energies

Review
Overview of Control Algorithm Verification Methods in Power
Electronics Systems
Paweł Szcześniak 1, * , Iwona Grobelna 1 , Mateja Novak 2 and Ulrik Nyman 3

1 Institute of Automatic Control, Electronics and Electrical Engineering, University of Zielona Góra,
65-516 Zielona Góra, Poland; [email protected]
2 AAU Energy, Faculty of Engineering and Science, Aalborg University, 9220 Aalborg, Denmark;
[email protected]
3 Department of Computer Science, Technical Faculty of IT and Design (TECH), Aalborg University,
9220 Aalborg, Denmark; [email protected]
* Correspondence: [email protected]

Abstract: The paper presents the existing verification methods for control algorithms in power
electronics systems, including the application of model checking techniques. In the industry, the
most frequently used verification methods are simulations and experiments; however, they have to
be performed manually and do not give a 100% confidence that the system will operate correctly in
all situations. Here we show the recent advancements in verification and performance assessment of
power electronics systems with the usage of formal methods. Symbolic model checking can be used
to achieve a guarantee that the system satisfies user-defined requirements, while statistical model
checking combines simulation and statistical methods to gain statistically valid results that predict
the behavior with high confidence. Both methods can be applied automatically before physical
realization of the power electronics systems, so that any errors, incorrect assumptions or unforeseen





 situations are detected as early as possible. An additional functionality of verification with the use of
Citation: Szcześniak, P.; Grobelna, I.;
formal methods is to check the converter operation in terms of reliability in various system operating
Novak, M.; Nyman, U. Overview of conditions. It is possible to verify the distribution and uniformity of occurrence in time of the number
Control Algorithm Verification of transistor switching, transistor conduction times for various current levels, etc. The information
Methods in Power Electronics obtained in this way can be used to optimize control algorithms in terms of reliability in power
Systems. Energies 2021, 14, 4360. electronics. The article provides an overview of various verification methods with an emphasis on
https://doi.org/10.3390/en14144360 statistical model checking. The basic functionalities of the methods, their construction, and their
properties are indicated.
Academic Editor: Ui-Min Choi

Keywords: power electronics; reliability validation testing; verification; performance assessment;

Received: 28 May 2021
model checking
Accepted: 16 July 2021
Published: 19 July 2021

Publisher’s Note: MDPI stays neutral

1. Introduction
with regard to jurisdictional claims in
published maps and institutional affil- Power electronics is an interdisciplinary field related to three basic technical areas:
iations. (1) electrical engineering, (2) computer engineering, and (3) control engineering. The
importance of power electronics has grown over the years, and now it can be found in
every area of life [1]: household appliances, a wide variety of industries, power engineering,
energy, telecommunications, medicine, transport, etc. The large number of various types
Copyright: © 2021 by the authors.
of converters (DC/DC, AC/DC, DC/AC, AC/AC), their various complexity levels and
Licensee MDPI, Basel, Switzerland.
the possibility of their potential applications, constitute a great challenge for engineers
This article is an open access article
at the design and construction stage. Each of the stages of product implementation will
distributed under the terms and be characterized by distinct necessary analyses. In the initial design stage, the concept of
conditions of the Creative Commons the system operation and the control strategy should be checked, taking into account the
Attribution (CC BY) license (https:// parameters of the components used, as well as the parameters related to power supply,
creativecommons.org/licenses/by/ load and disturbances. However, in the last phase of design and construction, one should
4.0/). take into account the mutual physical interactions of individual elements and interactions

Energies 2021, 14, 4360. https://doi.org/10.3390/en14144360 https://www.mdpi.com/journal/energies

Energies 2021, 14, 4360 2 of 20

with the environment, as well as changes in the parameters of the system during its
operation, e.g., element heating, aging of elements, etc. The stage of launching and testing
the operation of prototypes should include analyses related to the observance of safety
procedures, the correctness of switching on/off of individual system components and the
analysis of the occurrence of unwanted states of the system operation.
Among the methods of testing the operation of power electronic systems, the most
popular methods are computer simulation and experimental verification of low-power
prototypes. Each of these methods has its own advantages and disadvantages. The general
properties of these two methods of verifying the operation of power electronic systems will
be discussed in this part of the article.
In general, computer simulation can greatly assist in power electronics analysis, design,
and education. Computer simulation is an attempt to model the real or hypothetical
situation in the computer environment without the need to build a prototype in order to
test the operation of the analyzed system. By changing various variables related to the
parameters of the system itself, mains, load or other external factors, the behavior of the
entire system can be predicted.
Several software packages and platforms have been developed to simulate electronic
systems as well as power electronics. Different simulation software packages have different
complexities for creating or designing a model, processing simulation results, and graphical
user interface. All these packages also differ in their level of accuracy and the ability
to perform various analyses. The most popular simulation packages include Matlab
(Simulink), PSIM, Simplorer, Pspice (OrCAD), Multisim, PLECS, PSCAD, etc. For more
information on Matlab (Simulink) and Pspice, the reader can refer to [2–4], and more details
about PLCES can be found in reference [5].
Computer simulations are in most cases the first step in the design and analysis of
power electronic systems. Their invaluable contribution is primarily in the study of the
properties of new converter topologies. Computer simulations enable engineers to study
the behavior of structurally complex systems, as well as complex systems in terms of
their control strategy, without the need to build or operate them. They are also used
to analyze the behavior of converters in non-standard operating conditions of systems
related to both the occurring disturbances and parameters of the external environment. In
addition, computer simulations are a source of information in the analysis of the causes
of hardware failures and the identification of a specific type of failure. In summary,
computer simulations are used in the analysis of existing equipment as well as in the
design of new systems, and their beneficial properties are the fact that they allow engineers
to safely investigate abnormal operating conditions or faults without actually creating
such conditions in a real environment. It should be pointed out here that even the most
modern computer programs are not able to comprehensively and accurately reproduce all
parameters and aspects of the real equipment [6]. The accuracy of the simulation results
depends on the accuracy of the models created and the proper identification and location
of parasitic circuit elements and couplings with the environment, e.g., parasitic inductance,
capacitance and mutual coupling. In this context, simulation models are often used to
estimate the behavior of the tested device under certain limitations and inaccuracies of
the models. Often, simulation models are also more accurate when testing the behavior
of systems in steady states, i.e., the implementation of the basic function of the converter.
Testing circuits in dynamic states or perfect mapping of states related to switching power
semiconductor elements is a more complex issue that requires an individual approach to
the problem.
The second mentioned method of testing power electronic systems is the construction
of low-power prototypes and experimental verification. The advantage of this approach is
in checking the behavior of the systems in real conditions, taking into account all parameters
and physical interactions. The undoubted difficulty in this type of hardware verification
is the time-consuming nature and high cost of building a prototype. Additionally, testing
Energies 2021, 14, 4360 3 of 20

the properties of systems for their various parameters and supply or load conditions is a
time-consuming and complex process and often leads to damage to the prototype.
Digital Real-Time Simulation (DRTS) [7] is a combination of simulation and hardware
verification. DRTS can be divided into two sub-categories. First is a fully digital real-
time simulation, e.g., model-in-the-loop (MiL) or software-in-the-loop (SiL). The second is
hardware-in-the-loop (HiL) in real-time. In the HiL simulation, parts of the fully digital
real-time simulation are replaced with real physical components. Power hardware-in-the-
loop (PHiL) simulation is the most advanced type of verification of circuits and systems
using DRTS [8], used, e.g., for a 500 kW advanced photovoltaic inverter functionality
verification [9]. PHiL is based on a hybrid configuration of software (simulation) and
hardware (physically connected). The real-time simulation environment exchanges low-
voltage and low-current measurement signals with the devices under test and controls
its power through the hardware via the power interface. A good comparison of the real-
time simulators, with respect to operating system and software compatibility, is shown in
reference [10] (comparing five simulators) and reference [11] (comparing eight simulators).
Among the recently strongly developed HiL systems, we will highlight: RTDS Technologies
Inc. [12] (used, e.g., for simulation of Static VAR compensator (SVC) in a large power
system [13]), Opal-RT Technologies [14] (used, e.g., for estimation of on-line parameters
and current control of a six-phase induction machine [15]) and dSPACE [16] (used, e.g., for
permanent magnet motors [17], and multilevel converters [18]). The FPGA-based design
alternatives to HiL in power converters with different coding methods and numerical
formats are compared in terms of area and speed in [19]. Another interesting approach
is the proposed ultralow-latency HiL platform combining flexibility, accuracy and ease
of use of state-of-the-art-simulation packages with the response speed of small power-
hardware models [20]. This allows acceleration in the pace of product prototyping. The
latest advances include integration of individual HiL systems (based on Opal-RT) into a
network of HiL systems (so-called networked HiL simulation system), to better reflect the
needs of modeling large-scale power systems [21].
It is impossible to discuss in detail all the components and applications of the men-
tioned main systems (RTDS, Opal-RT and dSPACE). A synthetic look at them is presented
in the following description. RTDS real-time power system simulator enables the verifica-
tion of the performance of power system devices and the implementation of risk reduction
procedures using HiL testing. It is based on a dedicated hardware platform based on
the NovaCor multi-core processor. It enables the testing of power systems and power
electronic converters. OPAL-RT real-time simulators are based on PC/FPGA (personal
computer/ field-programmable gate array) devices, and are mainly used as HiL testing
equipment and Rapid Control Prototyping (RCP) systems. Their widespread industrial and
research use has been found in such areas as: power networks, power electronics, motor
drives and automotive. Meanwhile, dSPACE offers solutions in the field of prototyping
control systems and HiL simulations. The dSPACE real-time simulators are based on an
Intel processor and FPGA. HiL testing systems include versatile I/O boards as well as
bus and network interfaces. They are used, among other things, in power electronics,
automotive, aviation, defense, industrial automation and medical technology industries.
All of these simulation platforms are also widely used in research and development centers
and universities.
The efficiency and reliability of power electronic converters is an important aspect,
because the accuracy of the signals shaped by the converter affects the behavior of the
powered devices or the supply network. Reliability is especially important in the use of
power electronics in the power network, where the performance of converters is influenced
by the parameters of the power network. They are usually assessed based on multiple
simulations and experimental investigations [22,23]. The latest literature research shows
that it is also possible to evaluate the results of power electronic converter operation with
the use of formal methods used previously by universities mainly in the fields of computer
engineering and automation control systems. Formal methods have also been successfully
Energies 2021, 14, 4360 4 of 20

