Open-Circuit Switch Fault Diagnosis and Accommodation of a Three-Level Interleaved Buck Converter for Electrolyzer Applications

Abstract

This article proposes a novel open-circuit switch fault diagnosis method (FDM) for a three-level interleaved buck converter (TLIBC) in a hydrogen production system based on the water electrolysis process. The control algorithm is suitably modified to ensure the same hydrogen production despite the fault. The TLIBC enables the interfacing of the power source (i.e., low-carbon energy sources) and electrolyzer while driving the hydrogen production of the system in terms of current or voltage. On one hand, the TLIBC can guarantee a continuity of operation in case of power switch failures because of its interleaved architecture. On the other hand, the appearance of a power switch failure may lead to a loss of performance. Therefore, it is crucial to accurately locate the failure in the TLIBC and implement a fault-tolerant control strategy for performance purposes. The proposed FDM relies on the comparison of the shape of the input current and the pulse width modulation (PWM) gate signal of each power switch. Finally, an experimental test bench of the hydrogen production system is designed and realized to evaluate the performance of the developed FDM and fault-tolerant control strategy for TLIBC during post-fault operation. It is implemented with a real-time control based on a MicroLabBox dSPACE (dSPACE, Paderborn, Germany) platform combined with a TI C2000 microcontroller. The obtained simulation and experimental results demonstrate that the proposed FDM can detect open-circuit switch failures in one switching period and reconfigure the control law accordingly to ensure the same current is delivered before the failure.

1. Introduction

According to Climate Watch by the World Resources Institute [1], the energy sector represents three quarters of global greenhouse gas (GHG) emissions. Transportation, electricity production, and industry generate the majority of global GHG since they are mainly based on fossil fuel burning. For this reason, it is crucial to decarbonize these sectors to reverse the global trend of GHG emissions and temperature rise as well. Beyond the growing development of renewable energy sources (RES) (particularly wind and photovoltaic) to generate low-carbon electricity, hydrogen as an energy carrier can play a key role in decarbonizing energy sectors [2,3]. Hydrogen features a high energy density and can be exploited to deliver and store usable energy. However, its production pathway is still dominated by thermochemical processes (coal gasification, natural gas reforming) that may be coupled with carbon capture, utilization, and storage (CCUS) solutions to decrease GHG [3], even if the future perspective is tied to green hydrogen produced by renewables [3,4].

In fact, to cope with this issue, the dissemination of large water electrolysis power plants all over the world supplied by low-carbon power sources (wind, photovoltaic, hydro, and nuclear) has seen rising interest over the last few years [4]; on the other hand, a relevant increase could come from the diffusion of many small power plants. The water electrolysis process consists of exploiting electricity coming from low-carbon power sources and pure water to deliver green hydrogen that can be used to store energy, supply fuel cells for electricity generation in transportation or industrial/commercial/residential buildings, and for power-to-x applications such as the generation of green gas [5,6,7]. The water electrolysis process is made possible thanks to the use of electrolyzers. Currently, four electrolyzer technologies have been reported in the literature, depending on their electrolyte material and the ionic species they transport: alkaline water electrolysis [8], proton exchange membrane (PEM) water electrolysis [9], solid oxide (SO) water electrolysis [10], and anion exchange membrane (AEM) water electrolysis [11]. For now, only alkaline and PEM water electrolysis technologies are available on the market; while SO and AEM technologies are still being investigated, with promising features and results with developed prototypes reported in the literature [10,11].

The literature has given great attention to the entire conversion chain from electricity to hydrogen production. Electrolyzers can be seen as loads requiring very high currents (thousands of amps) and high voltage (hundreds of volts) [12]. Since such supply is not directly available, the electrolyzers are usually combined with power electronics systems that can be classified into two categories: (1) AC-DC converters that are thyristor-based [13] or IGBT-based [14], and (2) union AC-DC converters and DC-DC converters [15]. Currently, thyristor-based AC-DC converters such as 6-pulse and 12-pulse rectifiers dominate the market for large-scale water electrolysis power plants because of the very high current ratings of thyristors compared to IGBT [16]. The performance and the reliability of such systems depend on many factors including harmonics superimposed on the supply current, control algorithms, and fault tolerance. As pointed out in the literature, power converters suffer from generating harmonics affecting the power quality and contributing to high current ripple, decreasing the specific energy consumption [13,17]. Furthermore, further investigations are expected to have a better understanding of the current ripple effects on the performance [18,19] and aging of electrolyzers [20,21]. On the other hand, the combination between AC-DC converters and DC-DC converters allows facing power quality and current ripple issues [12,17], assessing that the ripple reduction improves the electrolyzer’s reliability. Control algorithms are currently under study, aiming to increase robustness against fault [22] and to encompass features of grid services [23,24,25]. Nevertheless, some issues are remaining such as the increase in the power rating due to the limit of IGBT’s current ratings (roughly equal to 1400 A) and the reliability in case of electrical failures [15].

