Development and Validation of a Special Protection System for Internal Fault in a High-Power Three-Level NPC VSC

: This paper describes the development and validation of an innovative protection system based on medium-voltage fuses for a high-power switching conversion system. This special conversion system, rated to deliver about 56 MW to the load, is based on neutral-point clamped IGCT inverters, connected to the same dc link through a set of distributed busbars, with a dc-link voltage of 6.5 kV and a capacitive stored energy up to 837 kJ. The sudden release of this energy in case of a switch failure in one inverter and the subsequent short circuit of one leg can lead to destructive consequences. From the analysis of different protection strategies, performed by numerical simulations of the fault evolutions, the developed solution based on medium-voltage fuses was found the only provision able to cope with such high stored energy and uncommon circuit topology. Custom fuses were developed for this application, and a specially tailored test was designed for validating the fuse selection. The paper, after summarizing the work carried out to simulate the fault evolution and select the protection, presents the analyses carried out to set up the validation test, and describes and discusses the results of the test and the complementing numerical simulations, which demonstrated the effectiveness of the protection system.


Introduction
The use of multi-level voltage source converters (VSCs) [1,2] in large power supply systems with high dc-link voltage implies large capacitive energy stored, which can be dangerous in case of a fault event due to the possible uncontrolled release of this energy. Typical applications where the issue is particularly important are the VSC-based high voltage direct current (HVDC) systems [3], where expensive dc breakers are necessary to protect the converter against a dc fault [4]. In this paper, this topic is treated with reference to a special VSC rated to deliver a power of about 56 MW to the load; it is part of a complex power supply (PS) system, called acceleration grids power supply (AGPS), aimed to feed the acceleration grids of a neutral beam injector (NBI) designed to heat the plasma of ITER, the world largest fusion experimental reactor [5,6]. The full-scale prototype of ITER NBI, called megavolt ITER injector and concept advancement (MITICA), is under realization to prove the capability to provide to the plasma 16.5 MW of power by accelerating a 40 A negative beam of deuterium up to 1 MV (or 46 A of hydrogen up to 870 kV), satisfying challenging requirements on the beam performance [7][8][9].
A simplified scheme of the AGPS (described in [10]) is shown in Figure 1. It is split into two parts; the part on the left-hand side, called AGPS-CS (conversion system), is the one discussed in this paper. It features five dc/ac conversion stages based on multi-level neutral-point clamped (NPC) inverters [10]. The dc-link voltage is set to 6.5 kV, higher than standard values commonly used in industrial applications [11]. To meet the special requirements of the application, the dc-link capacitors are rated to store a very high capacitive energy, 837 kJ. The sudden release of this energy in case of a switch short-circuit failure in one inverter, and subsequent short circuit of one leg could determine the circulation of very high currents and possibly the explosion of the components, with consequent catastrophic propagation of the fault and damage [12]. The mitigation of such a fault requires a proper, reliable, and effective protection system. A survey has been performed to receive suggestions on how to address the protection. The issue of the protection from internal short-circuit in high power multilevel converters is known and discussed: the analysis of the fault current distribution and the evaluation of the I 2 t in the semiconductor components allow the design of the protection system and estimation of its effectiveness [13]. In some applications, in which the continuity of service is a priority, fault-tolerant strategies are adopted. An example is the reconfiguration strategy for an NPC converter presented in [14], consisting in connecting the faulty leg to the neutral point, which guarantees the continuity of the operation at 50% of the rated power in case of short-circuit fault [15]. In the specific case of NPC inverters, the work presented in [16] is interesting, dealing with the use of an additional bidirectional controlled thyristor for protecting the load from fault transients and continuing the operation at lower dc-link voltage. However, these fault-tolerant strategies are applicable only in systems where the energy stored in the dc link is sufficiently low not to generate catastrophic damages in the VSC during the fault transient. In the system considered in this article, the unprecedented capacitive energy stored requires the installation of a reliable protection system for the protection of the NPC inverters during the transient generated by the internal fault.
In cases in which the continuity of service is not necessary, the protection commonly adopted in industrial solutions is based on the disconnection of the VSC from the mains, by switching off the front end feeding the VSC [17] or by opening circuit breakers [18]. In addition, the use of a crowbar discharging the dc link for limiting the fault current in the VSC [19] is a common implementation. For the application considered, the disconnection from the main is already foreseen but not sufficient since the energy stored in the dc link alone would be able to cause the catastrophic propagation of the fault. Furthermore, this To meet the special requirements of the application, the dc-link capacitors are rated to store a very high capacitive energy, 837 kJ. The sudden release of this energy in case of a switch short-circuit failure in one inverter, and subsequent short circuit of one leg could determine the circulation of very high currents and possibly the explosion of the components, with consequent catastrophic propagation of the fault and damage [12]. The mitigation of such a fault requires a proper, reliable, and effective protection system. A survey has been performed to receive suggestions on how to address the protection. The issue of the protection from internal short-circuit in high power multilevel converters is known and discussed: the analysis of the fault current distribution and the evaluation of the I 2 t in the semiconductor components allow the design of the protection system and estimation of its effectiveness [13]. In some applications, in which the continuity of service is a priority, fault-tolerant strategies are adopted. An example is the reconfiguration strategy for an NPC converter presented in [14], consisting in connecting the faulty leg to the neutral point, which guarantees the continuity of the operation at 50% of the rated power in case of short-circuit fault [15]. In the specific case of NPC inverters, the work presented in [16] is interesting, dealing with the use of an additional bidirectional controlled thyristor for protecting the load from fault transients and continuing the operation at lower dc-link voltage. However, these fault-tolerant strategies are applicable only in systems where the energy stored in the dc link is sufficiently low not to generate catastrophic damages in the VSC during the fault transient. In the system considered in this article, the unprecedented capacitive energy stored requires the installation of a reliable protection system for the protection of the NPC inverters during the transient generated by the internal fault.
In cases in which the continuity of service is not necessary, the protection commonly adopted in industrial solutions is based on the disconnection of the VSC from the mains, by switching off the front end feeding the VSC [17] or by opening circuit breakers [18]. In addition, the use of a crowbar discharging the dc link for limiting the fault current in the VSC [19] is a common implementation. For the application considered, the disconnection from the main is already foreseen but not sufficient since the energy stored in the dc link alone would be able to cause the catastrophic propagation of the fault. Furthermore, this high stored energy makes the crowbar protection system not effective, as a set of dedicated numerical analyses demonstrated in [20].
Another solution considered and presented in [20] is the adoption of decoupling diodes avoiding the discharge of all the energy stored in the dc link into the fault. Re-Energies 2021, 14, 5937 3 of 18 gardless, this option was immediately ruled out due to the requirement of avoiding the unbalances of the voltages at the input of the inverters. An explanation of the operative principle of this solution and a clarification of the reason why it was discarded will be provided in paragraph III, after the overview of the system layout.
In [20], the third solution analyzed is protection based on fuses isolating the fault from the dc link. The use of fuses as a protection system has been reported for the protection of integrated gate-commutated thyristor (IGCT) drives and, in the past, for gate turn-off (GTO) drives [21]; however, for this level of complexity and energy, this solution has never been applied before. Moreover, the case treated the position of the fuses differently from the one considered in [21]. The work described in [20] pointed out the effectiveness of the protection based on medium-voltage fuses installed at the input of each inverter, which was found, by means of numerical simulations of the fault evolution, to be the only provision able to cope with such a high stored energy level. The simulations were based on numerical models of the circuits and on analytical calculations relying on the assessment of a suitable circuit model for the protection fuses.
This paper summarizes the further analyses that led to choosing this protection strategy and focuses on the studies carried out for selecting the best configuration for the dedicated special test. Indeed, due to the novelty of the solution and the high level of reliability required, the confirmation of the protection method could not rely only on simulations. The test setup was conceived evaluating trying to identify the best trade-off between the test significance in verifying the protection effectiveness and the risk limitation for the system. Finally, the results of the tests are discussed and analyzed with further simulations supporting the final validation of the protection.

