Analysis and Simulation Research of Cascading Faults in AC/DC Hybrid Grid

In the development of power systems, the traditional AC power grids are gradually evolving into AC/DC hybrid grids. However, the safety of hybrid grids is threatened by cascading faults, which is a set of chain events caused by a single fault and will eventually lead to a blackout. Based on the blackout accident that happened in Brazil on March 21st, 2018, this paper analyzes the cause, mechanism, and development of cascading faults in AC/DC hybrid grids. Simulations based on PSCAD/EMTDC software have been carried out to illustrate the typical cascading fault scenario including HVDC commutation failure, DC blocking, power flow transferring, incorrect relay protection and the outage of the network. Both analysis and simulation results shows that the “strong DC weak AC” structure and unreasonable cooperation of relay protections and stability control devices are important factors of cascading faults. Finally, this paper prospects a series of protection and control technologies that are expected to solve the problem.


I. INTRODUCTION
I N RECENT years, with the rapid growth of renewable energy generation and the development of High-Voltage Direct-Current (HVDC) technology, a large number of power electronic devices have been introduced into the power systems, causing continuous and significant changes in power grid characteristics globally [1]. The traditional alternating current (AC) power grid is evolving in the AC/DC hybrid direction. A preliminary AC/DC hybrid power system has emerged, which is a new form of power grid after a century of development [2]. The relevant topology, parameters, operation characteristics, fault characteristics, and stability characteristics have all undergone fundamental changes. It is the mission of relay protection researchers to analyze and understand this changing power grid and find out the core problems threatening its security. Undoubtedly, cascading faults are the main challenge faced by AC/DC hybrid power grid.
Cascading faults in AC/DC hybrid power grids refer to the phenomenon that a fault in one component induces faults or operation termination of other components/systems, especially the cross propagation of faults between AC and DC systems [2]. Rather than a single simple fault, it is a collection of secondary events affecting each other between AC and DC power grids. In AC/DC hybrid power grids, cascading faults are the new normal state of power system faults [2].
The cascading faults follow some specific patterns, of which a typical scenario is shown below. Firstly an AC fault occurs at the inverter side of HVDC system, resulting in commutation failure. Then DC blocking is caused by continuous or multiple commutation failure. The DC blocking leads to power flow transferring and power imbalance of the grid. Incorrect protection or safety and stability control device operation intensifies the power imbalance, eventually resulting in the collapse or disconnection of the whole hybrid power grid, and even the power outage of the whole network. A recent example is the blackout accident that happened in Brazil on March 21st, 2018, which will be discussed in this paper.
DC blocking, power flow transferring, and cascading tripping are important links causing cascading faults in AC/DC hybrid power grid. Cascading faults often originate from the failure of a single component, but it will further expand and lead to a domino effect if the power system cannot be controlled and protected timely and effectively, resulting in irreparable losses [3], [4], [5], [6].
At 15:48 (Brazil local time) on March 21, 2018, a largescale power outage occurred in Brazil. The accident originated from the overcurrent protection action of a section circuit breaker in the AC system, which led to the bipolar blocking shutdown of the Belo-Monte-I UHVDC project, with an instantaneous power loss of 3.73 million kW. Ultimately, the power grids in the north and northeast Brazil successively separated and became isolated. Nine states in southern Brazil are also affected to varying degrees. This paper first introduces the process of the blackout in Brazil on March 21, 2018, then deeply analyzes the causes of the accident and explores the three key links of the cascading fault of AC/DC hybrid power grids, and then simulates and verifies the cascading fault process in combination with the blackout. Finally, the possible countermeasures and protection measures are proposed, which provides references for the research of cascading faults in AC/DC hybrid power grid in the future. It should be noted that due to a lack of detailed Brazil power grids structure and parameters, the author could only try to understand the occurrence and development of this disaster from some information that had already been made public, but the results were still gratifying.