Nowadays, the availability on the market of power devices, providing high efficiency to the converters in which they are adopted, has increased the interest in the development of DC/DC converters of rated power up to about 10 kW to be used also in domestic applications [26,27]. In this case, the operating voltage is reduced (about ten volt), enhancing safety; however, the market requires improved reliability so that the maintenance cost is reduced, and the continuity of the production is guaranteed.

In the case under study, the reliability issue is investigated since DC-DC converters are frequently sources of failures in many applications [28]. Indeed, as highlighted in the literature, the decrease in reliability of these converters is caused by operating and climate conditions. Moreover, the components featuring the highest failure rates in these converters are capacitors and power switch devices [29]. In this work, open-circuit failures (OCF) are studied, considering that short-circuit failure (SCF) monitoring and detection can be handled by current driver boards [30]. When considering RES coupled with the electrolyzer where the operating conditions are governed by the weather conditions (wind speed, solar irradiance), discontinuous operating and climate conditions such as voltage and current spikes and high temperature can occur, and consequently may cause failures. The water electrolysis process is a critical application and hydrogen generation must be ensured despite the occurrence of failures. Hence, to avoid any disruption in hydrogen production, the use of fault-tolerant DC-DC converters and fault diagnosis is highly recommended [31,32].

Over the last decade, many researchers have employed fault-tolerant DC-DC converters, taking advantage of static redundancy or additional circuits coupled with fault diagnosis to ensure the continuity of service in case of failures while enhancing the performance of the system [33,34,35,36,37,38,39,40,41]. From the current literature, it can be noted that fault diagnosis is generally proposed for interleaved converters [34,35,36,37,38,39,40,42], floating interleaved converters [41], which are suitable for fuel cell and photovoltaic applications, and microgrids [43]. On one hand, due to their static redundancy, these converters can continue to operate despite the occurrence of failures. On the other hand, albeit to improve their performance, fault diagnosis is needed. Studies specifically focused on electrolyzer applications are relatively poor in the literature, and only one paper has been published so far [44]. In this paper, the authors have proposed a fault-tolerant operation control strategy in the case of OCF for a multiphase stack interleaved buck converter. However, fault diagnosis has not been investigated.

Starting from this literature review, the main contribution of this paper is to develop a fault diagnosis method (FDM) to detect and accurately locate OCF and a fault-tolerant control strategy in a three-level interleaved buck converter (TLIBC) conceived for electrolyzer applications. The FDM consists of comparing the shape of the input current and the pulse width modulation (PWM) gate signal of each power switch. To assess the performance of the studied developed FDM and fault-tolerant control strategy for TLIBC during post-fault operation, an experimental test bench of the hydrogen production system has been realized with a real-time control based on a MicroLabBox dSPACE (dSPACE, Paderborn, Germany) platform combined with a TI C2000 microcontroller. The obtained simulation and experimental results have demonstrated that the proposed FDM can detect open-circuit switch failures in one switching period. Furthermore, the fault does not interrupt the function of the converter, which continues to operate with a reduced circuit configuration.

Compared to the existing literature, the proposed paper encompasses features of improving reliability, maintaining the same performance before fault, fault tolerance, and control. The converter differs from those shown by the survey [15], representing an improvement. Specifically, the proposed converter shows a better efficiency than that in [27] thanks to the current sharing and zero-current switching on power devices. In comparison with the fault-tolerant architecture described by [31,32], our device requires neither additional components nor redundant parts (meaning zero cost) to perform a phase shift adjustment to compensate for the fault. The fault is detected without using a dedicated observer as in [29,34] and without a current sensor as in [38]. Even though current sharing to minimize losses is also proposed in two-level interleaved converters [35,36,37], our TLIBC reduces the voltage and thermal stress on power devices; moreover, a novel open-circuit FDM is proposed. In contrast to traditional interleaved converters in which reconfiguration after fault modifies the amplitude and ripple frequency, the proposed TLIBC maintains the same current ripple before fault thanks to two complementary pairs of power devices, and using a phase shift technique as in [36]. The obtained reduced ripple is compliant with the requirements addressed by [13,17,18,19]. The adopted fault diagnosis is simpler than the one proposed in [41]. The TLIBC can be controlled like a dynamic load thanks to its control algorithm, as the traditional converters proposed by [23,24], ensuring the absence of overshoots on the electrolyzer with step current reference variation and including the fault-tolerance features that are not addressed by [23,24]. The proposed converter is not suitable for very high power levels, as those described by [8,9,12]; however, it can contribute to a distributed use of hydrogen even at the domestic level. In addition, it encompasses all the main features required for a converter devised for hydrogen production: high efficiency, fault tolerance, and low current ripple. Finally, design considerations address the correct choice of power components so that the converter does not require stopping operation after failure, postponing the replacement of the failed component.

This paper is composed of six sections. After providing a thorough discussion of the state-of-the-art focused on the reliability of power electronics and the motivations to carry out this work, the second section presents the investigated DC-DC converter for fault diagnosis purposes and some simulation results to bring out the impacts of open-circuit failures into the converter. Then, in section three, the proposed FDM and adopted fault-tolerant control strategies are described. Afterwards, in section four, simulation results are given to validate both the FDM and fault-tolerant control strategies. In section five, the designed experimental test bench is detailed, and experimental results are provided to support the performance of the proposed FDM in detecting and precisely identifying the failure of the converter. Finally, section six addresses converter design issues to achieve a fault-tolerant converter; the main advantages of the proposed approach are then summarized in the conclusion.

