Submodule Fault-Tolerant Strategy for Modular Multilevel Converter with Scalable Control Structure

Abstract

Modular Multilevel Converter (MMC) topology is considered a good candidate for high-voltage applications. One of the reasons is that an MMC can quickly generate a higher voltage with an excellent sine wave with the series connection of many power blocks, called Sub-Modules (SMs). In such applications, the control system of an MMC can be challenging, and the possibility of an SM failure increases. As a result, the reliability and availability of the application reduce over time. To reduce the effects of SM failure, an MMC is usually equipped with Redundant SMs (RSMs). The RSMs are added into MMC arms as regular SMs to increase the application’s reliability and reduce downtime. This paper proposes a unique decentralized SM fault-tolerant control model for RSMs to participate in any SM sets. In an MMC arm, a dedicated controller is assigned to RSMs, while the group of SMs has their local controllers. The controller of the RSMs continually monitors the voltage of all the SM sets in the arm. If there is any failure, the controller of the RSMs activates a requested number of SMs to help local controllers to generate the desired voltage level. The proposed control system significantly reduces local controllers’ computational and communication requirements compared to conventional redundant controllers. The proposed control system is based on a distributed structure, so it does not limit hardware flexibility, such as the scalability and modularity of an MMC system. Besides, the separate controller for the RSMs significantly helps increase the reliability of an MMC application.

1. Introduction

Voltage Source Converters (VSCs), especially the Modular Multilevel Converter (MMC), are considered suitable candidates for medium-to-high voltage transmission and motor drive systems [1,2]. The MMC topology consists of hundreds of power modules, known as Sub-Module (SM), so high efficiency and excellent voltage generation can be achieved [3,4]. Furthermore, low-rated power switches and DC capacitors can be adopted by increasing the number of SM by the desired output ratings.

On the other hand, a low-reliability index might be a concern due to many semiconductor switches, SM capacitors, and gate drivers. Effectively reducing the number of components increases reliability, but an MMC is meant to have many SMs. Therefore, an effective fault-tolerant control method may solve this issue and provide reliable, stable, and continuous operation even with many SMs.

In practice, redundant SMs (RSMs) are constantly added to MMC arms to increase reliability. The RSMs typically operate either in cold reserve mode or the spinning (hot) reserve mode [5]. The cold reserve mode bypasses the RSMs during regular operation and connects the RSMs to the circuit when a failure occurs [6]. However, charging the RSMs’ capacitor voltages at the rated voltage before connecting them to the circuit arm is one of the main issues of this method. Because of the charging time, internal transients may occur. In hot reserve mode, the RSMs are considered and operated as regular SMs, and RSMs dynamically replace faulty SMs when needed. However, the same number of SMs in the opposite arm might need to be bypassed for vertical arm voltage balancing [7,8]. In hot mode, RSMs increase the switching losses because RSMs are fully utilized [9,10]. Due to high switching losses concern, the cold reserve mode seems more suitable for high voltage applications. Besides, the cold reserve mode does not effectively reduce reliability as the redundant SMs are not actively operated during regular operation [11]. In the literature, many MMC control strategies are devoted to sustaining the MMC operation under semiconductor switch or capacitor failure [4,12,13,14].

Most of these MMC control strategies have been based on a centralized control structure [15,16,17,18,19,20,21]. However, centralized control structure limits the hardware flexibility of an MMC as the complexity of the MMC control system is proportional to the number of SMs. With many SMs, the MMC control system can be complicated because of the high computation and data processing burden. Therefore, a centralized control structure may not be the best solution for high-power MMC applications.

On the other hand, the distributed controller has gained more popularity as an MMC can become more scalable and flexible for hardware changes. Researchers proposed distributed control algorithms for MMC applications in [22,23,24] to reduce the burden on the CPU. Even though the computational burden is reduced, scalability challenges still exist. The reason is that each SM has a local controller, and the number of the local controller increases proportionally with the number of SMs, and the central controller needs to process all the data. Therefore, modification of these local controllers in case of a hardware modification might be challenging and time-consuming during validation and testing. Besides, fault-tolerant capability has not been evaluated in these studies in case of failure. In [25], the SMs within an MMC arm are divided into groups with a small number of SMs.

