1 Introduction

There has been a rather long history of research on the control and protection of AC faults in electric power transmission systems [1, 2]. Regarding the high-voltage direct current (HVDC) including multi-terminal HVDC (MTDC) technologies, research effort has been made on the protection against DC faults [3–6]. As for AC faults, control strategies of voltage source converter (VSC) for improving the AC fault ride-through capability of VSC-HVDC systems were proposed in [7, 8]. An approach of limiting the AC unbalanced fault on the VSC MTDC grids was proposed in [9]. Control and protection strategies were investigated in [10] for a hybrid MTDC system against AC faults. In most situations, AC faults can be isolated by AC circuit breakers. However, when an AC fault occurs at the nearby AC side of the converter, which is beyond the protection area of the nearby AC circuit breakers, the fault isolation is achieved by both blocking of the converter to prevent current flowing from the DC side and tripping the AC side circuit breakers. In the above situation, previous work has assumed that the blocking of the converter is successful. However, this assumption is not necessarily valid in terms of practical operation of converters, especially in the more advanced modular multilevel converter (MMC) [11, 12] in the current system. The MMC at the fault side has different conditions of blocking failure: ① for the communication outage of control signals where the whole converter can be out of control and cannot be blocked, although the occurrence of such a condition is considered to be rare; ② a more common condition is that one of the six converter arms is failed to be blocked; ③ the most common condition is that one sub-module (SM)/several SMs on one converter arm is/are failed to be blocked; ④ other conditions. Hence, it is worth identifying the potential risk to the MTDC system, analyzing the dynamic performance to reveal the fact that special control and protection is necessary to be conducted when the MTDC system is significantly affected under emergency conditions, while under other non-emergency conditions, the special control and protection may not be essential.

This paper investigates the control and protection strategy against a converter-side AC fault during the blocking failure of the converter of a four-terminal MMC HVDC system. The MMC technology was firstly introduced in 2001 [13] and its advantageous over the traditional VSC technology [11, 12], such as low switching losses and small harmonic proportions, have been widely recognized. The number of HVDC projects deployed the MMC technology [14, 15] has gradually been increasing. The occurrence of the aforementioned blocking failure conditions may exist and deserve to be investigated.

The rest of this paper is outlined as follows. Section 2 introduces the MTDC system configuration and control strategy. Section 3 presents the control and protection strategy against a converter-side AC fault with normal blocking operation. In Section 4, the dynamic performance of the MTDC system during different conditions of MMC blocking failure following the fault is analyzed and the impact of each condition on the MTDC system is revealed by real-time simulations. An associated special control and protection strategy is proposed for certain emergency conditions where the MTDC system is significantly affected. Conclusions are drawn in Section 5.

2 MTDC system

A single-line diagram of a four-terminal MMC HVDC system is shown in Fig. 1. Tn (n  = 1, 2, 3, 4) denotes the HVDC terminal. On the AC side, each AC source is modeled as an ideal voltage source with a line-to-neutral voltage of 138 kV. CBn (n = 1, 2, 3, 4) represents the AC circuit breaker. On the DC side, DC ISOn denotes the DC isolation switch. The length of each DC cable is 100 km. The nominal DC voltage is ±50 kV. Four converters (MMC-n) are seven-level, half-bridge MMC converters. Each MMC consists of six converter arms where each arm consists of six SMs and one arm inductor.

Fig. 1
figure 1

Configuration of four-terminal MMC HVDC system

Full size image

Figure 2 shows a schematic diagram of the MMC system. To achieve the capacitor voltage balancing in each converter arm, the charging and discharging operations depend on the arm current direction and the capacitor voltage of each SM [12, 13] where the SM with lower capacitor voltage is charged first, while the SM with higher capacitor voltage is discharged first. Detailed parameters of the MTDC system are shown in Table 1.

Fig. 2
figure 2

Schematic diagram of MMC system

Full size image
Table 1 Parameters of MTDC system
Full size table

The control of the MMC converter station is achieved in a dq reference frame and the well-known dq decoupled control strategy is applied [16–18]. The d-axis control regulates either the active power or the DC voltage, while the q-axis control regulates either the reactive power or the AC voltage magnitude. In the MTDC system, MMC-1, MMC-3 and MMC-4 use the active power control to regulate the active power at the converter AC terminals. MMC-2 applies DC voltage control to maintain the voltage of the MTDC grid. In order to reduce the power losses caused by the reactive current, the reactive power control is applied by all the four converter stations where the reactive power reference is set to 0 Mvar.