used in the industry, for example in nuclear power plants [24–26], wind turbine systems [27]
or automotive company SCANIA [28]. A performance verification method must prove that
the control algorithm can handle any system disturbances and keep the deviations of the
controlled variables from the references at a minimum. Additionally, formal verification
methods can be used to test the master control algorithm of converters related to the correct
startup or shutdown sequence, safety systems, operation of systems under abnormal power
or load conditions, as well as to check whether the system will not enter dangerous states.
Power electronics systems can benefit from formal verification methods which allow
the thorough investigation of the designed system before its final implementation. In
general, formal verification methods allow the identification of some divergences between
the formal model of the system and the requirements of the customer or user. Hence,
formal methods, powerful and mature, but formerly also complex for efficient use [29],
may increase the quality of the final product [30]. It is commonly known from the industry
of any domain, that the earlier any errors are detected, the faster they can be repaired
and the cheaper the costs are. Formal methods can be applied at an early stage of system
development, namely, already at the specification stage. The most valuable formal methods
are symbolic model checking [31] and statistical model checking [32,33], both of which are
currently being applied to a wide variety of systems, including production systems [34],
cyber-physical systems [35], manufacturing systems [36,37], or even instrumentation and
control systems [26]. Their use in power electronic systems is a research subject that has
recently been gaining the attention of world research centers [38–42]. Although the first
attempts at introducing formal methods to this application area date from the beginning of
the 21st century, they have not gained popularity. Power electronic circuits had already
been formally checked in the year 2004 [43], by introducing a procedure to obtain hybrid
automata from a power circuit, modeling time varying sources in the circuit components,
and implementing formal verification and controller redesign procedures. As shown
in [40,41], formal methods can be used to solve problems that go beyond the well-known
conventional methods in power electronics. By using conventional simulation software,
we can obtain some information about the different performance metrics, such as control
accuracy, use of the semiconductor devices or response to system disturbances at certain
operating points. However, a few simulations might not be sufficient to draw conclusions
about the above-mentioned performance metrics and, moreover, exploring the whole state
space of a converter system seems impossible using simulations. Formal methods based
on statistics do not require simulation as they rely on statistical evidence.
The information obtained in this way can be useful for optimization in terms of
reliability in power electronics by improving control algorithms.
The contributions of the paper are as follows:
(1) Presentation of the commonly used verification methods of power electronic systems:
simulations and experiments;
(2) Discussion of the recent advancements of introducing formal verification methods to
power electronic systems;
(3) Presentation of the use of statistical model checking to automatically check the perfor-
mance and reliability of a designed power electronic system;
(4) Comparison of the verification methods of power electronics systems.
To reflect the latest state of the art regarding verification of the methods of control for
algorithms in power electronics systems, the research was performed through a search of
recent papers, including the following databases: Elsevier, IEEE Xplore Library, MDPI and
Springer. Simulations and experiments are well-established methods of verification, used
for many years in the everyday work of engineers, both in practice and in academia [44].
They do require a lot of time and professional expertise, but some approaches have also
appeared to shorten and simplify the process, as proposed in [45]. The hardware-in-the-
loop (HiL) method has been applied in many recent projects, e.g., in a tram regenerative
braking system [46], for evaluation of the active safety of vehicles equipped with electronic
stability control systems [47], or for simulation of a photovoltaic system in micro-grids [48].
Energies 2021, 14, 4360 5 of 20

Unfortunately, to the best of the authors’ knowledge, there are just a few papers focusing
on model checking (both symbolic and statistical) in the area of power electronics systems.
The aim of this article is not to provide a comprehensive survey on all the advancements,
especially in respect of various commercial simulation systems, as these aspects—although
interesting—are beyond the scope of this paper. The main goal is to show the control
algorithm verification possibilities and the potential for introducing formal methods to the
new application area. Model checking, already recognized in many domains of computer
science and control theory, also seems to be a promising technique in energy systems.
Therefore, great emphasis in this article is put on boosting the application of formal
verification in power electronics system.
The rest of the paper is structured as follows. Section 2 describes the system model.
Section 3 provides a short overview of performance assessment and verification methods,
mostly considering simulations and experiments. Section 4 focuses on formal verification
methods, including symbolic model checking and statistical model checking. Section 5
compares and discusses the existing verification methods of power electronics systems.
Section 6 presents control algorithm verification workflow. Finally, Section 7 concludes
the article.

2. System Model
A matrix converter (MC) was selected as the power electronic system for the anal-
ysis [49]. The MC circuit diagram is shown in Figure 1. It is a power electronic system
with a complex structure with a large number of power electronic switches that perform
direct AC/AC conversion. It allows for independent shaping of the output currents and
control of the input power factor. Due to the direct conversion, the quality of the shaping
of the output currents is influenced by all disturbances from the power grid. Additionally,
the use of the modulation algorithm and the correct selection of its parameters and the
passive elements of the input filter affects the quality of the signals shaped by the converter.
Among many MC modulation algorithms [50], model predictive control (MPC) was used
in this article. The principles of MC control with MPC are based on the system model
and the selection of the optimal configuration of switches resulting from the minimization
of the cost function. The system model can be described by the following state-space
equations for the source filter (1) and differential equation of load side (2) and MC signals
relationships (3):
" # " #  " #
dv abc 0 1
0 −1 
dt C v abc C vS
diS = −1
F
− R LF + 1
F (1)
L L
iS L 0 i abc
dt F F F

di L
LL = v ABC (t) − R L i L (t) (2)
dt
        
ia s aA s aB s aC iA vA s aA sbA scA va
 ib  =  sbA sbB scB  i B  v B  =  s aB sbB scB  vb  (3)
ic scA scB scC iC vC s aC sbC scC vb
where LF and CF represent the output filter inductance and capacitance, LL and RL and are load
inductance and resistance, respectively. The process of discretization of Equations (1)–(3),
in order to obtain recursive formulas describing the parameters of the system, is carried
out by means of the zero-order hold (‘zoh’) method. The Matlab program, which has built-
in functions for this purpose, can be used to discretize the matrices describing the input
filter [51]. The Matlab code of discretization procedure is described as follows:
Ai = [0 1/Cf; −1/Lf − (Rf)/Lf]; Bi = [0 −1/Cf; 1/Lf 0]; Ci = [1 0; 0 1]; Di = [0 0; 0 0];
system = ss (Ai,Bi,Ci,Di); systemd = c2d (system,Ts);
Ad11 = systemd.a (1,1); Ad12 = systemd.a (1,2); Ad21 = systemd.a (2,1); Ad22 = systemd.a (2,2);
Bd11 = systemd.b (1,1); Bd12 = systemd.b (1,2); Bd21 = systemd.b (2,1); Bd22 = systemd.b (2,2);
Energies 2021, 14, 4360 6 of 20

Energies 2021, 14, 4360 6 of 20

system = ss (Ai,Bi,Ci,Di); systemd = c2d (system,Ts);
Ad11 = systemd.a (1,1); Ad12 = systemd.a (1,2); Ad21 = systemd.a (2,1); Ad22 = systemd.a (2,2);
Bd11 = systemd.b (1,1); Bd12 = systemd.b (1,2); Bd21 = systemd.b (2,1); Bd22 = systemd.b (2,2);
The internal prediction model is given from the following recursive formulas:
The internal prediction model is given from the following recursive formulas:
pre
iS (k) = Ad21 v abc (k ) + Ad22 iS (k) + Bd21 vS (k ) + Bd22 i abc (k) (4)
𝑖 (𝑘) = 𝐴 𝑣 (𝑘) + 𝐴 𝑖 (𝑘) + 𝐵 𝑣 (𝑘) + 𝐵 𝑖 (𝑘) (4)
 
R T
= =1 −1 −L𝑅 S𝑇 i L𝑖(k(𝑘)
pre
i L 𝑖(k) (𝑘) ) ++v ABC k)
𝑣 ((𝑘) (5)
(5)
L L𝐿
As can be seen from Equations (4) and (5), load and grid currents are optimized
As can be seen from Equations (4) and (5), load and grid currents are optimized var-
variables for MC with MPC. Other variables in the model are measured (vS , v abc , iS , i L ) or
iables for MC with MPC. Other variables in the model are measured (𝑣 , 𝑣 , 𝑖 , 𝑖 ) or cal-
calculated from the measured signals (i abc , v ABC —Equation (3)). This method of objective
culated from the measured signals (𝑖 , 𝑣 − Equation (3)). This method of objective
function minimalization performs two tasks. Tracking the output current iL ∗∗ computing
function minimalization performs two tasks. Tracking the output current iL computing
the converter output voltage vABC is the main objective of the algorithm, while the second
the converter output voltage vABC is the main objective of the algorithm, while the second
function performed is to maintain the unit input power factor. The cost functions of the
function performed is to maintain the unit input power factor. The cost functions of the
described system are defined as follows:
described system are defined as follows:
 
pre pre pre pre
= =λ1𝜆 i∗Lα𝑖 ∗ −−i Lα
g𝑔 𝑖 + i ∗ ∗
−
+ Lβ𝑖 −Lβi 𝑖 ++λ2𝜆 vSβ 𝑖 −−
𝑣 iSα vSα
𝑣 iSβ𝑖 (6)
(6)

where indices α𝛼 and

where indices and ββ denote
denote the
the real
real and
and imaginary
imaginary part
part of
of the
the respective
respective three-phase
three-phase
voltages and currents described on the complex reference plane,
voltages and currents described on the complex reference plane, λ1 and λ2 are theλ1 and λ2 weight-
are the
weighting
ing factors.factors.
The proposed methods
The methods ofof formal
formalverification,
verification,which
whicharearethe
themain
maintopic of of
topic thethe
article,
arti-
should
cle, check
should the converter
check performance
the converter in relation
performance to these
in relation two indicated
to these objective
two indicated func-
objective
functions described
tions described by (6).
by (6).
.
SaA

SbA

ScA
uS1 LF1 SaB LL1 RL1
a A
uS2 LF2 SbB B LL2 RL2
b
N
uS3 LF3 ScB C LL3 RL3
c
CF1 CF2 CF3 SaC

SbC

ScC

Figure 1.
Figure 1. Matrix converter
converter schematic
schematic diagram.
diagram.

