⚡ electrical engineering

Grid-Forming Control with Assignable Voltage Regulation Guarantees and Safety-Critical Current Limiting

This paper proposes a nonlinear grid-forming controller that combines a deadzone-adapted disturbance suppression framework with a backstepping-based architecture to guarantee assignable voltage regulation and exponential transient performance, while ensuring hard current limits are strictly enforced through a minimally invasive control-barrier-function safety filter.

Original authors: Bhathiya Rathnayake, Sijia Geng

Published 2026-03-04

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Bhathiya Rathnayake, Sijia Geng

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the electrical grid as a massive, complex dance floor. For decades, the rhythm was kept by giant, heavy machines called synchronous generators (like old-school power plants). These machines had a lot of "inertia"—think of them as heavy dancers who couldn't stop or start quickly, but their weight kept the whole floor steady even if someone bumped into them.

Now, we are replacing these heavy dancers with solar panels and batteries. These are like agile, lightweight dancers. They are great, but they don't have that heavy "inertia." If the music changes suddenly or someone trips (a fault), the whole dance floor can spin out of control.

This paper introduces a new "dance instructor" (a controller) for these lightweight dancers to keep the rhythm steady and safe. Here is how it works, broken down into simple concepts:

1. The Problem: The "Heavy" vs. The "Light"

The Old Way: The heavy generators naturally resisted changes. If the grid got shaky, they just kept plodding along.
The New Way: Solar and battery inverters are fast but fragile. They can't handle too much current (electricity flow) without burning out their internal parts (semiconductors). It's like a sprinter who can run very fast but will pull a muscle if they try to carry a heavy backpack.
The Challenge: We need these inverters to act like the heavy generators (stabilizing the grid) without breaking their own legs (overheating) when things go wrong.

2. The Solution: A Two-Part Safety System

The authors built a smart controller with two main features: a Smart Navigator and a Safety Filter.

Part A: The Smart Navigator (The "DADS-BS" Controller)

Imagine you are driving a car on a foggy road where you can't see the other cars (the grid voltage) or the exact weight of your car (network parameters). You just know the road is bumpy.

The Goal: You need to stay in your lane (maintain the correct voltage) even if the road shakes.
The Trick: The controller uses a technique called Backstepping (think of it as a step-by-step guide) combined with Deadzone-Adapted Disturbance Suppression (DADS).
- The Analogy: Imagine you are walking on a slippery floor. You have a sensor that feels how much you are slipping.
- The "Deadzone": If you slip just a tiny bit, the sensor ignores it (it's in the "dead zone"). This prevents you from over-correcting and wobbling.
- The "Adaptation": If you slip hard, the sensor wakes up and says, "Whoa, that's a big slip!" It then automatically tightens your grip (increases the control gain) to stop the slip.
- The Result: No matter how bumpy the road gets (even if the grid voltage crashes), this navigator keeps the inverter stable and ensures it doesn't drift too far off course. It learns on the fly without needing a map of the whole neighborhood.

Part B: The Safety Filter (The "Control Barrier Function")

Now, imagine that same driver is driving a car with a strict speed limit. If they hit the gas too hard, the engine might explode.

The Problem: The "Smart Navigator" might tell the car to go fast to fix a problem, but that could push the current (electricity flow) too high and burn out the inverter.
The Solution: The authors added a Safety Filter based on Control Barrier Functions (CBF).
- The Analogy: Think of this as a smart seatbelt or a guardian angel sitting next to the driver.
- How it works: The driver (the Navigator) says, "Turn left hard!" The Guardian checks the speedometer. If turning left that hard would make the car spin out of control (exceed the current limit), the Guardian gently but firmly overrides the steering wheel.
- Minimally Invasive: The Guardian only touches the wheel when absolutely necessary. If the driver is driving safely, the Guardian does nothing. This ensures the car stays safe without ruining the driving experience.
- The Math: It solves a tiny, instant math puzzle (a quadratic program) every millisecond to find the safest possible steering angle that keeps the current under the limit.

3. Why This is a Big Deal

Previous methods were like trying to stop a speeding car by slamming on the brakes (which stops the car but might crash it) or hoping the driver is careful enough (which isn't reliable).

This paper's approach is like having a self-driving car that knows exactly how to handle a blizzard:

It doesn't need a perfect map: It works even if it doesn't know the exact details of the road (network parameters).
It handles the bumps: It automatically adjusts to shocks and disturbances (grid faults).
It never breaks the engine: The safety filter guarantees the current never exceeds the limit, protecting the hardware.
It recovers fast: When the danger passes, the car immediately returns to normal driving, much faster than older systems.

The Bottom Line

This research gives us a way to run our future power grid entirely on solar and batteries. It provides a "brain" for these devices that is smart enough to stabilize the grid and strong enough to protect itself from burning out during storms or accidents. It's the missing link that makes a 100% renewable energy grid safe and reliable.

