Overview of Control Algorithm Verification Methods in Power Electronics Systems

Abstract

The paper presents the existing verification methods for control algorithms in power electronics systems, including the application of model checking techniques. In the industry, the most frequently used verification methods are simulations and experiments; however, they have to be performed manually and do not give a 100% confidence that the system will operate correctly in all situations. Here we show the recent advancements in verification and performance assessment of power electronics systems with the usage of formal methods. Symbolic model checking can be used to achieve a guarantee that the system satisfies user-defined requirements, while statistical model checking combines simulation and statistical methods to gain statistically valid results that predict the behavior with high confidence. Both methods can be applied automatically before physical realization of the power electronics systems, so that any errors, incorrect assumptions or unforeseen situations are detected as early as possible. An additional functionality of verification with the use of formal methods is to check the converter operation in terms of reliability in various system operating conditions. It is possible to verify the distribution and uniformity of occurrence in time of the number of transistor switching, transistor conduction times for various current levels, etc. The information obtained in this way can be used to optimize control algorithms in terms of reliability in power electronics. The article provides an overview of various verification methods with an emphasis on statistical model checking. The basic functionalities of the methods, their construction, and their properties are indicated.

1. Introduction

Power electronics is an interdisciplinary field related to three basic technical areas: (1) electrical engineering, (2) computer engineering, and (3) control engineering. The importance of power electronics has grown over the years, and now it can be found in every area of life [1]: household appliances, a wide variety of industries, power engineering, energy, telecommunications, medicine, transport, etc. The large number of various types of converters (DC/DC, AC/DC, DC/AC, AC/AC), their various complexity levels and the possibility of their potential applications, constitute a great challenge for engineers at the design and construction stage. Each of the stages of product implementation will be characterized by distinct necessary analyses. In the initial design stage, the concept of the system operation and the control strategy should be checked, taking into account the parameters of the components used, as well as the parameters related to power supply, load and disturbances. However, in the last phase of design and construction, one should take into account the mutual physical interactions of individual elements and interactions with the environment, as well as changes in the parameters of the system during its operation, e.g., element heating, aging of elements, etc. The stage of launching and testing the operation of prototypes should include analyses related to the observance of safety procedures, the correctness of switching on/off of individual system components and the analysis of the occurrence of unwanted states of the system operation.

Among the methods of testing the operation of power electronic systems, the most popular methods are computer simulation and experimental verification of low-power prototypes. Each of these methods has its own advantages and disadvantages. The general properties of these two methods of verifying the operation of power electronic systems will be discussed in this part of the article.

In general, computer simulation can greatly assist in power electronics analysis, design, and education. Computer simulation is an attempt to model the real or hypothetical situation in the computer environment without the need to build a prototype in order to test the operation of the analyzed system. By changing various variables related to the parameters of the system itself, mains, load or other external factors, the behavior of the entire system can be predicted.

Several software packages and platforms have been developed to simulate electronic systems as well as power electronics. Different simulation software packages have different complexities for creating or designing a model, processing simulation results, and graphical user interface. All these packages also differ in their level of accuracy and the ability to perform various analyses. The most popular simulation packages include Matlab (Simulink), PSIM, Simplorer, Pspice (OrCAD), Multisim, PLECS, PSCAD, etc. For more information on Matlab (Simulink) and Pspice, the reader can refer to [2,3,4], and more details about PLCES can be found in reference [5].

Computer simulations are in most cases the first step in the design and analysis of power electronic systems. Their invaluable contribution is primarily in the study of the properties of new converter topologies. Computer simulations enable engineers to study the behavior of structurally complex systems, as well as complex systems in terms of their control strategy, without the need to build or operate them. They are also used to analyze the behavior of converters in non-standard operating conditions of systems related to both the occurring disturbances and parameters of the external environment. In addition, computer simulations are a source of information in the analysis of the causes of hardware failures and the identification of a specific type of failure. In summary, computer simulations are used in the analysis of existing equipment as well as in the design of new systems, and their beneficial properties are the fact that they allow engineers to safely investigate abnormal operating conditions or faults without actually creating such conditions in a real environment. It should be pointed out here that even the most modern computer programs are not able to comprehensively and accurately reproduce all parameters and aspects of the real equipment [6]. The accuracy of the simulation results depends on the accuracy of the models created and the proper identification and location of parasitic circuit elements and couplings with the environment, e.g., parasitic inductance, capacitance and mutual coupling. In this context, simulation models are often used to estimate the behavior of the tested device under certain limitations and inaccuracies of the models. Often, simulation models are also more accurate when testing the behavior of systems in steady states, i.e., the implementation of the basic function of the converter. Testing circuits in dynamic states or perfect mapping of states related to switching power semiconductor elements is a more complex issue that requires an individual approach to the problem.

The second mentioned method of testing power electronic systems is the construction of low-power prototypes and experimental verification. The advantage of this approach is in checking the behavior of the systems in real conditions, taking into account all parameters and physical interactions. The undoubted difficulty in this type of hardware verification is the time-consuming nature and high cost of building a prototype. Additionally, testing the properties of systems for their various parameters and supply or load conditions is a time-consuming and complex process and often leads to damage to the prototype.