AGPS-CS
The design and features of the AGPS-CS ( Figure 2) are detailed in [22,23] and the main ones, important for the scope of this study, are summarized as follows: The AGPS-CS is composed of two step-down transformers-an ac/dc converter made of four three-phase thyristor bridges and a dc/ac conversion system composed of five stages. Each stage adopts two three-level NPC inverters connected in parallel.   The use of 5 separate ac/dc converters, each one supplying the relative dc/ac conversion stage, would have implied 5 different dc links each one having 1/5 of the overall dc-link energy and, consequently, much lower risk associated with the capacitive energy stored. However, the higher costs and larger dimensions of the system for this solution with five ac/dc converters led to discarding it.
The system is supplied by the medium-voltage distribution grid at 21.6 kV, which is directly connected to a 380 kV incoming feeder line dedicated to the experimental facilities installed at the Consorzio RFX, in the northeastern Italian area. The main parameters of the transformers and the ac/dc converters are reported in Table 1. The output of the ac/dc converter system supplies a common dc link at 6500 V (2 × 3250 V), with a central point available for the neutral-point connection to the inverters. The dc link is made up of three massive bars: positive, neutral, and negative polarity. Each dc/ac conversion stage is composed of two three-phase NPC inverters [2] (the main parameters are reported in Table 2) connected in parallel, mainly to guarantee the capability to switch off the expected peak current (about 5 kA) in case of short-circuit at the load side [22]. This is a foreseen operative condition since the acceleration grids work at the breakdown limit; thus, it has to be properly managed: the event is detected, and the dc/ac conversion system is quickly switched off, limiting the energy flowing into the grid short-circuited. The AGPS is programmed to automatically reapply the voltage between grids after the arc extinction. A three-phase reactor (180 µH for each phase) is installed at the output of each inverter to reduce the current peak at the breakdown event. Each inverter is made of three legs (one per phase), placed in one cubicle. The layout of the system has been optimized in order to minimize the stray inductance of the connections.
The dc-link capacitor bank has a total capacitance value of 39.6 mF and stores up to about 837 kJ at nominal dc-link voltage. The capacitors are evenly spread across the inverter cubicles. A separate cubicle comprises an additional capacitor bank and a voltage crowbar for the fast discharge of the dc link in case of overvoltage.

