Safe and Stable Secondary Voltage Control of Microgrids Based on Explicit Neural Networks

This paper proposes a novel safety-critical secondary voltage control method based on explicit neural networks (NNs) for islanded microgrids (MGs) that can guarantee any state inside the desired safety bound even during the transient. Firstly, an integrator is introduced in the feedback loop to fully eliminate the steady-state error caused by primary control. Then, considering the impact of secondary control on the stability of the whole system, a set of transient stability and safety constraints is developed. In order to achieve online implementation that requires fast computation, an explicit NN-based secondary voltage controller is designed to cast the time-consuming constrained optimization in the offline NN training phase, by leveraging the local Lipschitzness of activation functions. Specially, instead of using the NN as a black box, the explicit representation of NN is substituted into the closed-loop MG for transferring the stability and safety constraints. Finally, the NN is trained by safe imitation learning, where an optimization problem is formulated by maximizing the imitation accuracy and volume of the stable region while satisfying the stability and safety constraints. Thus, the safe and stable region is approximated that any trajectory initiates within will converge to the equilibrium while bounded by safety conditions. The effectiveness of the proposed method is verified on a prototype MG with detailed dynamics.


I. INTRODUCTION
W ITH the increasing penetration of inverted-based renewables, the inertia of the power network continuously reduces, thus intensifying the challenges of ensuring system stability and safety. Microgrids (MGs) as localized small-scale power systems, that can operate in both grid-tied and islanded modes, have shown potential for improving the resilience of power networks [1], [2], [3], [4], [5]. In gridconnected mode, the MG is mainly governed by the main grid. While in islanded mode, local controls are needed to coordinate multiple distributed energy resources (DERs). A hierarchical control structure is commonly used for islanded MGs, which intrinsically decouples the control objectives based on different time scales. Primary control stabilizes the DERs at the fasted and lowest layer, which is usually implemented with droop equations. Secondary control is needed to eliminate the steady-state error caused by the droop characteristics. Tertiary control focuses on economic dispatching and operation scheduling in the slowest time scale and does not directly take into consideration the transient stability and safety constraints [6].
According to the time scales, stability and safety can be classified into steady-state and transient-state [7]. Transient stability problem has been widely investigated in MG control, which ensures that the trajectories of MG states (e.g., voltage, current, frequency, etc.) converge to the equilibrium. While transient safety is rarely studied which requires each critical state to satisfy certain operational conditions during the transient. Transient safety issue is important for enhancing system reliability, as it can be of higher priority to bound the system trajectories inside a certain safe region, rather than only ensuring convergence without considering overshooting. Conventionally, steady-state safety is considered as algebraic inequality constraints in the slowest time scale at the tertiary level [8]. However, as the reduction of network inertia, large overshooting and intense fluctuations become more likely to happen during the transient aroused by various disturbances [9]. As a result, it is imperative to take into account the transient safety in the faster secondary level [10]. Therefore, this paper focuses on the secondary control of MG considering transient stability and safety constraints.
From the viewpoint of the time scale of MG modeling, secondary control can also be classified into steady-state and transient-state. In the first class, partial high-level dynamics (e.g., derivative of droop equations) [11], [12] or even only steady states [13], [14] are considered by using power flow equations to model the MG. These methods have notable scalability for regulating steady-state voltage and frequency in high-dimensional MG. Operational constraints such as steadystate safety and stability are uncomplicated to execute by means of static optimization. However, it cannot satisfy transient constraints and may result in sampled-data control problems in lower-level [15]. The second class considers detailed dynamics of inverters thus enabling control of MGs in transient-state [16], [17]. More efforts have been made on stability-constrained optimization [8], parametric stability conditions [18] and smallsignal stability analysis for reduced-order dynamic model [19]. Nonetheless, these methods suffer from scalability issues for high-dimensional MGs. More elaborate reviews about control This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ architecture and communication infrastructure such as centralized, decentralized and distributed secondary control methods are covered in [20], [21].