Digital Real-Time Simulation (DRTS) [7] is a combination of simulation and hardware verification. DRTS can be divided into two sub-categories. First is a fully digital real-time simulation, e.g., model-in-the-loop (MiL) or software-in-the-loop (SiL). The second is hardware-in-the-loop (HiL) in real-time. In the HiL simulation, parts of the fully digital real-time simulation are replaced with real physical components. Power hardware-in-the-loop (PHiL) simulation is the most advanced type of verification of circuits and systems using DRTS [8], used, e.g., for a 500 kW advanced photovoltaic inverter functionality verification [9]. PHiL is based on a hybrid configuration of software (simulation) and hardware (physically connected). The real-time simulation environment exchanges low-voltage and low-current measurement signals with the devices under test and controls its power through the hardware via the power interface. A good comparison of the real-time simulators, with respect to operating system and software compatibility, is shown in reference [10] (comparing five simulators) and reference [11] (comparing eight simulators). Among the recently strongly developed HiL systems, we will highlight: RTDS Technologies Inc. [12] (used, e.g., for simulation of Static VAR compensator (SVC) in a large power system [13]), Opal-RT Technologies [14] (used, e.g., for estimation of on-line parameters and current control of a six-phase induction machine [15]) and dSPACE [16] (used, e.g., for permanent magnet motors [17], and multilevel converters [18]). The FPGA-based design alternatives to HiL in power converters with different coding methods and numerical formats are compared in terms of area and speed in [19]. Another interesting approach is the proposed ultralow-latency HiL platform combining flexibility, accuracy and ease of use of state-of-the-art-simulation packages with the response speed of small power-hardware models [20]. This allows acceleration in the pace of product prototyping. The latest advances include integration of individual HiL systems (based on Opal-RT) into a network of HiL systems (so-called networked HiL simulation system), to better reflect the needs of modeling large-scale power systems [21].

It is impossible to discuss in detail all the components and applications of the mentioned main systems (RTDS, Opal-RT and dSPACE). A synthetic look at them is presented in the following description. RTDS real-time power system simulator enables the verification of the performance of power system devices and the implementation of risk reduction procedures using HiL testing. It is based on a dedicated hardware platform based on the NovaCor multi-core processor. It enables the testing of power systems and power electronic converters. OPAL-RT real-time simulators are based on PC/FPGA (personal computer/ field-programmable gate array) devices, and are mainly used as HiL testing equipment and Rapid Control Prototyping (RCP) systems. Their widespread industrial and research use has been found in such areas as: power networks, power electronics, motor drives and automotive. Meanwhile, dSPACE offers solutions in the field of prototyping control systems and HiL simulations. The dSPACE real-time simulators are based on an Intel processor and FPGA. HiL testing systems include versatile I/O boards as well as bus and network interfaces. They are used, among other things, in power electronics, automotive, aviation, defense, industrial automation and medical technology industries. All of these simulation platforms are also widely used in research and development centers and universities.

The efficiency and reliability of power electronic converters is an important aspect, because the accuracy of the signals shaped by the converter affects the behavior of the powered devices or the supply network. Reliability is especially important in the use of power electronics in the power network, where the performance of converters is influenced by the parameters of the power network. They are usually assessed based on multiple simulations and experimental investigations [22,23]. The latest literature research shows that it is also possible to evaluate the results of power electronic converter operation with the use of formal methods used previously by universities mainly in the fields of computer engineering and automation control systems. Formal methods have also been successfully used in the industry, for example in nuclear power plants [24,25,26], wind turbine systems [27] or automotive company SCANIA [28]. A performance verification method must prove that the control algorithm can handle any system disturbances and keep the deviations of the controlled variables from the references at a minimum. Additionally, formal verification methods can be used to test the master control algorithm of converters related to the correct startup or shutdown sequence, safety systems, operation of systems under abnormal power or load conditions, as well as to check whether the system will not enter dangerous states.

Power electronics systems can benefit from formal verification methods which allow the thorough investigation of the designed system before its final implementation. In general, formal verification methods allow the identification of some divergences between the formal model of the system and the requirements of the customer or user. Hence, formal methods, powerful and mature, but formerly also complex for efficient use [29], may increase the quality of the final product [30]. It is commonly known from the industry of any domain, that the earlier any errors are detected, the faster they can be repaired and the cheaper the costs are. Formal methods can be applied at an early stage of system development, namely, already at the specification stage. The most valuable formal methods are symbolic model checking [31] and statistical model checking [32,33], both of which are currently being applied to a wide variety of systems, including production systems [34], cyber-physical systems [35], manufacturing systems [36,37], or even instrumentation and control systems [26]. Their use in power electronic systems is a research subject that has recently been gaining the attention of world research centers [38,39,40,41,42]. Although the first attempts at introducing formal methods to this application area date from the beginning of the 21st century, they have not gained popularity. Power electronic circuits had already been formally checked in the year 2004 [43], by introducing a procedure to obtain hybrid automata from a power circuit, modeling time varying sources in the circuit components, and implementing formal verification and controller redesign procedures. As shown in [40,41], formal methods can be used to solve problems that go beyond the well-known conventional methods in power electronics. By using conventional simulation software, we can obtain some information about the different performance metrics, such as control accuracy, use of the semiconductor devices or response to system disturbances at certain operating points. However, a few simulations might not be sufficient to draw conclusions about the above-mentioned performance metrics and, moreover, exploring the whole state space of a converter system seems impossible using simulations. Formal methods based on statistics do not require simulation as they rely on statistical evidence.