3 Control and protection strategy against converter- side AC fault with normal blocking operation

When an AC fault occurs at the converter AC side of one terminal of the MTDC system, say the most severe three-phase short-circuit fault, the voltage at the faulted point will drop, and the fault current will flow into the faulted point from both the grid AC side and the MMC AC side.

Figure 3 shows the diagram of the fault occurring at the converter AC side. The MMC AC side current is from the DC grid flowing through the MMC. In the MTDC system without appropriate control and protection, the occurrence of the AC fault at one terminal will affect the interconnected terminals. In order to isolate the fault and protect power electronic devices, the insulated gate bipolar transistors (IGBTs) of the MMC at the fault side are rapidly blocked when the fault occurs. The unilateral conductive characteristics of the diode will prevent the DC current flowing from the DC grid to the MMC AC side. In order to isolate the fault from the grid AC side, the AC circuit breaker at the fault terminal is tripped. The blocking of the MMC and tripping of the AC circuit breaker to isolate the fault is shown in Fig. 4.

Fig. 3
figure 3

Three-phase short-circuit fault at MMC AC side

Full size image
Fig. 4
figure 4

Fault isolation by blocking of MMC and tripping of AC circuit breaker

Full size image

If the fault is temporary, the fault terminal can be resumed to the normal operating condition once the fault is cleared. If it is a permanent fault, the MTDC system will be re-configured as a three-terminal HVDC system. In the following case studies, the AC fault is applied as a permanent fault at T1.

The control and protection strategy against a converter side AC fault comprises a series of control and protection operations, i.e., control and protection sequence. The control and protection sequence of the four-terminal MMC HVDC system under a permanent three-phase short-circuit fault at the MMC AC side of T1 is shown in Fig. 5. The fault is applied at 2 s. The IGBTs can normally be blocked within 1~2 ms, while the AC circuit breakers can normally be tripped within half to one cycle, i.e., 10~20 ms [19]. In the control and protection sequence discussed in this paper, MMC-1 is assumed to be blocked within 2 ms, while CB1 is tripped at 20 ms after the fault. Simulations are carried out using the real-time digital simulator (RTDS) to present the system dynamic performance and verify the proposed control and protection strategy.

Fig. 5
figure 5

Control and protection sequence of MTDC system

Full size image

Initially, T1 and T3 are importing powers to the DC grid, while T2 and T4 are exporting powers from the DC grid. The system dynamic performance is shown in Fig. 6 applying the control and protection sequence of Fig. 5. Figure 6a shows the active power of each terminal measured at the point of common coupling (PCC), Fig. 6b shows the root-mean-square (RMS) value of the AC current at PCC1, Fig. 6c shows the RMS value of the AC side current of MMC-1, Fig. 6d shows the DC voltage of each terminal and Fig. 6e shows the DC current of each terminal.

Fig. 6
figure 6

MTDC dynamic performance with normal converter blocking

Full size image

In Fig. 6a, the increase of the active power at T1 is observed due to the short-circuit fault. Since MMC-1 is successfully blocked 2 ms later, isolating the fault from the DC grid, the active power at T3 and T4 is maintained stable at the nominal value and the loss of power at T1 is balanced by MMC-2. The AC current of PCC1 surges to a peak of 0.84 kA following the fault and reduces to zero when CB1 is tripped, as shown in Fig. 6b. Due to the successful fast blocking of MMC-1, no overcurrent is observed at the MMC AC side, as shown in Fig. 6c. The DC voltages of the other three terminals decrease initially and resume to the nominal value smoothly, as shown in Fig. 6d, since MMC-1 has been operated as a rectifier to inject the power from the AC system to the DC grid. The DC current at T1 gradually decreases to zero, while the DC current of the others is not significantly influenced, as shown in Fig. 6e. Therefore, the simulation results verify that with normal blocking operation of the converter, the proposed control and protection strategy is effective against the fault at the MMC AC side.

4 Control and protection strategy against converter- side AC fault during converter blocking failure

Previous analysis and simulation were made with normal converter blocking operation. In this section, the same three-phase short-circuit fault is applied; however, the MTDC system is under different conditions of blocking failure of MMC-1.