2. Investigated DC-DC Converter for Fault Diagnosis Purposes

As is well known, the conversion of electric energy to H₂ production by a PEM electrolyzer is based on the reaction in which the water molecule is split into protons and oxygen, giving electrons for the conduction according to:

$$H_{2}O\to 2H^{+}+\frac{1}{2}{O}_2+2e^{-}$$

(1)

The electrons go outside the anode and contribute to the current, whereas the protons go through the membrane. Once the protons reach the cathode, they combine with electrons coming from the terminal at a negative potential, producing hydrogen:

$$2H^{+}+2e^{-}\to H_2$$

(2)

The electrons’ flow corresponds to an electric current that must be supplied by a suitable generator. Ideally, a constant current generator should be employed; in practice, it is realized by a power electronic circuit that implements a voltage generator with a control algorithm able to assure the desired performance. The supply of a PEM requires some design constraints such as a high value of DC current with a negligible ripple, the possibility to regulate the DC current based either on the H₂ to be produced or on the available energy in case of exploitation of renewable sources, and finally, a high reliability or fault-tolerant features to assure the continuity of production. As explained in the introduction, the literature proposes many architectures for power converters; however, few studies address the issues related to the PEM. The knowledge of the PEM behavior (or of its dynamical equivalent model) is crucial since this kind of load can alter the performance of the converter compared to a traditional purely resistive load [27,45]. The converter proposed here shows a better fault-tolerant architecture and efficiency compared to those in [27] and [45] thanks to its topology, as described below.

2.1. Three-Level Interleaved Buck Converter

Over the last few years, a lot of efforts have aimed at proposing new DC-DC converter topologies to interface RES and electrolyzers for medium-power applications (around ten kilowatts) [22,27,44,46,47,48]. These converters can be connected directly to photovoltaic systems [22,46] or wind turbine conversion systems through the use of an additional AC-DC stage [15]. The good operation of the DC-DC converter is crucial for the conversion chain [27]. In this work, the investigation of open-circuit fault diagnosis is focused on a three-level interleaved buck converter (TLIBC) to address the main issues specified above. To the best of the authors’ knowledge, no related works have been reported in the literature.

The TLIBC scheme and its principle of operation are shown in Figure 1 and Figure 2, respectively. From its electrical architecture point of view, the TLIBC presents similarities with the four-phase floating interleaved boost converter presented in [41]. However, the converter shown in Figure 1 operates in buck mode (i.e., step-down operation since the electrolyzer requires a low voltage (about ten volt)). In the upper part of the TLIBC, two basic buck DC-DC converters are connected in parallel; as well as the reverse versions of the buck DC-DC converter in the lower part. Therefore, the current can be equally shared between the phases, and the current stress through the power electronics devices can be lowered. Furthermore, this solution reduces conduction losses since one half of the total current flowing through the same parasitic resistance (given by the sum of the on-state resistance of the power switch and the resistance of the inductor) will give one quarter of the total loss. As a consequence, the total conduction losses considering Q₁ and Q₂ are halved. This redundancy also not only allows the converter to be kept in operation even in case of failure (a result that could be achieved with only one complementary pair of devices), but also current with the same ripple reduction to be compensated for. The latter feature is crucial for powering the electrolyzers since the current ripple degrades its performance by decreasing reliability [18,19]. At the input of the TLIBC, two capacitors C₁, C₂ can be found; they reduce the voltage stress at the terminals of the power electronics devices. As a matter of fact, they are subjected to a blocking voltage of a single capacitance. Finally, at the output, two inductors L₀/2 are used to achieve zero-current switching. In summary, the proposed TLIBC features can be summarized as follows: it has a (a) low step-down voltage ratio, (b) low current ripple, and (c) high energy efficiency, and (d) it can continue to operate in case of power switch failures because of its interleaved architecture adopting two pairs of complementary switches.

Regarding the operation of the TLIBC shown in Figure 2, each PWM gate control signal driving the power switches is controlled with a shift angle of π/2 radian in this order: Q₁, Q₃, Q₂, Q₄. Each power switch with its free-wheel diode behaves like in a traditional buck converter; however, thanks to the phase displacement of the gate driving signals, each device is operated for half of the switching period, reducing the thermal stress. As a result, the current flowing through the load, given by the sum of I_L1 and I_L2, will exhibit a reduced peak-to-peak value. Hence, the output current ripple can be reduced and allows optimizing the performance of the electrolyzer, drawing from a recent investigation of current ripple effects on the degradation of electrolyzer performance that showed the performance worsening and reliability lessening increasing the current ripple [19]. Thanks to the adoption of two pairs of complementary switches, the ripple compensation is also achieved in case of fault.

