Multi-vendor interoperability in HVDC grid protection: State-of-the-art and challenges ahead

Multi-vendor interoperable HVDC grid protection is key to build large-scale HVDC grids in a step-by-step manner. On the one hand, various protection strategies and technologies have been developed in the past decade to address the challenges associated with HVDC grid protection. On the other hand, state-of-the-art HVDC technologies are often vendor-speciﬁc and there is a general lack of standardisation on HVDC systems as the majority of existing HVDC systems have been built by single vendors as turn-key projects. In recent years, driven by the need to develop multi-vendor HVDC grids, both national and international standardisation bodies have been working on guidelines and pre-standardisation for HVDC systems. This paper provides a comprehensive review of the recent progress on HVDC grid protection focusing on multi-vendor interoperability and identiﬁes the main challenges to achieve interoperable HVDC grid protection. Compared to AC system protection, the fundamental differences of multi-vendor interoperability in HVDC grid protection are the possible co-existence of multiple protection philosophies and the extended scope of the fault clearing process in terms of protection and control. The challenges and research needs related to multi-vendor HVDC grid protection due to these fundamental differences are identiﬁed.


INTRODUCTION
Modern power systems are undergoing drastic changes to accommodate the integration of bulk and often remotely located renewable energy generation. Voltage source converter (VSC)-based high voltage direct current (HVDC) grids are playing a key role in such power systems by transmitting bulk power with high efficiency and reliability [1,2]. To achieve such high reliability, HVDC grid protection is indispensable, yet challenging due to the nature of the DC-side fault behaviour [3]. In comparison to AC protection, the main technical challenge of HVDC grid protection is interrupting a DC fault currentwithout naturally reoccurring zero-crossings-within a very short amount of time [4]. Various protection strategies, ranging from fully selective to non-selective fault clearing, have been proposed in the past decade to address the challenges associated with HVDC grid protection, using different converter and circuit breaker technologies [5].
This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited. To date, the majority of HVDC systems have been built by a single vendor as turn-key projects. A multi-vendor solution is, however, inevitable to build large-scale HVDC grids in a step-by-step manner [6,7]. Recently, multi-terminal HVDC systems and HVDC grids with multi-vendor primary equipment have been demonstrated in China [8][9][10]. However, the overall control and protection systems were designed and provided by single-vendors in these projects. Such a design philosophy may not be universally applicable, particularly in a competitive framework or for a step-by-step grid development [11]. A "complete" multi-vendor scheme, with all equipment independently supplied by any vendor, may be a preferred option, as it allows for the highest level of freedom in promoting vendor competition for innovation and cost reduction.
The need to develop multi-vendor HVDC grids has driven national and international standardisation bodies to work on guidelines and standards for HVDC systems. This standardisation work mainly focuses on: (i) specifying AC-side requirements for HVDC systems and DC-connected wind park modules [12], (ii) proposing guidelines for a DC grid code focusing on planning, building, and operating a DC grid [13], (iii) specifying high-level requirements on HVDC grid control and protection [14,15], (iv) classifying HVDC grid protection strategies [5,15] and (v) specifying general requirements on protection equipment, such as DC circuit breakers (DCCBs) [16][17][18] and intelligent electronic devices (IEDs) [19]. Besides the interest from industry, multi-vendor interoperability of HVDC grids has also been studied in recent research projects. These projects focus on: (i) control interoperability of multi-vendor VSCs [7,20]; (ii) analysing adaptability of AC standards to HVDC grid protection [21]; (iii) interoperability analysis of protection equipment, such as DCCB technologies [22][23][24], stand-alone DC protection IEDs [25], and pole rebalancing technologies [26,27]; and (iv) multi-vendor protection design methodologies [28]. In summary, it is clear that recent works have made great progress in clarifying fundamental concepts for HVDC grid protection and specifying high-level requirements for the system behaviour and protection equipment. Nevertheless, most publications address one of many aspects of multi-vendor interoperability in HVDC grid protection; a comprehensive review covering recent developments, unique challenges, and future research needs is still missing.
This paper provides a comprehensive review of multi-vendor interoperability in HVDC grid protection with a focus on identifying the challenges and future research needs. This paper is structured as follows: Section 2 provides a review on the state-of-the-art of HVDC protection technologies, including primary and secondary equipment. Section 3 reviews HVDC grid protection strategies proposed in the literature and their classification approaches. Section 4 reviews recent standardisation efforts on HVDC systems. Section 5 summarizes relevant frameworks and design methodologies of multi-vendor interoperable HVDC grid protection. Based on the review in Sections 2 to 5, main challenges and future research needs to achieve multivendor interoperability in HVDC grid protection are identified in Section 6. Section 7 summarises the general conclusions of this paper.