4.1 Whole MMC blocking failure

If MMC-1 is completely not blocked, i.e., all SMs on six arms fail to be blocked, and only CB1 is tripped after the fault, the DC current of T2 for power balancing together with the current of T3 will flow into the faulted point at T1 through MMC-1. This process is illustrated by the red arrow and the power flow direction of each terminal is shown by the blue arrow before the occurrence of the fault, as shown in Fig. 7.

Fig. 7
figure 7

Schematic diagram of MMC-1 blocking failure and tripping of CB1 following fault

Full size image

During the transient period when the fault is applied, the voltage drop at the faulted point will lead to a fault current surge, which comes from the AC utility side and MMC-1 AC side, and may potentially damage the system equipment. Because of the tripping of CB1, the fault current from the utility side is interrupted and then contributed by the current from MMC-1 AC side. The fault characteristics with complete blocking failure of MMC-1 are shown in Fig. 8. Figure 8a shows RMS value of MMC-1 AC side current, which presents the fault current from the converter side due to the blocking failure. The MMC DC side current of each terminal is shown in Fig. 8b, which presents the impact of the blocking failure on the adjacent terminals.

Fig. 8
figure 8

MTDC system fault characteristics with blocking failure of whole MMC-1 converter

Full size image

In Fig. 8a, the MMC-1 AC side current increases and stays at a peak of 5.6 kA, which is 7 times of the nominal value and may damage the system equipment, particularly the IGBTs of MMC-1 and MMC-2. Large DC over currents can be observed in both T1 and T2, and the current reversal of T2 can be seen in Fig. 8b. Therefore, it is indicated that the fault is not fully isolated, necessitating special control and protection to isolate the fault, preventing the power from further injecting into the faulted point.

Firstly, the IGBTs of the other MMCs need to be protected immediately by blocking the adjacent MMCs. Nevertheless, the freewheeling diode cannot prevent the AC currents flowing into the DC grid, so the AC circuit breakers of the interconnected terminals need to be tripped. Figure 9 shows the proposed special control and protection strategy of the MTDC system.

After tripping all the AC circuit breakers, the MTDC system has no power sources and the current of the DC grid gradually decreases. When the DC current at T1 reduces to zero, the DC ISO1 is tripped to realize the isolation of the fault section at T1. Then, T2, T3 and T4 could be restored. Figure 10 shows the MTDC system with the fault section isolation and restoring of the other three terminals.

Fig. 9
figure 9

Special control and protection strategy against whole MMC-1 blocking failure

Full size image

With the blocking failure of whole MMC-1, special control and protection is activated where the control and protection sequence is shown in Fig. 11. The fault is applied at 2 s. MMC-1 completely fails to be blocked and only CB1 is tripped at 20 ms later after the fault. When the DC current of any terminal is detected over 20% of its nominal value, the MMCs of the other three terminals will be blocked within 2 ms with tripping the AC circuit breakers within 20 ms. In the simulation, the DC current of T1 is the first to be detected over 20% of its nominal value. DC ISO1 is tripped when the DC current of T1 reduces to zero. In the case study, it takes approximately 1.42 s for the DC current of T1 to decay to zero after tripping all the AC circuit breakers. T2, T3 and T4 can be resumed after the tripping of DC ISO1.

Fig. 10
figure 10

MTDC system recovery after the faulted section isolation

Full size image

The control and protection characteristics of the MTDC system are shown in Fig. 12. Figure 12a shows the active power of the MTDC system, Fig. 12b shows the RMS value of MMC-1 AC side current, Fig. 12c shows the MMC DC side voltages and Fig. 12d shows the MMC DC side currents.

Fig. 11
figure 11

Control and protection sequence of MTDC system under AC fault during blocking failure of whole MMC-1

Full size image

The active power of the MTDC system decreases to zero within 0.15 s by applying the proposed control and protection strategy, as shown in Fig. 12a. The RMS value of MMC-1 AC side current increases to a peak of 2.5 kA when MMC-1 completely fails to be blocked, as shown in Fig. 12b. The RMS value of MMC-1 AC side current in this figure is much lower than that of the previous case without special protection and reduces to zero within 2 s. The DC voltage of the MTDC system gradually reduces to zero after tripping all the AC circuit breakers, as shown in Fig. 12c. The DC current at T1 is monitored over 0.48 kA at 2.056 s, as shown in Fig. 12d, leading to the blocking of the adjacent MMCs and tripping of all the AC circuit breakers. The DC current of the other terminals reduces to zero with small oscillations. It can be seen that the oscillations and over current have been reduced, and the fault is fully isolated using the proposed control and protection strategy when the complete blocking failure of MMC-1 appears.