2.2. Operation after Open-Circuit Failures without Suitable Control Strategy

To point out the effects of an OCF on the system, simulations have been performed using Matlab-Simulink Software (version R2022a). The simscape electrical library has been employed to implement both the TLIBC and also the electrolyzer model based on an equivalent electrical circuit considering static and dynamic operations [26]. The technical specifications of the TLIBC used for the simulations are given in

Table 1. Synthesis of the technical specifications and controller parameters of the studied TLIBC.

Component	Value	Unit
Inductor $L_1=L_2=L_3=L_4$	200	µH
Inductor $L_0/2$	800	µH
Input Capacitors $C_1=C_2$	4400	µF
Output Capacitor $C_0$	3300	µF
Sampling Frequency	10	kHz
$k_i={\lambda }_i$	1256	-
$k_V={\lambda }_V$	125	-

. The switching frequency of the converter has been set at 10 kHz. It should be noted that in this analysis, the output current is regulated by a modified sliding mode-based controller designed in [49]; this solution allows the fault effect to be minimized. Moreover, this control law is designed for two main objectives: first, to control the hydrogen flow rate, and second, to ensure the balance of both input capacitor voltages. The schematic diagram of the controller is depicted in Figure 3.

Based on Figure 3, the input current (i_in), output current (i_CH), and capacitor voltage of C₁ and C₂ (V_C1 and V_C2), have been measured so that the modified sliding mode control can calculate the duty cycle (d). Moreover, the duty cycle of Q₁ and Q₂ is assumed as $d_1=d_2$, whereas the duty cycle of Q₃ and Q₄ is $d_3=d_4$. In addition, the output current reference is filtered by a second-order filter to smooth the aggressive current of the output capacitor.

In order to verify the performance in case of fault, firstly, an OCF has been simulated in the lower part (i.e., power switch Q₃) and the obtained simulation results are shown in Figure 4a,b. From Figure 4a, on one hand, during the operation in healthy mode (i.e., without failure), the output current is equal to 10 A with a very reduced ripple (lower than 0.1 A, meaning about 1%), while the four inductor currents (i.e., i_L1, i_L2, i_L3, i_L4) are perfectly balanced (around 5 A). Even if the currents through L₁, L₂, L₃, and L₄ are subjected to ripple, the results are compensated on the load. On the other hand, as a result of an OCF in Q₃, Figure 4b shows the consequence of the TLIBC operation keeping the same control law as in the healthy case. After a slight transient of a few switching periods’ duration, the new steady operation shows that the TLIBC is still able to operate but shows reduced performance. Specifically, the output current is lowered by about 10% and the related ripple is almost doubled. In comparison, the power switch Q₄ compensates for the OCF in Q₃ since it is located in the faulty part. Indeed, both the upper and lower parts are independent of each other. Accordingly, the magnitude of the current i_L2 is twice the value in healthy mode (around 10 A) and the output current is kept near its reference value through the robustness of the controller. However, a slight increase in the current ripple can be perceived (0.16 A), which is emphasized in Figure 4b. This increase is due to an unfit shift angle of the PWM gate control signals driving the healthy power switches, which also causes a modified shape of the current, as highlighted in Figure 4b compared to a healthy mode with a fit shift angle. This operation in faulty mode can be compensated for by adopting the re-phase and compensating techniques proposed in this paper conceived to restore the original performance.

From this detailed analysis when an OCF occurs, a fault diagnosis and fault-tolerant control strategy are required, and are presented in the next section. Although the control strategy described in [49] is able to minimize the effect of an OCF, it requires the precise identification of the power switch with the fault. For this reason, one of the most important features required for the fault diagnosis that is proposed in this paper is to precisely identify the location of the failure. On this basis, by the suitable accommodation technique proposed here, the original performance is restored.

3. Proposed Fault Diagnosis Method and Fault-Tolerant Control Strategies

3.1. Description of the Fault Diagnosis

An FDM has been designed to precisely identify the OCF in the TLIBC. It relies on the comparison of the shape of the input current with the PWM gate signal of each power switch in the TLIBC. As mentioned in Section 2.1, the PWM gate signal control of each phase of the TLIBC is shifted π/2 (i.e., Q₁, Q₃, Q₂, Q₄.). Hence, the shape of the input current i_in of TLIBC is a pulse signal with 4-phase PWM waveforms. A schematic diagram of the proposed FDM of phase 3 is illustrated in Figure 5.

Based on Figure 5, the developed FDM is composed of 3 signals (i.e., input current (i_in), PWM signal, and Pulse Generator), 2 analog comparators (i.e., AND gate and XOR gate), Relay, SR Flip Flop, integral, and gain. The studied FDM starts with receiving the input current (i_in) of the TLIBC. The waveform of the input current is similar to the ON state of the 4-phase PWM signal. After that, the Relay converts the input current (i_in) from high amplitude into binary form to compare with the PWM signal.

After this, the output of the Relay and the PWM signal of phase 3 are compared via the use of an “AND gate” to capture the shape of the current of phase 3. As a result, the signal output of the AND gate shows only the current of phase 3 as compared with the output of Relay.