The existing secondary control methods consider only stability but not transient safety. Moreover, these methods cannot compute the stable region which is important for initial and operating points selection for operators. To fill this gap, safetycritical control is attracting increasing attention in the power systems community. Secondary control of MG with transient stability and safety guarantees is essentially a dynamic constrained optimization problem. A classical method is model predictive control (MPC), which can directly handle dynamic constraints [22]. However, it suffers from a high computational burden aroused by system order and prediction horizon. Thus, in MPC-based secondary control, the order of the MG dynamic model is usually highly reduced, leading to the loss of faster dynamics and corresponding stability and safety guarantees. Moreover, nonlinearities of MG and information disparity due to communication overheads are also challenging to overcome in such a method [7]. Another method that can guarantee transient stability and safety in power systems is the control Lyapunov function (CLF) and control barrier function (CBF) based method. In this method, CLF is used for stabilization and CBF is to ensure safety based on forward set-invariance principles via Lyapunov-like conditions [23]. This method has difficulty in artificially constructing Lyapunov and barrier functions, thus it often results in excessive computational cost and conservative estimation of the stable and safe region.
This paper proposes a novel secondary voltage control scheme with transient stability and safety guaranteed. The frequency control can be achieved similarly using the proposed method by replacing the Q-V droop with P-f droop. To fully eliminate the steady-state errors of DER output voltages, an integrator is introduced into the feedback loop [24]. Then, for online implementation that requires the fast computation of control signal, we innovatively utilize the learning feature of neural networks (NNs) to cast the computational-intensive constrained optimization problem into offline training. The NN training is formulated as an optimization problem maximizing the tracking accuracy and volume of approximated stable region, while enforcing stability and safety constraints. An alternating direction method of multipliers (ADMM) is used to efficiently solve this multi-objective optimization problem [25]. The well-trained NN is a nonlinear algebraic function that can be conveniently used online as the secondary voltage controller guaranteeing transient stability and safety of MG.
The main contributions of this paper are concluded as the following three aspects: • A general methodology for propagating the constraints from MG states onto the parameters of the explicit NN is developed based on the local Lipschitz condition. Compared with the existing online constrained optimization-based control approaches, the proposed safe and stable secondary voltage control method has a significantly lower computational cost and hardware requirement for online computational implementation. • To guarantee stable and safe MG operation, a set of novel transient stability and safety constraints are developed, convexified and integrated into the training of explicit NN-based controllers. • The proposed safe and stable secondary voltage control method can maximize the inner approximation of the stable region, which provides informative visualization for selecting initial and operating points. The rest of the paper is organized as follows: Section II introduces the safe and stable secondary control problem of MG. Section III proposes an offset-free online secondary voltage control method based on explicit NN. Section IV develops the offline training method of the explicit NN with stability and safety constraints based on imitation learning. In Section V, case studies are conducted to validate the proposed approach and Section VI concludes the paper.