HVDC GRID PROTECTION TECHNOLOGIES: STATE-OF-THE-ART
This section first reviews recent developments of primary and secondary equipment for HVDC grid protection. Then, the DC fault response of a converter station as a combination of different converter technologies, DC switchgear and auxiliary equipment is discussed. With respect to primary equipment, this paper focuses on VSC, DC switchgear, pole rebalancing equipment and fault current limiting equipment due to their importance in shaping DC fault behaviour, fault clearing and voltage recovery. Regarding secondary equipment, this section reviews measurement devices, protection IEDs and communication protocols as these play a key role in fault detection and coordination.

2.1
Primary equipment

Voltage source converter
Since its first commercial application, VSC technologies have evolved from the early two-level and three-level topologies to multi-level topologies [29]. In particular, modular multi-level converters (MMCs) have become the dominant VSC technology in the current market due to low power losses, high controllability and its suitability for high voltage applications [29,30]. In terms of their abilities to prevent AC-side contribution during a DC fault by converter actions, VSC technologies can be broadly classified into fault feeding (FFC) and fault blocking converters (FBC). As suggested by their names, FFCs will keep feeding the DC fault through their anti-parallel diodes even when the converters are blocked. However, FBCs can block the AC-side contribution by inserting a counter-voltage to oppose the AC line voltages [31]. The vast majority of practical applications have been built with FFCs, such as two-level, three-level converters and half-bridge MMCs (HB-MMCs) [29]. However, recent applications of FBCs in commercial projects, such as full-bridge MMCs (FB-MMCs) [32] and hybrid MMCs [33], may facilitate using FBCs in future large-scale HVDC grids.

DC switchgear
The DC switchgear technologies proposed for HVDC grid protection can be classified into two categories: DC circuit breakers (DCCBs) and high-speed switches (HSSes). DCCBs have fault current interrupting capabilities and can be placed at both ends of a line or between two sub-grids to isolate the faulty part in a fully or partially selective protection strategy, respectively. HSSes can only interrupt residual currents and are used to isolate a faulted component in a de-energised grid.

DC circuit breaker
Compared with ACCBs, the main challenges faced by DCCBs are interrupting a DC current without natural zero-crossings, handling the inductive energy associated with current interruption and high operation speed [16]. In practical realisations of DCCBs, DC current interruption is achieved either by power electronic switches or mechanical switches with auxiliary circuitry to artificially create current zero-crossings. A generic DCCB topology includes at least two parallel branches: one for carrying the load current and one for energy absorption. DCCBs are broadly grouped into passive oscillation, active current injection (or mechanical), mechanical-power electronic hybrid (or hybrid) and pure power electronic types [16,34]. Mechanical and hybrid DCCBs are the most promising technologies, which have been prototyped and installed in a few demonstration projects [17,[35][36][37][38]. Different DCCB technologies differentiate primarily by their operating speeds, interruption capabilities, and availability of auxiliary functions. Some hybrid or power electronic DCCBs may be able to provide a variety of auxiliary functions, such as proactive opening, fault current limiting (FCL) mode, and self-protection, primarily attributed to the high controllability of the power electronic switches used in these technologies [23,39,40]. Breaker opening times ranging from 2 to 20 ms and interruption capabilities from a few kA up to 25 kA have been reported in [16,17].
Recent developments on DCCB technology focus on reducing losses or component counts while maintaining high performance [36,41] and developing multi-functional devices [42,43]. Zero steady-state loss can be achieved for a hybrid DCCB by using an inductance coupled circuit to generate a negative voltage to force the current commutation from the load current branch to the main breaker branch [36]. Additional ultra-fast disconnectors may be used to maintain bidirectional fault current interruption while only using unidirectional power electronic switches [41]. Another trend is developing multifunctional and multi-port DCCBs to have integrated fault current interruption, limiting and power flow control aiming at reducing component counts [42,43].

High speed switch
Unlike conventional DC disconnecting switches, HSSes are required to have a much faster isolation speed. In the literature, the opening speed of an HSS may be in the range of 2 to 120 ms depending on the technology [16,44,45]. Different from DCCBs, HSSes are typically only required to interrupt a small residual current (0.1 to 10 A [16,46]). After fault current interruption by circuit breakers or FBCs, it can take up to a few hundred milliseconds for the current to decay depending on the damping in the fault current path. Higher residual current capabilities (even in the order of tens of amperes) can thus significantly reduce the total fault clearing time in non-selective protection strategies [45].