Subsequently, to detect the fault of phase 3, the XOR gate has been applied to compare the output of the AND gate and, once again, with the PWM signal of phase 3. On one hand, the output of the XOR gate is equal to 1 (ON state) when both inputs are ON at the same time. However, the output of the XOR gate is the ON state for a few seconds. For this reason, the integrator and gain have been applied to this signal to increase the ON period. Additionally, the value of gain is equal to the period of switching frequency (i.e., 10 ms). On the other hand, the output of the XOR gate is equal to 0 (OFF state) when both inputs are in different states.

Moreover, an SR Flip Flop has been employed in this FDM. The RESET terminal of the SR Flip Flop is commanded by the output of the XOR gate. Additionally, a pulse generator with the same phase shift and switching frequency of PWM phase 3 at duty cycle 50% has been utilized for the SET of SR Flip Flop and to reset the value of the integrator. Finally, the output of the SR Flip Flop at $\overline{Q}$ is equal to 1 or 0 when the TLIBC operates in healthy and degraded modes, respectively. The operation of the proposed FDM during healthy mode switch to degraded mode is sketched in Figure 6.

According to Figure 6, the waveforms show only two switching periods with seven signals: input current (i_in), the PWM signal of phase 3, the output of AND gate, the output of XOR gate, and the RESET, SET, and $\overline{Q}$ outputs of the SR Flip Flop.

The diagram starts with the TLIBC operating in healthy mode (first switching period). It can be highlighted that the input current signal (filtered by the Relay) is composed of the ON state of the 4-phase PWM gate control signals (Figure 6a). After this, the output of the AND gate presents only the current of phase 3 (Figure 6c). Hence, both inputs of the XOR gate are the same signals. As a result, the output of the XOR gate is the ON state for a short period (Figure 6d). Subsequently, this signal has been integrated and multiplied by a gain to increase the ON period (Figure 6e) and applied to the RESET terminal of the Flip Flop. Moreover, the pulse signal at duty cycle 50% with the same phase angle and frequency of PWM phase 3 has been generated to SET SR Flip Flop, and allows the resetting of the integrator (Figure 6f). Finally, the output of the SR Flip Flop at $\overline{Q}$ is equal to 1 because both inputs of the SR Flip Flop are in the same states. In this case, the TLIBC operates in healthy mode.

Afterwards, in the second switching period, the 3-LIBC starts operating in degraded mode. It can be observed that an OCF has occurred at phase 3. To create this failure, the PWM gate signal of Q1 has been forced to 0. Consequently, the current of phase 3 in the input current has disappeared. The input current displays only phase 1, 2, and 4 (Figure 6a). Hence, both inputs of the AND gate and XOR are equal to 0, resulting in both outputs being 0 (Figure 6c,d). Finally, both inputs of the SR Flip Flop are in different states. Therefore, the output of the SR Flip Flop at $\overline{Q}$ is equal to 0. This means that the proposed FDM has detected an OCF in phase 3.

The knowledge of the faulty power switch enables the application of a suitable fault-tolerant control strategy for the TLIBC, which is provided in the following section.

3.2. Fault-Tolerant Control Strategies Adopted

Referring to the obtained simulation results in Figure 4a,b, the occurrence of an OCF causes the increase in the output current ripple (i.e., i_CH) and the current flowing through the power switch located in the faulty part (i.e., the value of the current is twice higher than in a healthy operating mode without failure). Furthermore, the output current ripple is an unsymmetrical waveform because of an unsuitable phase shift angle of the remaining PWM gate control signals compared to a healthy mode. As recently pointed out in the literature [18,19], the current ripple alters the energy efficiency and the performance of the PEM electrolyzer, especially from DC-DC converters operating at high switching frequencies. Hence, in this subsection, fault-tolerant control strategies have been investigated to decrease the output current ripple and enhance electrolyzer performance over a long period of operation.

The proposed fault-tolerant control strategies of the TLIBC in degraded mode are developed depending on the remaining healthy power switches. Once the faulty power switch is identified by the fault diagnosis, the unfit PWM phase shift is adjusted consequently to the suitable phase angle of the remaining power switches. Indeed, the proposed fault-tolerant control strategies are re-phased to shift 2π/3 radian between each remaining power switch instead of π/2 in healthy mode. As a result, the studied fault-tolerant control strategies’ tracking phase failures are given in

Table 2. Fault-tolerant control strategies of PWM tracking phase failure showing the phase correction added to the value corresponding to the healthy mode.

Phase Failure	New Phase Shift Angle to Decrease Current Ripple [Rad]
	Q1	Q2	Q3	Q4
Phase 1	-	π + π/6	$\pi /2$	$3\pi /2$ + π/3
Phase 2	0	-	$\pi /2$ + π/6	$3\pi /2$ − π/6
Phase 3	0	π − π/3	-	$3\pi /2$ − π/6
Phase 4	0	π + π/3	$\pi /2$ + π/6	-

.

The values indicated in Table 2 show the phase that has to be added to the original value before the fault to achieve the phase shift allowing compensation after the fault. As an example, the new phase value of Q₂ will be modified from π to (π + π/6) in case of failure detected in Q₁, from π to (π − π/3) in case of failure detected in Q₃, and from π to (π + π/3) in case of failure detected in Q_4.