II. PROBLEM STATEMENT
An inverter-based islanded MG with m DERs, p RL loads and q lines can be represented in a general state space model [26]:ẋ where y = [u o1 , . . . , u om ] is the output vector containing the output voltage of each DER in the MG, u oi = u 2 odi + u 2 oqi ; x loadp ] is the state vector of inverters, lines and loads; denotes the voltage setpoint for the droop controllers of each DER, and it is also the control vector to be generated by the secondary controller; denoting n = 13m + 2p + 2q, F : R n × R m → R n is the state function and G : R n → R n denotes the output function. This high-dimensional dynamic model describes the detailed transient dynamics of the whole MG, thus the transient safety of all states can be taken into consideration.
In this framework, the inverter is directly controlled by double-loop PI controllers which are also named zero-level or inner control loops. The reference signal for the inner control loop, u * oi (t), is generated by the primary controller using droop characteristics as follows, where Q i (t) is the output reactive power of the i th DER passing through a low pass filter; D qi is the Q-V droop gain. Voltage control of microgrids aims to regulate the DER output voltage u odi to the desired value. With primary control (2) only, setpoint u seti is selected as the desired value but there will remain a residual −D qi Q i (∞) at the steady state. Thus, the primary control signal u * odi does not equal to the setpoint u seti . The inner-control loops can accurately regulate u odi to u * odi with well-tuned parameters, nonetheless, this will lead to u odi = u seti . To eliminate this steady-state error, a secondary controller can be designed to automatically tune u seti (t) using the feedback measurements. Secondary control as a technique for compensating the off-set has been widely studied, nonetheless, most existing methods cannot guarantee that all the critical signals are bounded within safe region all the time including the transient.
Definition 1: The safe region is defined as a polytope that is symmetric around the steady-state operating point x * (equilibrium): wherex(t) x(t) − x * is the error state vector, H ∈ R n S ×n selects and combines the critical states, andx ub ∈ R n S ≥ 0 contains the corresponding upper bounds. Note that the transient safety constraint (3) is essentially a general state constraint. The transient safe bound mainly depends on the safety concerns and physical constraints of the hardware. It is usually larger than steady-state bound. However, to the authors' best knowledge, there still lacks a commonly accepted standard suggesting the magnitude of transient safety bound for microgrids. To this end, we assume the steady-state bound as the transient bound for the DER output voltages, e.g., [0.95, 1.05] p.u. for DER output voltages as shown in Fig. 1. If such a tight bound can be satisfied by the proposed method, then a looser transient bound can be respected naturally.
Although the primary controller has been designed to stabilize the MG, the implementation of a secondary controller can actually influence the dynamic behavior and system stability. Therefore, the transient stability of the closed-loop MG system should be guaranteed when the secondary controller is interfaced. Unlike other methods that can only analyze whether the closed-loop system is stable or not, the proposed control method in this paper will also provide the largest inner approximation of the stable region, i.e., the region of attraction (ROA) within which the initial state will converge to the equilibrium asymptotically. To simultaneously satisfy both the safety and stability conditions, we give the following definition.

Definition 2:
The safe and stable region (SSR) is defined as where x 0 is an initial value, and φ denotes the solution of the closed-loop system (1) with designed secondary controller u. Figure 1 demonstrates the relationship between safety constraints and SSR in a two-dimensional projection. The SSR is an inner approximated ROA bounded by safety constraints.
Our control objective is to design a novel secondary controller that computes fast enough to be applied online while satisfying the transient stability and safety constraints (3)-(4). For nonlinear model (1), there remain four challenges to realize safe and stable secondary control: a) the dynamics of state observer must be considered when deriving the stability condition due to the violation of separation property; b) there lacks a systematic method to establish Lyapunov functions for microgrids, such that an artificially constructed Lyapunov function usually leads to conservative results and the stability condition is typically difficult/impossible to be convexified; c) transient safety constraints are essentially state constraints, which are difficult to be satisfied in the controller design for nonlinear systems; d) the existing online optimization based nonlinear control methods such as nonlinear MPC are online computation-costly. To this end, a small-signal model developed in [26] is modified and adopted in this paper. With a small enough sampling interval satisfying the Nyquist-Shannon sampling theorem [22], the small-signal system developed in [26] can be discretized as the following difference equations with high fidelity using zero-order holder, where (x,ũ,ỹ) = (x − x * , u − u * , y − y * ) are defined as small deviations from the equilibria; k denotes the discrete-time step; A mg ∈ R n×n , B mg ∈ R n×m and C mg ∈ R m×n are state, input and output matrices, respectively and their derivations can be found in [26]. Remark 1: An important issue in microgrid secondary control is the communication time delays, whose impact depends on its magnitude. In normal operation situations, typically the wireless communication time delays are negligible. In [27], an experimental study was performed to show that the minimum expected communication time delay in IEEE 802.11 (WiFi) from the moment of packet reception until completion of broadcasting is of the order of 10 ms, which is no larger than the typical sampling rate of the secondary control of microgrids. In cases with bad communication conditions, large time delays (of the order of 100 ms) may occur. In such a situation, Eq. (5) needs to be revised to accommodate the communication time delay and a tailored design of the secondary controller for handling the large time delays is necessary for maintaining stability [28], [29]. Controlling microgrids with large communication time delays while guaranteeing the transient safety constraints simultaneously is still challenging and out of the scope of this paper.