4.2 One converter arm complete blocking failure

A higher possibility is considered to have the blocking failure occurred on part of MMC-1 instead of the whole converter. The impact of such a condition on the MTDC system should be less significant and will determine the necessity of utilizing the special control and protection.

The condition discussed in this section is that one of the six converter arms has blocking failure, i.e., all the SMs on one arm fail to be blocked, while the other five arms are blocked normally. The upper arm of phase A of MMC-1 is selected to have blocking failure in the simulation, the simulation results are shown in Fig. 13. Figure 13a shows the current in phase A of MMC-1 AC side, Fig. 13b shows the MMC DC side current of each terminal. The control and protection sequence is the same as that in Fig. 5.

Fig. 12
figure 12

Control and protection characteristics with whole MMC-1 blocking failure

Full size image

The current in phase A of MMC-1 AC side increases to a peak of 6.2 kA, as shown in Fig. 13a. MMC-1 DC side current at T1 reverses and eventually stabilizes at −1.1 kA. Therefore, it is indicated that, due to the blocking failure of the upper arm of phase A, the AC and DC side of MMC-1 are not fully isolated. This leads to the result that the MMC DC side current of T1 does not reduce to zero after the protection operation, but flows through MMC-1 and injects into the faulted point. Therefore, the blocking failure of one arm of the converter and the whole converter blocking failure are both considered as emergency condition, necessitating the fault isolation with the special control and protection strategy proposed in Section 4.1.

4.3 One converter arm partly blocking failure

In comparison with the complete blocking failure of one converter arm, the possibility of having the blocking failure on part of a converter arm would be higher in practical operations. Three different conditions of blocking failure on one arm are considered: ① all SMs except one; ② half of the SMs; ③ only one SM.

4.3.1 All SMs but one blocking failure

Despite the fact that all SMs fail to be blocked except one, the one that is blocked successfully provides the possibility of interrupting the DC current flowing to the MMC AC side. This is because that the arm current must flow through the diode D1, as shown in Fig. 2 and charge the blocked SM capacitor before flowing to the MMC AC side. When the voltage of the SM capacitor is charged higher than the positive DC voltage of T1, D1 will work in the reverse direction to block the current.

Five SMs of the upper arm of phase A are simulated to have blocking failure. The simulation results are shown in Fig. 14. Figure 14a shows the current on phase A of MMC-1 AC side, Fig. 14b shows the MMC DC side current of each terminal and Fig. 14c shows the voltages of the SM capacitors on the upper arm of phase A.

Fig. 13
figure 13

Blocking failure of one converter arm of MMC-1

Full size image

Figure 14a shows that the current in phase A of MMC-1 AC side is largely limited with a peak value of 1.2 kA and reduces to zero within 1.5 s, due to the existence of the blocked SM. In Fig. 14b, the DC current of T1 decreases to zero indicating the isolation of AC and DC side of MMC-1. However, the SM, which has been blocked successfully, is charged until its voltage increases to the nominal positive voltage of T1 (50 kV), so as to interrupt the arm current and achieve the isolation. Therefore, even the overcurrent is largely restricted and the isolation of the fault side is achieved, the blocked SM capacitor is identified to have a potential risk of being overcharged and breakdown.

4.3.2 Half converter arm blocking failure

In comparison with the condition that all SMs have blocking failure except one, it is more likely to have the blocking failure on half of the SMs. When half of the SMs are blocked successfully, the blocked SM will equally divide the positive DC voltage when positive DC voltage is larger than their sum. According to the applied strategy of the SM capacitor balancing, the voltages of the blocked SM capacitors will eventually stabilize at the nominal value. Three SMs of the upper arm of phase A are simulated to have blocking failure with the simulation results, as shown in Fig. 15. Figure 15a shows the current in phase A of MMC-1 AC side, Fig. 15b shows the MMC DC side current of each terminal and Fig. 15c shows the voltages of SM capacitors on the upper arm of phase A.

