Fault-tolerant strategies in MMC-based high power magnet supply for particle accelerator

Many particle accelerators require to supply chains of magnets with high quality, high magnitude, cycling currents. To do this, the power converters need to provide high output voltages, reaching in some cases tens of kilovolts. Additionally, converters are required to store the magnet energy during de-magnetization cycles. For such application, Full-bridge Modular Multilevel Converters (FB-MMC) could be used given their capacity to store energy and their inherent reliability. In this sense, one of the most interesting features of the proposed topology is the possibility of bypassing one or several submodules in the event of a fault or malfunction. By doing this, it is possible to ride-through the failure of a component and avoid the interruption of the accelerator operation. However, when the number of submodules is small, this operation could lead to an excessive charge of the healthy cells, increasing the risk of secondary failures. Besides, undesired harmonic content could appear on the output current, degrading the operation of the accelerator. It is then necessary to implement strategies that allow to remove a faulty cell without significantly impacting the operation of the remaining ones and of the converter itself. Accordingly, the purpose of this article is to investigate several of these strategies and assess them. By means of detailed computer simulations, the behaviour of the converter during normal and submodule fault conditions is analysed. Then, several fault-tolerant strategies are described, verified and compared with the aid of simulation tools. The results show the effectiveness of the analysed strategies in avoiding the overvoltage on the healthy submodules after a cell bypass and the little impact of this operation on the quality of the converter output current.


Introduction
CERN is currently developing the feasibility studies for a new particle accelerator, the Future Circular Collider (FCC) [3].This new ring of 100 km of circumference will overtake the Large Hadron Collider (27 km), also at CERN, as the biggest machine of the world.The FCC will reach 100 TeV of energy (8 times more than LHC) and will assure several decades of high-energy particle physics research and technology advancement.However, the technical challenges for the FCC are numerous.Considering the power consumption, the size of the facilities and the complexity of such machine, the electrical transmission and distribution networks shall be optimized to maximize the reliability (to reach the highest levels of availability), the efficiency (to minimize operation electrical losses) and the robustness (to be immune against all internal and external network disturbances).
At present, many different powering scenarios are being considered and analysed, with the Modular Multilevel Converters (MMCs) among the concepts and research lines that attracts more interest [6,11].This type of converters is being studied for its potential application for the distribution network [15], as well as for the power supplies of the particle accelerator magnets.In this sense, MMCs based on Full Bridge modules (FB-MMC) [1,13] could be used to supply magnet chains requiring high peak power.Some of the advantages of this topology are its efficiency [19], its scalability [7], its low harmonic distortion [14] and its high reliability [2].
In this sense, high voltage, high current power supplies typically used in particle accelerators cannot cope with the failure of one of its components.When it happens, the system is usually stopped, and the faulty converter is replaced by a spare one.This intervention requires time and resources and, for larger accelerators as the FCC, it could lead to long downtime periods and waste of resources, especially if equipment is placed in a harsh environment with numerous constraints of access and space.
Contrary to other converter topologies, MMCs allow to ride-though a failure of one of its main power components.If properly designed, the MMC can safely bypass a faulty submodule (SM) in the case of a semiconductor or capacitor failure given the relatively low energy stored on it [21].In fact, for magnet supplies, where energy recovery is required, MMC-based systems allow to distribute the energy among many cells.This has a significant impact on the severity of a component failure (the amount of energy storage capacity lost in case of failure is minimal) and allows to limit the damages on the surrounding equipment in case of short-circuit.In other topologies, a large amount of energy is lumped in large capacitor banks, and the failure of a semiconductor or a capacitor often leads to the impossibility of restoring the system and, eventually, to the destruction of the equipment involved in the discharge path [16].Conversely, in MMCs, the same failure would only involve a fraction of the energy stored and its consequences could be greatly limited.In fact, the MMC would allow to continue operation until the next scheduled maintenance without significant degradation of its performance.Nevertheless, certain impact could be expected.
In MMCs with a large number of submodules, as the ones used in HVDC [5], the bypass of a submodule has a minor impact on converter operation.On the contrary, in medium voltage applications, where the number of submodules is low (usually 5 to 15 per arm), the disconnection of a cell can have a significant impact on the healthy submodules [10], usually in the form of an overvoltage.Additionally, higher harmonic distortion on output current could occur.
Accordingly, for the application considered here, where even a small ripple on the output could disturb the physics experiments, it is necessary to define strategies to cope with the failure of one or several cells during operation.In many applications, it is often enough to operate the system at lower currents and/or voltages.However, this is not desired in particle accelerators, where de-rating is usually not possible, or would lead to losing precious physics time and resources.Instead, it is preferred to use other strategies that enable safe operation keeping nominal supply conditions.
In this article, several of these strategies will be explained, compared and verified using simulation.The results show their convenience or not for the application considered attending to their impact on output current and their capacity to avoid submodule overvoltages.