3.
3. Simulation
Simulation andand Low-Power
Low-Power Prototype
Prototype Verification
VerificationofofPower
PowerElectronic
Electronic Converter
Converter Properties
Properties
3.1. General Characteristics of Selected Programs for Simulating Power Electronics Systems
3.1. General Characteristics of Selected Programs for Simulating Power Electronics Systems
As mentioned previously, the most popular simulation packages that enable sim-
As of
ulation mentioned previously,
power electronics the most
systems popular
also simulation applications
in electro-energy packages thatinclude
enable Matlab
simula-
(Simulink), PSIM, Simplorer, Pspice (OrCAD), Multisim, PLECS or PSCAD [2–5]. (Sim-
tion of power electronics systems also in electro-energy applications include Matlab
ulink), PSIM,isSimplorer,
PSpice Pspice (OrCAD),
a circuit simulation tool forMultisim,
both analogPLECS
andor PSCAD
digital [2–5]. Initially, it
systems.
was created as a tool for simulating low-power electronic systems, then it Initially,
PSpice is a circuit simulation tool for both analog and digital systems. it was
was extended
created as a tool for simulating low-power electronic systems, then it was
to other electrical systems, also of high power. The advantage of the software is a large extended to
other electrical systems, also of high power. The advantage of the software
database of PSpice model libraries for various real electronic components. Software limita- is a large da-
tabase
tions ofrelated
are PSpiceto model libraries for various
the representation real electronicofcomponents.
and implementation numeric blocks Software limita-
and complex
tions are related
controllers. to the is
Simplorer representation
an advanced and andimplementation
multidisciplinary of circuit
numeric blocks and
simulator thatcomplex
allows
controllers.
you Simplorer
to perform is an
analysis, advanced and
optimization and multidisciplinary
verification of the circuit
product simulator thatstage
at an early allows
of
you to perform analysis, optimization and verification of the product at
the project (analysis of both individual components as well as complete systems). Sim- an early stage of
plorer allows you to analyze all aspects of large-scale systems, from detailed component
analysis to system performance, in one virtual design environment. Simplorer has the
Energies 2021, 14, 4360 7 of 20

Energies 2021, 14, 4360 the project (analysis of both individual components as well as complete systems).7Sim- of 20
plorer allows you to analyze all aspects of large-scale systems, from detailed component
analysis to system performance, in one virtual design environment. Simplorer has the
ability to analyze sensitivity, efficiency, sequence of events, interference effects, harmonic
ability to analyze
and statistical sensitivity,
analysis. efficiency,
The great sequence
advantage ofprogram
of the events, interference effects,ofharmonic
is the rich library elements
and statistical analysis. The great advantage of the program is the
(including, among others: electrical, magnetic, mechanical, hydraulic, control rich library of elements,
elements
(including, among others:
models of batteries, electrical,
PFC filters magnetic, mechanical,
and converters). PSIM is one hydraulic, control elements,
of the simulators that has
models
been especially developed for power electronics. It is one of the fastest simulatorsthat
of batteries, PFC filters and converters). PSIM is one of the simulators has
for sim-
been
ulating power electronics; therefore, it is optimized for the tasks appearing in this fieldfor
especially developed for power electronics. It is one of the fastest simulators of
simulating power electronics; therefore, it is optimized for the tasks appearing
technology. Generally, PSIM and its add-on modules provide simulation in many areas, in this field
of technology.
including: Generally,
power PSIMmotor
electronics, and its add-on
drives, modules
motor provide
control design, simulation in many
digital control, areas,
renewa-
including: power electronics, motor drives, motor control design, digital
ble energy. Matlab is a mathematical tool designed mainly for numerical calculations. Op- control, renew-
able energy. Matlab is a mathematical tool designed mainly for numerical calculations.
tional toolkits, called Simulink, also enable simulations of power systems, including
Optional toolkits, called Simulink, also enable simulations of power systems, including
power electronics. An additional set of tools that can be combined with Matlab for the
power electronics. An additional set of tools that can be combined with Matlab for the
simulation of power electronics is, among others, PLECS. MATLAB Add-On Toolboxes
simulation of power electronics is, among others, PLECS. MATLAB Add-On Toolboxes
enable cooperation with other simulation programs, as well as with devices for Digital
enable cooperation with other simulation programs, as well as with devices for Digital
Real-Time Simulation, microprocessors and microcontrollers and FPGAs. It is probably
Real-Time Simulation, microprocessors and microcontrollers and FPGAs. It is probably
the most extensive simulation environment that can work with a huge number of other
the most extensive simulation environment that can work with a huge number of other
environments and systems. It is also one of the main tools for simulating power electronics
environments and systems. It is also one of the main tools for simulating power electronics
systems and their applications.
systems and their applications.
3.2. Simulation
3.2. Simulation of
of Matrix
Matrix Converter
Converter Using
Using Matlab
Matlab Simulink
Simulink
Our example
Our example of of simulation
simulation verification
verification of
of aa power
power electronic
electronic system
system will
will focus
focus on
on aa
matrix converter with a model predictive control algorithm, described in chapter
matrix converter with a model predictive control algorithm, described in Section 2. The 2. The
general view of the simulation scheme is presented in Figure
general view of the simulation scheme is presented in Figure 2. 2.

Figure 2. Matrix
Figure 2. Matrix converter
converter simulation
simulation diagram.
diagram.

The presented simulation

The presented simulationisisbased
basedon ona acircuit
circuitmodel
model with
with basic
basic elements
elements of input
of input LC
LC filter and simplified load in the form of series connected RL elements. The
filter and simplified load in the form of series connected RL elements. The simulation as- simulation
assumptions
sumptions includeincludesymmetry
symmetryofofthethesystem
systemparameters
parametersfor
for each
each line
line of
of the
the three-phase
three-phase
system and the use of idealized switches in the matrix converter
system and the use of idealized switches in the matrix converter power stage. power stage.
TheThe pa-
param-
rameters of the simulation model are summarized in Table 1. The
eters of the simulation model are summarized in Table 1. The MPC algorithm is imple-MPC algorithm is
implemented in a text environment (Matlab Function) as a script with code
mented in a text environment (Matlab Function) as a script with code that implements the that imple-
ments the algorithm’s assumptions. All the constants for the algorithm were previously
calculated and set as input variables. The zero-order hold method was used to discretize
the differential equations. The MPC algorithm is executed with a time of 25 µs during
which the system model response to 27 allowed MC switch states is checked. The algorithm
 algorithm’s assumptions. All the constants for the algorithm were previously calculated
and set as input variables. The zero-order hold method was used to discretize the differ-
Energies 2021, 14, 4360 8 of 20
ential equations. The MPC algorithm is executed with a time of 25 μs during which the
system model response to 27 allowed MC switch states is checked. The algorithm mini-
mizes the objective function, which is related to the load current performance and obtain-
ing the unitythe
minimizes input powerfunction,
objective factor. The simulation
which model
is related enables
to the the measurement
load current performance of any
and
obtaining
signals the control
in the unity input power
circuit and factor. The simulation
high-power model appropriate
signals through enables the measurement
voltage or cur-of
any measuring
rent signals in the control
sensors. circuit
The and high-power
visualization signals through
of the obtained results isappropriate voltage
possible with or
the use
current
of Scope measuring
blocks. sensors. The visualization of the obtained results is possible with the
use of Scope blocks.
Table 1. Parameters of simulation model.
Table 1. Parameters of simulation model.
Parameter Value Unit
Voltage source
Parameter Value230/50 V RMS/Hz
Unit
Filter capacitance
Voltage source 230/50 60 μF
V RMS/Hz
Filter
Filter inductance
capacitance 60 1 mH
µF
Filter
Filterinductance
choke resistance 1 0.1 mHΩ
Filter choke resistance 0.1 Ω
Output inductance 10 mH
Output inductance 10 mH
Output
Output resistance
resistance 48 48 ΩΩ
Sampling
Sampling timetime 25 25 μs
µs

Example results of MC simulation tests for appropriately selected parameters of the

Example
circuit, results system
power supply of MC and
simulation tests for appropriately
control algorithm are presented selected
in Figureparameters of
3. They illus-
the circuit, power supply system and control algorithm are presented in
trate the output currents measured in the circuit and the reference value of the set outputFigure 3. They
illustrateFrom
currents. the output currents
the results measured
obtained, in be
it can theseen
circuit
thatand
thethe reference
control value has
algorithm of the set
good
output currents. From the results obtained, it can be seen that the control
tracking performance. To test the operation of the system with different parameters, an- algorithm has
good simulation
other tracking performance. To testout
should be carried theand
operation of the system
the obtained with different
results should parameters,
be recorded. Only
another
after simulation
a series of testsshould be carried
has been out and
performed, canthe obtained
other analysesresults should
of the be recorded.
results Only
be performed,
after a series of tests has been
e.g., statistical, collation, etc. performed, can other analyses of the results be performed,
e.g., statistical, collation, etc.

Figure
Figure3.3.Output
Outputand
andreference
referencecurrents
currents in
in matrix
matrix converter
converter using
using Simulink.
Simulink.

Testing
Testing the
the operation
operation and
and performance
performance of of power
power electronic
electronic converters
converters by
by means
means ofof
computer simulation requires
computer simulation requiresa large
a large number
number of simulations
of simulations to be carried
to be carried out without with
changes
changes in its parameters.
in its parameters. The simplest
The simplest approachapproach
to analyzingto analyzing the properties
the properties of systemsofbysystems
means
by
of means of simulation
simulation is toitperform
is to perform multipleittimes
multiple
for atimes for a step
step change change
of the of the set param-
set parameters and to
save and
eters the results
to saveafter each simulation.
the results after each This approach
simulation. Thisis approach
simple butistime consuming.
simple This
but time con-
hinders This
suming. the multi-criteria analysis of the
hinders the multi-criteria operation
analysis andoperation
of the the performance
and the of the converter
performance of
system.
the Matlab
converter has Matlab
system. an option hasofanparallel
option of simulations and uses and
parallel simulations all processor cores or
uses all processor
graphics
cores processing
or graphics unit (GPU)
processing unitcores,
(GPU)so cores,
it is easy toisdoeasy
so it a parameter sweep. This
to do a parameter approach
sweep. This
is more complex when creating a simulation model, but allows for multi-criteria analysis
more easily.
The challenges related to the simulation of various matrix converter topologies and
their control strategies and modeling techniques are described in the book [52]. Matlab
Simulink was also used as the basic simulation tool. Additionally presented in the latter
Energies 2021, 14, 4360 9 of 20

reference were issues with testing control algorithms using HiL based on the dSpace plat-
form.