The information obtained in this way can be useful for optimization in terms of reliability in power electronics by improving control algorithms.

The contributions of the paper are as follows:

(1)

Presentation of the commonly used verification methods of power electronic systems: simulations and experiments;

(2)

Discussion of the recent advancements of introducing formal verification methods to power electronic systems;

(3)

Presentation of the use of statistical model checking to automatically check the performance and reliability of a designed power electronic system;

(4)

Comparison of the verification methods of power electronics systems.

To reflect the latest state of the art regarding verification of the methods of control for algorithms in power electronics systems, the research was performed through a search of recent papers, including the following databases: Elsevier, IEEE Xplore Library, MDPI and Springer. Simulations and experiments are well-established methods of verification, used for many years in the everyday work of engineers, both in practice and in academia [44]. They do require a lot of time and professional expertise, but some approaches have also appeared to shorten and simplify the process, as proposed in [45]. The hardware-in-the-loop (HiL) method has been applied in many recent projects, e.g., in a tram regenerative braking system [46], for evaluation of the active safety of vehicles equipped with electronic stability control systems [47], or for simulation of a photovoltaic system in micro-grids [48]. Unfortunately, to the best of the authors’ knowledge, there are just a few papers focusing on model checking (both symbolic and statistical) in the area of power electronics systems. The aim of this article is not to provide a comprehensive survey on all the advancements, especially in respect of various commercial simulation systems, as these aspects—although interesting—are beyond the scope of this paper. The main goal is to show the control algorithm verification possibilities and the potential for introducing formal methods to the new application area. Model checking, already recognized in many domains of computer science and control theory, also seems to be a promising technique in energy systems. Therefore, great emphasis in this article is put on boosting the application of formal verification in power electronics system.

The rest of the paper is structured as follows. Section 2 describes the system model. Section 3 provides a short overview of performance assessment and verification methods, mostly considering simulations and experiments. Section 4 focuses on formal verification methods, including symbolic model checking and statistical model checking. Section 5 compares and discusses the existing verification methods of power electronics systems. Section 6 presents control algorithm verification workflow. Finally, Section 7 concludes the article.

2. System Model

A matrix converter (MC) was selected as the power electronic system for the analysis [49]. The MC circuit diagram is shown in Figure 1. It is a power electronic system with a complex structure with a large number of power electronic switches that perform direct AC/AC conversion. It allows for independent shaping of the output currents and control of the input power factor. Due to the direct conversion, the quality of the shaping of the output currents is influenced by all disturbances from the power grid. Additionally, the use of the modulation algorithm and the correct selection of its parameters and the passive elements of the input filter affects the quality of the signals shaped by the converter. Among many MC modulation algorithms [50], model predictive control (MPC) was used in this article. The principles of MC control with MPC are based on the system model and the selection of the optimal configuration of switches resulting from the minimization of the cost function. The system model can be described by the following state-space equations for the source filter (1) and differential equation of load side (2) and MC signals relationships (3):

$$\left[\begin{array}{c}\frac{d{v}_{abc}}{dt}\\ \frac{d{i}_S}{dt}\end{array}\right]=\left[\begin{array}{cc}0& \frac{1}{C_F}\\ \frac{-1}{L_F}& \frac{-R_{LF}}{L_F}\end{array}\right]\left[\begin{array}{c}{v}_{abc}\\ i_S\end{array}\right]+\left[\begin{array}{cc}0& \frac{-1}{C_F}\\ \frac{1}{L_F}& 0\end{array}\right]\left[\begin{array}{c}{v}_S\\ i_{abc}\end{array}\right]$$

(1)

$$L_L\frac{d{i}_L}{dt}=v_{ABC}\left(t\right)-R_L{i}_L\left(t\right)$$

(2)

$$\left[\begin{array}{c}{i}_a\\ i_b\\ i_c\end{array}\right]=\left[\begin{array}{ccc}{s}_{aA}& s_{aB}& s_{aC}\\ s_{bA}& s_{bB}& s_{cB}\\ s_{cA}& s_{cB}& s_{cC}\end{array}\right]\left[\begin{array}{c}{i}_A\\ i_B\\ i_C\end{array}\right]\left[\begin{array}{c}{v}_A\\ v_B\\ v_C\end{array}\right]=\left[\begin{array}{ccc}{s}_{aA}& s_{bA}& s_{cA}\\ s_{aB}& s_{bB}& s_{cB}\\ s_{aC}& s_{bC}& s_{cC}\end{array}\right]\left[\begin{array}{c}{v}_a\\ v_b\\ v_b\end{array}\right]$$