High power magnet supply using full-bridge MMCs
Some particle accelerators operate in cycling mode, where particles are repeatedly injected in the machine, accelerated, and extracted.This operation involves a fast ramp-up of the magnetic field during the acceleration phase, constant magnetic field during extraction phase and a fast ramp-down of the magnetic field to prepare the machine for the next injection.For the machine under consideration, this operation requires a current up to 6 kA that must be reached in only some tens of a second.Given the highly inductive character of the load, voltages up to ±10 kV are necessary for ramping up and down this current.Several power converter topologies can be employed to supply this machine.Thyristor rectifiers are often used for this application, but they have a severe impact on power quality and do not allow to store the magnetic energy.Another topology which is commonly used is the 3-phase Neutral Point Clamped (NPC) interleaved DC/DC converter, which allows to produce high output voltages with reduced semiconductor rating and high efficiency.To reach the high voltage required, several of these converters are connected in series [4].For a system as the one under consideration, 12 of these converters plus the AC/DC chargers would be necessary, which results in a large number of semiconductors working without redundancy.Flying-Capacitor Multilevel Converters can be utilized similarly, but at lower switching frequencies, the size and cost of the flying capacitors tend to increase [18].Operating such a system poses challenges in terms of reliability.If a single IGBT among the numerous ones fails, it necessitates stopping the entire system.Additionally, depending on the cause of the failure, there is a risk of potentially dangerous overcurrents arising from the discharge of the large capacitor banks that form the DC bus.
With the aim of increasing reliability of this kind of systems, the use of two AC-DC Modular Multilevel Converters is proposed (see Fig. 1).This MMC configuration enables the attainment of any voltage and current rating with a heightened level of reliability, despite potentially requiring a higher number of components compared to other solutions.This is due to the inherent modularity of the converter.Unlike NPC-based topologies, the MMC can maintain operation even in the event of a semiconductor failure by simply bypassing the faulty submodule.In fact, with proper design, this topology can sustain operation even with multiple faulty cells".
Under the proposed scheme, two MMC stations are connected in series with the magnet chain, which is split in two to reduce the required insulation levels.During normal operation, each of the MMCs produces half of the voltage required by the magnet chain but with opposite polarity (when one of the converters applies a peak voltage of 5 kV the other one applies −5 kV and vice versa, resulting in ±10 kV across the magnet).Therefore, to allow this operation (that is, positive, negative and zero DC voltages are needed), Full-Bridge submodules are required.An interesting feature of the proposed system is that the converters only take from the AC network the power required to cover the losses on the converters and on the magnet chain.Therefore, the magnetic energy is provided exclusively from the submodule capacitors, using the MMCs as energy buffers.
To understand the behaviour, Fig. 2 shows the basic operation curves of the system.The magnet current is plotted in Fig. 2(a) whereas the converter output voltages are shown in Fig. 2(b).Initially the magnet current is zero, thus the DC voltage generated by the MMCs is also zero.At t = 1 s, MMC1 creates a positive DC voltage whereas MMC2 generates a negative DC voltage, ramping up the magnet current.Note that each MMC only creates a maximum voltage of ±5 kV.Therefore, although the total voltage across the magnet is ±10 kV, each half of the magnet only needs to be isolated to 2.5 kV considering that the system is grounded using the mid-point of the converter DC output.
