Renewable Modelling · Protection System

Protection in Renewable EMT Models in EMTP®

Voltage relays, deep-sag blocking, dc chopper and device protection

A renewable converter controller tries to keep the plant operating, but the protection layer decides when operation is no longer safe. Under severe voltage, current, dc-link or islanding conditions, the model must limit, block, dissipate energy or trip. This protection layer is layered — plant and system protection, converter protection, dc-link protection, and semiconductor device protection — and it overrides the controller when equipment safety or protection coordination require it. The functions in the generic model are the over/under-voltage relay, deep-voltage-sag blocking, the dc-bus chopper, converter overcurrent protection, islanding detection and fast IGBT protection.

Reading time ≈ 17 min · relays, blocking, chopper & device protection

A real wind or PV model is not only control. Around the plant controller, the converter control, the current loops, the PLL and the fault-ride-through logic sits a protection layer, because when abnormal conditions become severe enough the controller alone cannot cope. Control regulates normal and ride-through behaviour; protection overrides control when equipment safety, semiconductor limits or protection coordination require it — limiting, blocking, dissipating energy or tripping when the operating point is no longer safe.

Abbreviations used on this page

GSCGrid-side converter

MSCMachine-side converter

FRTFault ride-through

OV / UVOver-voltage / under-voltage

V–tVoltage–time (trip characteristic)

\(V_{dc}\)dc-bus (dc-link) voltage

Chopperdc resistive braking branch

IGBTInsulated-gate bipolar transistor

PCCPoint of common coupling

WTWind turbine

OEMOriginal equipment manufacturer

EMTP®Electromagnetic Transients Program

Key idea

Control keeps the converter operating; protection decides when it is no longer safe to operate normally and then limits, blocks, chops or trips. A converter model without protection is incomplete for serious EMT fault work.
The generic model carries the main protections: an over/under-voltage relay on a voltage–time curve, deep-voltage-sag blocking that restricts FRT to faults outside the park, a dc-bus chopper, converter overcurrent blocking, islanding detection and fast IGBT protection.
They form a hierarchy from system and plant level down to the semiconductor device. The dc chopper and the overcurrent block are protective interventions, distinct from the control’s ordinary current limiter — a harder boundary beyond it.
Protection overrides control when they conflict, so the model’s fault behaviour depends on both designs. The generic model includes the most important protections but stays customisable rather than reproducing every OEM detail.

Key terms used on this page

01Protection system

The logic that limits, blocks, chops or trips when conditions become unsafe for the converter or plant.

02Voltage–time curve

The envelope of voltage deviation versus duration the turbine may tolerate before tripping.

03Deep voltage sag

A very severe or close voltage collapse that triggers temporary converter blocking.

04Blocking

Temporarily inhibiting converter switching to prevent overcurrent during a severe disturbance.

05dc chopper

A resistive branch switched across the dc link to dissipate surplus energy and clamp the dc voltage.

06Overcurrent protection

A hard threshold that blocks the converter if the actual current passes a dangerous level.

07Current limiter

The control function that caps the commanded current — softer than overcurrent protection.

08Islanding

The plant energising a section separated from the main grid; detection acts to stop or disconnect.

09IGBT fast protection

Device-level protection that switches off in milliseconds to save the semiconductor.

10Collector grid

The internal park network whose protection must coordinate with the plant’s fault response.

11Protection hierarchy

The ordering of functions from system and plant level down to the semiconductor device.

12Generic model

An open baseline model carrying the most important protections, customisable for project specifics.

Section 1

Why control alone is not enough

A controller works hard to keep the converter operating correctly, but there are conditions in which the normal control loops simply cannot cope: the voltage is too low or too high, the current is too high, the dc-link energy becomes excessive, the grid is gone, or the semiconductor stress becomes dangerous. In those situations the protection system keeps the converter within its thermal, current, voltage and semiconductor operating limits, and protects the plant, the collector system and the realism of the model itself. It is layered, acting at four levels — plant and system protection, converter protection, dc-link protection, and semiconductor device protection — the hard boundary that sits around the controller and intervenes, level by level, when normal operation is no longer safe.