The Protection System
One inverter leg comprises four integrated gate commutated thyristors (IGCTs) snubberless, two clamping diodes, four freewheeling diodes, and the clamping network, as depicted in Figure 3; this is called inverter module in what follows. ABB 5SHY 42L6500 [24] rated for 6500 V and 3800 A have been used as IGCT, and Infineon D1131SH [25] rated for 6500 V and 1100 A have been used as diodes.  Another approach was chosen with protection guaranteeing the insulation of the faulty inverter similarly to the diodes solution but avoiding voltage unbalances between inverters. This adopted protection system is based on fuses placed at the input of each inverter cubicle, designed to disconnect the faulty inverter from the dc link before the complete capacitor bank discharges into the faulty module. In Figure 5, a simplified scheme, with similar simplifications to the one of Figure 4, explains the principle of operation of the protection: the fuses at the input of the cubicle in which the fault occurs open (highlighted in Figure 5). In this way, the discharge of the capacitor modules installed in the other cubicles is stopped. If a failure to one IGCT occurs, a short circuit between two dc-link bars is generated at the next activation of an IGCTs of the same module. For example, if G1 fails when G2 and G3 are on, the positive and the neutral bars are short-circuited through the components: G1, G2, G3, and Dcl2. Half-capacitor bank, distributed in the different inverter cubicles, is discharged in the faulty module, with a very high current flowing in the short-circuit path and with high let-through specific energy deposited in the faulty module.
The described fault can involve the faulty module, and its transient evolution is not easily predictable, as the layout of the power supply is complex: the distributed capacitor bank and the stray impedances of the dc-link connections generate oscillations of voltages on the modules and along the dc link.
Different from the classical industrial solution with a current crowbar in the dc link, in which the fault energy is diverted into the crowbar resistance, the basic idea of the protection approach is to avoid as much as possible the discharge of the capacitor banks of the healthy inverters into the fault. Placing decoupling diodes upstream of each inverter dc-link connection can achieve this goal. Figure 4 shows a simplified scheme explaining the operation principle of this protection system; for simplification, the dc link is represented in two busbars instead of three, and the inverters and capacitor modules in the cubicles in which no faults occur are represented as concentrated in one. In the case of a short circuit in an inverter module, the capacitor modules installed in the same cubicle are short-circuited and discharged into the fault, while the diodes installed at the input of each of the other cubicles avoid the discharge of the other capacitor modules. This capacitance is indicated with 10/11 of the overall capacitance installed on the dc link for considering the additional capacitor bank installed in the cubicles containing the voltage crowbar. The blocking diodes are highlighted in red in Figure 4. In the real scheme, they would be two diodes at the input of each inverter cubicle. This protection option was ruled out due to the necessity of avoiding the unbalance of dc-link voltages among the inverters generated by the fault transient, which is a requirement of the AGPS-CS system.  Another approach was chosen with protection guaranteeing the insulation of the faulty inverter similarly to the diodes solution but avoiding voltage unbalances between inverters. This adopted protection system is based on fuses placed at the input of each inverter cubicle, designed to disconnect the faulty inverter from the dc link before the complete capacitor bank discharges into the faulty module. In Figure 5, a simplified scheme, with similar simplifications to the one of Figure 4, explains the principle of operation of the protection: the fuses at the input of the cubicle in which the fault occurs open (highlighted in Figure 5). In this way, the discharge of the capacitor modules installed in the other cubicles is stopped. Another approach was chosen with protection guaranteeing the insulation of the faulty inverter similarly to the diodes solution but avoiding voltage unbalances between inverters. This adopted protection system is based on fuses placed at the input of each inverter cubicle, designed to disconnect the faulty inverter from the dc link before the complete capacitor bank discharges into the faulty module. In Figure 5, a simplified scheme, with similar simplifications to the one of Figure 4, explains the principle of operation of the protection: the fuses at the input of the cubicle in which the fault occurs open (highlighted in Figure 5). In this way, the discharge of the capacitor modules installed in the other cubicles is stopped. Different topologies were evaluated for the installation of the fuses at the input of the inverters. Three possible topologies are shown in Figure 6: the fuses could be installed on the dc-link side at the input of the cubicle (A) or inside the cubicle between the inverter and the capacitor modules (B). The benefit of topology A is lower aging of fuses, which, in this configuration, are subjected only to the dc component, without inversion of the current in the operation. The drawback is that fuses decouple the inverter from the capacitor banks distributed in the other cubicles, but the capacitors installed in the same cubicle of the faulty modules discharge completely into the fault. The benefit of topology B is the decoupling of the inverter from all the capacitors installed on the dc link at the intervention of the fuses; the drawback is higher aging of fuses due to reversions of the current during the operation.
In the case of three capacitor modules located in the inverter cubicle, each one installed in parallel to one inverter leg, as it is in the studied system (Figure 7), topology B allows the faulty leg to be detached from any capacitor, both outside the relative cubicle and also all the capacitors inside. However, the selected topology was topology A, guar- Different topologies were evaluated for the installation of the fuses at the input of the inverters. Three possible topologies are shown in Figure 6: the fuses could be installed on the dc-link side at the input of the cubicle (A) or inside the cubicle between the inverter and the capacitor modules (B). The benefit of topology A is lower aging of fuses, which, in this configuration, are subjected only to the dc component, without inversion of the current in the operation. The drawback is that fuses decouple the inverter from the capacitor banks distributed in the other cubicles, but the capacitors installed in the same cubicle of the faulty modules discharge completely into the fault. The benefit of topology B is the decoupling of the inverter from all the capacitors installed on the dc link at the intervention of the fuses; the drawback is higher aging of fuses due to reversions of the current during the operation.