II. INTRODUCTION TO CASCADING FAULTS ACCIDENT IN BRAZIL A. PRE-ACCIDENT OPERATION STATUS
Brazil's power grid includes four major networks, that is, northwest power grid, northern power grid, northeast power grid, and southern power grid. The southern power grid can be further divided into the central west, south, and southeast regions. The northern power grid, northeast power grid, and southern power grid are connected and therefore form a large-scale regional connected power grid, while the northwest power grid runs independently [7], [8]. The regional connected power grid under normal operation before the accident is shown in Fig. 1.
Belo-Monte hydropower station transmits power to the southern power grid through the ±800kV Belo-Monte-I UHVDC project. The Northern power grid is connected with the northeast power grid, and the northeast power grid and the Southeast power grid are connected through 500kV AC lines to form an AC/DC hybrid power grid.
Before the accident, a total of 7 generators of the Belo-Monte hydropower station were in operation, and the Belo-Monte-I UHVDC system was working normally, with a transmission power of 3.73 million KW. The electrical wiring diagram of the Xingu converter station is shown in Fig. 2. As its AC system is still under construction, the  Xingu station of the Belo-Monte-I UHVDC project operates through a single bus scheme during this transition period, which was divided into three stages [9], [10]. In the first stage, Bus B operates without the circuit breaker to ensure bipolar commissioning and operation. In the second stage, Bus A operates with the circuit breaker and Bus B shuts down temporarily. In the third stage, Bus B operates again with the circuit breaker. The accident occurred at the second stage of the transition period. Since no circuit breakers were installed in the first stage, the setting values of section breaker protection were not configured timely when switching to the second stage. Specifically, the setting value of overcurrent protection in section circuit breaker 9522 remained as a default value of 4000A [11].

B. ACCIDENT PROCESS
The blackout accident happened in the following course [7], [10], [12], [13]. After DC blocking occurred, if the generators were cut off timely, the output power of the northern grid can be quickly reduced to prevent large DC transmission power from being transferred to the AC lines. However, the stability control devices did not consider the extreme situation of simultaneous voltage loss on both Bus A and Bus B (in this accident, it was refered to the ocasion of voltage loss during single bus operation in the transition period). When the stability control devices received the signal to cut off 6 generators, it determined the signal was invalid and failed to do so. 7 generators of the hydropower station continued to operate with the output power unchanged. Therefore, the DC power flow was transferred to AC lines.As displayed in Fig. 1, after DC line 1 was blocked, all the 3.73 million kW of power was transferred to its parallel AC corridors 2 , 3 and, 4 .
After the DC power flow was transferred to AC lines, the system began oscillating and became overloaded. About 738ms-1134ms after the incident occurred, corridor 2 was cut off due to the mal-operation of out-of-step protection and distance protection. Therefore the northern power grid was disconnected from the southern power grid. Similar events also happened on AC corridor 3 subsequently, making the northern power grid isolated. At this time, the northern power grid was seriously overpowered and completely collapsed after a period of time. Finally, the distance protection on the corridor 4 between the northeast and the south operated incorrectly, and the northeast power grid was also isolated.

3) THE NORTHERN POWER GRID AND THE NORTHEAST POWER GRID COLLAPSED, AND THE SOUTHERN POWER GRID WAS RESTORED TO STABILITY
After the northern power grid was isolated, the power became surplus, and the frequency increased up to 71.69 Hz. Some lines tripped due to overvoltage. After a large number of generators were cut off, the system started to oscillate. 85 seconds after the accident, the northern power grid was isolated and about 93% of the load was lost.
After the disconnection, the power of the Northeast grid became insufficient. After 5 rounds of low-frequency load shedding action, the frequency recovered to around the rated value. However, about 10s later, due to the incorrect tripping of two generators in Paulo Afonso Hydropower Station and some thermal generators, the frequency decreased again. And finally, the northeast power grid collapsed and lost about 99% of the load.
After the southern power grid was disconnected, the power became insufficient. The frequency was reduced to as low as 58.44 Hz. After a round of low-frequency load shedding, a total of 3.67 million kW load was cut off, and the system returned to stable operation.

III. ANALYSIS OF THE CASCADING FAULTS ACCIDENT IN BRAZIL
The initial cause of this blackout is the blocking of Belo-Monte-I UHVDC caused by the tripping of the section circuit breaker. However, only DC blocking itself would not cause a large-scale power blackout. The root cause of blackout actually lay in the subsequent cascading failures after DC blocking. In this section, several key links in this accident will be analyzed.