Control versus protection

Control tries to keep the converter operating; protection decides when it is no longer safe to keep operating normally. Both shape the model’s fault behaviour, which is why a converter model without protection is incomplete for serious EMT work.

Section 2

The protection functions at a glance

The generic model carries a compact but well-chosen set of protective functions. Each watches a different quantity and takes a different action, and together they cover everything from a slow voltage excursion to a microsecond-scale device fault:

Table 1 — The protection functions of the generic renewable model.
Function	Trigger	Action	Protects
Over/under-voltage relay	Voltage outside the voltage–time envelope	Trip the turbine	Plant; grid coordination
Deep voltage sag protection	Very deep / close voltage collapse	Temporarily block GSC & MSC; restrict FRT to external faults	Converter from overcurrent; collector coordination
DC-bus overvoltage	dc voltage above threshold	Fire the dc resistive chopper	dc link / capacitor
Converter overcurrent	Current above a hard threshold	Temporarily block the converter	Converter hardware
Islanding detection	Loss of proper grid connection	Stop energising / disconnect	Safety; coordination
IGBT fast protection	Device-level overcurrent / stress	Very fast switch-off	The semiconductor devices

Section 3

Over/under-voltage relay

The over/under-voltage relay produces a wind-turbine trip signal when the over- or under-voltage falls outside a pre-specified voltage–time characteristic. The key word is “characteristic”: it is not a single instantaneous threshold but a curve. A mild under-voltage may be tolerated for a relatively long time; a severe under-voltage only very briefly; an over-voltage likewise only for a limited duration. If the measured voltage stays outside the allowed envelope long enough, the model issues a trip. In effect the relay answers the question “should the turbine remain connected, or must it disconnect?” — which matters in EMT because some faults are ride-through events while others lie beyond the ride-through range. In the generic model the relay operates on rms voltage and its envelope follows a published ride-through profile, for example a Hydro-Quebec LVRT/HVRT characteristic, so the trip decision reflects a recognised grid-code shape rather than an arbitrary one.

A second, cumulative over-voltage relay

Alongside the voltage–time relay the model carries a separate cumulative-instantaneous-overvoltage relay based on IEEE Std 1547-2018. Instead of testing a single duration, it adds up all the time for which the instantaneous voltage sits above a set threshold within a rolling one-minute window; if that accumulated time becomes too large the relay trips. This catches repeated or intermittent over-voltage bursts — harmless one at a time, but damaging in aggregate — that a single voltage–time curve on rms voltage would let through.

Section 4

Deep voltage sag protection

Deep-voltage-sag protection is more specific than the ordinary under-voltage relay. It temporarily blocks the grid-side and machine-side converters to prevent potential overcurrent, and it restricts FRT action to faults that occur outside the wind park. The reasoning is that not every fault should be ridden through the same way: if the voltage collapse is extremely deep or very close — especially inside the plant or the collector system — then letting the converters keep pushing hard can be harmful. So the protection blocks the converter action, prevents excessive current, and avoids forcing the plant to behave as though a severe internal fault were just a normal external grid event.

Section 5

Why “faults outside the wind park” matters

This is one of the most practical points in the whole protection layer. Fault ride-through is mainly intended for external grid faults. But if the fault is inside the wind park — in the collector system, an internal feeder, or nearby plant-side equipment — then blindly forcing FRT behaviour can interfere with the internal protection coordination. So this function helps the model distinguish the two cases: for an external system fault, ride-through behaviour may be appropriate; for an internal plant fault, blocking and letting the internal protection act is more appropriate. That distinction is exactly what makes deep-sag protection important for correct collector-grid protection operation.

External vs internal

External grid fault → ride through. Internal park fault → block, and let the collector-system protection clear it. Forcing FRT on an internal fault fights the very protection that should be operating.