III. OFFSET-FREE ONLINE SECONDARY VOLTAGE CONTROLLER DESIGN BASED ON EXPLICIT NN
In this section, we first use an integrator to transform the output tracking problem of (5) into a stabilization problem of its augmented system for fully eliminating the steadystate error between DER output voltages and their setpoints. Then, an explicit NN-based controller is designed for online implementation, while the time-consuming stability and safety constraints are cast into the offline training of the NN.

A. Setpoint Tracking Control of DER Output Voltage
The MG secondary control problem is a setpoint tracking problem, i.e., regulating the output voltages of DERs y to their reference value y ref with zero off-set. The original safe imitation learning method in [30] was designed for stabilization problems, i.e., regulating all the states to the equilibrium, and the equilibrium is required to be all zero (origin). To extend this method for stability and safety-constrained secondary voltage control problem, we introduce the following integrator which dynamically feeds back the integral of off-set wherex I is the state vector of the integrator andỹ ref is the voltage setpoint vector to be tracked byỹ. Then, the setpoint tracking problem of (5) is transformed into a stabilization problem of the following augmented system where the augmented state vector is defined asx aug (k) x =x − x * is the error between the new equilibriumx and the original equilibrium x * , the control vector is augmented asũ aug (k) = [ũ(k) −ũ],ũ is determined by (9) and the augmented output vectorỹ aug (k) =ỹ(k) −ỹ ref .
The augmented system matrices are derived as To achieve off-set free setpoint tracking, the steady-state values x andũ should satisfy When the augmented system (7)- (9) is stabilized by a properly designedũ aug (k), it is equivalent that: a) the small-signal MG (5) is stabilized, i.e., the original MG (1) is locally Definition 3: By definingH = [H, 0 n S ×m ], the safe region for the augmented system (7) is re-defined as Definition 4: The corresponding SSR for the augmented system (7) is re-defined as wherex aug (0) is an initial value, andφ denotes the solution of the closed-loop system (7) with secondary controller u aug . When steady-state condition (9) holds, the safety constraint (10) and SSR (11) of the augmented system (7) are equivalent to (3) and (4) of the original system (1), respectively.

B. Secondary Controller Based on Explicit NN
Stabilizing all the dynamics of (7) requires full-state feedback. Yet, full-state measurements are often unavailable in practical MGs. Therefore, state observers are needed to estimate the states by using input and output data only. For linear system (7), the separation property holds, so that the state observer and controller can be designed separately. Assume that the system is detectable, i.e., unobservable modes are stable, then it is simple to design a classical linear state observer to obtain the estimated statesx, which is used in the following state feedback controller design.
The feedback controllerũ aug = U(x aug ) is designed based on an L-hidden-layer feedforward NN as is state feedback as shown in Fig. 2; γ i ∈ R N i and z i ∈ R N i are input/output vectors of activation functions in the i th layer, respectively; ψ i : R N i → R N i is a vector collecting the activation functions elementwisely; w i ∈ R N i ×N i−1 and b i ∈ R N i are weight matrix and bias vector of the i th layer, respectively; N i is the number of neurons in the i th layer; i = 1, . . . , L.
The equilibriumx aug, * of system (7) with controllerũ aug = U(x aug ) satisfiesx aug, * = Ax aug * + BU(x aug, * ). To ensure that x aug, * = 0, the controller should satisfy U(0) = 0, which translates to a nonconvex constraint on (w i , b i ). To solve this problem, b i is set to zero as in [30], although it leads to underuse of the NN and hence may limit the achievable performance. It is still a challenging problem to develop a less restrictive convex constraint that ensures U(0) = 0 without setting b i = 0.
Our objective is to offline train the NN to imitate an expert controller for stabilizing the augmented system (7) while satisfying stability and safety constraints (10)- (11). Note that the explicit NN-based controller (12) is a static function such that its evaluation requires low computational cost and simple hardware. Therefore, the well-trained explicit NN-based controller can be conveniently implemented online. The overall control diagram is shown in Fig. 2. For the ease of stability and safety analysis, we use the method proposed in [30] to isolate the nonlinear activation functions from the linear operations of the NN: Note that (13a) and (13b) are linear and nonlinear components of the explicit NN-based controller (12). This decomposition simplifies the derivation of stability and safety constraints in the next section.