Each group of SMs requires a dedicated local controller for voltage balancing. Therefore, the burden on the CPU is distributed to the local controllers. However, this method evenly distributes the number of SMs among groups. The SM voltage balancing might not be achieved if the number of SMs among groups is different. In other words, voltage balancing might not be guaranteed if any group has a faulty SM. In [26], a decentralized control method is proposed. In this method, each group of SMs has a local controller, and the local controllers report to the master controller. The number of SMs in each group can be different in this method, so a fault-tolerant application can be achieved by controlling each group separately. However, a CPU is still required for the average voltage balancing and the coordination between the local controllers. The central control unit in this method can be very complicated, with many local controllers under a high-voltage application. Besides, changing the number of SMs might require a significant modification of the control system. In [27], a scale-up control structure method for the MMC is proposed for medium and high-voltage applications. A local controller is assigned for each group of SMs for voltage balancing without a CPU. The number of SMs in each group can be modified without significant effort. However, the method is only effective with equal SMs among the groups. If SM(s) fails in any group, the control system cannot sustain the operation.

Researchers in [28] present an SM-level fault-tolerant method for MMC with a decentralized control structure. In this method, several SMs is put together in a set, and each set is designed based on the hot redundant scheme. In case of an SM failure, the local controller of the set bypasses the faulty SM and boosts the healthy SM’s voltage to keep the set voltage as desired. The number of SMs can be modified without changing the entire control system. This control method is effective with SM faults by considering RSMs. However, the RSMs can only operate at a specific set and cannot be utilized in other sets within the same arm. Thus, the utilization of RSMs is only limited within a set. Besides, the SM capacitors are operated under their rated value to allow a voltage boost in case of SM failure in a set.

This paper proposes a fault-tolerant control method based on a decentralized control structure. Similar to the proposed controller in [28], local controllers are assigned to the SM sets. However, the sets are designed without any redundancy. Besides, SM capacitors are operated at their rated value, unlike the proposed method in [28]. In [28], the local controllers boost the voltage of the SM capacitor to their allowable ratings to keep the set voltage at a desirable value in case of any SM failure. However, this paper proposes a separate controller for the redundant SM sets so that all the SM capacitors are operated at their rated value at full load. Employing higher-rating capacitors increases the total cost and footage. Besides, if a set cannot generate the desired voltage due to too many SM failures within the set, the operation must be lowered or shut down [28].

In this paper, the redundant controller communicates with the local controllers and effectively inserts redundant SM to any SM set in an MMC arm when needed. Therefore, regular SM sets are designed without considering redundancy. The RSMs can join the operation into any set within the same arm. Thus, the overall reliability of the MMC system is enhanced with the decentralized, scalable control design. The proposed method’s computational and communication demands are significantly reduced compared to conventional MMC structures.

Additionally, the number of SMs can be changed without significant control changes. Consequently, the proposed control structure considerably increases the MMC system’s expandability and scalability. To summarize, the proposed method in this paper will allow flexible hardware changes for an MMC application without significant control modifications. The need for high bandwidth communication is eliminated. Similarly, computation complexity will be distributed among the local controllers. Lastly and more importantly, additional redundant control can dynamically replace faulty SMs in any of the sets in an arm. Therefore, the regular sets can be designed without redundancy consideration.

This paper follows the MMC structure and operational principle in Section 2, a detailed explanation of the proposed methodology in Section 3, result validation in Section 4, and the conclusion in Section 5.