Section 6

DC-bus overvoltage protection and the chopper

The dc link is an energy buffer, and during a fault it is easily over-filled: the grid-side power transfer is limited by the depressed voltage, while source-side energy keeps arriving, so the capacitor charges and the dc voltage rises. Left unchecked it can reach dangerous levels. The protection is a dc resistive chopper: a resistor is switched temporarily across the dc bus to dissipate the excess energy and stop the voltage rising too far. Writing the dc-link energy balance makes the chopper’s role explicit:

\[ C\,V_{dc}\frac{dV_{dc}}{dt} = P_{in} - P_{out} - P_{ch}, \qquad P_{ch} = \begin{cases} V_{dc}^{2}/R_{ch}, & V_{dc} > V_{th} \\ 0, & V_{dc} \le V_{th} \end{cases} \]

\(C\): dc-link capacitance
\(V_{dc}\): dc-bus voltage
\(P_{in},P_{out}\): source-side power in, grid-side power out
\(P_{ch}\): chopper dissipation (resistance \(R_{ch}\), threshold \(V_{th}\))

During a fault \(P_{out}\) falls while \(P_{in}\) keeps arriving, so \(V_{dc}\) climbs; once it passes \(V_{th}\) the chopper switches in \(R_{ch}\) and burns off the surplus, clamping the dc bus. The chopper is a protection device, not a normal control device — its job is to let the dc link survive the disturbance. It is not a limitless sink, though: the chopper resistor has a thermal and energy rating and cannot absorb unlimited fault energy, so if the fault lasts too long or the surplus energy is too high, the chopper alone is not enough and further protection — converter blocking or a turbine trip — must still act.

Section 7

Converter overcurrent protection

Converter overcurrent protection blocks the converter temporarily when its current exceeds a pre-specified limit. This is distinct from the current limiter already present in the control loops. Even with a limiter on the commanded current, the actual converter current can still exceed safe values during severe faults, through control delay, abnormal conditions, limiter interaction or the network forcing current into the converter. A harder, protective intervention is then needed — a threshold that sits above the limiter and below the device rating:

\[ |i_{conv}| > I_{pr} \ \Rightarrow\ \text{block}, \qquad I_{lim} < I_{pr} \le I_{dev} \]

\(i_{conv}\): actual converter current
\(I_{pr}\): overcurrent-protection threshold (a hard limit)
\(I_{lim}\): control current-limiter cap on the commanded current
\(I_{dev}\): device (semiconductor) current rating

The current limiter tries to keep the commanded current within \(I_{lim}\); the overcurrent protection acts if the actual hardware current still climbs past \(I_{pr}\). One is a control function, the other a protective one — an important distinction.

Section 8

Islanding detection

Islanding detection identifies the situation where the plant has been electrically separated from the main grid but may still be energising a local island. That is hazardous: the voltage and frequency can drift, protection coordination changes, unintended energisation can occur, and safety problems arise. So islanding detection decides whether the plant should stop energising the isolated section or disconnect altogether. The function is especially important for distributed resources and renewable plants connected to weaker sub-networks; the generic model does not need the full detail of every islanding method, but it represents the essential concept — detect loss of proper grid connection, and act accordingly.

Section 9

IGBT fast protection

IGBT fast protection is the fastest and most device-level protection of all. It is not about plant-level voltage or system-level ride-through logic; it is about protecting the semiconductor switches themselves. If an IGBT sees a dangerous condition — a very high or fast-rising current, abnormal switching stress, or a device-level fault — a very fast response is essential, because semiconductors can be damaged in milliseconds or less. Where the other functions protect the system and the plant, IGBT fast protection protects the device directly. It is the last line of defence for the converter hardware. In the generic model this is represented by its effect — a fast device-level switch-off once the semiconductor limit is reached — while the exact gate-drive protection implementation remains OEM-specific.

Section 10

The protection hierarchy

The cleanest way to hold all of this together is to order the functions by the level they act at — from the whole system down to a single semiconductor:

Table 2 — The protection hierarchy, from system level to device level.
Level	Function(s)	Role
System / grid	Over/under-voltage relay; islanding detection	Decide whether to stay connected or trip
Severe-disturbance mode	Deep voltage sag protection	Switch operating mode under a deep or internal fault
Converter energy	DC-bus overvoltage (chopper)	Bleed off the dc-link energy surplus
Converter current	Converter overcurrent protection	Block on a dangerous actual current
Device	IGBT fast protection	Protect the semiconductor in milliseconds

Section 11

Protection must be coordinated with control — and overrides it

This is the most important lesson behind the whole layer. The controller may want to inject reactive current, hold the dc voltage steady, continue riding through and keep operating. The protection may decide to block the converter, fire the chopper, or trip the turbine. When the two conflict, protection wins — it overrides control. The practical consequence is that the model’s real behaviour under a fault depends on both the control design and the protection design, and the two have to be coordinated. A study that looks only at the control loops, ignoring when protection blocks or trips, can give the wrong fault response entirely.