(3)

where L_F and C_F represent the output filter inductance and capacitance, L_L and R_L and are load inductance and resistance, respectively. The process of discretization of Equations (1)–(3), in order to obtain recursive formulas describing the parameters of the system, is carried out by means of the zero-order hold (‘zoh’) method. The Matlab program, which has built-in functions for this purpose, can be used to discretize the matrices describing the input filter [51]. The Matlab code of discretization procedure is described as follows:

• Ai = [0 1/Cf; −1/Lf − (Rf)/Lf]; Bi = [0 −1/Cf; 1/Lf 0]; Ci = [1 0; 0 1]; Di = [0 0; 0 0];
• system = ss (Ai,Bi,Ci,Di); systemd = c2d (system,Ts);
• Ad11 = systemd.a (1,1); Ad12 = systemd.a (1,2); Ad21 = systemd.a (2,1); Ad22 = systemd.a (2,2);
• Bd11 = systemd.b (1,1); Bd12 = systemd.b (1,2); Bd21 = systemd.b (2,1); Bd22 = systemd.b (2,2);

The internal prediction model is given from the following recursive formulas:

$$i_S^{pre}\left(k\right)=A_{d21}{v}_{abc}\left(k\right)+A_{d22}{i}_S\left(k\right)+B_{d21} v_S\left(k\right)+B_{d22}{i}_{abc}\left(k\right)$$

(4)

$$i_L^{pre}\left(k\right)=\left(1-\frac{R_L{T}_S}{L_L}\right)i_L\left(k\right)+v_{ABC}\left(k\right)$$

(5)

As can be seen from Equations (4) and (5), load and grid currents are optimized variables for MC with MPC. Other variables in the model are measured ($v_S, v_{abc}, i_S, i_L$) or calculated from the measured signals ($i_{abc}, v_{ABC}-\text{Equation (3)}$). This method of objective function minimalization performs two tasks. Tracking the output current i_L^∗ computing the converter output voltage v_ABC is the main objective of the algorithm, while the second function performed is to maintain the unit input power factor. The cost functions of the described system are defined as follows:

$$g={\lambda }_1\left(\left|i_{L\alpha }^{*}-i_{L\alpha }^{pre} \right|+\left|i_{L\beta }^{*}-i_{L\beta }^{pre}\right|\right)+{\lambda }_2\left|v_{S\beta }{i}_{S\alpha }^{pre}-v_{S\alpha }{i}_{S\beta }^{pre}\right|$$

(6)

where indices α and β denote the real and imaginary part of the respective three-phase voltages and currents described on the complex reference plane, λ₁ and λ₂ are the weighting factors.

The proposed methods of formal verification, which are the main topic of the article, should check the converter performance in relation to these two indicated objective functions described by (6).

3. Simulation and Low-Power Prototype Verification of Power Electronic Converter Properties

3.1. General Characteristics of Selected Programs for Simulating Power Electronics Systems

As mentioned previously, the most popular simulation packages that enable simulation of power electronics systems also in electro-energy applications include Matlab (Simulink), PSIM, Simplorer, Pspice (OrCAD), Multisim, PLECS or PSCAD [2,3,4,5].

PSpice is a circuit simulation tool for both analog and digital systems. Initially, it was created as a tool for simulating low-power electronic systems, then it was extended to other electrical systems, also of high power. The advantage of the software is a large database of PSpice model libraries for various real electronic components. Software limitations are related to the representation and implementation of numeric blocks and complex controllers. Simplorer is an advanced and multidisciplinary circuit simulator that allows you to perform analysis, optimization and verification of the product at an early stage of the project (analysis of both individual components as well as complete systems). Simplorer allows you to analyze all aspects of large-scale systems, from detailed component analysis to system performance, in one virtual design environment. Simplorer has the ability to analyze sensitivity, efficiency, sequence of events, interference effects, harmonic and statistical analysis. The great advantage of the program is the rich library of elements (including, among others: electrical, magnetic, mechanical, hydraulic, control elements, models of batteries, PFC filters and converters). PSIM is one of the simulators that has been especially developed for power electronics. It is one of the fastest simulators for simulating power electronics; therefore, it is optimized for the tasks appearing in this field of technology. Generally, PSIM and its add-on modules provide simulation in many areas, including: power electronics, motor drives, motor control design, digital control, renewable energy. Matlab is a mathematical tool designed mainly for numerical calculations. Optional toolkits, called Simulink, also enable simulations of power systems, including power electronics. An additional set of tools that can be combined with Matlab for the simulation of power electronics is, among others, PLECS. MATLAB Add-On Toolboxes enable cooperation with other simulation programs, as well as with devices for Digital Real-Time Simulation, microprocessors and microcontrollers and FPGAs. It is probably the most extensive simulation environment that can work with a huge number of other environments and systems. It is also one of the main tools for simulating power electronics systems and their applications.

3.2. Simulation of Matrix Converter Using Matlab Simulink

Our example of simulation verification of a power electronic system will focus on a matrix converter with a model predictive control algorithm, described in Section 2. The general view of the simulation scheme is presented in Figure 2.