Pole rebalancing device
In high-impedance grounded HVDC systems, dedicated pole rebalancing devices may be required to rebalance the pole voltages following a pole-to-ground fault for fast restoration. An exception is a non-selective protection strategy using FBCs, which can discharge both poles through the fault path before fault clearing [47,48]. Two main solutions for pole rebalancing, dynamic braking systems (DBSes) and AC-side grounding schemes permitting a zero sequence current, such as pole rebalancing reactors (PPR) and zig-zag transformers, have been studied in non-selective and fully selective protection strategies [26,49,50]. Both solutions are shown capable of providing an adequate pole rebalancing speed and dissipating the associated energy [26,50].

Fault current limiting
Limiting the magnitude and rate-of-rise of the prospective fault current is necessary to protect the sensitive power electronicsbased components and to allow for successful fault clearing [5].
In HVDC systems, the main parameters that limit the prospec- tive fault current are the AC system impedance, the converter transformer leakage impedance, DC inductor and converter arm inductor where applicable. As indicated in Figure 1, if additional fault current limiting is required, it can be achieved by (i) additional devices, such as additional series inductors associated with DCCBs [34], superconducting fault current limiters (SFCL) [51][52][53]; and (ii) additional controls, such as fault current limiting control by half-bridge or hybrid MMCs [54,55] and fault current limiting control of DCCBs [23,40]. Additional inductors associated with DCCBs is a relatively mature technology compared with SFCL or fault current limiting controls. For instance, in the Zhangbei HVDC grid, 150 mH series inductors are used with each DCCB [10]. Both resistive and inductive SFCL technologies are seen as promising options for HVDC applications, although further research is necessary to improve the reliability and cost-effectiveness of SFCL technologies [5].
Fault current limiting effect using converter control depends both on the converter capability and the allowed minimum DC voltage of the grid during a fault. In HVDC grids allowing for a complete collapse of the DC voltage, the DC fault current can be controlled to zero by using FBCs [56,57]. By contrast, in HVDC grids requiring to maintain a certain level of DC voltage, DC fault current can be limited to various levels by reducing the inserted submodules or inserting negative voltages depending on the converter technologies [54,55] [58]. NCITs used for HVDC applications can provide a bandwidth up to a few MHz, which is considered sufficient for HVDC grid protection [58,59]. The IEC 61869 standards have specified the sampling frequency for digital interfaces as 96 kHz, intended for DC control applications [60]. In addition, the IEC 61869 standards were established mainly with the line commutated converter (LCC) technology in mind, and changes may be needed for VSC applications.

Protection IED
Protection IEDs play a key role in HVDC grid protection for coordinating fault clearing and recovery by monitoring the status of the HVDC grid. This section first gives an overview of the protection algorithms proposed in the literature and then summarises recent developments on protection IED implementation.

Protection algorithms
Primary protection algorithms can be generally classified into two types: local measurement-based and communication-based [61]. Local measurement-based algorithms essentially use features contained in the local measurements to identify a DC fault, whereas communication-based algorithms rely on measurements from both line ends via remote communication [62]. Furthermore, backup protection is provided to isolate the faulty element considering failures of primary components, such as the primary protection IED or the DC circuit breaker [63].
Local measurement-based algorithms often use an inductive termination of the transmission line to define protection boundaries and improve selectivity [64]. Typical fault detection criteria include overcurrent, undervoltage, current/voltage derivative, and travelling wave extraction [61]. As academic research, frequency domain-based analysis techniques have also become prominent, such as S-transform and wavelet transform [58]. Additionally, a combination of different criteria may be adopted to improve the selectivity of a protection scheme [61,64]. In recent years, data-driven approaches using advanced machine learning algorithms are seen attracting attention in an academic context, such as support vector machine [65] and convolution neutral network [66]. The fault detection speed of local measurement-based algorithms is often very fast and proportional to fault distance. However, such algorithms may experience difficulty in selectivity for long transmission lines due to attenuation of the fault signals and may require a large inductive termination to ensure selectivity [67].
Communication-based algorithms rely on information from remote ends of the transmission line to identify a fault. Basic principles are directional and differential based on current or travelling wave [61]. Directional algorithms are further divided into "blocking" and "tripping" schemes, which only identify a fault when receiving a not-block or trip signal from the remote end, respectively. Travelling wave current differential is shown to be able to achieve much faster fault detection than conventional current differential as the travelling wave effects are accounted for [68]. Furthermore, communicationbased algorithms utilizing distributed sensors along the transmission lines are proposed to improve security compared with local measurement-based algorithms, while requiring less communication bandwidth compared with travelling wave differential [69,70]. These algorithms may also be viable solutions for ultra-long lines [69]. Communication-based algorithms can provide inherent security against external faults and don't require additional inductive termination. However, their performance may be limited by communication delay and reliability. In practical applications, local measurement-and communication-based algorithms may be combined to complement one other for achieving the required speed and reliability in future HVDC grids [61].
Breaker failure backup protection algorithms are essential to prevent detrimental fault current levels in case of a DCCB failure. Several breaker failure algorithms are proposed and can be classified based on the measurements: (i) at DCCB terminal [63,71,72] and (ii) internal [73]. The basic principles used for breaker failure detection are overcurrent, undervoltage and voltage derivative. Terminal measurement-based algorithms typically can deal with different DCCB technologies, while internal measurement-based algorithms may be limited to one specific DCCB technology [72].