IV. OFFLINE TRAINING OF NN WITH STABILITY AND SAFETY CONSTRAINTS BASED ON IMITATION LEARNING
In this section, we first utilize local Lipschitzness of activation functions to propagate safety constraints on states to the explicit NN-based controller. Then, the stability and safety constraints of the augmented system (7) with controller (12) are derived based on Lyapunov theory and convexified using loop transformation and similarity transformation. Finally, the developed constraints are added into the offline NN training based on imitation learning to achieve stable, safe, and fast offset-free online secondary voltage control.

A. Safety Constraint Propagation
In the proposed explicit NN-based secondary voltage controller, we adopt activation functions satisfying the following local slope constraint, for some slopes k j i ≤ k j i , where ψ j i denotes the i th activation function in the j th layer. γ j i ≤ γ j * i ≤ γ j i is the an equilibrium which can be obtained from * = W exaug, * + W Z ( * ). Ifx aug, * = 0, then * = 0. Consequently, the center of slope constraint (15) is shifted to the origin as shown in Fig. 3(b).
Most widely-used activation functions are qualified such as ReLU and tanh. As illustrated in Fig. 3, the existence of slopes k j i , and k j i are ensured by the local Lipshitzness of the activation functions [31], [32].
By stacking up (15) with * = 0, the local slope constraint of the whole nonlinearity can be developed in the following quadratic form , where K = diag(k 1 , . . . , k N ), K = diag(k 1 , . . . ,k N ) are combined lower and upper bounds of slopes, respectively; = diag(λ 1 , . . . , λ N ) is a multiplier matrix with λ i ≥ 0. Local slope constraint (16) establishes the relation between inputs (MG states) and gradient of NN. Using this relation, we can propagate the safety constraints on states throughout the NN with the following steps: Step 1: Find the smallest hypercube {x aug |x aug ∈ [x aug,lb ,x aug,ub ]} ⊃ B, wherex aug,lb andx aug,ub are lower and upper bounds ofx aug , respectively. Let [z 0 , z 0 ] = [x aug,lb ,x aug,ub ] and j = 0.
Step 2: Let j = j+1. Denote w j ik as the k th element in the i th row of w j . Then, with (12c), the bounds of the i th activation input in the j th layer can be computed by solving an convex optimization problem [30], whose explicit solutions arē Step 3: Letting K I N , then the slope of the i th activation function in the j th layer is computed as Step 4: Calculate the bounds of activation outputs of the j th layer as Step 5: If j = L, stop; otherwise, return to Step 2. With this propagation, the original safety bounds of the states [−x ub − Hx,x ub − Hx] are transferred to the slope bounds of the activation functions [K, K], such that the safety constraint (10) can be alternatively satisfied in the offline training process.