2. MMC Structure and Operational Principle

An illustration of a three-phase MMC structure is seen in Figure 1. A three-phase MMC consists of six upper and lower arms. Each MMC arm contains regular and redundant SMs. The non-redundant SMs are grouped into n sets, and the sets are connected in series with an arm inductor. The half-bridge SM (HBSM) topology is adopted in the sets. The redundant passive SMs are grouped in a set, namely, RSM, in Figure 1. The RSM set has N_R HBSM circuits. Each non-redundant set generates an AC output voltage independently, as shown in Figure 2. Initially, redundant SMs are discharged and bypassed under normal operation, as indicated in the cold reserve mode. If one of the SMs in the non-redundant sets is failed in an arm, the faulty SM can be replaced by a redundant SM from the RSM set in the same arm. With the help of the redundant SMs, the output voltage of the non-redundant set is still maintained. If there are multiple SM failures in a non-redundant set(s), the operation continues unless the number of SM failures exceeds the total number of SM in the redundant set. Therefore, the total active number of SMs $N_t$ in an MMC-arm under all circumstances is always kept the same and can be calculated as follows:

$$N_t=n\times N$$

(1)

where n is the number of sets (excluding the RSM set), and N is the number of basic SMs per set.

The SM capacitor voltage is desired to stay at the nominal value $v_c$, which is obtained as follows:

$$v_c=\frac{V_{DC}}{N_t}$$

(2)

where $V_{DC}$ represents the DC bus voltage.

The total output voltage of the upper arm $v_u$ and lower arm $v_l$ are obtained as follows:

$$v_u=\frac{V_{DC}}{2}-L_o \frac{d{i}_u}{dt}-v_m$$

(3)

$$v_l=\frac{V_{DC}}{2}-L_o \frac{d{i}_l}{dt}+v_m$$

(4)

where $i_u$and $i_l$ are the upper and the lower arm current, respectively, and $v_m$ is the AC grid phase voltage. $L_o$ indicates the MMC arm inductor size.

The output voltage of any set of SMs (e.g., $v_{u,1}$) is represented by dividing the arm output voltage (e.g., $v_u$) over the number of sets as follows:

$$v_{u,1}=\frac{V_{DC}}{2n}-\frac{L_o}{n} \frac{d{i}_u}{dt}-\frac{v_m}{n}$$

(5)

$$v_{l,1}=\frac{V_{DC}}{2n}-\frac{L_o}{n} \frac{d{i}_l}{dt}+\frac{v_m}{n}$$

(6)

Figure 1. Three-phase MMC system.

Figure 1. Three-phase MMC system.

Figure 2. MMC arm operating principle.

Figure 2. MMC arm operating principle.

3. Proposed Control Method for MMC Systems

An illustration of the proposed decentralized control structure can be seen in Figure 3. The supervisory control primarily oversees the system-level controls, such as the outer loop voltage and current and system-level protection. The required number of SMs in an arm and the direction of an arm current are sent from the supervisory control to the local controllers of the sets (i.e., set 1, set 2, …, and set n) for the AC output voltage generation and the capacitor voltage balancing. Each local controller of the non-redundant sets is responsible for SM-level protection, capacitor voltage balancing, and the SM gate pulse generation. The SM capacitor voltages are adjusted by each local controller in either raising or lowering order. The switching state of each SM in a set is determined by its local controller based on the sorting results. All local controllers of the non-redundant sets are identical.

On the other hand, the redundant set’s local controller is different from regular local controllers. The redundant controller monitors the operation and active the redundant SMs whenever a non-redundant set has a faulty SM. In such cases, the regular local controller generates a signal to isolate the failed SM. Once the defective SM(s) is isolated, the local controller of the faulty set communicates with RSM’s control to replace the defective SMs with a redundant SM. Suppose the total number of defective SMs in an MMC arm exceeds the redundant number (NR) of SMs in the redundant set. In that case, the MMC system should be gracefully shut down by a command signal transmitted from the local controller to the supervisory control.

Compared to existing MMC control designs in

Table 1. Comparison of MMC control designs.