Analytical Analysis of the Fault Transient
A theoretical analysis of the circuit was attempted with the aim to better understand the circuital conditions during the fault and to achieve a first evaluation of the dynamic of the transient and the current circulating in the faulty and healthy modules. The details are presented in the Appendix, while in this section, the results are discussed.
An analytical solution able to account for the full fault transient evolution is extremely complex, being dependent on the stray inductances associated with the dc-link connections between the cubicles. The analysis performed is able just to provide a rough estimation of the oscillation frequency of the transient, but it does not allow evaluating the stresses on the components subjected to the fault transient.
A numerical model developed with PSIM [26] was consequently developed for reproducing and studying in detail the transient evolution.

First Results of the Numerical Analysis of the Fault Transient
Due to the novelty of the fuses, which were developed ad hoc for the application, the information on their behavior provided by the fuse manufacturer was initially limited, as no experience was available. The first fault simulations were based on a simplified fuse model, assuming, as a conservative approach, that the fuse starts melting at a given current threshold with a linear fuse current decay down to interruption. In the case of three capacitor modules located in the inverter cubicle, each one installed in parallel to one inverter leg, as it is in the studied system (Figure 7), topology B allows the faulty leg to be detached from any capacitor, both outside the relative cubicle and also all the capacitors inside. However, the selected topology was topology A, guaranteeing both reduced aging of the fuses and the intervention only of the two fuses at the input of the faulty inverter; moreover, these fuses are easily replaceable since they do not have to be installed inside power modules or inside the inverter cubicles. The complete discharge of the capacitor modules installed in the same cubicle where the fault occurs was evaluated as a reasonable drawback, compatible with the threshold energy that the inverter components could withstand in a fault transient.

Analytical Analysis of the Fault Transient
A theoretical analysis of the circuit was attempted with the aim to better understand the circuital conditions during the fault and to achieve a first evaluation of the dynamic of the transient and the current circulating in the faulty and healthy modules. The details are presented in the Appendix, while in this section, the results are discussed.
An analytical solution able to account for the full fault transient evolution is extremely complex, being dependent on the stray inductances associated with the dc-link connections between the cubicles. The analysis performed is able just to provide a rough estimation of the oscillation frequency of the transient, but it does not allow evaluating the stresses on the components subjected to the fault transient.
A numerical model developed with PSIM [26] was consequently developed for reproducing and studying in detail the transient evolution.  An additional provision was implemented, consisting of improving the detection of switch failures using two independent monitors to immediately stop the firing sequence, thus avoiding the short circuit. The in-depth analysis carried out allowed a better understanding of the fault consequences on the whole system [20]: due to the voltage oscillations, in some points of the dc link, the voltage reverses, causing current circulation in the freewheeling and clamping diodes of healthy modules. In the following, the analytical approach for the calculation of the current in the faulty module is presented, and then the results of the circuit simulation already described in [20] are briefly indicated.

Analytical Analysis of the Fault Transient
A theoretical analysis of the circuit was attempted with the aim to better understand the circuital conditions during the fault and to achieve a first evaluation of the dynamic of the transient and the current circulating in the faulty and healthy modules. The details are presented in the Appendix A, while in this section, the results are discussed.
An analytical solution able to account for the full fault transient evolution is extremely complex, being dependent on the stray inductances associated with the dc-link connections between the cubicles. The analysis performed is able just to provide a rough estimation of the oscillation frequency of the transient, but it does not allow evaluating the stresses on the components subjected to the fault transient.
A numerical model developed with PSIM [26] was consequently developed for reproducing and studying in detail the transient evolution.

First Results of the Numerical Analysis of the Fault Transient
Due to the novelty of the fuses, which were developed ad hoc for the application, the information on their behavior provided by the fuse manufacturer was initially limited, as no experience was available. The first fault simulations were based on a simplified fuse model, assuming, as a conservative approach, that the fuse starts melting at a given current threshold with a linear fuse current decay down to interruption.
The prospective peak fault currents and energy were found to be about 139 kA and 59 MA 2 s, as reported in [20]. The simulation results showed the potential capability of the selected fuses to properly protect the system by limiting the energy in the faulty switch below the explosion threshold (a precautionary limit of 60 MA 2 s was indicated by the supplier) and by guaranteeing, at the same time, the selectivity of the intervention (all the fuses not at the input of the cubicle where the fault occurs are expected not to intervene) and the protection of the healthy inverter modules. As a consequence, protection was adopted in the design and integrated into the system.
The energy flowing in healthy modules is far from the explosion limit, but it can be potentially destructive for the diodes. In the datasheet of diodes, the supplier provides the maximum non-repetitive current referring to a sine half waveform of 10 ms; however, the current during the fault is far from sinusoidal (see in the next paragraph, Figures 8 and 9); thus, the acceptable maximum non-repetitive current also depends on the waveform. However, considering that the real waveform is not fully predictable, being dependent on stray parameters and on where the faulty module is placed in the system, the datasheet limit in terms of maximum non-repetitive current was assumed. Finally, if very high currents flow in diodes antiparallel to IGCTs, the voltage drop on diodes could be above the reverse voltage tolerable by IGCTs and damage them as well. Due to this phenomenon, even the healthy modules could be damaged during the fault. The resulting stress in the different modules and the number of modules involved in the evolution of the fault transient are strictly related to the performance of fuses and to the stray inductances between inverters. rents flow in diodes antiparallel to IGCTs, the voltage drop on diodes could be above the reverse voltage tolerable by IGCTs and damage them as well. Due to this phenomenon, even the healthy modules could be damaged during the fault. The resulting stress in the different modules and the number of modules involved in the evolution of the fault transient are strictly related to the performance of fuses and to the stray inductances between inverters.  As the fuse was a novel custom-developed device and due to the lack of experience, a special type test was designed to characterize its operation, assess, and validate the effectiveness of the foreseen protection action and the evolution of the fault propagation.