The energy needed to magnetize the magnet is provided by the MMC itself, thus, the submodule capacitors are discharged as shown in Fig. 2(c).Conversely, when the magnet is de-magnetized at t = 2 s, the current is reduced and the magnet energy is stored again in the submodules, increasing their voltage.Despite having a varying stored energy in the submodule capacitors, the MMC AC circulating currents can be controlled to be zero in order to reduce the inner converter losses as shown in Fig. 2(d).Thus the circulating current consists of only the DC component, corresponding to one third of the magnet current.The supply of the losses on the converter and on the magnets is done by importing power from the AC grid.Fig. 2(e) shows the currents absorbed from the network whereas Fig. 2(f) shows the input power.As it can be seen, the input power imported from the AC network is significantly reduced compared with the peak output power during the magnet ramp-up, which reaches 60 MW.
To operate the converters in this way, the MMC's total energy needs to be controlled.The relation between the converter energy (E), the AC (P AC ) and DC (P DC ) powers is: where P out is the power demanded by the magnets and P in the power required form the AC grid to keep the MMC energy at its reference value.For the MMC energy control, P DC can be considered as a disturbance and the MMC energy is controlled by means of P AC .Neglecting losses, if the power imported from the AC grid is zero, the magnet power has to be obtained from the MMC (cell capacitors) at the expense of reducing their stored energy.
Therefore, in order to feed the magnets using the MMCs energy, the stored energy needs to be modified according to the magnet energization and de-energization cycle, that is, the cell capacitor voltages have to be reduced as the magnets current increases and vice-versa.For this purpose, the following relation (Eq.( 3)), that balances the energy stored in the magnets and the energy of the capacitors, needs to be respected.
where L m is the magnet inductance, C SM is the SM capacitance, N is the number of submodules per arm, v o,c is the initial capacitor voltage, i m (t) is the instantaneous magnet current and v c (t) is the instantaneous cell capacitor voltage.Since the magnet inductance and their current reference are known, the following cell voltage reference v * c (t) can be used to control the submodule voltages and, thus, the MMC internal energy.
A simplified control diagram of the converter is shown in Fig. 3.As mentioned, the magnet current control loop, implemented as a PI controller, determines the converter total output voltage, V * magnet , which is divided by two and sent to the converters with opposite signs.The individual references, (V * MMC1 and V * MMC2 ), are passed directly to the low level control to generate the DC components of the arm voltages.On the other hand, the total energy control, which manages the charge and discharge of the submodules, compares the total energy stored in the converter with the one determined by the trajectory given by Eq. ( 4), and sets the AC current reference (and thus the power) to absorb from the AC network to supply the magnet and converter losses.
Finally, horizontal and vertical balancing of leg and arm energies is achieved by controlling the DC and AC circulating currents flowing through the arms [17].The horizontal balancing, or the difference between the legs energies, is controlled by setting a DC component on the circulating current reference.On the other hand, vertical balancing, or the difference between the upper and lower arms energies, is controlled by injecting AC components to the circulating currents.These components are of positive sequence to balance the common energy differences between upper and lower arms and of negative sequence to balance the differential energy differences between them.The current references generated by the three energy balancing controllers are passed to the circulating current control, which ensures their proper tracking by means of proportional-resonant regulators [12].