Control Structure	Central	Distributed
	[15,16,17,18,19,20,21]	[22,23,24,25,26,27]	[28]	Proposed Method
Scalability and flexibility	Low	Medium	High	High
Communication burden	High	Low	Low	Low
Computational burden	High	Low	Low	Low
Reliability	High	Low	Medium	High

, the RSMs can effectively replace any faulty SM within the same arm in the proposed design. Thus, the reliability and the redundant SM utilization can be increased. Besides, the proposed method allows an MMC to quickly become more flexible for hardware changes and replace the SMs. Similarly, the control algorithm can be modified accordingly without great effort and time. The communication and computational burdens are also kept low as the number of SMs is divided into smaller groups with a dedicated local controller.

3.1. System-Level Control

The supervisory control is responsible for the system-level controls. Figure 4 depicts the overall control scheme that is implemented in this paper. The main control, circulating current suppression control (CCSC), and nearest level modulation (NLM) approach are all parts of the system-level control. As illustrated in Figure 5, the main control is designed based on the conventional vector current in the dq synchronous reference frame. The voltage $v_{m,x}^{*}$ is generated based on the current control. The CCSC method is adopted in [29] and shown in Figure 6. The number of inserted SMs $N^{on}$ in an arm, which is necessary for each local controller, is determined by the NLM approach. The references for the voltages of the upper and lower arms are obtained by [28]:

$$v_{u,x}^{*}=\frac{V_{DC}}{2}-v_{z,x}^{*}-v_{m,x}^{*}$$

(7)

$$v_{l,x}^{*}=\frac{V_{DC}}{2}-v_{z,x}^{*}+v_{m,x}^{*}$$

(8)

where $x\in a,b, c$ and the $v_{z,x}^{*}$ is the reference circulating current voltage, out from the CCSC control, as seen in Figure 4. The reference signal for the AC-side voltage control is $v_{m,x}^{*}$. Circulating current $i_{circ,x}$ can be described as the AC part of the differential current $i_{z,x}$ and can be expressed in (9) where $i_{u,x} and i_{l,x}$ are the upper and lower arm currents. Arm currents can be described as half of the AC side current $i_x$ and the differential current as in (10) for the upper and (11) for the lower arm. The reference voltage of the circulating current is compared with the induced voltage $v_{z,x}$ (12) due to the circulating current.

$$i_{z,x}=\frac{ i_{u,x}+i_{l,x}}{2}=i_{dc,x}+i_{circ,x}$$

(9)

$$i_{u,x}=i_{z,x}+\frac{i_x}{2}$$

(10)

$$i_{u,x}=i_{z,x}-\frac{i_x}{2}$$

(11)

$$v_{z,x}=L_o \frac{d{i}_{Z,x}}{dt}$$

(12)

3.2. Local Controller

Each local controller of the non-redundant sets is responsible for the voltage balancing algorithm, generation of the gate pulses, and SM level protection. The capacitor voltage balancing (CVB) algorithm presented in [28] is implemented in each non-redundant local controller. The utilized balancing algorithm can control the SMs voltage of each set independently without communicating between the other sets in an arm. The local controller is improved to utilize RSMs under SM failures. Figure 7a shows the local controller flow chart for each set of SMs. Under an SM failure, the local controller of the set sends a replacement command to the RSM’s controller. The local controller of each set generates the gate signals for its healthy non-redundant SMs and the replacement SMs from the RSM set.

3.3. RSM Controller

Figure 7b shows the RSM controller flow chart. The RSM controller has a simple task: coordinating the RSM set and sets with basic SMs. When a replacement request is received from any local controller of the non-redundant sets, the RSM controller task is to find an available SM from the RSM set. Where i counts the number of SM failures in an arm, if the number i exceeds the number of RSMs N_R, the RSM controller sends an order to the main controller to shut down the system. The capacitor voltage of the RSM is sent to the local controller for voltage balancing. The RSM controller receives the gate signal for that RSM from the local controller of sets. The RSM controller sends the gate signals to the corresponding SM at the RSM set. The RSM controller has no voltage balancing tasks. Thus, the computational burden of the RSM controller is incredibly low.

4. Validation Results

4.1. Study System

The MMC system shown in Figure 1 is carried out in Simulink/MATLAB to validate the proposed MMC control design.