IED implementation
In existing point-to-point and multi-terminal HVDC systems, HVDC protection is typically implemented as an integrated part of the converter control & protection (C&P) system [74][75][76]. For HVDC grid protection, an integrated solution with the converter C&P system, stand-alone protection hardware and integration with the DCCB C&P system have been suggested in [5]. Recently, stand-alone HVDC protection IEDs are under development by various industrial vendors and research institutes [7,25,77]. The IED prototypes developed in recent research projects are shown to be able to detect a fault in well under 1 ms [25,78,79], and the protection IEDs in the Zhangbei HVDC grid operate in less than 3 ms [10].

Communication architecture and protocols
To-date, vendor-specific communication architecture and protocols are used in existing HVDC systems. Communication within an HVDC substation can be generally divided into two levels ( Figure 2): (1) local area network used for communication between substation control and monitoring with the main converter C&P system and (2) field bus used for communication between the main converter C&P system with I/O systems [29,80]. The local area network is typically based on Ethernet, although the speed may vary depending on the communication requirements and the manufacturer (e.g. Fast or Gigabit Ethernet) [29,81]. Various communication protocols are used for field bus by different manufacturers. For example, for fast control and protection applications, ABB uses eTDM and EtherCAT on direct optical fibre connections and Siemens uses PROFIBUS and high-speed optical TDM buses [29,81]. In the Zhangbei HVDC grid, the IEC 600044-8 standard with speeds of 5 and 1 Mbps is used between the station control and the DCCBs [10]. In 2018, GE launched its HVDC solution eLumina TM , which provides a fully digital system based on IEC 61850 [75]. Furthermore, the feasibility of using IEC 61850 for DC grid protection in non-selective protection strategies has been demonstrated in [82].

Converter station fault response
A converter station, consisting of the VSC together with any AC or DC switchgear and additional circuits, can lead to widely different DC fault responses. In [83], six types of converter stations have been identified based on their capabilities during DC-side faults. These capabilities are inherent to the converter station, regardless of the adopted protection strategy.
• Interruption of AC-side contribution to DC-side fault: is the minimum requirement of a converter station to be connected to an HVDC grid. This capability is necessary when deenergising an HVDC grid or providing backup protection to a line breaker failure. For an FFC, the converter-side ACCB or DCCB can be used to interrupt the AC-side contribution to the faulty HVDC grid. Alternatively, an FBC can prevent the AC-side contribution by temporarily blocking the converter or actively controlling the DC current [84,85]. • STATCOM mode operation: operating in STATCOM mode or providing reactive support during a DC fault may be required for VSC stations connected to weak AC systems to improve AC system voltage stability. Depending on the capability of the converter station, the STATCOM mode operation may be provided continuously, or be temporarily/permanently interrupted during a DC fault, regardless of the protection strategy. For example, an FBC can provide continuous STAT-COM mode operation while connected to a faulted HVDC grid; whereas the STATCOM mode capability is considered permanently interrupted for an FFC with an ACCB (FFC+ACCB) for the same condition. In the case of an FFC with a converter-side DCCB (FFC+DCCB), the STATCOM capability can be seen as approximately continuous in the viewpoint of the AC system dynamics if the DCCB has an ultra-fast opening speed or fault current limiting capability [83]. • Rectifying/inverting DC current control while connected to a faulted HVDC grid: These two abilities allow a converter station to maintain current control in either rectifying or invert- ing direction. The former may be useful for fault location or actively recharging the network for restoration [86]. The later allows for the active extinguishing of arcing faults, by reversing the DC system polarity for a short period of time [87].

