hvdc-control

How it is built

Architecture overview

An HVDC converter station turns AC into DC (or back) with thyristor or transistor valves, and its control and protection system decides when every valve switches. The system is a hierarchy that runs at very different speeds: an operator and dispatch layer sets a power order over seconds, a station and pole controller turns it into current or DC-voltage references in milliseconds, a converter controller shapes the waveform every control cycle, and valve-level electronics fire and monitor each device in microseconds. Beside the control hierarchy sits an independent protection system that watches for faults and trips the converter faster than any operator or controller could. The one idea that makes the whole work is that control is deterministic and duplicated: every loop runs on a fixed period with a fixed latency, every controller has a hot twin that can take over within a few cycles, and protection is a separate channel that can force a safe state whatever the controller does. The same architecture, with different loops, shows up in motor drives, solar inverters and PLC-based plants.

Parts:

• Station and pole control — power and DC-voltage references, mode and sequence control — Hierarchical state machine, PID control, Droop control (no page yet)
• Converter control — grid synchronisation, current loops, valve modulation, internal balancing — Phase-locked loop, Modular multilevel converter control (no page yet), Field-oriented control (no page yet), PWM generation, Fixed-rate control loop, IIR and FIR filters, Deterministic fixed-point math
• Valve electronics — fixed-latency logic that fires and monitors devices — FPGA dataflow pipelines (no page yet), Gate-drive desaturation protection (no page yet), Real-time fieldbus (no page yet), DMA transfers (no page yet)
• Protection — independent doer/checker path that trips to a safe state — Safety monitor architecture (no page yet), Redundancy voting (no page yet), Watchdog timer, Memory protection unit, End-to-end protection (E2E) (no page yet), fault-detection-isolation-recovery (no page yet)
• Redundancy — duplicated control with bumpless changeover — Hot standby redundancy, Primary-backup replication, Leases, Fencing tokens, Health checking
• Time and measurement — common time base and synchronised measurements — Clock synchronization, Synchrophasor estimation (no page yet), Robust statistics
• Operator interface and records — alarms, event logs, SCADA links — Alarm management, Debouncing and throttling (no page yet), DNP3 protocol (no page yet), Write-ahead log, CRC32C checksums, fsync and direct I/O
• Network security — zones, conduits and one-way links around the control network — Industrial network segmentation (no page yet), Packet classification (no page yet), Data diode unidirectional transfer (no page yet)

 SCADA / dispatch ──DNP3, IEC 61850──► station control (A) ◄─sync─► station control (B)  hot standby
 (alarms, orders)                          │  power / Vdc refs, modes
          ▲  event log                      ▼
          │                     converter control (A/B) ──fixed-period cycle──► modulation
 time ─ PTP / IRIG ─►                 │   PLL, current loops, balancing             │
                                       ▼                                             ▼
 remote station ◄─ telecom ─►   valve electronics (FPGA, optical) ──► gate drivers ──► valves
                                                                         │ desat, status
 protection (2oo3 vote) ◄── measurements (AC, DC, arm currents) ◄────────┘
        └──── trip / block ─────────────────────────────────────────────► valves, breakers

How the parts fit together

Station and pole control

Station control holds the modes of the plant: stopped, energising, deblocked, power transmission, with defined transitions between them and a rule for every fault event. That is a Hierarchical state machine: a child state (for example "rectifier, power control") inherits the reactions of its parent ("station running"), and entry and exit actions run in a defined order so a transition never leaves a breaker half-closed. Inside a mode, the outer loops regulate transmitted power, DC voltage or AC voltage with PID control on slow references; in a multi-terminal grid one station holds DC voltage while others follow, or all share the load through a voltage-power droop (Droop control, no page yet). The contract downward is a small set of references (active-power or DC-voltage target, reactive-power or AC-voltage target) updated at a rate the converter control can ramp towards without a step.