Design of the Test
To test the fuse protection, the idea was to use the AGPS-CS itself as a testbed. The system was fully assembled and prepared for the test in the factory, immediately after the completion of the manufacturing phase. A strong advantage of this approach is that it allows testing the actual system configuration, with the availability of the nominal stored energy in the capacitor banks (837 kJ) and accounting for the impact of the real stray impedances of the connections.
On the other hand, using the actual system may prove to be risky for the components in case something does not work as expected. The risk is remarkable, considering that the test is unconventional since this is an innovative protection system, and no indications As the fuse was a novel custom-developed device and due to the lack of experience, a special type test was designed to characterize its operation, assess, and validate the effectiveness of the foreseen protection action and the evolution of the fault propagation.

Design of the Test
To test the fuse protection, the idea was to use the AGPS-CS itself as a testbed. The system was fully assembled and prepared for the test in the factory, immediately after the completion of the manufacturing phase. A strong advantage of this approach is that it allows testing the actual system configuration, with the availability of the nominal stored energy in the capacitor banks (837 kJ) and accounting for the impact of the real stray impedances of the connections.
On the other hand, using the actual system may prove to be risky for the components in case something does not work as expected. The risk is remarkable, considering that the test is unconventional since this is an innovative protection system, and no indications were found in the literature on comparable systems in terms of power and complexity of the layout. The first assumption for the test setup was to exclude the ac/dc conversion system since it contributes marginally to the fault because the thyristor firing signals are turned off in about 100 µs after the detection of the fault, and the energy fed to the dc link is negligible. On the contrary, all the dc-link-distributed capacitors were kept connected to perform the test with full energy.
The main issue of the test design was to decide whether to install all inverter modules or just part of them and, in this case, how many and in which locations. In order to avoid the damage propagation on all the inverters and the extremely long inspection times (and consequently high costs) after the test to check the integrity of modules, the option of installing all the modules in the inverter cubicles was immediately discarded. A test setup with a partial installation of the modules (9 out of 30) was initially analyzed. This setup foresaw three modules installed in the cubicle where the fault is reproduced by short circuiting the dc link, activating three IGCTs of one module (the so-called sacrificial module) and the other six modules were foreseen in the electrically farthest and closest cubicles to the one where the short circuit was generated. This setup would allow evaluating the current distribution in healthy modules in the cubicles not containing the faulty module.
Several test configurations were simulated involving different inverter modules besides the faulty one. The results pointed out that by reducing the number of inverter modules connected to the dc link, the amplitude of voltage oscillations on the dc link during the fault increases. The same happens for the peak of the reverse current flowing in the freewheeling diodes of the healthy modules. The specific simulation reproducing the proposed setup gave current peaks in diodes up to 50 kA ( Figure 8). On the contrary, the current peaks foreseen by the simulation in the case of all modules connected to the dc link are much lower, as can be observed in Figure 9. It shows that even the highest current values calculated in this condition (corresponding to the diodes of the healthy modules located in the furthest cubicle from the cubicle containing the sacrificial module) remain below the limit.
Simulations indicate that by performing the test with the setup foreseeing the partial installation of modules, all the healthy modules installed could be damaged. In addition, this setup would introduce a remarkable difference between the test and the real operation, in which the inverter modules were supposed not to be damaged.
Thus, a new and final setup was considered as the best trade-off between test significance and risk limitation. It foresees capacitor modules installed in all the cubicles and all the fuses installed on the dc link, with no inverter modules other than the three belonging to the inverter where the short circuit has to be generated. With this setup, the damages should very likely be confined to one inverter cubicle. Figure 10 shows a picture of the test setup in the factory. The modules under test were in the inverter cubicle of stage 2, placed more or less in the middle of the dc link (see Figure 11). The switching on of the sacrificial module generates the short circuit between the neutral and negative bars of the dc link.

Test Setup
The system was equipped with voltage and current probes in the most significant positions, in particular, the following:

•
Currents in all the fuses of the inverter where the short circuit was generated; • Currents in the fuses of the positive dc-link busbar in all the other inverters; • Voltages across the dc link busbars (positive to neutral and neutral to negative).
These measurements were meant to provide the necessary information on voltage oscillations of the dc link and currents flowing in fuses.
The modules under test were in the inverter cubicle of stage 2, placed more or less in the middle of the dc link (see Figure 11). The switching on of the sacrificial module generates the short circuit between the neutral and negative bars of the dc link.
The system was equipped with voltage and current probes in the most significant positions, in particular, the following: • Currents in all the fuses of the inverter where the short circuit was generated; • Currents in the fuses of the positive dc-link busbar in all the other inverters; • Voltages across the dc link busbars (positive to neutral and neutral to negative).
These measurements were meant to provide the necessary information on voltage oscillations of the dc link and currents flowing in fuses.