HVDC GRID PROTECTION PHILOSOPHIES AND CONCEPTS
This section first summarises the classification approaches for HVDC grid protection strategies, then reviews the various protection strategies and their general fault clearing sequences.

Classification approaches
Various protection strategies and technologies have been proposed in recent years to tackle the challenges associated with HVDC grid protection [88]. Two approaches have been proposed to classify HVDC grid protection strategies: (1) CIGRE TB739 uses the scope of the protection zone [5], and (2) CEN-ELEC TC 8X uses the impact of the HVDC grid protection on the active and reactive power transfer at the points of connection of the AC-and DC-side (PoC-AC and PoC-DC) [15]. CIGRE TB739 follows the concept used in AC system protection-the extent of a protection zone-and classifies protection strategies into three main philosophies, namely nonselective, partially selective, and fully selective [5]. In this classification, selectivity is related to "selective fault clearing," and "selective fault identification" (or selectivity of the protection IED) is implied in all three protection philosophies. In the non-selective protection philosophy, the whole HVDC grid is treated as one protection zone, which leads to de-energisation of the grid if any DC fault occurs (Figure 4(a)). ACCBs, converter-side DCCBs and FBCs have been proposed for fault current interruption, and HSSes or low rating DCCBs (slow-speed with very low energy dissipating capability) are used at the line ends to provide isolation or to assist fault clearing, respectively [45,86,[89][90][91][92][93]. The fully selective protection philosophy uses the same approach as in AC system protection, in which each line is protected individually by DCCBs (Figure 4(b)). The partially selective protection philosophy splits the HVDC grid into multiple sub-grids using DCCBs or DC/DC converters with fault interruption capability, and the loss of the whole grid is avoided by isolated the healthy subgrids from the faulted one ( Figure 4(c)). As illustrated in Figure 4, the fundamental difference between these philosophies lies at the scope of a protection zone, namely, the whole HVDC grid, a sub-grid, or a line. Various types of converter stations and fault interruption equipment can be used to form a fault clearing strategy following one of the three philosophies [88].
An alternative classification followed in CENELEC technical specification CLC/TS 50654-1 is to define the impact of the protection at all PoC-ACs and PoC-DCs for a given AC/DC system [15]. Six main concepts are proposed: continued operation, temporary stop and permanent stop of active/reactive power (CO-P, TS-P, PS-P, CO-Q, TS-Q, and PS-Q). A protection matrix, describing the impact on all PoC-ACs and PoC-DCs of all faults targeted by the protection system, is used to visualize the impact of a fault clearing strategy. The time duration associated with these concepts is AC system dependent. A permanent stop corresponds to the protection of existing pointto-point links, de-energising the whole system using ACCBs. In contrast, the durations of temporary stop and continued operation are much shorter or negligible from the viewpoint of AC system dynamics.
This paper primarily follows the CIGRE approach to discuss multi-vendor interoperability of HVDC grid protection as it allows for a generic protection system design for HVDC systems connected to any type of AC systems. The protection matrix of the CENELEC approach can be used to specify AC system constraints to derive the functional requirements of HVDC grid protection in order to achieve interoperability.