B. Lyapunov Stability Constraint
Although we considered a linearized MG model, nonetheless, the closed-loop system is still nonlinear due to the substitution of a nonlinear explicit NN-based secondary voltage controller. Thus, instead of eigenanalysis, we will utilize Lyapunov theory to develop the stability constraints.
According to Lyapunov second method, the origin of system (7) with explicit NN-based controller (12) is an asymptotically stable equilibrium point if there exists a Lyapunov function V =x aug Rx aug > 0 with some symmetric positive definite matrix R ∈ R n+m , such that To combine the propagated safety constraint (16) with Lyapunov stability constraint (20), we define the following coordinate transformation [30], Then, the overall stability and safety constraints are proposed as the following theorem.
Theorem 1 (Stability and Safety): Select activation functions of NN satisfying local slope constraint (16) for the safety constraint (3) and denote the i th row ofH asH i .
If there exist a symmetric positive definite matrix R and positive semi-definite diagonal matrix , such that then, the proposed explicit NN-based secondary voltage controller (12) can locally stabilize the MG system (1) at a new equilibriumx and regulate the DER output voltages to the desired setpoints y ref with zero offset at the steady state. Moreover, it provides an inner-approximation of the SSR, S as the following ellipsoid, such that any trajectories starting within (R) will maintain in it and converge to the equilibrium asymptotically. The proof of Theorem 1 is given in Appendix-A. The stability and safety constraints (23)-(24) cannot be directly used in the offline NN training because it is non-convex to simultaneously solve for W, R and . Thus, a convexification procedure is carried out in the next subsection before applying them to the training phase.

C. Convexification of Stability and Safety Constraints
We first normalize the slope bounds of nonlinearity from [K, K] to [−1, 1] by using a loop transformation method as shown in Fig. 4, which was proposed in [30]. Thus, the explicit NN-based controller (13)- (14) is equivalently transformed as The detailed derivation of W is given in Appendix-B. Let [K, K] = [−1, 1], the slope constraint (16) is equivalent to Then, the stability constraint (23) is equivalently transformed as where The new stability constraint (28) is convex in R and when W is known. However, NN training requires to simultaneously search for R, and W, which is still non-convex with (28). For further convexification, (28) is written as the following linear matrix inequalities (LMIs) using Schur complements ⎡ with R 0, and 0. Define new decision variables as and left/right multiply (29) by diag(D 1 , D 2 , I n+m+N ). Finally, it has ⎡ ⎢ ⎢ ⎣ The new stability constraint (32) is now convex in the decision variables D = {D 1 , . . . , D 6 }. Note that the original variables (R, , W) can be retrieved from (30) and (31). Thus, (32) enables us to simultaneously search for (R, , W) by seeking D instead.
Moreover, to bound the ROA into safety constraint, (24) can be directly rewritten as a convex constraint on D 1 :

D. NN Training Based on Imitation Learning
The proposed explicit NN-based secondary voltage controller aims to imitate an expert control method under the premise of satisfying stability and safety constraints. Thus, the NN training is formulated as a constrained optimization problem as follows, where the first term in the objective function (34a) represents the training loss, N t is the total number of training data pairs. The training inputsx * aug and training outputs U * are generated by the expert controller to be imitated; the second term denotes the volume of the approximated SSR (R) that is proportional to det(D 1 ); η 1 , η 2 > 0 are weighting parameters. The inequalities (30), (32) and (33) are stability and safety constraints on D, while the equality constraint (31) bridges W and D, since W is a nonlinear function of W.
Problem (34) is a two-objective constrained optimization problem. The two objectives are separable and defined on uncoupled convex sets. Moreover, the equality constraint (31) can be used to connect the two subproblems. Thus, we adopt the ADMM used in [25] to solve (34). To use ADMM, an augmented Lagrangian function is first established as: where Y ∈ R (m+N )×(n+m+N ) is the Lagrangian multiplier, · F represents the Frobenius norm, ρ > 0 is the penalty parameter and Then (34) can be solved with the following iterative steps: Step 1: Update W with gradient-based methods by solving Step 2: Update D with semi-definite programming methods by solving (32) and (33) (38) Step 3: If E i+1 F ≤ σ , where σ > 0 is the stopping tolerance, then (34) has been solved with a converged result, and stop the training. Otherwise, update Y with the following equation and return to Step 1: Note that problem (34) is non-convex, thus the ADMM cannot guarantee a global optimum, but can obtain a local optimum. Nonetheless, the paramount task of offline training is to satisfy stability and safety constraints. Once the closed-loop augmented system (7) with the explicit NN-based controller is stabilized, the online controller based on the integrator will automatically eliminate the steady-state errors as illustrated   by Theorem 1. As a result, any converged solutions or even local optima are acceptable in the training phase. The overall offline training algorithm proposed in the section is concluded in Fig. 5.