3.3. Low-Power Prototype Experimental Verification

In the traditional approach to the verification of power electronic converter control sys-
tems, the computer simulation phase was followed by the experimental verification stage
in low-power prototypes. This stage is particularly important in studying the properties of
new converter topologies and new modulation or control strategies. This approach is also
often used in scientific research, where the experimental verification of scientific work is a
necessary stage enabling the publication of the obtained results in reputable technical and
scientific journals. It should also be emphasized that these prototypes are most often made
individual, without optimization of the mechanical structure and individual components.
The advantage of the experimental verification approach on low-power prototypes is
that it checks the behavior of the control system and the converter in real conditions, while
maintaining the scale effect of physical interactions with the environment. The results
obtained in this way can then be used in further multi-criteria analyses of the system
properties, taking into account various technical aspects such as: prediction of the losses
and efficiency, EMC (electromagnetic compatibility) problems, prediction of the reliability
in estimating the lifetime of the systems, construction of an effective cooling system and
appropriate selection of system components (transistor technology, type of protection and
selection of a control algorithm implementation technique).
An example of a low-power matrix converter prototype construction is shown in
Figure 4a. The prototype is made in an open version without a cover, and the control
signals from the control circuit are fed to the power transistors by means of optical fibers
in order to limit the influence of external interference. This system allows the checking
of the correctness of operation of various modulation algorithms and the commutation
strategies of transistors. In addition, the performance of the converter can be verified in
its various applications, such as variable speed drive systems and energy conditioners in
power systems.
The presentation of the results of the experimental verification of MC operation consist
of the waveforms of three output phase voltages (Figure 4b) as well as input and output
currents and voltages for one of the phases (Figure 4c). Additionally, Figure 4d shows the
control signals for the transistors of two switches, for which there is a switching process
with a four-step commutation strategy.
Simulations are less time consuming than experiments and can be performed before
physical realization of the system. Experiments, in turn, can help to find out how the real
physical power electronic system behaves. Neither of them, however, can ensure that the
system is error-free. It is hardly possible to cover all potential usage scenarios and to test
the system under all conditions. Additionally, skilled professional knowledge is necessary
to check the design correctness.
A modern approach to designing and testing the operation of power electronic con-
verters has developed new verification techniques using Digital Real-Time Simulation
systems based on SiL, HiL or PHiL platforms as well as model checking methods. The
extended approach to verification of the operation of power electronic systems provides
new possibilities, which will be discussed in the following chapters of the article.
 Energies2021,
Energies 14,4360
2021,14, 4360 1010ofof20
20

(a) (b)

(c) (d)
Figure
Figure4.4.Low-power
Low-powerprototypes
prototypesofofMatrix
MatrixConverter,
Converter,(a)
(a)photo
photoofofpower
powerstage,
stage,(b) selected
(b) wave-
selected wave-
forms of three phase voltages, (c) selected waveforms of grid and loads voltages as well as
forms of three phase voltages, (c) selected waveforms of grid and loads voltages as well as source source
and
andloads
loadscurrents,
currents,(d)
(d)transistor
transistorcontrol
controlwaveforms
waveformsfor
forfour-stage
four-stagecurrent
currentcommutation.
commutation.

4.4.Model
ModelChecking
Checking
4.1.Symbolic
4.1. SymbolicModel
ModelChecking
Checking
Symbolic model
Symbolic model checking
checking with
with exhaustive
exhaustivestate
stateexploration
explorationallows
allows formal
formalverification
verifica-
of aof
tion designed system
a designed at anatearly
system stage.
an early A system
stage. model
A system modelis verified against
is verified user-defined
against user-de-
requirements,
fined expressed
requirements, as temporal
expressed logic formulas.
as temporal In response,
logic formulas. the model
In response, checkerchecker
the model returns
an answer to the question of whether the requirements hold, and if
returns an answer to the question of whether the requirements hold, and if otherwise,otherwise, appropriate
counterexamples
appropriate are generated
counterexamples aretogenerated
track the toundesirable situation. The
track the undesirable processThe
situation. of symbolic
process
model checking is illustrated in Figure 5. The system model has
of symbolic model checking is illustrated in Figure 5. The system model has to to be delivered inbe
thedeliv-
input
format of a model checker. Much attention should be paid to requirements
ered in the input format of a model checker. Much attention should be paid to require- definition, as
only the specified requirements will be checked. The model checker then automatically
ments definition, as only the specified requirements will be checked. The model checker
compares the system model with the list of requirements. If any of them are not satisfied,
then automatically compares the system model with the list of requirements. If any of
all input elements should be revised to find the source of error. It may happen that either
them are not satisfied, all input elements should be revised to find the source of error. It
the system model is not correct or the requirement itself. The revised elements are verified
may happen that either the system model is not correct or the requirement itself. The re-
again, until all properties hold in the system model. Then, the next step towards physical
vised elements are verified again, until all properties hold in the system model. Then, the
realization can be taken.
next step towards physical realization can be taken.
Symbolic model checking techniques [31] are especially valuable in proving that some
Symbolic model checking techniques [31] are especially valuable in proving that
requirements are satisfied in the model. However, it suffers from the state explosion
some requirements are satisfied in the model. However, it suffers from the state explosion
problem [53], which is its main drawback. To mitigate this, model abstractions can be used
problem [53], which is its main drawback. To mitigate this, model abstractions can be used
that reduce the generated state space.
that reduce the generated state space.
Let us briefly describe the recent approaches of symbolic model checking in power
electronics systems. The application area is new, and therefore, to the best of the authors’
knowledge, there are only a few publications describing research that shows the benefits of
symbolic model checking.
Energies 2021, 14, 4360 11 of 20
Energies 2021, 14, 4360 11 of 20

Figure 5.
Figure 5. Process of symbolic model
model checking.
checking.

An
Let approach
us brieflyfor the design
describe verification
the recent of switching
approaches powermodel
of symbolic converters was shown
checking in power in
2012 [54]. Circuits were modeled as timed automata and verified with
electronics systems. The application area is new, and therefore, to the best of the authors’ the UPPAL model
checker.
knowledge, A sample-verified
there are only aproperty was that describing
few publications the output research
voltage always lies in
that shows thethe range
benefits
−
of10 V to 10 V.
symbolic The main
model contribution of the above-mentioned paper was to show that some
checking.
analog Ancircuits
approach canforbe the
naturally
designmodeled
verification as timed automata.
of switching power converters was shown in
An automatic formal verification approach
2012 [54]. Circuits were modeled as timed automata and verified of supervisory energy
withmanagement
the UPPAL model sys-
tems for microgrids was proposed in 2019 [38], with the use of the
checker. A sample-verified property was that the output voltage always lies in the range UPPAAL model checker.
The
−10 V system
to 10 V. is The
modeled as a networkof
main contribution ofthe
timed automata models,
above-mentioned paper each
wasone representing
to show that some a
function or a component. Possible modes of
analog circuits can be naturally modeled as timed automata. operation in the microgrid have been derived
and categorized
An automatic intoformal
allowable and non-allowable
verification approach of operating
supervisory modes. It has
energy been concluded
management sys-
that the approach is effective for reliable design verification guaranteeing
tems for microgrids was proposed in 2019 [38], with the use of the UPPAAL model checker. correctness of
design for the stable and efficient operation of a microgrid.
The system is modeled as a network of timed automata models, each one representing a
The or
function first application Possible
a component. of modelmodeschecking to verify in
of operation thethestand-alone
microgrid solar
have photovoltaic
been derived
system (with solar panel, charge controller, battery, inverter
and categorized into allowable and non-allowable operating modes. It has been and electric load) wasconcluded
proposed
in 2019 [55]. The verification lasted longer than the simulation,
that the approach is effective for reliable design verification guaranteeing correctness but was able to present of
the details that lead to failures in a photovoltaic
design for the stable and efficient operation of a microgrid. system. Three verification tools have
been evaluated (the C Bounded Model Checker, the Efficient SMT-based Bounded Model
The first application of model checking to verify the stand-alone solar photovoltaic
Checker and the Configurable Program Analysis Checker) to compare performance and
system (with solar panel, charge controller, battery, inverter and electric load) was pro-
soundness among automated verifiers.
posed in 2019 [55]. The verification lasted longer than the simulation, but was able to pre-
In a recent article [39], we also showed how to benefit from symbolic model check-
sent the details that lead to failures in a photovoltaic system. Three verification tools have
ing, focusing on formal verification of a direct matrix converter (MC) with transistor
been evaluated (the C Bounded Model Checker, the Efficient SMT-based Bounded Model
commutation and space vector modulation (SVM). The MC was specified as a Petri net
Checker and the Configurable Program Analysis Checker) to compare performance and
(formal specification technique used in control systems), and then further modeled in a
soundness among automated verifiers.
hardware description language towards final implementation in a programmable device.
In a recent article [39], we also showed how to benefit from symbolic model checking,
The proposed design methodology involves triple verification: (1) model checking of the
focusing on formal verification of a direct matrix converter (MC) with transistor commu-
specification with the nuXmv tool, (2) software verification of the modeled system, and
tation
(3) and space
hardware vector modulation
verification of the already (SVM). The MCsystem.
implemented was specified as a Petri
The rule-based net (formal
logical model
specification technique used in control systems), and then further
was used to represent the Petri net and to automatically generate a verifiable model modeled in a hardware
in the
description
format of the language
nuXmv towards final implementation
model checker. Thanks to this,inerrors a programmable device. The
related to manually pro-
written
posed design methodology involves triple verification: (1) model
code were eliminated, and the rule-based model was approximately 10 times shorter than checking of the specifi-
cation
the with the
verifiable nuXmv
one. Modeltool, (2) software
checking verification of
of the specification the modeled
confirmed that system,
all places and (3) hard-
of the Petri
ware verification of the already implemented system. The rule-based
net were reachable, and that the Petri net was live, which means that the designed system logical model was
used to represent the Petri net and to automatically generate
does not get stuck in any of the system states and is able to operate over a long perioda verifiable model in the
format
of time. of the nuXmv model checker. Thanks to this, errors related to manually written
code were eliminated, and the rule-based model was approximately 10 times shorter than
the verifiable one. Model checking of the specification confirmed that all places of the Petri
net were reachable, and that the Petri net was live, which means that the designed system
does not get stuck in any of the system states and is able to operate over a long period of
time.
 Energies2021,
Energies 2021,14,
14,4360
4360 12 20
12 of 20