MMC fault-tolerant operation strategies
The usual way to proceed if a submodule failure is detected (for example, an IGBT malfunction) is to connect a bypassing switch across the faulty cell and continue operation until the next scheduled maintenance.However, as mentioned, when the number of submodules is low, this operation is not straightforward.
Given that the magnet energy is supplied from the SM capacitors, if one or more cells are bypassed, the healthy cells will be overcharged to keep storing the same energy.Normally, it would not be safe to operate the system under this condition without increasing the risk of failure unless some measures are taken.One of them could be to increase the rating of the cells to cope with the voltage rise in the SM capacitors.However, this would lead to an unnecessarily over-dimensioned system, resulting in extra costs.Another solution, already mentioned, to cope with this issue would be to operate the system in a de-rated mode with a reduced MMC energy according to the number of faulty cells (i.e. with a reduced arm voltage) until maintenance can be programmed and performed.However, in many occasions this would not be possible without impacting the quality of the output current and, thus, of the physics experiments.
An alternative approach would be to operate the MMCs with more submodules than the nominal number.In this strategy, hereafter referred as (N + 1) Strategy, the extra cells participate on the energy balancing, charging and discharging following to the magnet energization and de-energization curve.Hence, during normal operation, there are more submodules than the strictly required for operation.Since the energy exchanged by the arm remains equal, the higher number of submodules results in a lower discharge of the capacitors.Accordingly, the submodule voltage trajectory, v * c (t) is modified.The new trajectory, v * c,N+1 (t), is given by Eq. ( 5).
Under this strategy, when a faulty cell is bypassed, the controller modifies the arm voltage reference to allow a deeper discharge of the cells of the faulty arm to keep the energy exchanged by the arm constant.The trajectory for the healthy arm submodule voltage remains the one given by Eq. ( 5) whereas the one used on the faulty arm is replaced by the N-submodules trajectory, as given by Eq. ( 4).By doing this, the overvoltage of the healthy modules of the faulty arm is avoided in the upcoming recharges whereas the faulty arm keeps supplying the energy required by the magnet.
Note here that, if the same strategy of further discharging the cells were used with N − 1 submodules to avoid the overvoltage, the capacitor voltages in the faulty arm would drop below the minimum voltage required to produce enough output DC voltage, resulting in an output current distortion that, as mentioned, could impact the operation of the accelerator.
The second strategy that can be implemented to ride-through a cell failure, hereafter called N Strategy, consist in keeping the nominal number of submodules and reduce the energy to be supplied to the magnet by the arm with a faulty cell.Under this strategy, when a cell is bypassed, the energy reference of the corresponding arm is reduced (the energy corresponding to the number of faulty cells).This reduction avoids an excessive charge of the submodules during the energy recovery phase and an excessive discharge during the magnet ramp-up.The principle is as follows: during normal operation, the control keeps the energies of the arms balanced and the energy of each arm, E arm , is controlled to be one sixth of the total energy stored in the converter, E total (Eq.( 6)).
where 2 .However, in case of a cell bypass, the energy reference of the faulty arm is reduced as given by Eq. ( 7) Here, N fault is the number of bypassed cells and v f,c is the final voltage of the submodules of the faulty arm after the discharge, which must be in this case equal to U dc, peak /(N − N f ault ) to guarantee that the arm generates the required voltage.Accordingly, the energy the system can supply to the magnets is reduced according to Eq. ( 8).
This is less than the energy required by the magnet chain (the submodules of the faulty arm discharge less than the submodules of the faulty arm).Therefore, to compensate, the power imported with the AC network must be increased.Accordingly, when the fault is detected under this strategy, the controller will change the energy reference determined by Eq. ( 3) with the one determined by Eq. ( 8).This will automatically result in an increase of the power exchanged with the AC network and, thus, of the AC currents.
Since these AC currents need to be balanced, the missing power will be delivered to all the arms (faulty or not).Consequently, it is necessary to redistribute the energy from the healthy arms to the faulty one to avoid overloading these.This has to be done by means of the circulating currents, which are internal to the converter and does not alter the input and output currents.Therefore, the side effect of this strategy will be the increase of the circulating current flowing through the arms.