The presented simulation is based on a circuit model with basic elements of input LC filter and simplified load in the form of series connected RL elements. The simulation assumptions include symmetry of the system parameters for each line of the three-phase system and the use of idealized switches in the matrix converter power stage. The parameters of the simulation model are summarized in

Table 1. Parameters of simulation model.

Parameter	Value	Unit
Voltage source	230/50	V RMS/Hz
Filter capacitance	60	μF
Filter inductance	1	mH
Filter choke resistance	0.1	Ω
Output inductance	10	mH
Output resistance	48	Ω
Sampling time	25	μs

. The MPC algorithm is implemented in a text environment (Matlab Function) as a script with code that implements the algorithm’s assumptions. All the constants for the algorithm were previously calculated and set as input variables. The zero-order hold method was used to discretize the differential equations. The MPC algorithm is executed with a time of 25 μs during which the system model response to 27 allowed MC switch states is checked. The algorithm minimizes the objective function, which is related to the load current performance and obtaining the unity input power factor. The simulation model enables the measurement of any signals in the control circuit and high-power signals through appropriate voltage or current measuring sensors. The visualization of the obtained results is possible with the use of Scope blocks.

Example results of MC simulation tests for appropriately selected parameters of the circuit, power supply system and control algorithm are presented in Figure 3. They illustrate the output currents measured in the circuit and the reference value of the set output currents. From the results obtained, it can be seen that the control algorithm has good tracking performance. To test the operation of the system with different parameters, another simulation should be carried out and the obtained results should be recorded. Only after a series of tests has been performed, can other analyses of the results be performed, e.g., statistical, collation, etc.

Testing the operation and performance of power electronic converters by means of computer simulation requires a large number of simulations to be carried out with changes in its parameters. The simplest approach to analyzing the properties of systems by means of simulation is to perform it multiple times for a step change of the set parameters and to save the results after each simulation. This approach is simple but time consuming. This hinders the multi-criteria analysis of the operation and the performance of the converter system. Matlab has an option of parallel simulations and uses all processor cores or graphics processing unit (GPU) cores, so it is easy to do a parameter sweep. This approach is more complex when creating a simulation model, but allows for multi-criteria analysis more easily.

The challenges related to the simulation of various matrix converter topologies and their control strategies and modeling techniques are described in the book [52]. Matlab Simulink was also used as the basic simulation tool. Additionally presented in the latter reference were issues with testing control algorithms using HiL based on the dSpace platform.

3.3. Low-Power Prototype Experimental Verification

In the traditional approach to the verification of power electronic converter control systems, the computer simulation phase was followed by the experimental verification stage in low-power prototypes. This stage is particularly important in studying the properties of new converter topologies and new modulation or control strategies. This approach is also often used in scientific research, where the experimental verification of scientific work is a necessary stage enabling the publication of the obtained results in reputable technical and scientific journals. It should also be emphasized that these prototypes are most often made individual, without optimization of the mechanical structure and individual components.

The advantage of the experimental verification approach on low-power prototypes is that it checks the behavior of the control system and the converter in real conditions, while maintaining the scale effect of physical interactions with the environment. The results obtained in this way can then be used in further multi-criteria analyses of the system properties, taking into account various technical aspects such as: prediction of the losses and efficiency, EMC (electromagnetic compatibility) problems, prediction of the reliability in estimating the lifetime of the systems, construction of an effective cooling system and appropriate selection of system components (transistor technology, type of protection and selection of a control algorithm implementation technique).

An example of a low-power matrix converter prototype construction is shown in Figure 4a. The prototype is made in an open version without a cover, and the control signals from the control circuit are fed to the power transistors by means of optical fibers in order to limit the influence of external interference. This system allows the checking of the correctness of operation of various modulation algorithms and the commutation strategies of transistors. In addition, the performance of the converter can be verified in its various applications, such as variable speed drive systems and energy conditioners in power systems.

The presentation of the results of the experimental verification of MC operation consist of the waveforms of three output phase voltages (Figure 4b) as well as input and output currents and voltages for one of the phases (Figure 4c). Additionally, Figure 4d shows the control signals for the transistors of two switches, for which there is a switching process with a four-step commutation strategy.

Simulations are less time consuming than experiments and can be performed before physical realization of the system. Experiments, in turn, can help to find out how the real physical power electronic system behaves. Neither of them, however, can ensure that the system is error-free. It is hardly possible to cover all potential usage scenarios and to test the system under all conditions. Additionally, skilled professional knowledge is necessary to check the design correctness.

A modern approach to designing and testing the operation of power electronic converters has developed new verification techniques using Digital Real-Time Simulation systems based on SiL, HiL or PHiL platforms as well as model checking methods. The extended approach to verification of the operation of power electronic systems provides new possibilities, which will be discussed in the following chapters of the article.

4. Model Checking

4.1. Symbolic Model Checking

Symbolic model checking with exhaustive state exploration allows formal verification of a designed system at an early stage. A system model is verified against user-defined requirements, expressed as temporal logic formulas. In response, the model checker returns an answer to the question of whether the requirements hold, and if otherwise, appropriate counterexamples are generated to track the undesirable situation. The process of symbolic model checking is illustrated in Figure 5. The system model has to be delivered in the input format of a model checker. Much attention should be paid to requirements definition, as only the specified requirements will be checked. The model checker then automatically compares the system model with the list of requirements. If any of them are not satisfied, all input elements should be revised to find the source of error. It may happen that either the system model is not correct or the requirement itself. The revised elements are verified again, until all properties hold in the system model. Then, the next step towards physical realization can be taken.