HVDC grid protection strategies
A review on HVDC grid protection strategies is summarized in Table 1, classified into three groups: NS, FS, PS corresponding to non-, fully and partially selective philosophies, respectively. The most simple implementation of a non-selective protection strategy is using ACCBs to de-energize the DC system and HSSes to isolate the faulty line [94]. The fault clearing speed of such a strategy is limited by the opening speed of ACCBs and the decay constant of the fault current once the ACCBs have opened. FBCs, such as FB-MMCs [45,47,93], alternate arm converters (AACs) [86] and hybrid MMCs [95] are used to quickly limit fault current. Furthermore, HSSes with a low counter-voltage capability [45] or low-rated DCCBs [86,93] in terms of speed and energy capability can be used to improve fault clearing speed. An alternative strategy uses lowspeed DCCBs at the line and converter terminals to clear the fault non-selectively [90,91]. The required breaking current of these low-speed DCCBs can be significantly reduced if current limiting devices are used [90].
Various DCCB technologies have been studied following a fully selective protection philosophy [26,27,[96][97][98][99]. The performance of a fully selective protection strategy may vary largely depending on the adopted DCCB technology, the fault current limiting devices, and the converter technology. High-speed DCCBs are likely to require smaller limiting inductances while ensure continuous operation of the HVDC grid during DC faults [96,98]. Recent work focuses on (i) optimizing DCCB  [104] aHSSes with small TIV capability is designed to speed up the fault current separation [45]. bDCCB at the converter terminal may also be used to provide selective breaker failure backup protection [27]. cMixed HB-MMC and FB-MMC is studied to analyze the impact of fault current control using FB-MMC in a fully selective strategy [104]. dThe DC voltage in the healthy zone can be maintained almost constant using FCL operation of hybrid DCCBs.
Partially selective protection strategies have not been studied to the same extent as the other two strategies. Analysis on maintaining DC voltage in healthy sub-grids is provided using hybrid DCCBs with FCL capability [39]. System recovery performance is investigated using fast DCCBs to split the grid [103,104].
For small-scale HVDC systems, non-selective protection strategies such as proposed in [45,86,91,93] may be able to achieve similar system restoration performances as fully selective protection strategies, as summarized in Table 1. However, the latter is likely to be applicable in large-scale HVDC grids, while the former may be limited to only small to medium systems since (i) the system recovery speed is likely to increase as the system expands and (ii) the impact of de-energizing a largescale HVDC grid on the neighbouring AC systems may not be acceptable. Partially selective protection strategies may provide cost-effective means to build large-scale HVDC grids in a stepby-step manner as they allow connections of HVDC grids with different protection philosophies.

DC fault clearing sequences
This section presents general fault clearing sequences of the three main protection philosophies based on protection studies presented in the literature [27,48,86,88,91,93]. In a fully selective protection strategy, fault detection and discrimination are initiated upon the arrival of the fault initiated travelling wave at the measurement position [27,88].
Fault interruption occurs after the faulty line is discriminated. The fault interruption process includes breaker opening and fault current suppression. The breaker opening speed primarily depends on the DCCB technology, while the fault current suppression time depends both on the breaker and the HVDC system. Power flow restoration can be started after fault current interruption. Note that in the case of a pole-to-ground fault in high-impedance grounded systems, pole rebalancing is a necessary step before power restoration.
In contrast, in a non-selective protection strategy, fault interruption can start as soon as the fault is detected, and fault discrimination may take a longer time [48,86,91,93]. Once the fault current has decayed below the residual current level of the HSSes [48,91] or the low rating DCCBs [86,93], they can be opened to isolate the faulted line. Thereafter, the circuit breakers are reclosed where applicable. In all non-selective strategies, recharging the network is a necessary step to build up the DC voltage and restore power flow. In case of a pole-to-ground fault in high-impedance grounded systems, pole voltages may be rebalanced before/after fault isolation depending on the implementation of the strategies [48,50,86].
A partially selective protection strategy-assuming nonselective protection strategies are used within the sub-gridsinvolves separating the faulty sub-grid from the healthy part, fault isolation and restoration in the faulty sub-grid, and reconnecting the sub-grids to restore the power flow. Fast fault detection and separation are needed at the interface to ensure minimal impact on the healthy part of the HVDC grid. Similar to a fully selective protection strategy, non-unit protection algorithms can be used in a partially selective protection strategy, with the help of series inductors to separate the protection zones [108]. In the faulty sub-grid, a typical fault clearing follows the sequence of a non-selective protection strategy. Reconnecting the sub-grids can be made when the faulty sub-grid is recovered so that the voltages at the two terminals of the interface equipment (DCCB or DC/DC converter) are close enough. Thereafter, power flow can be restored.
For future HVDC grids, it might also be interesting to consider a partially selective strategy connecting sub-grids with both non-selective and fully selective protection strategies. An example is a small system connecting to a large-scale meshed HVDC grid. A non-selective protection strategy may be justified for the small system assuming the impact on the AC systems is acceptable. In such a case, the consequences of DC faults depend on the fault location and the adopted protection strategy in the faulty sub-grid. Any DC fault in a non-selective protected subgrid leads to a separation of the sub-grids by operating the interface equipment and de-energisation of the faulty sub-grid. By contrast, if a DC fault occurs in the sub-grid with a fully selective protection strategy, the fault clearing only involves the isolation of the faulty line and power flow restoration.

PRE-STANDARDISATION ON HVDC GRIDS
Compared with AC protection, standardisation on HVDC protection is still in its initial stage. International standards on HVDC protection have only been established for instrument transformers (the IEC 61869 series). Recent efforts are focusing on pre-standardisation by CIGRE and CENELEC in Europe and national standardisation in China.