Impact of fault redundancy on converter harmonic performance
The quality and stability of the particle beam can be severely affected by undesired harmonics injected by the power converter.To avoid it, significant filtering effort is needed to attenuate those frequencies that could cause beam quality issues.
In the case of a MMC-based magnet power supply, a proper design of the submodule switching pattern allows to cancel out low frequency harmonics, resulting in smaller filters and, thus, a lower cost.However, if a submodule is bypassed, the harmonic content of the input and output currents changes, and the low frequency harmonics that were naturally eliminated now appear on the converter output voltage, potentially disturbing the proper operation of the system.Therefore, fault-redundancy strategies must consider this issue to avoid power quality problems during operation.In a MMC-based powering system, the harmonic performance is highly dependent on the modulation scheme.For the application under study, where the converters have a low number of submodules, Phased-Shifted Carrier (PSC) modulation is usually employed [9,20].Under this scheme, the switching signals for each of the fullbridge submodule are generated by comparing a common triangular carrier signal with two 180 • opposed reference waveforms, one for the left and one for the right semi-bridges (Fig. 4).Additionally, a phase-shift equal to (π/N ), is introduced between submodules of the same arm.Finally, the carrier groups for the upper and lower arms are shifted by an angle θ (Fig. 5).This angle is set to zero if the number of submodules per arm is even and to pi/2N is the number of submodules per arm is odd.The addition of these phase-shifts introduces undesired harmonics at frequencies significantly higher than the semiconductors' switching frequency.However, if a submodule fault occurs, the harmonic content of the converter will be altered, potentially leading to quality issues in the particle accelerator.
To understand which is the impact of bypassing a submodule on the converter output voltage under the PSC modulation scheme, Double Fourier Integral Analysis [8]) is introduced.The analysis starts by deriving the harmonic solution for a single submodule.Being U dc the peak DC voltage generated by the sub-converter, M dc is the DC modulation index, M ac is the AC modulation index, ω o the angular frequency of the reference signals, ω c the carrier angular frequency and N the number of submodules of a given arm, the voltages generated by the left and right side submodule semi-bridges of the i submodule, v le f t (i) and v right (i), are given by Eq. ( 9) and Eq.(10).
In these equations, J n (x) is a Bessel function of order n and argument x = mπ/2M ac , m is the carrier index, n is the baseband index.Together, these two last parameters define the angular frequency of each harmonic component of the output submodule voltage as mω c + nω o .Note that the phase of the reference waveform for the right half-bridge submodule is shifted by pi radians.
Known the two half-bridge voltages, the output voltage of the submodule i can be calculated by subtracting v le f t (i) and v right (i): For deriving Eq. (11), it has to be noted that v le f t (i) − v right (i) = 0 for odd multiples of the carrier frequency.Therefore, m can be replaced by 2m.Furthermore, v le f t (i) − v right (i) = 0 for even multiples of the sideband frequencies.Thus, n can be replaced by (2n + 1 − m).Accordingly, the odd multiples of the carrier frequencies and the associated sideband harmonics do not appear on the submodule voltage waveform.Only odd sideband harmonics (2n − 1) terms of the even (2 m) carrier groups are generated by a full-bridge submodule.
To obtain the voltage generated by an arm, the N submodule voltages are added up.As mentioned, in PSC modulation the carrier of the i submodule is shifted by (i − 1)(π/N ) radians.The resulting arm voltage is given by Eq. (12).
Where: In Eq. ( 12), the last summation term determines the frequencies that cancelled out.By equating this term with zero (Eq.( 13)), it is possible to determine that, under the PSC modulation, the converter arm only generates sideband harmonics centred around the 2N carrier multiples (see Fig. 6(a)).By further developing the summation terms, the expression for calculating the voltage generated by a converter arm can be obtained (Eq.( 14)).
Here, it is considered that N submodules are switching and the phase of the submodules is set accordingly.However, when a submodule is bypassed as a result of a fault, the initial setting for the carriers phase-shifts would be incorrect.Considering now the case where there are N −1 modules switching with their carriers shifted (i −1)(π/N ) radians, the arm voltage is given by Eq. (15).where M dc, f and M ac, f are the new DC and AC modulation indexes after the fault.When all submodules are healthy, only sideband frequencies around multiples of N appear.On the contrary, Eq. ( 16) shows that, when a submodule fails, the last summation term is not zero for several frequency bands below 2N ω c .This low frequency harmonics will consequently appear on the arm voltage spectrum and, thus, on the converter output (see Fig. 6(b)).
At those low frequencies, the damping of the output filter would be low and the harmonics will eventually cause distortion of the output current, potentially affecting the quality of the particle beam.To avoid it, the proposed fault-tolerant strategies must include a method to avoid the apparition of undesired low harmonics.
The most straightforward way to avoid the appearance of low-frequency harmonics is by realigning the PWM carriers to adapt them to the new number of switching submodules.This adjustment enables suitable harmonic cancellation.In strategies with N submodules, the realignment leads to a slightly lower output frequency, requiring a larger output filter to centre the harmonic bands at frequencies that are multiples of 2(N −1)ω c (refer to Fig. 6(c)).This ensures the same output current ripple.Conversely, if N + 1 submodules are employed, harmonics will occur during normal operation at higher frequencies (2(N + 1)ω c ).When a submodule is bypassed and the PWMs are realigned, the first harmonic band appears at a frequency of (2N ω c ).In this case, the filter is designed for operation with N submodules to prevent degradation of the output current quality after the fault.Thus, compared to strategies with N submodules, this approach allows for the use of a smaller and less costly output filter (see Fig. 6(d)), at the expense of additional submodules.