Symbolic model checking techniques [31] are especially valuable in proving that some requirements are satisfied in the model. However, it suffers from the state explosion problem [53], which is its main drawback. To mitigate this, model abstractions can be used that reduce the generated state space.

Let us briefly describe the recent approaches of symbolic model checking in power electronics systems. The application area is new, and therefore, to the best of the authors’ knowledge, there are only a few publications describing research that shows the benefits of symbolic model checking.

An approach for the design verification of switching power converters was shown in 2012 [54]. Circuits were modeled as timed automata and verified with the UPPAL model checker. A sample-verified property was that the output voltage always lies in the range −10 V to 10 V. The main contribution of the above-mentioned paper was to show that some analog circuits can be naturally modeled as timed automata.

An automatic formal verification approach of supervisory energy management systems for microgrids was proposed in 2019 [38], with the use of the UPPAAL model checker. The system is modeled as a network of timed automata models, each one representing a function or a component. Possible modes of operation in the microgrid have been derived and categorized into allowable and non-allowable operating modes. It has been concluded that the approach is effective for reliable design verification guaranteeing correctness of design for the stable and efficient operation of a microgrid.

The first application of model checking to verify the stand-alone solar photovoltaic system (with solar panel, charge controller, battery, inverter and electric load) was proposed in 2019 [55]. The verification lasted longer than the simulation, but was able to present the details that lead to failures in a photovoltaic system. Three verification tools have been evaluated (the C Bounded Model Checker, the Efficient SMT-based Bounded Model Checker and the Configurable Program Analysis Checker) to compare performance and soundness among automated verifiers.

In a recent article [39], we also showed how to benefit from symbolic model checking, focusing on formal verification of a direct matrix converter (MC) with transistor commutation and space vector modulation (SVM). The MC was specified as a Petri net (formal specification technique used in control systems), and then further modeled in a hardware description language towards final implementation in a programmable device. The proposed design methodology involves triple verification: (1) model checking of the specification with the nuXmv tool, (2) software verification of the modeled system, and (3) hardware verification of the already implemented system. The rule-based logical model was used to represent the Petri net and to automatically generate a verifiable model in the format of the nuXmv model checker. Thanks to this, errors related to manually written code were eliminated, and the rule-based model was approximately 10 times shorter than the verifiable one. Model checking of the specification confirmed that all places of the Petri net were reachable, and that the Petri net was live, which means that the designed system does not get stuck in any of the system states and is able to operate over a long period of time.

4.2. Statistical Model Checking

Another formal verification method is the statistical model checking (SMC) [32,33], which combines simulation and statistical methods for the analysis of stochastic systems. Symbolic model checking suffers from the state space explosion problem, i.e., the larger the model is, the longer it will take to explore the entire model state space. Moreover, once components that do not have a deterministic behavior, such as loads or a power grid, are introduced into the model, it is almost impossible to explore all scenarios that can occur in the system. Thus, instead of performing an exhaustive search of the complete state space of the model, SMC will use well-known methods originating from statistics, such as Monte Carlo simulations, which will be used to obtain the statistical evidence of the system’s properties. The method cannot provide a 100% guarantee; however, the confidence can be preset by the user. The confidence level is correlated with the number of simulation runs, so it is easily scalable. This fact can be used to test various system prototypes in a short time and to choose the one that is the most suitable for further development.

The process of statistical model checking is illustrated in Figure 6. The system model has to be delivered in the input format of a model checker. The hypothesis queries have to be defined and the confidence level must be specified. The higher the confidence level is, the more simulation runs have to be performed and the more time-consuming the verification becomes. Finally, the results are returned, which allows a statistical evaluation of the probability of the hypothesis queries (e.g., a system variable with the value below some threshold).

Let us briefly describe the recent approaches of statistical model checking in power electronics systems. There is also not much research that benefits from SMC in this application area.

Monte Carlo simulation for model validation of pulse width modulation dc–dc converters is discussed in [56]. Hybrid automata models are generated automatically, and interval matrices are used to model non-determinism due to parametric variations. The reachability analysis framework has been introduced, and the proposed reachability analysis method is said to outperform the brute force Monte Carlo method in computation time and confidence level. Reachability analysis is also a research object in [57] for closed-loop switching power converters, and in [58] for power electronics dc–dc converters, aiming at reducing computation burden.

In reference [40], statistical model checking (SMC) was used to check the performance of finite-set controlled power electronics converters. A detailed modeling procedure of the converter system components was given, and the UPPAAL SMC toolbox was used to perform statistical model checking, after the correctness of the created model was compared with the equivalent Simulink model and experimental results. The most difficult part of the presented approach is the modeling of power electronics systems as timed automata structures to be used in UPPAAL SMC. To model the converter system using the TA structures, the user has to first identify the components of the system, which states the components have and what will trigger the transition from one state to the other. It is in fact straightforward to identify the states of power electronics converters. They will correspond to the possible switching states that can be applied to the converter, while the trigger for this transition will be the control algorithm. It was also demonstrated that the toolbox can be used to model components that feature discrete behavior, e.g., the controller or measurement sampler and components that feature continuous behavior, such as the system voltages and currents.