Relying on Table 2, it can be observed that the new phase shift angles (indicated as re-phase in the following) of the remaining power switches are modified to achieve a suitable angle based on the initial phase angle. Moreover, one of the phase angles of the healthy power switch is not changed (still in the initial phase angle) to make the reference of the remaining two power switches. On one hand, with the fault occurring in phase 1, the phase angle of Q₃ is chosen as a reference. On the other hand, with the fault occurring in phases 2, 3, and 4, the phase angle of Q₁ does not need to be shifted because the initial angle is 0 radian. Thus, the phase angle of TLIBC during degraded mode is adjusted to 2π/3 radian.

In the last sections, simulations and experiments are performed to prove the performance of the proposed fault diagnosis and fault-tolerant control strategies in identifying the faulty power switch and enhancing the system operation. Furthermore, a comparison between the performance of the proposed fault diagnosis and those reported in the literature is provided to conclude this work.

4. Simulation Results

Starting from the healthy operation shown in Figure 4a, this section shows the benefits of re-phase and compensation on the output current. For the sake of clarity, the effects of the re-phase and compensation methods are firstly shown separately. Then, a simulation by adopting both techniques is shown to demonstrate the complementarity of both solutions.

The currents flowing through the four inductors and the output currents, adopting the re-phase technique only, are given in Figure 7. Compared to the results of Figure 4b (fault mode with no control corrections), the output current ripple minimization can be appreciated.

By adopting the compensation technique only, as shown in Figure 8, it can be noticed that the compensation technique is able to restore the original value of the output current, meaning that the produced hydrogen is unchanged; however, an increased ripple can be noticed. As explained above, the ripple has to be minimized.

Finally, both the effects of re-phase and compensation are shown in Figure 9, where both the current and its ripple have resumed, as in the healthy mode.

Concerning the transient between the healthy and fault mode, as shown in Figure 10, it can be noticed that after 6 ms, the converter can operate as before the fault. The time constant is due mainly to the output capacitance. It is a very reduced time interval, in which the electrolyzed does not experience any overshoot.

5. Experimental Validation

5.1. Experimental Test Bench

To assess the performance of the fault diagnosis method in identifying the OCF and fault-tolerant control strategies, an experimental platform has been built at the Renewable Energy Research Centre (RERC), King Mongkut’s University of Technology North Bangkok; a picture of the test rig is given in Figure 11. The platform encompasses the designed TLIBC (1) with the technical specifications provided in Section 2, a DC power supply (2), a dSPACE Microlabbox (3), a computer with the dSPACE Control Desk Software (4), a C2000 Microcontroller (5), a PEM electrolyzer (6), and an 8-channel oscilloscope (7). For the load of the system, a PEM electrolyzer emulator described and designed in [50] has been employed in this work. This emulator enables the recreation of the static and dynamic behavior of a real PEM electrolyzer through the use of an equivalent electrical circuit as shown in Figure 12. Furthermore, it is low-cost and allows avoiding the use of a real PEM electrolyzer whose performance could be degraded during experiments as pointed out in [19,51]. The operation of the PEM emulator is based on its dynamic model as explained in the following.

The voltage V_EL of the electrolyzer emulator is given by the following equation:

$$V_{EL}=E_{rev}+V_{ACT,A}+V_{ACT,C}+V_M$$

(3)

where $E_{rev}$ is the reversible voltage, $V_{ACT,A}$ and $V_{ACT,C}$ are the activation overpotentials at the anode and cathode, respectively, and $V_M$ is the ohmic overvoltage. Both RC branches at the anode and cathode allow the consideration of the chemical kinetics that influence the speed of the chemical reaction when modifying the operating conditions (in our case, a change in the supply current). The equations that govern these chemical kinetics are summarized below:

$$\frac{d{V}_{ACT,A}}{dt}=\frac{1}{R_A}{i}_{EL}-\frac{1}{R_A{C}_A}{V}_{ACT,A}$$

(4)

$$\frac{d{V}_{ACT,C}}{dt}=\frac{1}{R_C}{i}_{EL}-\frac{1}{R_C{C}_C}{V}_{ACT,C}$$

(5)

The time constants at the anode and cathode, respectively, are expressed as follows:

$${\tau }_A=R_A{C}_A$$

(6)

$${\tau }_C=R_C{C}_C$$

(7)

In summary, the “essence of electrolysis” in our case is fully represented by our emulator since we demonstrated that it behaves like a real electrolyzer; as a consequence, we can adopt this circuit to test the dynamic performance of our converter. It is different from a simple electrolyzer model considering only the static behavior of the electrolyzer using a simple resistance [27]. A detailed description of the emulator can be found in [50].

The modified sliding mode-based controller (shown in Figure 3) designed in [49] to control the output current and balance the two input capacitors (C₁, C₂) of the TLIBC, has been implemented in the dSPACE Microlabbox (dSPACE, Paderborn, Germany) (through the use of Matlab/Simulink software (version 2019b). The proposed fault diagnosis (as presented in Figure 5) has been realized via an analog circuit including operational amplifiers. In comparison, fault-tolerant control strategies have been embedded in the C2000 Microcontroller. The dSPACE Control Desk Software (version 7.0) allows for the monitoring, supervising, and recording of the conducted experiments. The required current and voltage sensors for control and fault diagnosis purposes are inserted into the designed TLIBC. The acquired current and voltage signals are sent to the inputs of the dSPACE Microlabbox.