4.2. Statistical
4.2. Statistical Model
Model Checking
Checking
Another formal
Another formal verification
verification method
method is is the
the statistical
statistical model
model checking
checking (SMC)
(SMC) [32,33],
[32,33],
which combines simulation and statistical methods for the analysis
which combines simulation and statistical methods for the analysis of stochastic systems. of stochastic systems.
Symbolic model
Symbolic model checking
checking suffers
suffers from
from the
the state
state space
space explosion
explosion problem,
problem, i.e.,
i.e., the
the larger
larger
the model is, the longer it will take to explore the entire model state
the model is, the longer it will take to explore the entire model state space. Moreover, once space. Moreover, once
components that do not have a deterministic behavior, such as
components that do not have a deterministic behavior, such as loads or a power grid, are loads or a power grid, are
introducedinto
introduced intothethemodel,
model,ititisisalmost
almostimpossible
impossible toto explore
explore allall scenarios
scenarios that
that cancanoccuroccur
in
in the system. Thus, instead of performing an exhaustive search
the system. Thus, instead of performing an exhaustive search of the complete state space of the complete state
space
of of the model,
the model, SMC will SMC usewill use well-known
well-known methods methods originating
originating from statistics,
from statistics, such as such
Monte as
Monte Carlo simulations, which will be used to obtain the statistical
Carlo simulations, which will be used to obtain the statistical evidence of the system’s evidence of the sys-
tem’s properties.
properties. The methodThe method
cannotcannot
provide provide
a 100%aguarantee;
100% guarantee;
however, however, the confidence
the confidence can be
can beby
preset preset by theThe
the user. user. The confidence
confidence level islevel is correlated
correlated with thewith the number
number of simulation
of simulation runs,
runs,
so it isso it is easily
easily scalable.scalable. Thiscan
This fact factbecan
used betoused
test to test various
various systemsystem prototypes
prototypes in a
in a short
shortand
time timetoand to choose
choose the one the oneisthat
that is thesuitable
the most most suitable for further
for further development.
development.
The process
The process of of statistical
statistical model
model checking
checkingisisillustrated
illustratedin inFigure
Figure6.6. TheThe system
systemmodelmodel
has to be delivered in the input format of a model checker. The
has to be delivered in the input format of a model checker. The hypothesis queries have hypothesis queries have
to be
to be defined
defined and and the
the confidence
confidence level
level must
must be bespecified.
specified. The
The higher
higher the the confidence
confidencelevel level
is, the more
is, more simulation
simulationruns runshavehavetoto bebe
performed
performed and thethe
and moremoretime-consuming
time-consuming the ver-
the
ification becomes.
verification becomes. Finally, thethe
Finally, results
resultsareare
returned,
returned, which
which allows
allows a statistical
a statisticalevaluation
evaluation of
of
thethe probability
probability ofofthe thehypothesis
hypothesisqueries
queries(e.g.,
(e.g.,aasystem
system variable
variable withwith the value
value below
below
some
some threshold).
threshold).

Figure 6.
Figure 6. Process
Process of
of statistical
statistical model
model checking.
checking.

Let
Let us
us briefly
briefly describe
describe the
the recent
recent approaches
approaches of of statistical
statistical model
model checking
checking inin power
power
electronics systems. There is also not much research that benefits from
electronics systems. There is also not much research that benefits from SMC in thisSMC in this applica-
appli-
tion area.
cation area.
Monte
Monte Carlo
Carlo simulation
simulation for
for model
model validation
validation ofof pulse
pulse width
width modulation
modulation dc–dcdc–dc con-
con-
verters
verters is discussed in [56]. Hybrid automata models are generated automatically, and
is discussed in [56]. Hybrid automata models are generated automatically, and
interval matrices are used to model non-determinism due to parametric
interval matrices are used to model non-determinism due to parametric variations. The variations. The
reachability
reachabilityanalysis
analysisframework
frameworkhas hasbeen
beenintroduced,
introduced,and andthetheproposed
proposedreachability
reachabilityanaly-
anal-
sis method is said to outperform the brute force Monte Carlo method in
ysis method is said to outperform the brute force Monte Carlo method in computation computation time
and confidence level. Reachability analysis is also a research object in [57] for closed-loop
time and confidence level. Reachability analysis is also a research object in [57] for closed-
switching power converters, and in [58] for power electronics dc–dc converters, aiming at
loop switching power converters, and in [58] for power electronics dc–dc converters, aim-
reducing computation burden.
ing at reducing computation burden.
In reference [40], statistical model checking (SMC) was used to check the performance
In reference [40], statistical model checking (SMC) was used to check the performance
of finite-set controlled power electronics converters. A detailed modeling procedure of
of finite-set controlled power electronics converters. A detailed modeling procedure of the
the converter system components was given, and the UPPAAL SMC toolbox was used to
converter system components was given, and the UPPAAL SMC toolbox was used to per-
perform statistical model checking, after the correctness of the created model was compared
form statistical model checking, after the correctness of the created model was compared
with the equivalent Simulink model and experimental results. The most difficult part of
with the equivalent Simulink model and experimental results. The most difficult part of
the presented approach is the modeling of power electronics systems as timed automata
Energies 2021, 14, 4360 13 of 20
Energies 2021, 14, 4360 13 of 20

the presented approach is the modeling of power electronics systems as timed automata
structures to be used in UPPAAL SMC. To model the converter system using the TA struc-
structures to be used in UPPAAL SMC. To model the converter system using the TA
tures, the user
structures, the has
usertohasfirsttoidentify the components
first identify the components of the system, which states
of the system, whichthe compo-
states the
components have and what will trigger the transition from one state to the other.in Itfact
nents have and what will trigger the transition from one state to the other. It is is
straightforward
in fact straightforward to identify the states
to identify of power
the states electronics
of power converters.
electronics They will
converters. Theycorre-
will
spond to thetopossible
correspond the possibleswitching statesstates
switching that canthatbe canapplied
be appliedto thetoconverter,
the converter, while the trig-
while the
ger for this transition will be the control algorithm. It was
trigger for this transition will be the control algorithm. It was also demonstrated that the also demonstrated that the
toolbox can be used to model components that feature discrete
toolbox can be used to model components that feature discrete behavior, e.g., the controller behavior, e.g., the control-
lermeasurement
or or measurement sampler
sampler andand components
components thatthat feature
feature continuous
continuous behavior,
behavior, suchsuchas theas
the system voltages
system voltages and currents.and currents.
SMC is
SMC is not
not limited
limited to to aa single
single converter
converter topology,
topology, and and itit can
can also
also be be applied
applied to to the
the
multilevel topologies,
multilevel topologies, as as shown
shown in in [41],
[41], for
for aa three-level
three-level neutral
neutral point
point clamped
clamped converter.
converter.
The results
The results show
show thatthat statistical
statistical model
model checking
checking can can successfully
successfully be be used
used forfor verification
verification
of power
of power electronics
electronics systems,
systems, although
although itit is is aa new
new research
research direction,
direction, but but with
with aa potential
potential
growth in the near
growth in the near future. future.
We will
We will briefly
briefly demonstrate
demonstrate the the logic
logic behind
behind transferring
transferring aa power power electronic
electronic system
system
modelfrom
model fromaasimulation
simulationtool tooltotoaaTA-based
TA-basedmodel model that
that could
could bebeusedused in,in, e.g.,
e.g., UPPAAL SMC
UPPAAL SMC
toolbox. As
toolbox. As shown
shownininFigureFigure7,7,the the central
central component
component of the
of the modelmodel is theis the Controller.
Controller. In theIn
the physical
physical world, world, the controller
the controller TA represents
TA represents both the both the converter
converter and theand the algorithm,
control control algo- as
rithm, as
shown shown 8.
in Figure inTheFigure 8. Thedefine
locations locations define all
all possible possible configurations
configurations of switches.ofAccording
switches.
According
to the control toalgorithm,
the controlthe algorithm,
system will thetransition
system will from transition
one statefrom one state
to another. Thistotransition
another.
Thisbe
will transition will be used
used to update to update
the physical the physical
system component. system Ancomponent.
abstract model An abstract model
of a controller
is
ofshown in Figure
a controller 9, with
is shown in various
Figure 9,locations
with various . yn , corresponding
(y1 . . locations to configuration
(y1…yn, corresponding to con-of
switches)
figurationand conditions
of switches) and forconditions
choosing the for particular
choosing the location xn , corresponding
(x1 . . .location
particular (x1…xn, corre- to
the result of
sponding tocost calculating
the result of cost function).
calculating A physical
function). system component
A physical system is acomponent
set of differential
is a set
equations
of differentialwhich define the
equations which transfer
definerate
the of the system
transfer rate ofvoltages
the system andvoltages
currents, andi.e., a state
currents,
space model. Inputs to the controller are provided by the
i.e., a state space model. Inputs to the controller are provided by the sampler component, sampler component, which
takes a snapshot of the measured values. In the physical
which takes a snapshot of the measured values. In the physical world this corresponds world this corresponds to the to
measurement
the measurement acquisition system.
acquisition The purpose
system. The purpose of the ofTick
thecomponent
Tick component is to synchronize
is to synchro- the
controller and sampler
nize the controller and timed
sampler automata so that in so
timed automata each
thatsampling period theperiod
in each sampling controller can
the con-
obtain
troller new measurements
can obtain and updateand
new measurements the update
physicalthe system
physical component.
system component.

Figure 7.
Figure 7. Structure
Structure of
of matrix
matrix converter
converter in
in UPPAAL.
UPPAAL.
 Energies 2021, 14, 4360 14 of 20
Energies 2021, 14, 4360
Energies 2021, 14, 4360 14 of 20 14 of 20

Controller TA
Controller TA
Tick?

=
Tick?

=
S (k)

≈
S abc (k) abc
Controller TA

≈
Controller TA
io abc
io abc Physical system TA
Physical system TA

Sampler TA
Sampler TA
Output
Control Output
Control filter
algorithm filter
algorithm
ig abc
ig abc
vg abc Load TA or Grid TA
vg abc Load TA or Grid TA
...
Tick! Reference ...
Tick! Reference
Tick TA
Tick TA
Figure
Figure8.8.Modeling
Modeling aapower
powerelectronics
electronicsconverter system in UUPPAAL.
PPAAL.
Figure 8. Modeling a power electronics converter converter
system in system
UPPAALin
.