Pre-standardisation by CIGRE and CENELEC
In the past decade, CIGRE and CENELEC have made great progress in establishing guidelines and pre-standardisations for HVDC systems in order to enable multi-vendor grid development. In particular, the following works are related to HVDC grid protection: • CIGRE TB657 Guidelines for the preparation of "connection agreements" or "Grid Codes" for multi-terminal schemes and DC Grids: proposes a technical guideline for the development of a DC grid code with a focus on planning, building and operating a DC grid [13]. • CIGRE TB739 Protection and local control of HVDC grids: provides basic concepts and general requirements related to HVDC grid protection. In particular, this technical brochure classifies protection strategies into three main protection philosophies based on the scope of the protection zone. Furthermore, an in-depth review of key protection equipment, such as fault current limiting devices, protection algorithms and IEDs is provided [5].

National standards in China
National standards have been developed to cope with the development of multi-terminal HVDC systems and the first HVDC grid in China [8,9,114]. Although these projects adopted a scheme using a single-vendor C&P system for the overall HVDC systems, relevant Chinese national standards may still provide valuable insights for a complete multi-vendor scheme. Two series of national standards on HVDC grids have been established: • GB/T 22390.    [18].
In summary, the work done by CIGRE and CENELEC has clarified the fundamental philosophies and concepts of HVDC grid protection and provided a technical framework for harmonizing critical timing definitions of DCCBs by analysing interruption characteristics of various DCCB technologies. The ongoing work on specifying technical requirements and testing methods of DCCBs by CIGRE JWG A3/B4.80 is expected to further accelerate standardisation on DCCBs [17]. The guidelines and technical specifications from CIGRE and CENELEC together with the Chinese national standards are regarded as key inputs to IEC TC115 and TC17 to establish international standards on HVDC grids [115][116][117].

MULTI-VENDOR INTEROPERABILITY IN HVDC GRID PROTECTION
Interoperability has first been used in information technology and has since then expanded to various fields. According to the IEEE Standard Computer Dictionary [118], interoperability is defined as "the ability of two or more systems or components to exchange information and to use the information that has been exchanged." The key in this definition is that the exchange and the use of information are required. However, this definition may not be directly applicable to HVDC grid protection, as components in an HVDC grid are not only coupled informatically but also electrically. This section discusses the scope of multi-vendor interoperability in HVDC grid protection and the design methodologies to achieve multi-vendor interoperable HVDC grid protection.

Scope of multi-vendor interoperability in HVDC grid protection
The expectation from the end-users (such as transmission system operators, TSOs) on multi-vendor interoperability in an HVDC grid is the capability of "plug-and-play." However, interoperability in HVDC grids may not be guaranteed by design even with detailed functional requirements due to the complex interactions of control and protection. Consequently, interaction studies will be mandatory to assess and enhance the level of interoperability [7]. Interoperability in HVDC grid protection would require the HVDC grid protection system to allow a protection component or system from any vendor to be put into the system and achieve the required functionalities at component and overall protection system levels, with or without directly exchanging information. In addition, such a multi-vendor solution should entail a straightforward engineering cost, which does not favour any particular technology.
Defining the exact scope of multi-vendor interoperability in HVDC grid protection is, however, more complex than what is considered in information technology or AC system protection. A common consensus on the scope of multi-vendor interoperability in HVDC grid protection is yet to be reached. First attempts have been made in [28,119,120]. In [28], a multivendor interoperability model focusing on technological aspects is proposed by comparing key differences with AC protection. [119,120] discusses a wide definition of interoperability including both technical and non-technical aspects.

5.1.1
Technological interoperability Three fundamental differences are identified between AC and DC protection, namely: (i) the possible co-existence of multiple protection philosophies in one HVDC grid; (ii) the extended scope of protection equipment including not only DCCBs but also converters, and fault current limiting devices, and so on; and (iii) the extended scope of the fault handling process including system restoration [28]. These fundamental differences would demand additional requirements to achieve multivendor interoperability in HVDC grid protection. In [28], a three-dimensional multi-vendor interoperability model for HVDC grid protection is defined aiming at dealing with the three aforementioned differences from AC protection. An analogy was made in [28] between the interoperability model of smart grids and HVDC grids, considering that both systems are not built starting from scratch, but rather emerging through a transformation of the power system. Similar to the threedimensional smart grid interoperability model, three dimensions are defined for HVDC grid protection including (i) the protection philosophy (instead of zones as in the smart grid interoperability model), (ii) interoperability layers and (iii) domains [121]. The threedimensional model of multi-vendor interoperability in HVDC grid is shown in Figure 5, which illustrates the various elements need to be specified.