5.2. Obtained Experimental Results

After performing simulations through Matlab/Simulink, experimental tests have been carried out to corroborate the obtained simulation results. Moreover, the experimental results enable conclusions on the performance of the fault diagnosis coupled with fault-tolerant control strategies. Like in the simulations, an OCF in the power switch Q₃ has been generated at 4 ms and the output current of the TLIBC is regulated at 5 A. The obtained experimental results are given in Figure 13, Figure 14 and Figure 15. In Figure 13 (relying on the fault diagnosis scheme given in Figure 5), the output “relay”, the output “AND GATE”, the output “XOR GATE”, and the $\overline{Q}$ output of the SR Flip Flop are depicted. Before the occurrence of the failure, the outputs “AND GATE” and “XOR GATE” indicate that the TLIBC operates in healthy mode as highlighted in Figure 5. Then, after fault occurrence at 400 µs, the absence of the outputs “AND GATE” and “XOR GATE” emphasizes that the TLIBC operates in degraded mode. The OCF in Q₃ can be detected in one switching period, namely 100 µs, as shown in the $\overline{Q}$ output of the SR Flip Flop. Furthermore, it can be noticed that the reconfiguration of the phase shift between the remaining healthy switches (Q₁, Q₂, and Q₄) occurs at 200 µs after fault occurrence.

In Figure 14 and Figure 15, the same experimental results of the TLIBC are shown with different time scales to point out both the transient and steady-state operations after the fault occurrence. Regarding both figures, it can be noted that after fault occurrence and identification of the OCF by the fault diagnosis, the TLIBC keeps operating normally and the output current is still regulated at 5 A. The transient state of the output current lasts 3 ms before reaching its reference value. The failure in Q₃ is entirely compensated for by the power switch Q₄ located in the faulty part (i.e., lower part of the TLIBC), whereas the power switches Q₁ and Q₂ are not affected by the failure in Q₃ as observed in Figure 14. It can also be seen that the output current ripple in degraded operating mode is lower than in healthy operating mode due to the reconfiguration of the phase shift between the remaining power switches. Thus, the TLIBC continues to supply the electrolyzer with a very low current ripple at high switching frequency, contributing to its reliability in maintaining optimal performance [19].

6. Fault-Tolerant Architecture Design Considerations

It has been shown that by the re-phase and compensation method, it is possible to maintain the original operating conditions of the converter even if a fault on a power switch occurs. However, to ensure the converter’s reliability, some considerations of its design are necessary.

6.1. Power Switches Design

Figure 16 and Figure 17 show the currents flowing through the power switches and the related free-wheel diodes, respectively. The symmetry between complementary pairs (Q₁-Q₂ and Q₃-Q₄) can be noted. The currents correspond to the operation of a buck converter showing a peak of about 4.5 A for the power switches and 5 A for the free-wheel diodes. Clearly, after fault compensation and the related re-phase, the currents will show different values; this aspect must be taken into account for designing a fault-tolerant topology. While the hydrogen production is related to the mean current that is maintained by the fault-tolerant algorithm, the power devices are forced to support higher current peaks, as shown in Figure 18 and Figure 19. The maximum current peak represents a constraint for a correct choice of the devices; it can be noted that, as expected, the device belonging to the complementary pair in which a power switch experiences the fault (Q₃ in our case) has to support higher current. Remarkably, both the power switch Q₄ and the related free-wheel diode exhibit a peak of about 7.8 A. Concerning the design constraint, the rated current of the power switches in normal operation requires a safety factor equal to two.

Regarding efficiency, it can be noted that the conduction time of Q₄ is slightly increased after the fault and the current is almost doubled. In the case of MOSFET devices, losses will be increased four times since they depend on the square of the current multiplied by the device conduction resistance R_ON; in contrast, for bipolar devices, such as IGBT, the conduction losses are doubled as well as losses on the free-wheel diode. The switching losses are doubled in Q₄ since the final value of the current is doubled.

Considering that, as an example, for an IGBT-based converter, the power due to the loss before fault can be calculated as four times the sum of switching and conduction losses on power switches and free-wheel diodes, (indicated as P_{sw_Q}, P_{cond_Q}, P_{sw_D}, P_{cpnd_D}, respectively), and after fault, it results from the operation of the three remaining devices, it follows that the total power dissipated before fault P_{T_before_fault} and after fault P_{T_after_fault} can be calculated as:

$${\mathrm{P}}_{\mathrm{T}\_\mathrm{before}\_\mathrm{fault}}=4{\left({\mathrm{P}}_{\mathrm{sw}\_\mathrm{Q}}+{\mathrm{P}}_{{\mathrm{sw}}_{\mathrm{D}}}+{\mathrm{P}}_{\mathrm{cond}\_\mathrm{Q}}+{\mathrm{P}}_{\mathrm{cond}\_\mathrm{D}}\right)}_{1,2,3,4}$$