SMC is not limited to a single converter topology, and it can also be applied to the multilevel topologies, as shown in [41], for a three-level neutral point clamped converter. The results show that statistical model checking can successfully be used for verification of power electronics systems, although it is a new research direction, but with a potential growth in the near future.

We will briefly demonstrate the logic behind transferring a power electronic system model from a simulation tool to a TA-based model that could be used in, e.g., UPPAAL SMC toolbox. As shown in Figure 7, the central component of the model is the Controller. In the physical world, the controller TA represents both the converter and the control algorithm, as shown in Figure 8. The locations define all possible configurations of switches. According to the control algorithm, the system will transition from one state to another. This transition will be used to update the physical system component. An abstract model of a controller is shown in Figure 9, with various locations (y₁…y_n, corresponding to configuration of switches) and conditions for choosing the particular location (x₁…x_n, corresponding to the result of cost calculating function). A physical system component is a set of differential equations which define the transfer rate of the system voltages and currents, i.e., a state space model. Inputs to the controller are provided by the sampler component, which takes a snapshot of the measured values. In the physical world this corresponds to the measurement acquisition system. The purpose of the Tick component is to synchronize the controller and sampler timed automata so that in each sampling period the controller can obtain new measurements and update the physical system component.

Once the modeling part is completed, similar to that in traditional simulation software, we can obtain the waveforms of the system voltages and currents and check whether the model behavior corresponds to the simulation model. An example of the system currents waveforms is shown in Figure 10. The created UPPAAL model can now be used to validate the hypothesis, as shown in Figure 6.

Additionally, the UPPAAL tool can also estimate the probability of expression values statistically by checking, e.g., how possible it is for a controller to be in a particular state (sample queries for the first five locations and their results are shown in

Table 2. Sample queries for estimation of the probability (Pr) of reaching a certain controller state.

Query Number	Query	Result (Probability)
1	Pr [<=44,000] (<> (con == 1))	[0.0800269, 0.179748]
2	Pr [<=44,000] (<> (con == 2))	[0, 0.0981446]
3	Pr [<=44,000] (<> (con == 3))	[0, 0.0981446]
4	Pr [<=44,000] (<> (con == 4))	[0.901855, 1]
5	Pr [<=44,000] (<> (con == 5))	[0.901855, 1]

). It can be observed that the possibility of reaching a particular state within the first 44,000 time units is not the same for all the states, i.e., some of them are more likely to be reached, while others, less. Interpretation of the obtained results can then be used to develop more reliable converter control algorithms, especially for converter operation with a very distorted supply network.

The estimation probability is an unavoidably long-lasting task, as it is usually based on many simulation runs (e.g., 186 simulation runs for query no 1); notwithstanding that, it is performed automatically, which confers a significant mitigating advantage.

SMC has also found application in electric power grids, which also feature a stochastic behavior. Each substation of the power grid can have hundreds of consumers that need to be taken into account. In [42] the authors presented a high-performance computing software-based system (APD—aggregated power demand analyzer) that can assist the distribution support operator (DSO) in the analysis of the possible effects of high fluctuating and individualized price policies for the electricity consumers on the electric distribution network. The analyzer can perform the safety verification of the set price policies and whether the grid safety is guaranteed. APD combines two SMC approaches. First, an algorithm is used to identify when the required number of samples has been reached and then, second, to guarantee termination on zero/low-probability areas of the computed power demand distributions.

5. Comparison of Verification Methods of Power Electronics Systems

The verification methods of power electronics systems are compared with each other in

Table 3. Comparison of verification methods of control algorithm in power electronics systems.

	Simulations	Symbolic Model Checking	Statistical Model Checking	HiL	Experiments
Usage frequency	dominant	rare	rare	medium	dominant
Execution and analysis	manual	automatic	automatic	manual	manual
Time needed	short	medium	long	short	medium
Guarantee for properties satisfaction	medium	full	high	medium	medium
Challenges	selection of test scenarios	state space explosion, modeling of the system	modeling of the system	selection of test scenarios, limited computation resources	selection of test scenarios
Examples in the literature	Used in most high-quality research papers	[38,39,54,55]	[40,41,56,57]	[10,11,13,15,18,19,20,21,46,47,48]	Used in most high-quality research papers

. Their usage frequency differs a lot, with the up-until-now rare application of the model checking techniques. Simulations are used the most frequently, mainly because of their availability, and possible usage at an early stage (working with models) and quickly obtained results, albeit reflecting only some scenarios and providing no information about what is going on beyond them. Experiments, in turn, allow the checking of the real system or its components, which is of great importance for future implementations. However, none of the methods provides any guarantee that the power electronic system will behave correctly in all situations. This can only be achieved by applying formal verification methods, working on models, and which allows the checking of any properties related to a designed system. Symbolic model checking indicates with 100% certainty which properties are satisfied in the model and which are not (additionally supplemented by generated counterexamples), but such checking is subject to the state space explosion problem, which is a significant problem in power electronics systems. High certainty can be achieved with statistical model checking, returning a probability that some properties can be satisfied.

