 to an electricity grid 30. As an option, at 230 of the method, an electrical connection of at least one of the terminals of at least one of the partial strings 70 a, 70 b, 70 c to ground may be carried out.
FIG. 4 shows two power curves for a photovoltaic installation, as a function of the generator voltage U. A first curve 340 shows the characteristics of power P for a generator in case of the series connection of the partial strings. The maximum power output is achieved for an operating point 300 at which the value of the generator voltage U_MPPexceeds a hazard limit value U_GG. If upon the detection of a hazard situation it is necessary for the generator voltage to be controlled to a value that lies below the hazard limit value U_GG, the operating point of the generator may be shifted, e.g., to an operating point 330 that lies just below the hazard limit value U_GG, whereupon the power that is fed in as compared to the potential maximum power output at the operating point 300 is reduced.
If upon the detection of a hazard situation the partial strings are reconfigured from series connection to parallel connection, this will result in a second power curve 350 in which, in the example considered, the generator voltage remains below the hazard limit value U_GGover the entire course. In this way, it is possible for the generator to continue operation at the point of maximum power output 310, such that the feeding of electric energy can happen substantially unchanged as compared to the series connection.
If the generator remains in series connection, i.e., is operating at the operating point 330 in case of a hazard condition, it is necessary, upon the separation of the inverter from the electricity grid or in other cases in which the feeding of electric power to the electricity grid is no longer possible, to achieve an operating point at which the power output of the generator is zero and the generator voltage at the same time lies below the hazard limit value U_GG. Such an operating point is the short-circuit point 320, which can be achieved by short-circuiting the generator.

Claims

1. An inverter operable to interface with a generator that has a number of partial strings, comprising:

an inverter bridge circuit configured to connect to the partial strings;

a control device operably associated with the inverter bridge circuit; and

a series-connection switching device configured to selectively connect the partial strings in series in response to a control signal from the control device such that the series-connection switching device interrupts the series connection of the partial strings in case of a detected hazard condition.

2. The inverter as claimed in claim 1, wherein the partial strings are dimensioned such that a maximum voltage thereof is lower than 120 volts.

3. The inverter as claimed in claim 1, wherein the generator comprises at least three partial strings.

4. The inverter as claimed in claim 1, further comprising a d.c. disconnecting device that is controlled by the control device and configured to selectively disconnect the partial strings from the inverter.

5. The inverter as claimed in claim 1, further comprising a short-circuiting device that is controlled by the control device and configured to selectively short-circuit the partial strings.

6. The inverter as claimed in claim 1, further comprising a parallel-connection switching device that is controlled by the control device, wherein in case of the detected hazard condition, the parallel-connection switching device is configured to selectively connect the partial strings in parallel.

7. The inverter as claimed in claim 1, further comprising a grounding device that is controlled by the control device, wherein in case of the detected hazard condition, the grounding device is configured to selectively connect at least one of the terminals of at least one of the partial strings to ground.

8. The inverter as claimed in claim 1, wherein the series-connection switching device comprises a relay or a semiconductor switch.

9. The inverter as claimed in claim 4, wherein the d.c. disconnecting device comprises a relay or a semiconductor switch.

10. The inverter as claimed in claim 1, wherein the control device is configured to detect an operating state of the photovoltaic installation that is associated with the hazard condition.

11. The inverter as claimed in claim 1, wherein the control device is configured to receive a signal that is associated with the hazard condition, and wherein the signal is transmitted via a control line, by wireless connection, or via connecting lines to the partial strings or to an electricity grid.

12. A method for limiting a voltage of a generator of a photovoltaic installation in case of a hazard using a device arranged in an inverter, comprising:

operating the photovoltaic installation at a generator voltage that exceeds a hazard limit value;

detecting a hazard condition; and

controlling the generator voltage to a value that lies below the hazard limit value, in response to the detection of the hazard condition, wherein the controlling is performed local to inverter.

13. The method as claimed in claim 12, wherein controlling the generator voltage to a value that lies below the hazard limit value comprises switching the partial strings of the generator from a series configuration to a parallel configuration.

14. The method as claimed in claim 13, further comprising establishing an electrical connection between at least one of the terminals of at least one of the partial strings and ground, in response to the detection of a hazard condition.

15. The method as claimed in claim 12, wherein controlling the generator voltage to a value that lies below the hazard limit value is achieved by means of a step-up converter, which converts the generator voltage to a specific input voltage value for an inverter bridge.

16. The method as claimed in claim 12, wherein detecting a hazard condition comprises detecting one of the following:

occurrence of an islanding situation;

detection of an arc on the electrical lines of the photovoltaic installation;

detection of a ground fault on the electrical lines of the photovoltaic installation;

tripping of a generator disconnection device;

tripping of a manual emergency shutdown device;

response of an external sensor device;

detection of variations in electrical parameters on the photovoltaic installation that are typically indicative of a hazard; and

reception of a further signal that is associated with a hazard condition from a further photovoltaic installation or a further inverter, the photovoltaic installation is connected to in a data network.

17. The method as claimed in claim 12, wherein the hazard limit value lies between 60 volts and 150 volts.

18. The method as claimed in claim 12, wherein during the controlling of the generator voltage to a value that lies below the hazard limit value, further comprising continuing to feed electric power to an electricity grid to which the photovoltaic installation is connected.

19. The method as claimed in claim 12, wherein controlling the generator voltage to a value that lies below the hazard limit value comprises short-circuiting one of the partial strings of the generator.