A. Simulation Setup
A widely used 220 V (per phase RMS) prototype MG with three inverter-based DERs is adopted as shown in Fig. 6 [26]. Since this is a low-voltage distribution system, the network is resistance dominated. The parameters are given in Table I. All three DERs are equally rated (10 kVA), especially with the same droop gain, such that they can share the load power equally. Without secondary control, the initial voltage setpoint in primary control for each DER is given as u seti = 380 V, leading to steady-state errors in DER output voltages U od at the initial operating point. All the dynamic simulations are conducted in MATLAB and Python environments.
The secondary controller is established as a feedforward NN with 2 hidden layers. Each layer has N 1 = N 2 = 40 neurons with tanh as the activation functions. The hyperparameters of the NN are tuned through cross-validation. The expert controller is selected as the linear quadratic regulator (LQR), which has been widely used as an optimal control method in practical engineering due to its rapid transient response and ability to provide an inner approximation of ROA [25]. Considering discrete-time system (7), and performance index J = ∞ k=0 (x aug (k) Qx aug (k) +ũ aug (k) Rũ aug (k)), the optimal control law minimizing J is derived as where P is the unique positive definite solution to the following discrete-time algebraic Riccati equation According to a uniform distribution, 1 × 10 6 state vectorsx aug are randomly produced as the training inputs. Then, by using the LQR control law (40), one can obtain the corresponding control signalsũ aug of the expert controller as the training outputs. The learning rate is designed as 1 × 10 −3 /(1 + 3 × epoch/n epoch ), where n epoch is the total number of epochs [30]. The penalty parameter ρ = 1. The weighting parameters for imitation accuracy and volume of SSR are initially selected as η 1 = 100 and η 2 = 5, respectively, which means the control performance is considered as a more important factor. The training algorithm based on ADMM is terminated at the 38 th iteration with E F = 1.35.

B. Voltage Regulation Performance
We consider safety bounds on the DER output voltages as 380 × (1 ± 5%) V. As shown in Fig. 7, without secondary control, there exist steady-state errors between DER output voltages and their setpoints 380 V. After 1 s, the proposed secondary controller is activated and the steady-state errors are fully eliminated rapidly and safely. The blue ellipsoid in Fig. 8 shows the SSR calculated by the proposed method, which is an inner approximation of ROA bounded by the safety constraints (yellow cube). The phase plot of the trajectory of u od shows that output voltages cannot escape the SSR anytime.

C. Influence of Weighting Parameters
To test the influence of weighting factors in (34a), we fix η 1 = 100 and change η 2 to 20. As shown in Fig. 9, the controller with smaller η 2 has faster transient response but larger overshooting, which means it is more closed to the expert controller and focuses more on control performance. In contrast, larger η 2 leads to a more sluggish response speed but safer overshooting. Figure 10 shows that increasing η 2 can significantly enlarge the estimation of SSR.

D. Ability of Handling Other State Constraints
The proposed method can handle linear inequality constraints of any controllable state variables in the form of Eq. (3). To validate this, case studies with state constraints on both DER output currents i od and voltages v od are conducted as an example. Specially, unlike DER output voltages that need to be maintained at a certain level for safe operation, the steady-state values of output currents are regulated according to the loading condition, such that they usually have a much larger variation range. Therefore, the current constraints in this case study are set as [0.75ī od , 1.25ī od ], where the new steady-state valueī od is computed via Eq. (9) and η 2 = 20. The SSR from the viewpoint of i od is shown in Fig. 11. We can see the SSR is successfully bounded by the current constraints and an initial point starting within the SSR finally converges to the new equilibrium. Figure 12 compares the current trajectories with voltage constraints only and with both voltage and current constraints. As shown in the figure, by considering current constraints in the proposed secondary control method, the currents can be bounded within the safe range. It should be mentioned that all the bounds are flexible to be changed according to the practical engineering requirement. The influence on DER output voltage induced by considering current constraints is also studied. As shown in Fig. 13, the SSR of DER output voltage has unsurprisingly shrunk by adding current constraints.