1. Problem Statement

The integration of inverter-based resources (IBRs) into power systems is replacing conventional synchronous generators, leading to reduced system inertia and limited short-circuit current capabilities. While Grid-Forming (GFM) inverters are essential for stabilizing low-inertia grids by regulating voltage and frequency, they face two critical challenges:

Robust Voltage Regulation: GFM inverters must maintain voltage stability despite unknown grid disturbances (e.g., faults) and uncertain network parameters (line resistance and inductance). Existing nonlinear controllers often rely on accurate network models or disturbance observers, which are difficult to implement practically.
Safety-Critical Current Limiting: Unlike synchronous generators, IBRs have strict semiconductor current limits (typically 1.2–2 p.u.). Existing current-limiting methods often compromise the "voltage-source" behavior of the inverter or lack rigorous mathematical guarantees that the current will never exceed safe bounds. There is a need for a control framework that enforces hard current limits while minimally disrupting the nominal voltage-forming control.

2. Methodology

The authors propose a novel control architecture that combines a nonlinear nominal controller with a safety filter.

A. Nominal Controller: DADS-BS

The core of the proposed solution is a Droop-based Backstepping (BS) controller enhanced with Deadzone-Adapted Disturbance Suppression (DADS).

Architecture: It follows an inner-outer loop structure.
- Outer Loop: Generates voltage and frequency references using active/reactive power droop laws with second-order power filters.
- Inner Loop: Uses backstepping to synthesize terminal voltage commands.
DADS Framework: To handle unknown bounded grid voltage and unknown network parameters ( $R, L$ $R, L$ ) without observers, the controller incorporates:
- Deadzone Adaptation: Adaptive gains ( $z_d, z_q$ ) are updated only when the error energy exceeds a threshold $\epsilon$ . This prevents "gain drift" and ensures boundedness.
- Nonlinear Damping: Dynamic damping terms inject dissipation to suppress disturbances of arbitrarily large magnitude.
Key Feature: The design requires no knowledge of network parameters beyond the Point of Common Coupling (PCC) and does not assume knowledge of the disturbance bound.

B. Safety Filter: Control Barrier Functions (CBF)

To enforce hard current limits, a Control Barrier Function (CBF) based safety filter is layered on top of the nominal controller.

Mechanism: It formulates a Quadratic Program (QP) that minimally modifies the nominal terminal voltage command ( $v_t^n$ ) only when necessary to satisfy the constraint $\|i_t\| \leq I_{max}$ .
Closed-Form Solution: The authors derive an explicit analytical solution for the QP, eliminating the need for online optimization solvers.
Compatibility: The filter is compatible with any locally Lipschitz nominal controller, ensuring the "safe" set of currents is forward invariant.

3. Key Contributions

The paper makes four primary theoretical and practical contributions:

DADS-BS Controller Design: A nonlinear GFM controller that achieves practical voltage regulation. It guarantees that PCC voltage errors converge to an assignable, small residual set ( $\sqrt{2}\epsilon$ ) regardless of unknown network parameters or disturbance magnitude.
Global Well-Posedness (Theorem 1): Rigorous proof that the closed-loop system (without current limiting) has unique, globally existing solutions with all physical states (voltages, currents, power filter states) and adaptive gains remaining bounded.
Transient Performance Guarantees (Theorem 2): Proof that voltage error convergence is exponential with an assignable rate. The system maintains stability even under severe faults (e.g., three-phase-to-ground faults where grid voltage drops to zero).
Safety-Critical Current Limiting (Theorems 4 & 5):
- Establishment of forward invariance for the safe-current set using a CBF-based filter.
- Proof that all physical states remain bounded under the safety filter.
- Specific analysis of the DADS-BS under the safety filter, proving that the adaptive gains ( $z_d, z_q$ ) remain bounded provided the safety filter is activated only a finite number of times with finite total duration (a mild assumption validated by simulations).

4. Results

Numerical simulations were conducted comparing the proposed Safe DADS-BS against a conventional Safe PI-based GFM controller during a three-phase-to-ground fault (2s to 4s).

Without Current Limiting: The DADS-BS successfully suppressed voltage errors to the theoretical residual band, while the PI controller showed larger deviations. Both exceeded the current limit ($1.2$ p.u.) during the fault, highlighting the necessity of the safety filter.
With Current Limiting:
- Both controllers successfully enforced the hard current limit ( $I_{max} = 1.2$ p.u.) without violation.
- Transient Recovery: The Safe DADS-BS demonstrated superior transient performance. It recovered from the fault and resumed nominal GFM behavior (voltage regulation) significantly faster than the Safe PI controller.
- Trade-off: The results confirmed the inherent trade-off: when the safety filter activates, voltage regulation is temporarily relaxed to prioritize current safety. However, the DADS-BS architecture allowed for a much quicker return to voltage regulation once the fault cleared.

5. Significance

This work addresses a critical gap in the deployment of GFM inverters in future low-inertia grids:

Robustness: It provides a control strategy that is robust to unknown network parameters and arbitrarily large disturbances without complex estimation algorithms.
Safety: It offers a mathematically rigorous method to enforce hard hardware constraints (current limits) without compromising the stability of the underlying control loop.
Practicality: By deriving a closed-form solution for the safety filter, the approach is computationally efficient and suitable for real-time implementation.
Theoretical Rigor: The paper moves beyond heuristic current limiting by providing global stability proofs and boundedness guarantees for both the physical states and the adaptive parameters, ensuring the system does not "blow up" during safety interventions.

In summary, the paper presents a theoretically sound, robust, and safe control framework that enables GFM inverters to operate reliably in weak or disturbed grids while strictly adhering to hardware limitations.