Table 2. MMC system parameters.

Parameter	Value
Rated Power	100 MVA
Rated DC voltage	100 kV
AC grid voltage	55 kV
Fundamental frequency	60 Hz
Number of SMs per arm (N × n)	16 × 3 = 48
Number of RSMs per arm (NR)	6
Capacitance of SM	6.8 mF
Capacitor rated voltage	2.08 kV
Arm inductance	10 mH

tabulates the MMC parameters and structure design. The primary number of SMs per arm is 48 SMs divided into three sets (i.e., n = 3) with 16 basic SMs per set. The number of RSMs N_R is 6 SMs per MMC-arm.

4.2. Performance Validation under Normal Conditions

The performance of the MMC system with the proposed control design is studied at steady states. The MMC system operates in inverter mode at the rating power level (e.g., 100 MVA). Because the DC voltage is 100 kV and the total number of primary (or active) SMs $N_t$ per arm is 48, and the SM capacitor voltage per arm is maintained at 2.08 kV per arm. Figure 8 shows the MMC performance under normal conditions at steady states. The capacitor voltage of SMs is well-maintained, and the grid voltage and current are purely sinusoidal waveforms.

4.3. Performance Validation under Power Reversal

The proposed control design is also performed under power ramp conditions to validate its effectiveness under transients. Initially, the converter operates in inverter mode. At 50 ms, the active power is ramped from 100 MW to −100 MW within 100 ms, as shown in Figure 9. Thus, the converter operating mode is changed from inverter mode to rectifier mode. The active power is precisely tracking the reference command. The SM voltages are maintained at the rated voltage in the different operating modes.

4.4. Performance Validation under SM(s) Failure in One Set

This section tests the proposed method under SM(s) failure only in a single set per arm. The MMC system operates in inverter mode at the rated voltages and power. One SM from Set 1 intentionally failed-opened at 0.2 s, as shown in Figure 10. The defective SM will be promptly bypassed once the system identifies the failure. Simultaneously, a replacement request is sent to the RSM controller. As a result, an RSM is recharged to 2.08 kV and dynamically replaces the faulty SM. At 0.4 s, another SM from Set 1 fails.

Consequently, another RSM from the RSM set is activated and recharged to 2.08 kV to replace the second faulty SM. The capacitor voltage of SMs in the three sets is depicted in Figure 10. The capacitor voltage of SMs in the MMC arm is well-maintained at the rated voltage under the faulty SMs. Thus, the MMC system is capable of functioning satisfactorily under SM failures.

4.5. Performance Validation under SM Failures in Multiple Sets

This section tests the proposed controller for simultaneous SM(s) failure in multiple sets. As seen at 0.05 s, a total of 6 SMs are intentionally fail-opened in the MMC upper arm of phase-a. Two SMs in set 1, set 2, and set 3 failed at the same time. Accordingly, the RSM controller coordinates with the local controller of the faulty sets to replace the faulty SMs with 6RSMs. As shown in Figure 11, the faulty SMs are bypassed after the local controller identifies the failure. When the faulty SMs are bypassed, the RSMs are activated and charged to the rated voltage of 2.08 kV. As can be seen in Figure 11, the capacitor voltage of SMs in the MMC arm is well-maintained at the rated voltage under multiple faulty SMs in different sets. Figure 12 shows that arm currents, grid voltage, and current are not significantly affected by SMs failure in multiple sets.

To summarize the results in Section 4.2, Section 4.3, Section 4.4, Section 4.5,

Table 3. Summary of the Results.