Simulation results
The proposed fault-tolerant strategies described in the previous section have been verified by means of detailed simulations using Matlab/Simulink.To test the proposed strategies, the model developed must represent each of the individual cells.However, modelling each of the individual components of the submodule could lead to an excessive computational burden.For this reason, a simplified model, where the IGBTs and diodes are modelled as two-state resistors and each arm as a variable capacitor and voltage source, whose values depend on the number of inserted cells, is used.This model allows to keep a record of the voltage of every single cell with a low computational burden.
The main parameters of the converters are presented in Table 1.As described in Section 2, the converters must generate an output voltage of ±5 kV at the end of the ramp-up.Considering a rated submodule voltage of 1.2 kV (which offers a good compromise between number of cells and component availability), and N = 8 submodules per arm, the minimum submodule voltage cannot be lower than 625 V (U dc, peak /N = 5/8 kV).Known these values, the cell capacitance can be obtained as shown in Eq. (17).

Submodule fault behaviour
Fig. 7 shows the system response in the event of a SM failure.At t = 3.05 s, one SM of a lower arm of MMC2 fails, being immediately bypassed.From that instant on, the faulty arm works with only seven cells whereas the other five arms continue working with eight SMs per arm.Note that at t = 3.05 s, the faulty cell was inserted and generating a negative voltage.
Due to the cell failure, the energy stored in the faulty arm abruptly decreases by 12.5% (1/N × 100%).Consequently, since the MMC is controlling the energy of each arm, if the energy reference is not changed, the MMC quickly increases the power imported from the AC grid (Fig. 7(f)).This causes a peak on the AC current (Fig. 7(e)) and on the MMC circulating current (Fig. 7(d)).However, the control restores the normal values within 100 ms.On the other hand, the impact on the MMC DC voltage (Fig. 7(b)) and on the magnet current (Fig. 7(a)) is low (the control reacts immediately to compensate the missing voltage).However, as previously stated, low-frequency harmonics will be generated.
After the transient caused by the cell failure, the faulty arm can track the arm voltage reference again using seven cells.However, to be able to generate the maximum DC voltage, the minimum SM capacitor voltage is limited by Eq. (18).
Thus, the minimum capacitor voltage on the faulty arm increases due to a lower number of cells.This can be seen in Fig. 7(c), where the SM capacitors of the healthy arm are discharged to 0.625 kV (5 kV/8 SM) whereas the SM capacitors of the faulty arm can only be discharged to 0.71 kV (5 kV/7 SM).Consequently, if the control is not modified, the SM capacitors of the faulty arm are charged now from 0.71 kV to 1.29 kV, and the overvoltage is produced.

Strategy with N + 1 submodules
As mentioned in Section 3, the first strategy that could be employed to ride-through a cell failure is to use a spare cell in each arm, that is, 9 SM per arm.During normal operation, all cells are used, thus the capacitor voltages are only discharged from 1.2 kV to 0.72 kV (Fig. 8(c)) (as given by Eq. ( 5)) to provide the magnet energy.When one cell is lost at t = 3.05 s, the energy reference of the faulty arm is changed since there are now only 8 cells.However, the faulty arm keeps feeding the magnet with the same energy, thus, given that the maximum capacitor voltage is limited to 1.2 kV, the minimum capacitor voltage is now reduced to 0.625 kV for the faulty arm according to Eq. ( 4).This is the minimum capacitor voltage during normal operation of the MMC without spare cells.
Considering that all the arms provide 1/6 of the magnet energy, no additional power (Fig. 8(f)) is imported from the AC grid (except for the system losses) so the AC currents do not vary either (Fig. 8(e)) and no AC circulating current is needed (Fig. 8(d)).The magnet current (Fig. 8(a)) and the MMC DC voltages (Fig. 8(b)) are not affected, provided that PWMs are realigned.