A. POWER FLOW TRANSFERRING CAUSED BY DC BLOCKING
HVDC transmission system is generally required to operate according to a certain power reference, that is, the power of the DC transmission system remains basically unchanged during normal operation. In case of DC or AC line faults, the DC converter station will be blocked out of operation in order to protect the DC converter station and power lines.
For this accident, only one ±800kV UHVDC line of the Belo-Monte-I project is in operation in Brazil's power grid at present. Therefore, after the DC lock, the 3.73 million kW power of the DC line is transferred to the parallel AC lines, which leads to large-scale power transferring.
And for AC/DC hybrid power grids with multiple dc lines, due to the characteristics of the control system in HVDC, the transmission power on other DC lines is basically unchanged. All the power originally transmitted on the blocked DC line will still be transferred to parallel AC lines, forcing the AC lines to bear a much heavier load than that in normal operation.

B. CASCADING TRIPS
All the power transmitted on the DC transmission line is transferred to the parallel AC lines. These AC lines may be overloaded, which is often accompanied by system oscillation. The overload and oscillation caused by power flow transferring are analyzed below.

1) LINE OVERLOAD CAUSED BY POWER FLOW TRANSFERRING
Under the existing protection configuration, the relay protection device on the AC line cannot distinguish between fault and overload caused by power flow transferring, which leads to cascading incorrect operation and further separation of the sending grids and receiving grids in the network structure. The probability of such events is very small in traditional AC systems. However, in AC/DC hybrid power grids, serious overloads of AC lines caused by DC blocking are very likely to occur.
The mechanism of protection operation caused by overload is deduced as follows. Take the directional circle characteristics of impedance relay shown in Fig. 3 as an example.
In the figure, Z set denotes the setting value of distance protection section III, and φ L is the load impedance angle. It is assumed that the actual transmission power of the AC line is P, the rated voltage is U N . And the amplitude of the measured impedance Z M is It can be seen from Fig. 3 that the minimum measured impedance value that will not cause the action of distance protection section III is When the measured impedance meets the conditions of (3), the protection trips.
Substitute (1) and (2) Equation (4) could also be formulated as: From (5), when the AC transmission power P is greater than P 1 , the distance protection section III trips.
Z set could be calculated as: where K rel is the reliability coefficient, K ss is the motor self-start coefficient, K re is the protection return coefficient, Z Lmin is the minimal load impedance corresponding to the maximum load. Take the typical values of 3 coefficients and substitute (6) into (5) to obtain: where P max is the maximum transmission power during normal operation. According to the above derivation, when the transmission power of the AC line is greater than 2.07 times of the maximum transmission power, the distance protection section III of the AC line is likely to trip due to overload.

2) SYSTEM OSCILLATION CAUSED BY POWER FLOW TRANSFERRING
Power flow transferring can also cause the transmission power of the AC line to exceed the static stability limit and then lead to system oscillation. When the system oscillates, the amplitude and phase of voltage and current at each point will change periodically, which may lead to the incorrect operation of the current relay or impedance relay [14].
Take the characteristic impedance circle of the directional circle as shown in Fig. 4 as an example.
In the figure, Z k is the measured impedance of the relay. When the system oscillates, the measured impedance of the relay will move on line OO , which is the vertical bisector of line N − Z set . Assuming that the intersection of relay action characteristics and straight line OO is O and O . When the measured impedance is located between O and O , the impedance relay will be affected by oscillation and trip incorrectly.
Furthermore, the effect of system oscillations on distance protection is also correlated to the protection location. The closer the protection installation point is to the oscillation center, the greater the oscillation impact. If the oscillation center is outside the protection range or in the opposite direction of the protection, the distance protection will not be affected by the oscillation [15]. VOLUME 9, 2022 In this accident, after the power flow was transferred, the load on the AC line far exceeded its normal transmission power, while the system oscillated at the same time. Under the dual influence of overload and oscillation, cascading trips were triggered.