Fig. 14
figure 14

Blocking failure of five SMs of one converter arm of MMC-1

Full size image

The peak of the current on phase A of MMC-1 AC side further reduces to 1 kA when half of the SMs have been blocked successfully and the current decreases to zero within 1 s, as shown in Fig. 15a. In addition, there is no overvoltage on the capacitors of the blocked SMs, as shown in Fig. 15c.

4.3.3 One SM blocking failure

In practical application, there are tens or hundreds of SMs on each arm, so the blocking failure of one SM is considered to be more probable than the others. In the previous section, there was little overcurrent on the AC side of MMC-1 and no overvoltage on the capacitors of the blocked SMs when half of the SMs on one arm failed to be blocked following the fault. Therefore, it can be predicted that the impact of one SM blocking failure on the MTDC system should be even smaller. Figure 16a shows the current in phase A of MMC-1 AC side, Fig. 16b shows the MMC DC side current of each terminal and Fig. 16c shows the voltages of the SM capacitors on the upper arm of phase A.

Fig. 15
figure 15

Blocking failure of three SMs of one converter arm of MMC-1

Full size image
Fig. 16
figure 16

Blocking failure of one SM of one converter arm of MMC-1

Full size image

When only one SM has blocking failure after the fault, there is no overcurrent observed in Fig. 16a. Since the positive DC voltage of T1 is smaller than the sum of the capacitor voltages of the blocked SMs, there would be no charging current on the converter arm and thus no overvoltage on the capacitors of the blocked SMs.

5 Discussion

The investigated blocking conditions are: ① the converter is normally blocked; ② the converter has complete blocking failure; ③ one converter arm has complete blocking failure; ④ one converter arm has partly blocking failure, including all SMs except one have blocking failure; half of SMs has blocking failure; only one SM has blocking failure.

According to the analytical study and simulation results, condition ② is considered to be the most severe condition with least occurring possibility, but has significant impact on the MTDC system, necessitating the special control and protection. As for condition ③ and the conditions between ② and ③, since the isolation of the faulted AC and DC sides is not achieved eventually, they will cause large influence on the MTDC system and are regarded as emergency conditions which require the special control and protection.

In condition ④, the isolation of the faulted AC side can be achieved without the special control and protection, so the basic control and protection strategy under condition ① is sufficient. The fault analyzed and simulated in this paper is the most severe AC fault, three-phase short-circuit fault. Therefore, the other types of faults can be effectively isolated in the MTDC system by applying the special control and protection strategy proposed.

During the protection period of condition described in Section 4.3.1, the capacitor of the blocked SM is identified to have the potential risk of being overcharged and breakdown. Furthermore, another potential problem with low probability, but may exist in condition described in Section 4.3.2, is found in the simulation. That is, at the instant of the blocking operation of the converter, if SMs that have blocking failure are under the switch-on condition, i.e. the capacitors are not bypassed; an impulse of the charging current will emerge on the converter arm leading to the charging process on the blocked SMs. Hence, attention needs to be paid on such conditions that there may be potential risk of overvoltage on the blocked SM capacitors, although the possibility is small.

The fault is assumed to occur at T1 in this paper. Due to the same control strategy of the converter station of T1, T3 and T4, which is the constant active power control, the control and protection strategy will be applicable for the fault at the other two terminals. But for the fault that occurs at T2, the constant DC voltage control is used, the control and protection operation will block the control system leading to the voltage of the DC grid out of control. Under this condition, one of the other three terminals needs to take over the control of the DC voltage, which can be achieved by the voltage margin control [20] or voltage droop control [18] instead of constant real power control.

6 Conclusions

Since there are a large number of series-connected SMs on each arm of MMC HVDC converters, the possibility of contingent failure on one or more SMs cannot be neglected. This paper proposes the issue of potential blocking failure of the MMC at the fault side after an AC fault. The blocking failure may occur on one or several SMs, or even the whole converter.

In this paper, the impact of different blocking failures in an MTDC system after a converter-side AC fault is analyzed with simulation studies. According to the performance and impact on the MTDC, they have been divided into the emergency condition and non-emergency condition. Under the emergency condition, the isolation between the faulted AC and DC sides is not achieved using the normal control and protection strategy. A special control and protection strategy, which achieves both the isolation of the fault terminal with reducing the fault current and recovery of the other terminals, is proposed. Under the non-emergency condition, a potential risk of overcharging the blocked SMs has been identified. The simulation is conducted using the RTDS. Simulation results prove the effectiveness of the proposed special control and protection strategy under the emergency condition.