Abstractmodel
Figure9.9.Abstract
Figure modelofofaacontroller
controllerin
inUUPPAAL.
PPAAL.
Figure 9. Abstract model of a controller in UPPAAL.
Once the
Once the modeling
modeling part
partisiscompleted,
completed,similar
similartoto
that in traditional
that simulation
in traditional software,
simulation soft-
Once wethe
canmodeling
obtain part
the is completed,
waveforms of thesimilar
system tovoltages
that in and
traditional
currentssimulation
and check soft-
whether the
ware, we can obtain the waveforms of the system voltages and currents and check
ware, wemodel
can obtain
behaviorthecorresponds
waveformstoofthe the system voltages
simulation model. An and currents
example andsystem
of the check currents
whether the model behavior corresponds to the simulation model. An example of the sys-
whether waveforms
the model behavior
is showncorresponds
in Figure 10.to thecreated
The simulation model.
UPPAAL An example
model can now ofbethe
usedsys-
to validate
tem currents waveforms is shown in Figure 10. The created UPPAAL model can now be
tem currents waveformsasisshown
the hypothesis, shownininFigure
Figure6.10. The created UPPAAL model can now be
used to validate the hypothesis, as shown in Figure 6.
used to validate the hypothesis,
Additionally, as showntool
the UPPAAL in Figure
can also6.estimate the probability of expression values
statistically by checking, e.g., how possible it is for a controller to be in a particular state
(sample queries for the first five locations and their results are shown in Table 2). It can be
observed that the possibility of reaching a particular state within the first 44,000 time units
is not the same for all the states, i.e., some of them are more likely to be reached, while
others, less. Interpretation of the obtained results can then be used to develop more reliable
converter control algorithms, especially for converter operation with a very distorted
supply network.
Energies 2021, 14, 4360 15 of 20
Energies 2021, 14, x FOR PEER REVIEW 15 of 20

Figure
Figure10.
10.Simulation
Simulationofofa apower
powerelectronics
electronicsconverter
convertersystem
systemusing
usingUUPPAAL.
PPAAL.

Table 2. Sample queries for

Additionally, theestimation of the
UPPAAL tool probability
can (Pr) ofthe
also estimate reaching a certainofcontroller
probability expressionstate.
values
statistically by checking, e.g., how possible it is for a controller to be in a particular state
Query Number Query Result (Probability)
(sample queries for the first five locations and their results are shown in Table 2). It can be
observed that1 the possibilityPr of[<=44,000]
reaching a(<> (con == 1))
particular [0.0800269,
state within the first0.179748]
44,000 time units
2 Pr [<=44,000] (<> (con == 2)) [0, 0.0981446]
is not the same
3
for all the states, i.e., some of them
Pr [<=44,000] (<> (con == 3))
are more likely to be
[0, 0.0981446]
reached, while
others, less.4 Interpretation ofPrthe obtained results can
[<=44,000] (<> (con == 4)) then be used [0.901855, 1] more relia-
to develop
ble converter5 control algorithms, especially
Pr [<=44,000] (<> for
(conconverter
== 5)) operation with a 1]
[0.901855, very distorted
supply network.
TheThe estimation
estimation probability
probability is anisunavoidably
an unavoidably long-lasting
long-lasting task,task,
as itasisitusually
is usually based
based
on many simulation runs (e.g., 186 simulation runs for query no 1); notwithstanding that,that,
on many simulation runs (e.g., 186 simulation runs for query no 1); notwithstanding
it isitperformed
is performed automatically,
automatically, whichwhich confers
confers a significant
a significant mitigating
mitigating advantage.
advantage.
SMC has also found application in electric power grids, which also feature a stochastic
Table 2. Sample queries for estimation of the probability (Pr) of reaching a certain controller state.
behavior. Each substation of the power grid can have hundreds of consumers that need
to beQuery
taken Number
into account. In [42] theQuery authors presented a high-performance computing
Result (Probability)
software-based 1 system (APD—aggregated power
Pr [<=44,000] (<> (con == 1)) demand analyzer) that can assist the
[0.0800269, 0.179748]
distribution support
2 operator (DSO) in the analysis
Pr [<=44,000] (<> (con == 2))of the possible effects of high fluctuating
[0, 0.0981446]
and individualized price policies for the electricity consumers on the electric distribution
3 Pr [<=44,000] (<> (con == 3)) [0, 0.0981446]
network. The analyzer can perform the safety verification of the set price policies and
4 Pr [<=44,000] (<> (con == 4)) [0.901855, 1]
whether the grid safety is guaranteed. APD combines two SMC approaches. First, an
5 Pr [<=44,000] (<> (con == 5)) [0.901855, 1]
algorithm is used to identify when the required number of samples has been reached and
then, second,
SMC hasto guarantee
also foundtermination
application on zero/low-probability
in electric power grids, whichareasalso
of the computed
feature a stochas-
power demand distributions.
tic behavior. Each substation of the power grid can have hundreds of consumers that need
to be taken into account. In [42] the authors presented a high-performance computing
5. Comparison of Verification Methods of Power Electronics Systems
software-based system (APD—aggregated power demand analyzer) that can assist the
The verification
distribution supportmethods of power
operator (DSO)electronics systems
in the analysis arepossible
of the compared withof
effects each
highother
fluctu-
in Table
ating3.and
Their usage frequency
individualized pricediffers a lot,
policies forwith the up-until-now
the electricity rare application
consumers of the
on the electric distri-
model checking techniques. Simulations are used the most frequently, mainly
bution network. The analyzer can perform the safety verification of the set price policies because of
their availability, and possible usage at an early stage (working with models)
and whether the grid safety is guaranteed. APD combines two SMC approaches. First, an and quickly
obtained results,
algorithm albeittoreflecting
is used only some
identify when scenarios
the required and providing
number of samplesno information aboutand
has been reached
what is going on beyond them. Experiments, in turn, allow the checking
then, second, to guarantee termination on zero/low-probability areas of the computed of the real system
or its components,
power which is of great importance for future implementations. However,
demand distributions.
none of the methods provides any guarantee that the power electronic system will behave
correctly in all situations. This can only be achieved by applying formal verification
methods, working on models, and which allows the checking of any properties related to a
designed system. Symbolic model checking indicates with 100% certainty which properties
are satisfied in the model and which are not (additionally supplemented by generated
counterexamples), but such checking is subject to the state space explosion problem, which
Energies 2021, 14, 4360 16 of 20

is a significant problem in power electronics systems. High certainty can be achieved with
statistical model checking, returning a probability that some properties can be satisfied.

Table 3. Comparison of verification methods of control algorithm in power electronics systems.

Symbolic Model Statistical Model

Simulations HiL Experiments
Checking Checking
Usage frequency dominant rare rare medium dominant
Execution and
manual automatic automatic manual manual
analysis
Time needed short medium long short medium
Guarantee for
properties medium full high medium medium
satisfaction
state space selection of test
selection of test explosion, modeling of the scenarios, limited selection of test
Challenges
Energies 2021, 14, 4360 17 of 20
scenarios modeling of the system computation scenarios
system resources
Used in most Used in most
Examples in the should be used [59]. On the other [40,41,56,57] [10,11,13,15,18–
hand, if the control algorithm design ishigh-quality
targeting the
high-quality [38,39,54,55]
literature 21,46–48]
researchreduction
papers of the computation burden, a detailed device model might not be required
research [60].
papers
In the next stage, the performance of the controller in a stochastic environment can
be evaluated using the model checking tools. Here, the main goal is to observe whether
Statistical model checking provides a new type of analysis that is a compromise
or not the controller has a deadlock [38] and how the stochastic elements, such as load
between the realism of experiments and the classical formal verification of symbolic models.
changes or the grid, can affect the controller performance and reliability of converter. This
The type of quantitative measures that are needed for power electronics systems makes
becomes of special interest for advanced control methods such as MPC, which at the mo-
it impossible to capture full symbolic verification without running into the problem of
ment lack tools to evaluate these properties [40]. The existence of a deadlock in the control
state space explosion. The verification time of statistical model-checking on the other hand
algorithm would raise a red flag at this point and return the control design back to the
scales with the specified certainty and not the model size or complexity. This provides
initial stage.
the promise that statistical model checking can provide huge gains in the early design of
Before going to the prototype experiments, an HiL verification of the algorithm can
power electronic systems in the future.
be performed, which brings, as mentioned above, many advantages, such as a safe envi-
ronment
6. Control forAlgorithm
testing fault tolerant algorithms.
Verification WorkflowIt is very convenient for simulation of open
circuit or short circuit scenarios. In this stage the control algorithm is already implemented
As observed in Table 3, each verification method has its strengths, but also challenges
in the control platform, while the converter system is run in the simulator. If the perfor-
that it cannot overcome. Therefore, to obtain better insight into the designed control
mance of the control algorithm at this point is satisfactory, the verification can proceed to
algorithm performance, a systematic workflow needs to be established. It is schematically
the experimental testing stage.
illustrated in Figure 11. Initial design starts typically with the simulation-based verification,
The above-mentioned workflow is in general not limited to the application to a cer-
where steady-state and to some degree transient-state performance is evaluated. At this
tain power converter topology, especially at the simulation stage. For implementation to
point, a different level of abstraction can be used, e.g., if the control algorithm is targeting
a HiL platform there might be some restrictions regarding the number of detailed device
reduction of the switching losses or improving the reliability, a detailed device model
components a platform can execute or how high a sampling frequency can be used for
should be used [59]. On the other hand, if the control algorithm design is targeting the
system simulation as stated by the manufacturer for example in [61].
reduction of the computation burden, a detailed device model might not be required [60].