(8)

$$\begin{array}{ll}{\mathrm{P}}_{\mathrm{T}\_\mathrm{after}\_\mathrm{fault}}=& 2{\left({\mathrm{P}}_{\mathrm{sw}\_\mathrm{Q}}+{\mathrm{P}}_{{\mathrm{sw}}_{\mathrm{D}}}+{\mathrm{P}}_{\mathrm{cond}\_\mathrm{Q}}+{\mathrm{P}}_{\mathrm{cond}\_\mathrm{D}}\right)}_{1,2}\\ & +{\left(2{\mathrm{P}}_{\mathrm{sw}\_\mathrm{Q}}+2{\mathrm{P}}_{{\mathrm{sw}}_{\mathrm{D}}}+2{\mathrm{P}}_{\mathrm{cond}\_\mathrm{Q}}+2{\mathrm{P}}_{\mathrm{cond}\_\mathrm{D}}\right)}_4\end{array}$$

(9)

where the subscript n indicates the devices. After the fault on device 3, devices 1 and 2 continue with the same operation as before the fault, whereas device 4 has to support the total current. Since conduction losses in an IGBT linearly depend on the current as well as the switching losses, device 4 (Q₄ and its free-wheel diode) is solicited with a power double compared to the condition before the fault. Obviously, this requires a proper choice of devices, as is discussed in more detail below.

For MOSFET-based converters, similar considerations can be made considering that the conduction losses depend on the square of the current; if the current in a device doubles, the power will be four times greater. As a consequence, only the conduction losses are increased.

$$\begin{array}{ll}{\mathrm{P}}_{\mathrm{T}\_\mathrm{after}\_\mathrm{fault}}=& 2{\left({\mathrm{P}}_{\mathrm{sw}\_\mathrm{Q}}+{\mathrm{P}}_{{\mathrm{sw}}_{\mathrm{D}}}+{\mathrm{P}}_{\mathrm{cond}\_\mathrm{Q}}+{\mathrm{P}}_{\mathrm{cond}\_\mathrm{D}}\right)}_{1,2}\\ & +{\left(2{\mathrm{P}}_{\mathrm{sw}\_\mathrm{Q}}+2{\mathrm{P}}_{{\mathrm{sw}}_{\mathrm{D}}}+4{\mathrm{P}}_{\mathrm{cond}\_\mathrm{Q}}+2{\mathrm{P}}_{\mathrm{cond}\_\mathrm{D}}\right)}_4\end{array}$$

(10)

In this case, the total losses after failure will be higher than before failure. In particular, the conduction losses on Q₄ are increased.

These considerations can guide the designer to the correct sizing of the rated power of power devices and of the heatsink. In any case, taking into account the increased losses for MOSFET-based converters is feasible and does not jeopardize the design.

6.2. Power Inductor Design

To ensure the operation fault mode, the rated current of inductor currents L₁, L₂, L₃, and L₄ must correspond to the load-rated current. Even though in healthy mode, this current is halved compared to the load current, in fault mode, the inductor belonging to the complementary couple in which one device is in OCF has to support the total load current. On the other hand, their value depends on the imposed current variation, which does not need to be minimized since it is compensated by interleaved topology through L₀/2 . As a consequence, even if 200 µH inductors are adopted in our prototype, a lower value could be employed, assuring the continuous conduction mode (CCM) operation.

6.3. Capacitor Design

The capacitive divider has the task of maintaining a reduced voltage compared to the input one. The optimal sizing can be achieved by assuring a low variation in the middle point after fault and, at the same time, a negligible voltage ripple. The experimental verification has been performed by using two capacitors of 4400 µF, available in the laboratory; however, by simulation, lower values have been tested as well. Figure 20 shows the voltage at the C1 terminals before fault considering a value of 4400 µF and the voltage after fault calculated with 4400 µF, 2200 µF, and 1000 µF, respectively. As expected, only a slight voltage increase is appreciated, decreasing the capacitance values; the voltage ripple remains negligible. As a consequence, the capacitive divider can be designed with lower capacitance values.

7. Conclusions

The design of the power converter devised for supplying electrolyzers must encompass, as a constraint, the feature of accommodating performance after fault to maintain the hydrogen production. The proposed converter topology fulfills this requirement. It is based on a three-level interleaved buck converter (TLIBC) and on a suitable architecture, which is able to detect a fault on a power device and to accommodate it assuring the same load current and ripple as before the fault.

The performance of the proposed TLIBC architecture has been verified by simulation and experimentally on a practical case of a converter loaded by a suitable electrolyzer emulator set-up on purpose by the authors. A fault on a power device is detected by a suitable diagnostic system in a very short time interval, then the control system provides accommodation by varying the phase displacement and the duty cycle so that the original operation is restored both in terms of DC load current and ripple. The DC component of the current delivered by the converter does not show significant variation after the fault accommodation, remaining equal to 8A in our case study, and its superimposed ripple goes from 0.1021 A to 0.1123 A peak-to-peak. The electrolyzer is always protected against fault consequences and no overshoots occur.