C. IMPACTS ON THE POWER GRID CAUSED BY CASCADING TRIPS
The tripping of AC transmission lines will impact the power grid at the sending and receiving ends, resulting in great frequency fluctuation, which is very likely to cause frequency out of limit.
For the sending end system, the power transmission is interrupted after DC blocking. The active power of the sending end system becomes surplus and the frequency increases. If the frequency modulation of the system itself can keep the system frequency within the rated range, there is no need for subsequent action. Otherwise, it is necessary to cut off some generators to reduce the power. In this accident, the northern power grid, as the sending end system, provided a typical example.
For the receiving end system, the active power is insufficient after DC blocking. Therefore the frequency is reduced.If the system frequency is reduced beyond the rated range, the automatic under frequency load shedding (UFLS) device in the system will function to avoid system frequency collapse, automatically cutting off part of the load according to the frequency level and restoring the frequency to be within the rated range as soon as possible. Besides, after the system is stabilized, if the protection only focuses on its own protected component and operates, the system may still collapse. In this accident, the frequency of the southern power grid was reduced after disconnection, but it was restored to the rated range after UFLS. However, for the northeast power grid, the protection in the system still tripped incorrectly after it returned to stability, resulting in the final collapse.
To sum up, the reason for this blackout accident included three links of cascading faults in AC/DC hybrid power grids: DC blocking, power flow transferring, and cascading trips. In addition, after the system is disconnected, the UFLS configuration is not sufficient, which aggravates the accident.

IV. SIMULATION RESEARCH
In order to verify the process of cascading faults in the AC/DC hybrid grid, a simple AC/DC hybrid grid model, as displayed in Fig. 5 was established in PSCAD/EMTDC software for simulation.
As shown in Fig. 5, the system is composed of three power grids. Voltage level of all buses is 500kV. And AC system frequency is 50Hz. Grid 1 is connected to Grid 2 via 2 DC transmission lines and AC transmission Line3-9. Grid 1 and Grid 3 are connected via the AC transmission Line1-10. Grid 2 is connected to Grid 3 via the AC transmission Line8-11. The power flow and AC/DC transmission properties of the three power grids in the simulation model are similar to the operation statuses of the Brazilian power grids.    Fig. 6 shows the power flow changes of the AC lines Line3-9, Line1-10, and Line8-11 after the DC blocking. Fig. 7 presents the frequency fluctuation diagram of the power grid 1-3 after the DC blocking. It should be noted that the frequency curves have been smoothed to eliminate  At 5s, the DC line connecting Grid 1 and Grid 2 was blocked. Instantly, the power flow of the AC Line3-9 running in parallel with the DC line increased greatly. Meanwhile, affected by the DC blocking, the transmission power from Grid 1 to Grid 3 (Line 1-10) increased, whereas the transmission power from Grid 2 to Grid 3 (Line 8-11) slightly decreased.The frequency remained stable temporarily.
At 5.5s, Line3-9 tripped because the distance protection section III was affected by overload. DC Line3-4 was the only channel left of power transmission from Grid 1 to Grid 2. Nevertheless, its power flow remained basically unchanged. And Grid 1 began to transmit power to Grid 2 through Grid 3. As a result, the power flow of Line1-10 was further increased. The power flow of Line8-11 decreased and reached 0 at around 6s. If this state persisted, the power flow of Line8-11 would reverse. The system also began to oscillate, as shown in Fig. 7. Grids 1 and 3 exhibited excess power, of which the frequency was increasing. The frequency of Grid 2, on the other hand, decreased due to power shortages.
At 6s, Line1-10 also tripped due to the Protection maloperation caused by overload. In the case of no generator shedding, the frequency of Grid 1 continued to rise because the internal power generation of the grid was greater than the load. The power flow of Line 8-11 recovered. The frequency of Grid 2 continued to decline due to power shortages. At that moment, Grid 3 lost the power input from Grid 1, so its frequency was reduced.
During 6s to 8s, Line8-11 undergone significant oscillation due to the drastic change in the frequency of Grid 2 and 3, of which the current is shown in Fig. 8. At 8s, Line8-11 tripped due to overload and oscillation. Grid 2 and Grid 3 were seperated.
The simulation results can be compared to the Brazil blackout event qualitatively. Grid 1 is similar to the north grid of Brazil, Grid 2 is similar to the south grid of Brazil, and Grid 3 is similar to the northeast grid of Brazil. As the main power transmission area, Grid 1 outputs power to the grids 2 and 3, and Grid 2 also transmits power to Grid 3. After DC blocking, the power of Grid 1 is excessive, the power flow on Line3-9 and Line1-10 that transmit power to Grid 2 and Grid 3 increases, the power of Grid 2 is lost, and the power of Line8-11 that transmits power to Grid 3 decreases. This is also similar to the actual power flow between regional power grids in the blackout of Brazil. Subsequently, line3-9, line1-10 and line8-10 are tripped due to overload and oscillation. Similar cascading tripping also happened during the Brazil blackout event. According to the simulation results, it can be seen that after all the connecting lines between the three power grids are disconnected, the power of Grid 1 is excessive and the frequency rises, while the power of Grid 2 and Grid 3 is insufficient and the frequency drops due to the lack of power transmission of Grid 1, which is consistent with the actual frequency characteristics of the blackout in Brazil.
The simulation results revealed the process of cascading faults in the AC/DC hybrid system. DC blocking, power flow transferring and cascading trips, as the three major links of AC and DC hybrid power grid cascading faults, functioned successively and progressively. DC blocking was only a single component failure, but it affected the whole system due to the cascading effect, which led to large-scale power flow transferring across the overall power grid. But due to VOLUME 9, 2022 the cascading effects, which led to large scale transferring of power flow in the overall power grid. Due to overload and oscillation, cascading trips occurred in the AC transmission lines between local power grids, imposing frequency impacts on all of them and ultimately causing complete paralysis of the large power grid.