E. Comparison Case Studies
The proposed method is compared with the expert LQR controller and the conventional constrained MPC method. The configuration of LQR remains the same as Section V-A. As for the MPC, we consider safety constraints (3) and terminal stability constraints. The constrained optimization problem is solved at each time step as a quadratic programming (QP) problem. As shown in Fig. 14   The comparison of computational time is shown in Fig. 15. Note that the y-axis is scaled logarithmically, and the computational time of LQR and the proposed method is much lower than that of the MPC. This is because, evaluating control signalũ aug (k) of the proposed method and LQR method at each time step only requires performing several multiplications, additions and evaluating activation functions (required by the Fig. 12.
Comparison of DER output currents with and without current constraints.
proposed method only). In contrast, the MPC needs to solve a QP problem at each time step, which is significantly more time-consuming. The high computational cost leads to two problems. Firstly, it can result in time delays when the computational time at each time step is larger than the sampling time of the secondary control signal as shown in Fig. 15. Secondly, solving the QP problem requires more expensive hardware than simply evaluating a static function. Figure 10 shows that the SSR approximated by the proposed method is much larger than the ROA approximated by LQR. This is because our training objective is also designed to maximize the volume of SSR as illustrated in (34a). It also shows that increasing the weighting parameter η 2 can significantly enlarge the volume of the approximated SSR. The conventional MPC cannot directly provide a ROA approximation, so it is not compared in this aspect. It is worth noting that, all the SSR and ROA here are inner approximations of the real ones which are usually difficult to be accurately obtained.

F. Anti-Disturbance Performance
To test the anti-disturbance performance of the proposed secondary voltage control method, a disturbance term is added to (5) which is equivalent to connecting a controlled current source in parallel to Load 1 [26]. After the system is    NN-based method are shown in Fig. 16. We can observe that the output voltage of DER1 is most influenced since it is closest to the disturbance. The proposed method has overall better robustness than MPC and LQR methods.

VI. CONCLUSION
This paper proposed a novel secondary voltage control method that can guarantee the transient stability and safety of microgrids (MGs). The explicit neural network (NN) enables casting the time-consuming stability and safety-constrained optimization problem into the offline training phase by leveraging local Lipschitzness of activation functions, such that the trained explicit NN-based controller is fast enough to be implemented online. Moreover, the proposed method can also provide a large inner approximation of the stable region, within which the trajectories of MG will be bounded by safety constraints and converge to the equilibrium asymptotically. Comparison case studies have been carried out to validate the effectiveness and show the advantages of the method.
The future work will extend the proposed approach for nonlinear MG models. To control transient states, a nonlinear state observer is required to estimate the MG states. The main challenge is aroused by the violation of separation property due to the coupling between the MG dynamics and nonlinear state observer, which leads to difficulties in deriving and convexifying transient stability and safety constraints. For anyx aug (k) ∈ (R), the last term of (42) is nonnegative, thus V(x aug (k + 1)) − V(x aug (k)) < 0. By Lyapunov theory, any trajectory originating in (R) converges to the origin asymptotically, i.e., lim k→∞xaug (k) = 0. This indicates that (R) is a ROA and an invariant set [30]. Recall that (R) ⊆ B, so (R) is an inner approximation of SSR (11). Finally, it follows in the steady state that, for any initial values satisfyingx aug (0) ∈ (R).

B. Derivation of Loop Transformation
From Fig. 4, we can obtain