Test Results
The test was performed by charging the dc link up to the nominal voltage and then by turning on the three IGCTs (G1, G2, and G3) of the sacrificial module. During the test, no explosions occurred, and the fuses behaved as expected: only the fuses of the positive and neutral incoming bars of the inverter where the short circuit was generated opened, while all the others did not intervene. An X-ray checking on the fuse bodies confirmed the complete melting of the elements and the integrity of the healthy fuses. All fuses were rechecked and routinely tested again by the supplier to show that the test did not cause aging.
The inspection on the cubicles after the test showed that in the sacrificial module three IGCTs (G1, G2, and G3) and the clamping diode Dcl2 were found to be broken as expected because of the high values of fault current. Components were found damaged also in the other two power modules installed in the same inverter cubicle: IGCT G1, the antiparallel diode D1, and the clamping diode Dcl1. These were the expected consequences from simulations since only three modules were connected to the dc link, and current peaks on diodes were consequently extremely high.
The inspection also revealed that an arc occurred inside the cubicle. This was caused by the breaking of a flexible connection in the sacrificial module due to the electrodynamic Figure 11. Layout of the inverter and dc-link cubicles, and installed probes during the test.

Test Results
The test was performed by charging the dc link up to the nominal voltage and then by turning on the three IGCTs (G1, G2, and G3) of the sacrificial module. During the test, no explosions occurred, and the fuses behaved as expected: only the fuses of the positive and neutral incoming bars of the inverter where the short circuit was generated opened, while all the others did not intervene. An X-ray checking on the fuse bodies confirmed the complete melting of the elements and the integrity of the healthy fuses. All fuses were rechecked and routinely tested again by the supplier to show that the test did not cause aging.
The inspection on the cubicles after the test showed that in the sacrificial module three IGCTs (G1, G2, and G3) and the clamping diode Dcl2 were found to be broken as expected because of the high values of fault current. Components were found damaged also in the other two power modules installed in the same inverter cubicle: IGCT G1, the antiparallel diode D1, and the clamping diode Dcl1. These were the expected consequences from simulations since only three modules were connected to the dc link, and current peaks on diodes were consequently extremely high.
The inspection also revealed that an arc occurred inside the cubicle. This was caused by the breaking of a flexible connection in the sacrificial module due to the electrodynamic force resulting from the high fault current flowing during the test. The connection was then reinforced and improved in the final version of the inverter module in order to avoid such drawbacks.
Due to a minor problem with the acquisition of the currents, only the measure of the voltage on the dc link can be shown here. Surprisingly, the voltage on the dc link between positive and neutral busbars fell down from 3250 V to 2650 V at the end of the test, with a final voltage only 600 V less than the initial value: the short-circuited half-capacitor bank was only partially discharged. This is an unexpected behavior since simulations foresaw the complete discharge of the dc link.

Discussion on the Test Results
This section is devoted to discussing the results of the tests executed to verify the effectiveness of the protection system described in Section 3.
A new set of simulations were carried out to better understand the test results and explain the unforeseen observations. These simulations were complicated by the need to also reproduce the detachment of the flexible connection during the test and the consequent internal arc. On the other hand, the new simulations could take advantage of more detailed information coming from the fuse supplier, not available at the time of test preparation. The additional parameters provided by the supplier were the pre-arc energy and the total arc energy. The fuse model was updated according to the new information: the fuses began to melt when the let-through energy reached the pre-arc energy, and the total arc energy determined the decay time of the current in fuses.
With the new fuse model, the I 2 t on the sacrificial module during the internal fault is much lower: 7.8 MA 2 s with respect to the precautionary limit of 60 MA 2 s, while the total intervention time of the fuses (considering pre-arc and arc time) is less than 1 ms. The previous conservative estimations indicated about 5-10 ms instead. As a consequence, the new simulations show the reduced discharge of the dc-link voltage, in agreement with what was observed during the test.
The impact of the flexible connection detachment in the dc-link discharge appears quite negligible from simulations: Figure 12 shows that even without considering the detachment, the dc-link discharge is almost equal to the one obtained experimentally.     vention decouples almost immediately the cubicle of the faulty module from the rest of the system. As a consequence, while the dc link only partially discharges, the voltage on capacitor modules installed in the cubicle disconnected from the dc link is free to evolve and reverse, driven by the transient generated by the discharge of these capacitors into the sacrificial module. Figure 13 shows the current distribution in this situation: when the voltage on the capacitor modules (of the cubicle containing the three inverter modules) becomes negative, the current flows through the freewheeling diodes of the healthy modules.

Prediction of the Fault Evolution in the Complete System by the Validated Model
Despite the difficulties encountered in the tests, the results allowed validating the model, updated with the new fuse parameters, with fair confidence. The validated model has consequently been used to simulate the internal fault occurring during the whole The simulation shows that the current in the diodes is weakly dependent on the arc caused by the detachment of the flexible connection. The currents in diodes are so high ( Figure 14) that lead to twofold consequences: breaking the diodes and generating a voltage drop on diodes, which breaks the IGCTs in antiparallel for an over-limit reverse voltage applied. The damages on the components found at the end of the test are therefore fully justified and understood. Table 3 summarizes the electrical limits on the components and the values obtained from the simulation of the test. The results lead to the following conclusions:

•
The current in sacrificial module overcomes the limit for IGCTs and diodes; the peak values weakly depends on the arc on the flexible bar; • The specific let-through energy in the faulty IGCTs is well below the explosion limit, confirming the fact that the IGCT did not explode during the test and validating the fuse protection; • Currents on the diodes of the other two modules are high enough to cause damage to both diodes and IGCTs (due to the reverse voltage applied); • The reduction of 600 V with respect to the nominal voltage between positive and neutral busbars of the dc link after the fault is correctly reproduced; • The selectivity of the fuses is confirmed, as the current in the dc-link connection of other inverters is below the fuse intervention limit. Figure 13. Voltages on the dc link, obtained from the simulation of the short circuit, without considering the detachment of the flexible connection, and the voltage measurements acquired in the test.