V. ANALYSIS AND ENLIGHTENMENT OF CASCADING FAULTS THROUGH THE BLACKOUT IN BRAZIL A. REFLECTIONS ON THE BLACKOUTS
Blackouts generally originate from some accidental events, but there are often many fundamental, inevitable defects hidden beneath [14]. This accident has exposed two defects of Brazil's power grid. One is the ''strong DC and weak AC'' structure, the other is the unreasonable cooperation of relay protection and stability control devices.

1) AC/DC HYBRID POWER GRID STRUCTURE WITH ''STRONG DC AND WEAK AC''
The development of AC/DC hybrid power grids has roughly experienced three stages: small capacity DC with AC hybrid stage (strong AC and weak DC), large capacity DC with AC hybrid stage (strong DC and weak AC), and hybrid stage with equivalent capacity of AC and DC (equal strength of AC and DC) [16], [17]. In the stage of ''strong DC and weak AC'', the transmission capacity of one DC line could possiblely be much greater than that of parallel AC lines. The number of interconnected DC transmission channels is also higher than that of AC transmission channels. Because the transmission power of DC lines is larger than AC lines', once a single DC line or several DC lines block, largescale power flow transfer is inevitable. But AC power grid cannot withstand large power fluctuations. Besides, distance protections cannot correctly distinguish faults and overloads, which then leads to incorrect actions and aggravates system separation. These chain reactions may finally cause serious blackout.

2) UNREASONABLE COORDINATION MODE OF RELAY PROTECTIONS AND STABILITY CONTROL DEVICES UNDER THE BACKGROUND OF AC/DC HYBRID
The cooperation mode between relay protection and SEP devices has not been updated amid the dramatic increase in the scale of HVDC transmission and the rapid development of AC/DC hybrid power grids.
The traditional relay protections focus on the protection object itself without considering the whole power grid system. Such a working mode has an adverse effect on the operation of the AC/DC hybrid power grid. Take line protections as an example, when there is instantaneous high power fluctuations caused by the DC blocking on the receiving system, parallel AC transmission channels should maintain operation as long as possible to provide more time for stability control devices. Instead, the line protection often trips under overload or oscillation, posing another impact on the sending and receiving end systems and aggravating the implications of the accident.

B. COUNTERMEASURES FOR CASCADING FAULTS IN AC/DC HYBRID POWER GRIDS
According to the above analysis and simulation, the cascading faults of AC/DC hybrid power grid are a series of chain reactions. Thus a single protective measure would not be sufficient to counter them. The countermeasures should be a series of protection & control technologies that cooperate properly. Targeting different links of the cascading faults, the comtermeasures includes several following categories.