Cases	Number of Faulty SMs
	Set 1	Set 2	Set 3
Normal Conditions (Section 4.2)	None	None	None
Power Reversal (Section 4.3)	None	None	None
SM(s) Failure in a Single Set (Section 4.4)	2 SMs at t = 0.2 s and t = 0.4 s	None	None
SM Failures in Multiple Sets (Section 4.5)	2 SMs at t = 0.05 s	2 SMs at t = 0.05 s	2 SMs at t = 0.05 s

is prepared. In Section 4.2. the MMC with the proposed controller is operated under no SM failure to test the control capability under steady-state. Section 4.2 tests the MMC system under active power reversal with the proposed controller. The results show that the proposed control method has no adverse effects on steady-state and power reversal. Section 4.4 tests the same system under 2 SM failure at t = 0.2 s and t = 0.4 s. The proposed controller immediately picks the faulty SMs and replaces them with the redundant SMs based on Figure 10. In Section 4.5, 2 SMs in three sets (set 1, set 2, and set 3) are purposely failed-opened simultaneously at t = 0.05 s. Based on Figure 11, the redundant controller activates six redundant SMs to participate in three sets simultaneously. Overall, the proposed decentralized, redundant control algorithm effectively communicates with the local controllers and dynamically replaces faulty SMs.

4.6. Reliability Evaluation of MMC System

To validate the effectiveness of the proposed design, the Markov model, which is fundamentally explained in [30], is used to evaluate the reliability of the MMC system under different MMC designs. In this reliability assessment, the following assumptions are made:

• The switching devices (e.g., semiconductor devices) are only considered because they have higher failure potential than any other components in the SM, such as the capacitor.
• In the case of any switch failure in an SM, the whole SM will be removed from the MMC system and replaced with an RSM.
• The entire MMC system will shut down when the number of faulty SMs per arm exceeds the number of RSMs.

The reliability of the proposed method is evaluated and compared with the decentralized control designs presented in [27] and [28]. In addition, the proposed design’s reliability has been compared with the conventional control design. The MMC system parameters are tabulated in

Table 4. MTTFs and MMC system parameters for reliability evaluation.

	Non-Redundant Design [27]	Redundant Design [28]	Conventional MMC with Redundancy	Proposed Design
Control structure	Decentralized	Decentralized	Centralized	Decentralized
Number of RSM	0	6	6	6
Number of SMs $N_t$	48	48	48	48
DC voltage	100 kV	100 kV	100 kV	100 kV
Rated power	100 MVA	100 MVA	100 MVA	100 MVA
MTTF (Year)	1	13	24.25	24.25

. The DC voltage, power rating, and number of SMs for each case are similar for a fair evaluation. The number of RSMs is 6 SMs per arm for designs with redundancy. Thus, the MMC system will shut down when the number of faulty SMs per arm exceeds 6 SMs.

Figure 13 shows the reliability operation for each scenario. Overall, the designs with SM redundancy have higher reliability than the non-redundant design. The proposed method has reliability higher than the redundant design presented in [28], although the same number of SMs is utilized in both systems. Besides the gained features of the proposed decentralized control design, the proposed technique can achieve reliability as high as the conventional centralized control design of the MMC, as shown in Figure 13. The Mean Time To Failure (MTTF) is typically used to identify reliability. The MTTFs of the considered designs are listed in Table 4. The MTTF of the proposed method is improved by about 187% when compared to the MMC design presented in [28]. The non-redundant MMC design has the lowest MTTF because there are no RSMs; thus, the entire system will fail if any SM fails.

5. Conclusions

This work presents an SM fault-tolerant technique for MMCs with a scalable control design. The proposed control method is suggested to ride through SM failures and balance voltages between sets. The total number of SMs per arm is distributed among sets with smaller SMs. A local controller is allocated for each set of SMs for voltage balancing, SM-level protection, and gate signal generation. In addition, a simple controller is assigned for the RSMs to coordinate and pass data, such as gate signals and SM capacitor voltages, between RSMs and the set local controllers under SM failures. The RSMs have fully utilized at any specific set within the same arm due to the RSM controller, which enhances the system reliability. The proposed method does not require communication between the sets’ local controllers, which significantly improves the expandability of the MMC systems. Local controllers have much lower computational loads than traditional centralized control approaches. The MMC sets function with unequal numbers of SMs among sets when conditions are abnormal (for instance, when there are SM failures).