Converter control

The converter controller is where the power electronics live. It locks to the AC grid with a Phase-locked loop, transforms the measured three-phase quantities into rotating-frame components and regulates them with fast current loops, the same structure as in a motor drive (Field-oriented control, no page yet). The transistor-based voltage-source converters used in modern stations are mostly modular multilevel converters: each arm is a chain of submodules with a capacitor, and the controller must keep the capacitor voltages balanced and suppress the circulating current inside the converter while following the references (Modular multilevel converter control, no page yet; see the original topology by Lesnicar and Marquardt and a circulating-current controller by Tu et al. in Sources). The output is a number of submodules to insert per arm; with many submodules a nearest-level choice is enough, and PWM generation with dead time is used where the converter is a conventional two- or three-level bridge or inside a submodule.

All of this must run as a fixed-period task. A Fixed-rate control loop uses absolute deadlines and a constant dt, so jitter never accumulates into the integrators and filter coefficients stay valid. Measurements pass IIR and FIR filters before the loops use them. Where two redundant controllers or two vendors' tools must produce bit-identical results (for replay, for factory acceptance tests, for hot-standby comparison), Deterministic fixed-point math removes the compiler and CPU differences of floating point.

Valve electronics

Below the controller, a hardware layer runs without an operating system: logic on an FPGA with a fixed latency from input to output (FPGA dataflow pipelines, no page yet), a deterministic link to the controller over optical fibre (Real-time fieldbus, no page yet), and gate drivers that protect the device on their own. A driver watches the voltage across a conducting device and, if it rises like a short circuit, turns the device off softly and latches a fault (Gate-drive desaturation protection, no page yet), because no controller is fast enough to do it. Bulk data such as sampled waveforms moves by DMA transfers (no page yet), so the processor does not copy samples inside the control cycle. Timing closure of the FPGA design is checked with Static timing analysis, which propagates arrival times through the logic graph and reports slack; the graph behind it is a DAG, so Topological sort and Critical path analysis (no page yet) give the same answer a tool computes.

Protection

Protection is a separate system, not a feature of the controller. The pattern is Safety monitor architecture (no page yet): an independent checker with its own sensors and its own power that can force a safe state (block the valves, open breakers) when the main channel misbehaves. Trip decisions are voted: several redundant protection channels evaluate the same fault and a 2-out-of-3 vote (no page yet) trips only if two agree, so one failed sensor neither misses a fault nor trips a healthy plant. A Watchdog timer on each processor forces a defined reaction if software stops, and a Memory protection unit stops a faulty task from corrupting another. Messages between protection and control, and between the two stations, carry a counter, an ID and a CRC so that loss, repetition, corruption and delay are detected on a link nobody trusts (End-to-end protection (E2E), no page yet).

Tripping is only the first step. fault-detection-isolation-recovery (no page yet) is the sequence after it: detect which element misbehaved, isolate it (open the breaker or bypass the faulty converter arm or sub-module) so the rest of the pole keeps running where it safely can, and recover by a defined restart or reduced-power state instead of a full shutdown. Protection hands the fault location to this sequence, station control hands back the allowed operating modes, and recovery steps are never taken by the protection channel itself.

Redundancy

Control hardware is duplicated. The standby runs the same software on the same inputs, so its state follows the active unit's and a changeover costs only a few cycles; that is Hot standby redundancy on top of Primary-backup replication: one controller is the primary and the other mirrors it. The hard part is the same as in a database cluster: never two primaries. A Lease bounds how long a unit may act as primary after it loses contact, and an epoch or fencing token lets the output stage and the valve electronics ignore commands from a unit that was demoted but has not noticed. Health checking with hysteresis decides when a unit is bad, so one late message does not trigger a changeover; the standby's state is re-synchronised from a Write-ahead log of parameter changes after it restarts.

Time and measurement

Sequence-of-events recording, fault location and the coordination of the two stations all need a common time base. Clock synchronization (PTP, or the older IRIG-B signal) distributes it to the controllers, and a servo steers each local clock with the same PID control and Phase-locked loop ideas as the converter loops. Synchrophasor measurements from phasor measurement units (Synchrophasor estimation, no page yet) add a grid-wide, time-stamped view that damping controllers can use. Raw measurements contain spikes from switching noise, so plausibility checks use Robust statistics (median and MAD rather than mean and standard deviation) before a value is accepted.