1) PROTECTION AND CONTROL TECHNOLOGY TO AVOID DC BLOCKING
DC line faults, AC line faults on the rectifier side, and AC line faults on the inverter side are all possible causes of DC blocking in the AC/DC hybrid power grid. The Brazil blackout was caused by the incorrect tripping of the AC line segment circuit breaker on the rectifier side. But generally speaking, the possibility of a DC blocking caused by a fault on the inverter side of the AC line is much greater than the other two causes. In this case, AC faults always lead to commutation failure, which is the direct cause of DC blocking. Various methods to reduce the probability of commutation failure have been proposed, including advancing firing angle [18], supporting the AC bus voltage [19], and current limiting technologies [20].

2) WIDE-AREA DC CONTROL TECHNOLOGY AND AC DYNAMIC CAPACITY INCREASING TECHNOLOGY
The control technology based on power flow transferring can be considered in the following two aspects: On the one hand, the control strategy of DC transmission can be optimized so that after one DC line is blocked, the other DC lines can share the transmission capacity borne by the blocked DC line, reducing or even avoiding the overload of parallel AC transmission lines. On the other hand, the dynamic capacity increasing strategy of AC lines [21] can be considered to improve their overload tolerance and provide more action time for subsequent control and emergency dispatching, thereby reducing the possibility of AC line tripping.
An intuitive simulation was conducted to illustrate the power flow control idea, of which the results are presented in Fig. 9 and Fig. 10. At 5s, DC Line3-6 was blocked. If DC Line3-4 was able to sence this event and increase its transmission power by 1500MW at 5.1s, the overload and oscillation will be prevented, as shown in Fig. 9 and Fig. 10.

3) STATION DOMAIN PROTECTION TECHNOLOGY TO PREVENT THE CASCADING TRIPPING IN AC GRID
In order to prevent cascading tripping in AC grid, the overload identification method of lines should be studied. Quick removal is essential if the anomaly is identified as a power system fault. However, if it is recognized as an overload from power flow transferring, it should be cut off slowly without damaging the electrical equipment.
In addition, oscillation identification methods should be used, and special oscillation block circuits should be installed to prevent the maloperation of relay protection devices during system oscillation.

4) STRENGTHEN THE COOPERATION BETWEEN THE STABILITY CONTROL DEVICES AND PROTECTION DEVICES
On the one hand, the stability control, such as separation, lowfrequency/low-voltage load shedding, and high-frequency generator shedding, should be optimized, and a protection scheme suitable for AC/DC hybrid power grids should be proposed. On the other hand, cooperation between these stability control devices and protection devicse on the power supply side should be strengthened so as to prevent large-scale blackouts in extreme emergencies.
The result of the joint action of measures in section V-B.3 and V-B.4 are presented in Fig. 11 and Fig. 12. During 5s to 8s, when the AC lines were subjected to overload and oscillation, the station domain protection would be able to distinguish this occasion from line faults and therefore did not trip. At 8s, stability control functioned in time by a load shedding of 1200MW at load6 in Grid 2 and a generator  shedding of 1200MW at G3 in Grid 1. After a short transient process, the system recovered to stability.
In addition, to reduce the impact of the DC blocking on the power grid, quick recovery technology should also be considered. Most DC blockings are related to the AC fault at the inverter side. Therefore quick fault clearing and the optimal control strategy for DC lines should be investigated.

VI. CONCLUSION
This paper investigated the process of cascading faults in the AC/DC hybrid power grid and the effects of interactions between power grid links, in conjunction with the March 21 blackout in Brazil. In the case of the DC blocking, tripping the AC lines in parallel was very likely, and the frequency of the power grid at the sending end and the receiving end will be affected. The system might be subject to generator and load shedding, and a major power outage might be caused in extreme cases. This paper presented the process of cascading VOLUME 9, 2022 faults in a simple AC/DC hybrid power grid model through simulation.
To avoid cascading faults in the AC/DC hybrid power grid, a series of technologies should be adopted, including protection and control technology for HVDC, wide-area DC control technology and AC dynamic capacity increasing technology, and station domain protection technology. Furthermore, the cooperation between the stability control and protection should also be strengthened.