Figure 14.
Simulation of the test with the arc related to the flexible bar detachment lasting for 1.5 ms-current on diodes of the two non-sacrificial modules.

Prediction of the Fault Evolution in the Complete System by the Validated Model
Despite the difficulties encountered in the tests, the results allowed validating the model, updated with the new fuse parameters, with fair confidence. The validated model has consequently been used to simulate the internal fault occurring during the whole AGPS operation, to obtain information on a real operational scenario.
The simulation shows that the fuse protection should promptly detach the cubicle containing the faulty module at the fault occurrence, stopping the discharge of the dc link, avoiding the reversal of dc-link voltage (similarly to test result), and avoiding the generation of reverse currents in diodes in the cubicles not involved in the fault. Therefore, the Figure 14. Simulation of the test with the arc related to the flexible bar detachment lasting for 1.5 ms-current on diodes of the two non-sacrificial modules. Table 3. Limit on the components and values obtained in the test simulation.

Limit Simulation of the Test Simulation of Internal Fault in Nominal Operation
Max non-repetitive current on the IGCT (sine half-wave of 10 ms) 26 kA 110 kA of peak 120 kA of peak I 2 t on IGCT 60 MA 2 s 1 7.8 MA 2 s 12.7 MA 2 s

Limit Simulation of the Test Simulation of Internal Fault in Nominal Operation
Max non-repetitive current on the diodes (sine half-wave of 10 ms) 22 kA 53 kA and 45 kA of peak 37 kA and 22 kA of peak Reverse voltage on the IGCT 17 V 70 V and 60 V of peak 50 V and 30 V of peak 1 Value provided by the producer confidentially.

Prediction of the Fault Evolution in the Complete System by the Validated Model
Despite the difficulties encountered in the tests, the results allowed validating the model, updated with the new fuse parameters, with fair confidence. The validated model has consequently been used to simulate the internal fault occurring during the whole AGPS operation, to obtain information on a real operational scenario.
The simulation shows that the fuse protection should promptly detach the cubicle containing the faulty module at the fault occurrence, stopping the discharge of the dc link, avoiding the reversal of dc-link voltage (similarly to test result), and avoiding the generation of reverse currents in diodes in the cubicles not involved in the fault. Therefore, the protection system should be able to confine the fault in the inverter cubicle of the faulty module.
The capacitor bank of this cubicle discharges completely, with voltage oscillations generating the circulation of current on the diodes of the healthy modules.
The energy expected to be discharged in the faulty module is higher with respect to the one observed in the simulation of the test ( Table 3, higher I 2 t value) since the intervention of fuses is foreseen to be longer without any arc inside the faulty module. However, the I 2 t is much lower than the limit provided by the supplier to avoid explosions.
Due to the absence of the arc in the faulty module, the decay of the reverse current in diodes is slower than in the test, and the peak values are lower ( Figure 15 and Table 3); the damaging of diodes in healthy modules is somewhat uncertain, whereas the damaging of the IGCTs is likely due to high inverse voltages applied by the resistive voltage drop on antiparallel diodes.
protection system should be able to confine the fault in the inverter cubicle of the faulty module.
The capacitor bank of this cubicle discharges completely, with voltage oscillations generating the circulation of current on the diodes of the healthy modules.
The energy expected to be discharged in the faulty module is higher with respect to the one observed in the simulation of the test (Table 3, higher I 2 t value) since the intervention of fuses is foreseen to be longer without any arc inside the faulty module. However, the I 2 t is much lower than the limit provided by the supplier to avoid explosions.
Due to the absence of the arc in the faulty module, the decay of the reverse current in diodes is slower than in the test, and the peak values are lower ( Figure 15 and Table 3); the damaging of diodes in healthy modules is somewhat uncertain, whereas the damaging of the IGCTs is likely due to high inverse voltages applied by the resistive voltage drop on antiparallel diodes. According to the simulation, the consequences of an internal fault in an inverter cubicle during the AGPS operation should not be worse than those of the test. They should be comparable, or even better if one or both the healthy modules in the cubicles where the fault occurs are not damaged, due to the lower current peaks on diodes.
Moreover, the simulation provides indications on the procedures to be implemented at the occurrence of such a failure: only half of the dc link is partially discharged at the end of the fault transient (about 2.5 kV are expected on the discharging half dc link); high energy is still stored in the distributed capacitor bank, about 600 kJ.

Conclusions
A novel approach to the protection from internal faults in a special VSC rated for a very high level of power and storing an extremely large capacitive energy was developed. Due to the complexity of the system, any classical solution could not be directly applied. The deep circuital analyses were performed, both with an analytical and numerical approach and also accounting for the circuit stray parameters, which allowed us to understand the fault evolution, to reproduce the current transient, and to support the selection and design of the protection system.
The effectiveness of the novel approach based on fuses developed ad hoc for the application was validated by means of a special type test. The tool of the simulations was According to the simulation, the consequences of an internal fault in an inverter cubicle during the AGPS operation should not be worse than those of the test. They should be comparable, or even better if one or both the healthy modules in the cubicles where the fault occurs are not damaged, due to the lower current peaks on diodes.
Moreover, the simulation provides indications on the procedures to be implemented at the occurrence of such a failure: only half of the dc link is partially discharged at the end of the fault transient (about 2.5 kV are expected on the discharging half dc link); high energy is still stored in the distributed capacitor bank, about 600 kJ.