Operator interface and records

A converter fault produces hundreds of signals within milliseconds. Alarm management turns them into a few actionable alarms with delay, deadband, acknowledge and shelving states, and Debouncing and throttling (no page yet) stops a chattering contact from flooding the operator. The station talks to the control centre over a SCADA protocol with time-stamped events (DNP3 protocol, no page yet). Event and disturbance records are the evidence after a trip, so they are appended to a Write-ahead log with a CRC32C checksum per record and flushed with the sequence from fsync and direct I/O; a torn tail is detected on restart and cut.

Network security

The control network is separated into zones joined by narrow conduits, as in IEC 62443 and the Purdue model (Industrial network segmentation, no page yet). A firewall enforces protocol allow-lists, which is a Packet classification (no page yet) problem; deep inspection recognises the industrial protocol (Deep packet inspection, no page yet). Where data must leave the safety zone but nothing may come back, a Data diode (no page yet) gives one-way transfer with forward error correction.

Data and control flow

One power order:

1. The dispatcher sends a power setpoint over the SCADA link; the station state machine checks that the mode allows it and applies a ramp.
2. Station control converts the setpoint to a current or DC-voltage reference and sends it to the converter controller as a time-stamped, E2E-protected message on the control bus.
3. Each converter cycle: sample the AC and arm measurements, filter them, update the PLL angle, run the current loops, compute the submodule insertion counts and send them to the valve electronics. The cycle period is fixed (order of tens to hundreds of microseconds for the valve-facing loops, much slower for the outer loops).
4. The valve electronics fire the selected submodules; status and capacitor voltages come back on the same link.
5. The standby controller receives the same inputs and runs the same steps; the output stage listens to the primary only.

One DC fault:

1. Sensors see the current or voltage change; local detection at the gate driver may act first by switching off the device.
2. Protection channels evaluate the fault independently; two out of three agree and issue a block or trip.
3. The valves are blocked, breakers are opened and a status message goes to the remote station (E2E-protected, so a lost message is itself a fault).
4. The station state machine moves to a fault state, the event recorder flushes the disturbance record, the alarm system shows one root alarm, and the dispatcher is notified.
5. Time goes to detection and the valve-level reaction (microseconds to milliseconds), not to the operator: the operator's part starts after the plant is already safe.

Scaling

Control and protection do not scale by adding throughput; they scale by meeting a fixed deadline on more hardware. In the order you hit the limits:

1. Cycle time. More submodules per arm means more work per cycle. Pull the levers in this order: fixed-point or SIMD in the controller (SIMD programming), move the per-submodule work to the FPGA pipeline, then split the arm into parallel pipelines.
2. Signal count. Hundreds of measurements and alarms. Filter at the edge, debounce, and send changes rather than full tables.
3. Redundancy cost. Each added channel is more wiring, more voting and more spare parts; go from 2 to 3 channels only where an unavailable plant costs more than a false trip.
4. Network size. A multi-terminal system adds stations that share a DC voltage; use droop sharing so no high-bandwidth communication is on the critical path.
5. Verification. The more software, the more test hours; the only lever is a smaller, simpler protection core with its own proof.

Failure modes

Real implementations

Vendor control systems (ABB/Hitachi Energy, Siemens Energy, GE Vernova) are proprietary; the open projects below show the simulation and the protocol parts of the stack.

Sources

• M. Lesnicar and R. Marquardt, An innovative modular multilevel converter topology suitable for a wide power range, 2003 IEEE Bologna PowerTech. DOI
• Q. Tu, Z. Xu and L. Zhang, Circulating current suppressing controller in modular multilevel converter, IECON 2010. DOI
• Guironnet, Saugier, Petitrenaud et al., Towards an Open-Source Solution using Modelica for Time-Domain Simulation of Power Systems, IEEE PES ISGT Europe 2018. DOI
• Dynawo documentation: dynawo.github.io; source of the HVDC models in the repository above.
• libIEC61850: github.com/mz-automation/libiec61850.