Who wins

Control proposes; protection disposes. When a protective threshold is crossed, the block, chop or trip takes precedence over whatever the controller was trying to do — so fault behaviour is the product of both designs, not the controller alone.

Section 12

What the generic model includes — and what it leaves out

A model can always be made more detailed: more relays, more protective timers, more interlocks, more internal flags and logic branches, more hardware detail. But adding everything has a cost, and beyond a certain point the model stops being useful:

Why not model every protection

The model becomes slow to simulate, especially across many turbines and long fault studies.
It becomes hard to initialise and hard to reach a clean operating point.
It becomes hard for users to understand and reason about under faults.
It becomes impractical for the system-level studies the model is actually meant for.

So a generic model deliberately captures the dominant protection actions needed for EMT studies, with enough realism, but not every OEM-specific detail. It is, intentionally, a compromise between realism and usability — the same philosophy that governs the choice between detailed and average-value converter models. For final project studies, the generic protections should be set from OEM-confirmed settings wherever those are available.

Section 13

Customising the protection block

The compromise is not a cage. In an open, white-box model you can go inside the protection block and add functions or modify the existing ones — a specific under-voltage relay curve, extra blocking logic, special dc-chopper behaviour, or project-specific collector-protection interaction. The generic model gives a solid baseline protection structure without trapping you there, which is one of the real strengths of an open architecture: it ships with the essentials and lets the study extend them when a project needs more. For the DFIG-specific protective devices that sit alongside these functions — the crowbar, the dc chopper and converter blocking — see the DFIG wind-park modelling guide.

Section 14

Key points

Control keeps it running; protection decides when to stop

Control is not protection. Control regulates normal and ride-through behaviour; protection overrides it — limiting, blocking, chopping or tripping — when equipment or coordination limits are reached.
Voltage relays depend on magnitude and duration. The over/under-voltage relay trips on a voltage–time characteristic, not a single instantaneous threshold.
Deep-sag blocking separates external FRT from internal faults. Ride through an external grid fault; for an internal park fault, block and let the collector-system protection clear it.
The dc chopper limits dc-link overvoltage during a fault — but it has a finite energy rating, so a long or severe fault may still need converter blocking or a trip.
Device protection is the final safeguard when converter limits are exceeded; the functions form a hierarchy from system to semiconductor, and a generic model captures the dominant actions while final studies use OEM-confirmed settings.

The model stays customisable; for the converter control these protections wrap, see the DFIG converter control guide.

References

EMTP® Documentation and Application Notes. Powersys / EMTP®.

Built on EMTP® · Expert spotlight

Henry Gras

Chief Operating Officer, PGSTech · Montréal, Canada

Henry Gras delivers the EMTP® University course “EMT Simulation and Analysis of Large-Scale Power Systems with Renewables” and works daily with the tool this article is written around.

Henry is based in Montréal, where he is Chief Operating Officer of PGSTech, the company responsible for EMTP® engineering services, commercialisation and continuing software development. He holds a master’s degree from Polytechnique Montréal, where he worked on electrical-machine research, and previously completed an engineering degree at École Centrale de Lyon in France.

Readers who want a structured programme on EMT simulation of large-scale power systems with renewables will find his EMTP® University course an excellent next step.

Henry’s technical expertise covers electromagnetic transient simulation, renewable-energy integration, power-system modelling, electrical machines, protection and specialist transient studies including TRV, transformer energisation, ferroresonance, insulation coordination and power quality.

Part 20 Reading now

Protection in Renewable EMT Models

Voltage relays, deep-sag blocking, the dc chopper and device protection in renewable EMT models.

Series progress 20 of 30

Part 21

TOV Analysis for a Collector-Feeder Fault

Healthy-phase overvoltage from a collector-feeder fault, earthing, and arrester energy survival.