Strategy with N submodules
Under the N Strategy the energy reference of the faulty arm is reduced to limit the maximum and minimum capacitor voltages to 1.2 kV and 0.71 kV respectively, (Fig. 9(c)).
Again, the cell failure takes place at t = 3.05 s and 1 ms later the arm energy reference of the faulty arm is reduced.In this case, there is not any peak on the AC power (Fig. 9(f)) or on the AC current (Fig. 9(e)) since the energy stored in the faulty arm matches with its reference after updating the energy set-point.However, given that the faulty arm stores less energy, the MMC is not able to provide all the energy required by the magnets.Hence, when the magnets are magnetized, some energy has to be imported from the AC grid (in addition to the system losses) and when the magnets are de-magnetized some energy has to be injected to the AC grid.As a result, the maximum power imported from the AC grid reaches a peak value of 7.8 MW (see the third and fourth cycle in Fig. 9(f)), in contrast to 6.2 MW of the first cycle, previous to the SM failure.During the flat-top period when the magnet current (Fig. 9(a)) is constant at its maximum value, the MMC imports power from the AC grid to exclusively feed the systems losses.Thus, the AC power is the same before and after the cell failure.
As explained, the converter will import extra power by increasing the AC currents.These AC currents are balanced and all the arms are charged equally by them.Consequently, that energy has to be redistributed inside the MMC from legs a and b (healthy legs) to leg c (faulty leg with a reduced energy), which is carried out by the MMC inner AC circulating current as seen in Fig. 9(d).Finally, the magnet current and the MMC DC voltages are shown in Fig. 9(a) and Fig. 9(b) respectively.Again, DC magnitudes are not affected by realigning the PWMs, and the MMC can continue feeding the magnet without loss of quality.

Comparison of strategies
The N strategy requires over-sizing the AC side of the converter and selecting higher-rated IGBTs to accommodate the increased circulating currents and higher power imports from the AC grid, especially in the case of multiple faulty submodules.However, this approach eliminates the need for spare submodules, resulting in cost and volume savings.The output filter size will be larger due to the need to filter lower-frequency harmonic bands after the submodule bypass.Additionally, the N strategy can easily handle a second fault occurring in the same arm, provided that the converter can handle the increased current and the filter is appropriately sized to filter out lower harmonic frequencies.
On the other hand, the N + 1 strategy, which involves adding extra submodules, allows for maintaining the nominal current rating of components.However, it comes at the expense of a larger converter footprint and the need for additional hardware (extra submodules).The control algorithm does not require significant modifications.The output filter size will be smaller compared to the N strategy.Nevertheless, in the event of a second fault in the same arm, preventing overvoltage in the healthy cells would require the use of N + 2 modules.
It is worth noting that a combination of strategies is possible to address a second failure, provided there is sufficient voltage generation capability and appropriate harmonic filtering.For instance, an N + 1 strategy (adding an extra submodule) can be used to handle the first failure, while an N strategy (changing the energy reference of the arm) can be employed for the second failure.The first fault would result in the appearance of a harmonic band around 2N ω c , while the second fault would shift this frequency to 2(N − 1)ω c .Table 2 summarizes the main features of the two strategies.

Conclusions
This study presents a comprehensive analysis of fault ride-through strategies for the modular multilevel converter (MMC) utilized as the primary power supply for particle accelerator magnets, where the presence of submodules as

Fig. 1 .
Fig. 1.Diagram of the proposed magnet power supply system based on Full-Bridge Modular Multilevel Converters.

Fig. 3 .
Fig. 3. Simplified diagram of the control of the system.

Fig. 6 .
Fig. 6.Arm voltage harmonics for ω c = 2π • 250 rad/s.(a) Arm voltage with N submodules.(b) Arm voltage after a submodule bypass.(c) Arm voltage before and after a fault with PWM realignment, N strategy.Arm voltage before and after a fault with PWM realignment, N + 1 strategy.

Table 1
Main system parameters.