Model
Simulation HIL Experiments
checking

Figure Verification workflow

11. Verification
Figure 11. workflow of
of the
the control
controlalgorithm.
algorithm.

In the next stage, the performance of the controller in a stochastic environment can be
7. Conclusions
evaluated using the model checking tools. Here, the main goal is to observe whether or not
In this article
the controller has athe verification
deadlock methods
[38] and for stochastic
how the power electronics systems
elements, such aswere
loaddiscussed
changes or
and compared with each other, focusing both on frequently used techniques,
the grid, can affect the controller performance and reliability of converter. This such becomes
as sim-
ulations or experiments, and also on rarely used but promising ones, such as
of special interest for advanced control methods such as MPC, which at the moment lacksymbolic or
statistical model checking. Application of model checking to power electronics systems,
tools to evaluate these properties [40]. The existence of a deadlock in the control algorithm
although
would already
raise a red well established
flag at this point in other
and domains,
return is here
the control definitely
design a knowledge
back to gap
the initial stage.
and should be given more attention. A specific point of interest would be the application
of some form of automatic translation from one of the modeling tools specifically aimed
at power electronics to a symbolic model checking framework.
Table 3 is an attempt to analyze the properties of various methods of verification of
Energies 2021, 14, 4360 17 of 20

Before going to the prototype experiments, an HiL verification of the algorithm

can be performed, which brings, as mentioned above, many advantages, such as a safe
environment for testing fault tolerant algorithms. It is very convenient for simulation
of open circuit or short circuit scenarios. In this stage the control algorithm is already
implemented in the control platform, while the converter system is run in the simulator. If
the performance of the control algorithm at this point is satisfactory, the verification can
proceed to the experimental testing stage.
The above-mentioned workflow is in general not limited to the application to a certain
power converter topology, especially at the simulation stage. For implementation to a
HiL platform there might be some restrictions regarding the number of detailed device
components a platform can execute or how high a sampling frequency can be used for
system simulation as stated by the manufacturer for example in [61].

7. Conclusions
In this article the verification methods for power electronics systems were discussed
and compared with each other, focusing both on frequently used techniques, such as
simulations or experiments, and also on rarely used but promising ones, such as symbolic
or statistical model checking. Application of model checking to power electronics systems,
although already well established in other domains, is here definitely a knowledge gap
and should be given more attention. A specific point of interest would be the application
of some form of automatic translation from one of the modeling tools specifically aimed at
power electronics to a symbolic model checking framework.
Table 3 is an attempt to analyze the properties of various methods of verification
of power electronic systems. Each of the verification methods has its advantages and
disadvantages, providing different kinds of feedback information that are required to
obtain the complete verification of the control algorithm and/or its modification in order
to obtain greater reliability, efficiency and performance. Altogether, the methods build
a systematic workflow, which fits each stage of the control algorithm development. The
simulations focus on primary algorithm control objectives, e.g., voltage control, switching
loss minimization. On the other hand, the model checking methods focus on stability and
performance in a stochastic environment. In HiL control algorithm response to hazardous
scenarios, such as short circuit and open circuit, faults can be evaluated. Moreover, at this
stage the control algorithm is implemented in a physical platform, which allows us to inves-
tigate whether the code is correctly implemented and how high the computation burden is.
In the last stage of the verification, experiments are conducted on the converter prototype.
As an example of a power electronics system where the mentioned control algorithm
verification methods can be implemented, the article presents a matrix converter with a
model predictive control algorithm. In this type of power electronic converters, the quality
of the output signals will be directly dependent on the power quality in the power network,
which has stochastic properties, such as power harmonics and voltage sags. The article also
indicates and discusses the properties of the verification method for the operation of power
electronic converters based on model checking to obtain properties that the traditional
methods, such as simulations and experimental validation, cannot provide. Combining
the tools into a toolchain would avoid the redundant remodeling of power electronics
converter systems and finally build them as more reliable.
Techniques to verify the operation of various types of systems are a necessity today
to control the high quality of the product and check its operation in various operating
conditions. Product verification techniques based on Digital Real-Time Simulation have
become common not only in university research but also in the field of broadly understood
industrial use. The next step in the field of system operation verification may be to intro-
duce the formal verification methods indicated in this article. The characteristics of formal
methods indicate that they can be a good complement to commonly used verification
methods, especially for modeling and verifying the effects of the stochastic disturbances
on the control algorithm performance. Based on the results provided by the formal meth-
Energies 2021, 14, 4360 18 of 20

ods, a control algorithm could be redesigned or retuned to provide higher robustness to

these disturbances.
This article mainly shows the potential of the proposed formal verification methods
and their implementation in the field of power electronic systems. All aspects related to
electrical engineering, computer engineering and control engineering can be analyzed
taking into consideration the model used or the description of the states of a given system.

Author Contributions: Conceptualization, P.S. and I.G.; investigation, P.S., I.G., M.N., U.N.; writing—
original draft preparation, P.S., I.G., M.N.; writing—review and editing, P.S., I.G., M.N., U.N.;
visualization, I.G., M.N. All authors have read and agreed to the published version of the manuscript.
Funding: This research received no external funding.
Data Availability Statement: Not applicable.
Conflicts of Interest: The authors declare no conflict of interest.

References
1. Rashid, M.H. Power Electronics Handbook, 4th ed.; Butterworth-Heinemann: Oxford, UK, 2018.
2. Manias, S. Simulation of power electronics circuits using Psim, Pspice or Matlab/Simulink. Independently published. 2020.
3. Le-Huy, H.; Sybille, G. MATLAB/Simulink and PSPice as modelling tools for power systems and power electronics. In
Proceedings of the Power Engineering Society Summer Meeting (Cat. No.00CH37134), Seattle, WA, USA, 16–20 July 2000;
Volume 2, pp. 766–767. [CrossRef]
4. Narayanaswamy, P.R.I. Power Electronic Converters: Interactive Modelling Using Simulink; CRC Press: Boca Raton, FL, USA, 2018.
5. Asadi, F.; Eguchi, K. Simulation of Power Electronics Converters Using PLECS® ; Academic Press: Cambridge, MA, USA, 2020.
6. Drofenik, U.; Cottet, D.; Müsing, A.; Kolar, J.W. Design Tools for Power Electronics: Trends and Innovations. In Proceedings of
the 2nd International Conference on Automotive Power Electronics (APE’07), Paris, France, 26–27 September 2008.
7. Li, F.; Wang, Y.; Wu, F.; Huang, Y.; Liu, Y.; Zhang, X.; Ma, M. Review of Real-time Simulation of Power Electronics. J. Mod. Power
Syst. Clean Energy 2020, 8, 796–808. [CrossRef]
8. Lauss, G.F.; Faruque, M.O.; Schoder, K.; Dufour, C.; Viehweider, A.; Langston, J. Characteristics and Design of Power Hardware-
in-the-Loop Simulations for Electrical Power Systems. IEEE Trans. Ind. Electron. 2016, 63, 406–417. [CrossRef]
9. Mather, B.A.; Kromer, M.A.; Casey, L. Advanced photovoltaic inverter functionality verification using 500 kw power hardware-
in-loop (PSIL) complete system laboratory testing. In Proceedings of the 2013 IEEE PES Innovative Smart Grid Technologies
Conference (ISGT), São Paulo, Brazil, 6–9 October 2013; pp. 1–6. [CrossRef]
10. Ibarra, L.; Rosales, A.; Ponce, P.; Molina, A.; Ayyanar, R. Overview of Real-Time Simulation as a Supporting Effort to Smart-Grid
Attainment. Energies 2017, 10, 817. [CrossRef]
11. Faruque, M.D.O.; Strasser, T.; Lauss, G.; Jalili-Marandi, V.; Forsyth, P.; Dufour, C.; Dinavahi, V.; Monti, A.; Kotsampopoulos,
P.; Martinez, J.A.; et al. Real-time simulation technologies for power systems design, testing, and analysis. IEEE Power Energy
Technol. Syst. J. 2015, 2, 63–73. [CrossRef]
12. Official Website of the RTDS Technologies Company. Available online: https://www.rtds.com/applications/power-electronics-
hil/ (accessed on 22 June 2021).
13. Song, J.; Hur, K.; Lee, J.; Lee, H.; Lee, J.; Jung, S.; Shin, J.; Kim, H. Hardware-in-the-Loop Simulation Using Real-Time Hybrid-
Simulator for Dynamic Performance Test of Power Electronics Equipment in Large Power System. Energies 2020, 13, 3955.
[CrossRef]
14. Official Website of the Opal-RT Technologies Company. Available online: https://www.opal-rt.com/ (accessed on 22 June 2021).
15. Kali, Y.; Saad, M.; Bouchama, A.; Dehbozorgi, R. HIL Simulation of On-line Parameters Estimation and Current Control of a
Six-Phase Induction Machine using OPAL-RT Technologies. In Proceedings of the IEEE Power & Energy Society General Meeting
(PESGM), 3–6 August 2020; pp. 1–5. [CrossRef]
16. Official Website of the dSpace Company. Available online: https://www.dspace.com/en/inc/home/products/systems/ecutest.
cfm (accessed on 22 June 2021).
17. Luo, G.; Liu, W.; Song, K.; Zeng, Z. dSPACE based Permanent Magnet Motor HIL simulation and test bench. IEEE Int. Conf. Ind.
Technol. 2008, 1–4. [CrossRef]
18. Dekka, A.; Wu, B.; Narimani, M. A Series-Connected Multilevel Converter: Topology, Modeling, and Control. IEEE Trans. Ind.
Electron. 2019, 66, 5850–5861. [CrossRef]
19. Zamiri, E.; Sanchez, A.; Yushkova, M.; Martínez-García, M.S.; de Castro, A. Comparison of Different Design Alternatives for
Hardware-in-the-Loop of Power Converters. Electronics 2021, 10, 926. [CrossRef]
20. Vekić, M.S.; Grabić, S.U.; Majstorović, D.P.; Čelanović, I.L.; Čelanović, N.L.; Katić, V.A. Ultralow Latency HIL Platform for Rapid
Development of Complex Power Electronics Systems. IEEE Trans. Power Electron. 2012, 27, 4436–4444. [CrossRef]
21. Xie, F.; McEntee, C.; Zhang, M.; Lu, N.; Ke, X. Networked HIL Simulation System for Modeling Large-scale Power Systems. In
Proceedings of the 52nd North American Power Symposium (NAPS), Fargo, ND, USA, 11–14 April 2021; pp. 1–6. [CrossRef]
Energies 2021, 14, 4360 19 of 20