Statistical model checking provides a new type of analysis that is a compromise between the realism of experiments and the classical formal verification of symbolic models. The type of quantitative measures that are needed for power electronics systems makes it impossible to capture full symbolic verification without running into the problem of state space explosion. The verification time of statistical model-checking on the other hand scales with the specified certainty and not the model size or complexity. This provides the promise that statistical model checking can provide huge gains in the early design of power electronic systems in the future.

6. Control Algorithm Verification Workflow

As observed in Table 3, each verification method has its strengths, but also challenges that it cannot overcome. Therefore, to obtain better insight into the designed control algorithm performance, a systematic workflow needs to be established. It is schematically illustrated in Figure 11. Initial design starts typically with the simulation-based verification, where steady-state and to some degree transient-state performance is evaluated. At this point, a different level of abstraction can be used, e.g., if the control algorithm is targeting reduction of the switching losses or improving the reliability, a detailed device model should be used [59]. On the other hand, if the control algorithm design is targeting the reduction of the computation burden, a detailed device model might not be required [60].

In the next stage, the performance of the controller in a stochastic environment can be evaluated using the model checking tools. Here, the main goal is to observe whether or not the controller has a deadlock [38] and how the stochastic elements, such as load changes or the grid, can affect the controller performance and reliability of converter. This becomes of special interest for advanced control methods such as MPC, which at the moment lack tools to evaluate these properties [40]. The existence of a deadlock in the control algorithm would raise a red flag at this point and return the control design back to the initial stage.

Before going to the prototype experiments, an HiL verification of the algorithm can be performed, which brings, as mentioned above, many advantages, such as a safe environment for testing fault tolerant algorithms. It is very convenient for simulation of open circuit or short circuit scenarios. In this stage the control algorithm is already implemented in the control platform, while the converter system is run in the simulator. If the performance of the control algorithm at this point is satisfactory, the verification can proceed to the experimental testing stage.

The above-mentioned workflow is in general not limited to the application to a certain power converter topology, especially at the simulation stage. For implementation to a HiL platform there might be some restrictions regarding the number of detailed device components a platform can execute or how high a sampling frequency can be used for system simulation as stated by the manufacturer for example in [61].

7. Conclusions

In this article the verification methods for power electronics systems were discussed and compared with each other, focusing both on frequently used techniques, such as simulations or experiments, and also on rarely used but promising ones, such as symbolic or statistical model checking. Application of model checking to power electronics systems, although already well established in other domains, is here definitely a knowledge gap and should be given more attention. A specific point of interest would be the application of some form of automatic translation from one of the modeling tools specifically aimed at power electronics to a symbolic model checking framework.

Table 3 is an attempt to analyze the properties of various methods of verification of power electronic systems. Each of the verification methods has its advantages and disadvantages, providing different kinds of feedback information that are required to obtain the complete verification of the control algorithm and/or its modification in order to obtain greater reliability, efficiency and performance. Altogether, the methods build a systematic workflow, which fits each stage of the control algorithm development. The simulations focus on primary algorithm control objectives, e.g., voltage control, switching loss minimization. On the other hand, the model checking methods focus on stability and performance in a stochastic environment. In HiL control algorithm response to hazardous scenarios, such as short circuit and open circuit, faults can be evaluated. Moreover, at this stage the control algorithm is implemented in a physical platform, which allows us to investigate whether the code is correctly implemented and how high the computation burden is. In the last stage of the verification, experiments are conducted on the converter prototype.

As an example of a power electronics system where the mentioned control algorithm verification methods can be implemented, the article presents a matrix converter with a model predictive control algorithm. In this type of power electronic converters, the quality of the output signals will be directly dependent on the power quality in the power network, which has stochastic properties, such as power harmonics and voltage sags. The article also indicates and discusses the properties of the verification method for the operation of power electronic converters based on model checking to obtain properties that the traditional methods, such as simulations and experimental validation, cannot provide. Combining the tools into a toolchain would avoid the redundant remodeling of power electronics converter systems and finally build them as more reliable.

Techniques to verify the operation of various types of systems are a necessity today to control the high quality of the product and check its operation in various operating conditions. Product verification techniques based on Digital Real-Time Simulation have become common not only in university research but also in the field of broadly understood industrial use. The next step in the field of system operation verification may be to introduce the formal verification methods indicated in this article. The characteristics of formal methods indicate that they can be a good complement to commonly used verification methods, especially for modeling and verifying the effects of the stochastic disturbances on the control algorithm performance. Based on the results provided by the formal methods, a control algorithm could be redesigned or retuned to provide higher robustness to these disturbances.

This article mainly shows the potential of the proposed formal verification methods and their implementation in the field of power electronic systems. All aspects related to electrical engineering, computer engineering and control engineering can be analyzed taking into consideration the model used or the description of the states of a given system.