Conclusions
A novel approach to the protection from internal faults in a special VSC rated for a very high level of power and storing an extremely large capacitive energy was developed. Due to the complexity of the system, any classical solution could not be directly applied. The deep circuital analyses were performed, both with an analytical and numerical approach and also accounting for the circuit stray parameters, which allowed us to understand the fault evolution, to reproduce the current transient, and to support the selection and design of the protection system.
The effectiveness of the novel approach based on fuses developed ad hoc for the application was validated by means of a special type test. The tool of the simulations was also essential to design a proper and safe test to validate the solution and to finally understand the results of the test.
The solution was adopted by the supplier with a high degree of confidence. This development proved that in medium-voltage power drive applications, with a high level of energy stored in the dc link, therefore high short-circuit current in case of internal faults, the fuse is a valid option with respect to more classic solutions. More generally, the work demonstrates the importance of the approach for fault study, to develop the model and relevant numerical simulations for the selection, design, and validation of a reliable protection strategy, when the system is unconventional, both in terms of power and layout.
Future studies will be conducted to analyze the performance of this complex system and assess the effectiveness of the proposed special protection system over its operational life.

Conflicts of Interest:
The authors declare no conflict of interest.

Appendix A
In order to evaluate in detail the stray parameters of the system for calculating analytically the fault transient, a first rough estimation of the frequency oscillations of the fault transient was made taking into account the part of the system involved in the fault once the protection system intervened, i.e., when the fuses are open. Then, the parts of the system considered are the components installed in one inverter cubicle: three capacitance modules and three inverter modules.
The overall capacitance of the three modules connected in parallel (7.2 mF) and the inductance of the faulty module, which is mainly composed by the inductance clamping network (5 mH), determine the LC resonant frequency of the fault transient: about 1 kHz. At this frequency, due to the low resistance of the connections between the inverter modules, the stray inductance of the connections is determinant for the fault evolution. On the other hand, as a first approximation, the stray capacitances are low and can be neglected for the frequency range of the transient. Figure A1 shows the equivalent circuit of the situation considered for the analytical study, accounting for the fault evolution only once the fuses have opened but taking into account only the faulty module and one healthy module, neglecting, for simplicity, the second healthy module (and the relative capacitor bank, installed directly in parallel to it). C f , L f , and R f are, respectively, the capacitance of the capacitor connected in parallel to the faulty module, the inductance, and the resistance of the faulty module. R con and L con are the resistance and inductance of the connection between the faulty module and the healthy module. C h is the capacitance of the capacitor connected in parallel to the healthy module; L h and R h are the inductance and the resistance of the healthy module. If the voltage on the capacitance C h becomes negative during the transient, a current flows through L h and R h due to the direct polarization of antiparallel and clamping diodes, represented by the diode in the equivalent circuit. This simplified model can provide an analytical calculation of the current in the faulty module. However, it is a non-linear model for the presence of the diode; consequently, two cases have to be analyzed: one for each polarity of the voltage on Ch.
With a positive value of the voltage on Ch, the linear differential equation describing the transient of the current in the faulty module is as follows: With a negative value of the voltage on the capacitor bank Ch, the linear differential equation describing the transient of the current in the faulty module is as follows: The result obtained by such a simplified model is described by a fourth-and a fifthorder differential equation, respectively.
In order to describe the evolution of the fault current in the entire inverter, and considering also the other healthy module installed in the cubicle together with the capacitor installed directly in parallel to it, one additional inductive and one capacitive parameter have to be introduced. Consequently, differential equations between the sixth and the eighth order are necessary for describing the transient.
For considering the full transient, starting from the initial condition when the fuses are still closed, all the capacitor modules in the inverter cubicles must be considered, and this largely increases the order of the differential equations describing the current evolution, making the analytical calculation extremely complex. This simplified model can provide an analytical calculation of the current in the faulty module. However, it is a non-linear model for the presence of the diode; consequently, two cases have to be analyzed: one for each polarity of the voltage on C h .
With a positive value of the voltage on C h , the linear differential equation describing the transient of the current in the faulty module is as follows: With a negative value of the voltage on the capacitor bank C h , the linear differential equation describing the transient of the current in the faulty module is as follows: dt (C f C h L f L con L h ) + d 4 i dt (C f C h R f L h L con + C f C h R f L f L h R con + C f C h R h L f L h L con ) + d 3 i dt (C f C h R f R con L h + C f C h R f L con R h + C f C h L f R con R h + C f L f L con − C f L h L f + C h L f L h ) + d 2 i dt (C f C h R f R con R h + C f R f L con + C f L f R con + C h R con L h − C f R h L f − C f L h R f + C h R f L h + C h R h L f ) + di dt (C f R f R con + C h R con R h + L con + C f L con R h − C f R h R f + L h + C h R f R h + L f ) + (R con + R h + R f ) = 0 (A2) The result obtained by such a simplified model is described by a fourth-and a fifthorder differential equation, respectively.
In order to describe the evolution of the fault current in the entire inverter, and considering also the other healthy module installed in the cubicle together with the capacitor installed directly in parallel to it, one additional inductive and one capacitive parameter have to be introduced. Consequently, differential equations between the sixth and the eighth order are necessary for describing the transient.
For considering the full transient, starting from the initial condition when the fuses are still closed, all the capacitor modules in the inverter cubicles must be considered, and this largely increases the order of the differential equations describing the current evolution, making the analytical calculation extremely complex.