22. Rodriguez, J.; Pontt, J.; Silva, C.A.; Correa, P.; Lezana, P.; Cortés, P.; Ammann, U. Predictive Current Control of a Voltage Source
Inverter. IEEE Trans. Ind. Electron. 2007, 54, 495–503. [CrossRef]
23. Young, H.A.; Perez, M.A.; Rodriguez, J.; Abu-Rub, H. Assessing Finite-Control-Set Model Predictive Control: A Comparison with
a Linear Current Controller in Two-Level Voltage Source Inverters. IEEE Ind. Electron. Mag. 2014, 8, 44–52. [CrossRef]
24. Buzhinsky, I.; Pakonen, A. Model-Checking Detailed Fault-Tolerant Nuclear Power Plant Safety Functions. IEEE Access 2019, 7,
162139–162156. [CrossRef]
25. Pakonen, A.; Buzhinsky, I.; Björkman, K. Model checking reveals design issues leading to spurious actuation of nuclear
instrumentation and control systems. Reliab. Eng. Syst. Saf. 2021, 205, 107237. [CrossRef]
26. Pakonen, A.; Tahvonen, T.; Hartikainen, M.; Pihlanko, M. Practical applications of model checking in the Finnish nuclear industry.
In Proceedings of the 10th International Topical Meeting on Nuclear Plant Instrumentation, Control and Human Machine
Interface Technologies, San Francisco, CA, USA, 11–15 June 2017; American Nuclear Society: La Grange Park, IL, USA, 2017;
pp. 1342–1352.
27. Seceleanu, C.; Johansson, M.; Suryadevara, J.; Sapienza, G.; Seceleanu, T.; Ellevseth, S.-E.; Pettersson, P. Analyzing a wind turbine
system: From simulation to formal verification. Sci. Comput. Program. 2017, 133, 216–242. [CrossRef]
28. Nyberg, M.; Gurov, D.; Lidström, C.; Rasmusson, A.; Westman, J. Formal verification in automotive industry: Enablers and
obstacles. In Proceedings of the International Symposium on Leveraging Applications of Formal Methods, Rhodes, Greece, 20–30
October 2018; Springer: Cham, Switzerland; Berlin/Heidelberg, Germany, 2018; pp. 139–158.
29. Seidner, C.; Roux, O.H. Formal Methods for Systems Engineering Behavior Models. IEEE Trans. Ind. Inform. 2008, 4, 280–291.
[CrossRef]
30. Woodcock, J.; Larsen, P.; Bicarrequi, J.; Fitzgerald, J. Formal methods: Practice and experience. ACM Comp. Surv. 2009, 41, 4.
[CrossRef]
31. Clarke, E.M., Jr.; Grumberg, O.; Kroening, D.; Peled, D.; Veith, H. Model Checking; MIT Press: Cambridge, MA, USA, 2018.
32. Clarke, E.M.; Zuliani, P. Statistical model checking for cyber-physical systems. In International Symposium on Automated Technology
for Verification and Analysis; Springer: Berlin/Heidelberg, Germany, 2011; pp. 1–12. [CrossRef]
33. Agha, G.; Palmskog, K. A survey of statistical model checking. ACM Trans. Modeling Comput. Simul. 2018, 28, 1–39. [CrossRef]
34. Himmiche, S.; Aubry, A.; Marangé, P.; Duflot-Kremer, M.; Pétin, J.F. Using Statistical-Model-Checking-Based Simulation
for Evaluating the Robustness of a Production Schedule. In Service Orientation in Holonic and Multi-Agent Manufacturing.
Studies in Computational Intelligence; Borangiu, T., Trentesaux, D., Thomas, A., Cardin, O., Eds.; Springer: Cham, Switzerland;
Berlin/Heidelberg, Germany, 2018; p. 762. [CrossRef]
35. Grobelna, I. Formal Verification of Control Modules in Cyber-Physical Systems. Sensors 2020, 20, 5154. [CrossRef]
36. Torres, P.J.R.; Mercado, E.I.S.; Rifón, L.A. Probabilistic Boolean network modeling and model checking as an approach for DFMEA
for manufacturing systems. J. Intell. Manuf. 2018, 29, 1393–1413. [CrossRef]
37. Huang, X.; Ding, Z.; Bi, Z.; Wang, Y.; Zheng, K.; Huang, X. Model Checking of Systems with Unreliable Machines Using PRISM.
In Proceedings of the 9th International Conference on Information Technology in Medicine and Education, Hangzhou, China,
19–21 October 2018; pp. 872–876. [CrossRef]
38. Sugumar, G.; Selvamuthukumaran, R.; Novak, M.; Dragicevic, T. Supervisory Energy-Management Systems for Microgrids:
Modeling and Formal Verification. IEEE Ind. Electron. Mag. 2019, 13, 26–37. [CrossRef]
39. Wisniewski, R.; Bazydło, G.; Szcześniak, P.; Grobelna, I.; Wojnakowski, M. Design and Verification of Cyber-Physical Systems
Specified by Petri Nets—A Case Study of a Direct Matrix Converter. Mathematics 2019, 7, 812. [CrossRef]
40. Novak, M.; Nyman, U.M.; Dragicevic, T.; Blaabjerg, F. Statistical Model Checking for Finite-Set Model Predictive Control
Converters: A Tutorial on Modeling and Performance Verification. IEEE Ind. Electron. Mag. 2019, 13, 6–15. [CrossRef]
41. Novak, M.; Nyman, U.M.; Dragicevic, T.; Blaabjerg, F. Statistical Performance Verification of FCS-MPC Applied to Three Level
Neutral Point Clamped Converter. In Proceedings of the 20th European Conference on Power Electronics and Applications
(EPE’18 ECCE Europe), Riga, Latvia, 17–21 September 2018; pp. 1–10.
42. Mancini, T.; Mari, F.; Melatti, I.; Salvo, I.; Tronci, E.; Gruber, J.K.; Hayes, B.; Prodanovic, M.; Elmegaard, L. Parallel Statistical
Model Checking for Safety Verification in Smart Grids. In Proceedings of the IEEE International Conference on Communications,
Control, and Computing Technologies for Smart Grids, Aalborg, Denmark, 29–31 October 2018; pp. 1–6. [CrossRef]
43. Miranda, M.V.C.; Lima, A.M.N. Formal verification and controller redesign of power electronic converters. IEEE Int. Symp. Ind.
Electron. 2004, 2, 907–912. [CrossRef]
44. Hermanns, K.; Peng, Y.; Mantooth, A. The Increasing Role of Design Automation in Power Electronics: Gathering What Is
Needed. IEEE Power Electron. Mag. 2020, 7, 46–50. [CrossRef]
45. Zhong, Q.-C.; Wang, Y.; Amin, M.; Dong, Y.; Ren, B. Smart Grid Research and Educational Kit to Enable the Control of Power
Electronic-based Systems from Simulations to Experiments in Hours. IFAC-PapersOnLine 2020, 53, 17586–17591. [CrossRef]
46. Pavlović, T.; Župan, I.; Šunde, V.; Ban, Ž. HIL Simulation of a Tram Regenerative Braking System. Electronics 2021, 10, 1379.
[CrossRef]
47. Tumasov, A.V.; Vashurin, A.S.; Trusov, Y.P.; Toropov, E.I.; Moshkov, P.S.; Kryaskov, V.S.; Vasilyev, A.S. The Application of
Hardware-in-the-Loop (HIL) Simulation for Evaluation of Active Safety of Vehicles Equipped with Electronic Stability Control
(ESC) Systems. Procedia Comput. Sci. 2019, 150, 309–315. [CrossRef]
Energies 2021, 14, 4360 20 of 20

48. Gutierrez, A.; Chamorro, H.R.; Jimenez, J.F.; Villa, L.F.L.; Alonso, C. Hardware-in-the-loop simulation of PV systems in micro-
grids using SysML models. In Proceedings of the IEEE 16th Workshop on Control and Modeling for Power Electronics (COMPEL),
Vancouver, BC, Canada, 12–15 July 2015; pp. 1–5. [CrossRef]
49. Empringham, L.; Kolar, J.W.; Rodriguez, J.; Wheeler, P.W.; Clare, J.C. Technological issues and industrial application of matrix
converters: A review. IEEE Trans. Ind. Electron. 2013, 60, 4260–4271. [CrossRef]
50. Rodriguez, J.; Rivera, M.; Kolar, J.W.; Wheeler, P.W. A review of control and modulation methods for matrix converters. IEEE
Trans. Ind. Electron. 2012, 59, 58–70. [CrossRef]
51. Rodríguez, J.; Cortes, P. Predictive Control of Power Converters and Electrical Drives; John Wiley & Sons: Hoboken, NJ, USA, 2012.
52. Narayanaswamy, P.R. Iyer AC to AC Converters Modelling, Simulation, and Real-Time Implementation Using SIMULINK; CRC Press:
Boca Raton, FL, USA; Taylor & Francis Group: Abingdon, UK, 2019.
53. Clarke, E.M.; Klieber, W.; Nováček, M.; Zuliani, P. Model checking and the state explosion problem. In LASER Summer School on
Software Engineering; Springer: Berlin/Heidelberg, Germany, 2011; pp. 1–30. [CrossRef]
54. Johnson, T.T.; Hong, Z.; Kapoor, A. Design verification methods for switching power converters. IEEE Power Energy Conf. Ill 2012,
1–6. [CrossRef]
55. Trindade, A.; Cordeiro, L. Automated formal verification of stand-alone solar photovoltaic systems. Solar Energy 2019, 193,
684–691. [CrossRef]
56. Beg, O.A.; Abbas, H.; Johnson, T.T.; Davoudi, A. Model Validation of PWM DC–DC Converters. IEEE Trans. Ind. Electron. 2017,
64, 7049–7059. [CrossRef]
57. Hossain, S.; Dhople, S.; Johnson, T.T. Reachability analysis of closed-loop switching power converters. IEEE Power Energy Conf. Ill
(PECI) 2013, 130–134. [CrossRef]
58. Hope, E.M.; Jiang, X.; Dominguez-Garcia, A.D. A Reachability-Based Method for Large-Signal Behavior Verification of DC-DC
Converters. IEEE Trans. Circuits Syst. I Regul. Papers 2011, 58, 2944–2955. [CrossRef]
59. Aly, M.; Ahmed, E.M.; Shoyama, M. Thermal Stresses Relief Carrier-Based PWM Strategy for Single-Phase Multilevel Inverters.
IEEE Trans. Power Electron. 2017, 32, 9376–9388. [CrossRef]
60. Mora, A.; Cárdenas-Dobson, R.; Aguilera, R.P.; Angulo, A.; Donoso, F.; Rodriguez, J. Computationally Efficient Cascaded Optimal
Switching Sequence MPC for Grid-Connected Three-Level NPC Converters. IEEE Trans. Power Electron. 2019, 34, 12464–12475.
[CrossRef]
61. HIL Firmware Manager–Typhoon Hil Documentation. Available online: https://www.typhoon-hil.com/documentation/
typhoon-hil-software-manual/concepts/hil_firmware_manager.html (accessed on 20 May 2021).