Dimension 1: Protection philosophy
The main driver for the co-existence of multiple protection philosophies is that the applicable protection philosophy for a certain HVDC grid depends on the impact of the protection on the connected AC systems [88,122]. For instance, de-energising a small multi-terminal system due to a DC fault may be acceptable to the continental European system. However, an HVDC grid of a similar size may be required to be selectively protected if connected to the British or Irish grid. A future interconnection of these grids would require that HVDC grids with different protection philosophies can be connected and interoperable with each other. Since the operational principles and impacts of each protection philosophy are substantially different, multivendor interoperability in HVDC grid protection can only be meaningfully defined specifically within one protection philosophy (such as non-selective or fully selective) or among different protection philosophies using a partially selective protection strategy to split the grid.

Dimension 2: Interoperability layers
In the smart grid interoperability model, five layers are defined: business, function, information, communication and component [121]. For interoperability in HVDC grid protection, function, information, communication, and electrical interface layers are defined, as HVDC grid protection is not likely to have complex business and market models compared with smart grids.
• The function layer ensures the functional performance of HVDC grid protection by defining the functional requirements to which a component or system must comply. In this layer, it is essential to define the functional requirements of individual components and the behaviour of the overall HVDC grid during DC faults. Furthermore, it is necessary to define the interfacing components and the behaviour of sub-grids in a partially selective protection strategy, so that smaller HVDC grids can be connected to form a large HVDC grid without compromising the performance of the overall HVDC grid protection system. The key aspects need to be addressed in terms of the overall HVDC system or sub-grid behaviour including maximum fault current level, maximum DC-side overvoltage, fault clearing time, restoration times and levels of DC voltage, active power, and reactive power. In an HVDC grid protection strategy, function requirements of both protection and restoration equipment should be specified to achieve the required fault response of the HVDC grid. Key components include measurement devices, IEDs, fault interruption/isolation equipment (such as DCCBs, FBCs or HSSes depending on the protection strategy), pole rebalancing equipment, converters and AC-/DC-side pre-insertion resistors (PIR). • The information layer defines the information that is being exchanged between two components or systems. This includes defining common sets of input/output signals and a data format. • The communication layer defines the communication protocols and architecture for exchanging information between the various components. A key aspect is to specify the required communication speed and reliability for both local and/or remote communication to guarantee the performance of HVDC grid protection. The communication and information layers provide the ability of two or more components or systems to exchange data and to use the exchanged data for realising the desired functions, namely achieving syntactic and semantic interoperability. • The electrical interface layer ensures basic connectivity by defining voltage, current and power ratings of all equipment for continuous operation and withstand abilities for short-and long-time operation. The electrical interface interoperability allows electrical equipment to be connected in the same power system without being subjected to damaging electrical stresses. This requires the equipment to have the same ratings for normal operation and temporary overcurrent/overvoltage withstand abilities.
Interoperability at these four layers ensures that the HVDC grid protection system allows two or more components or systems to connect electrically, perform data exchange, make use of the exchanged data and achieve the required functionalities.

Dimension 3: Interoperability domains
In the smart grid interoperability model, the different interoperability domains are divided into generation, transmission, distribution, etc. This dimension is mapped in HVDC grid protection into (i) interoperability of components which perform the same functions, including protection and restoration, (ii) interaction between different components which perform different functions, and (iii) interoperability between sub-grids at a system-level.
In an HVDC grid, fault current interruption can be achieved not only by ACCBs but also DCCBs, FBCs or DC/DC converters using various protection philosophies. Limiting the rateof-rise and/or the magnitude of the fault current is necessary for fault current interruption using DCCBs [16,[123][124][125]. These extended functional requirements expand the scope of HVDC grid protection equipment to a wider range, not just to DCCBs but also to other devices such as FBCs and current limiting devices. It is thus necessary to identify all the components involved in a given protection philosophy and to define potential multi-vendor interoperability issues between these components.
Furthermore, the protection and control components, such as fault current limiting devices, VSCs and DCCBs are closely coupled with one other. For instance, the series line inductances associated with the DCCBs have significant impact on the DC fault-ride-through (DC-FRT) behaviour of the VSCs, primary protection algorithm design and DCCB requirements. It is thus necessary to ensure interoperability of components which perform different functions, as both the main circuit parameters and control responses of these components may vary depending on the vendor.
Although out of the scope of AC system protection, system restoration is a necessary and integrated step of a DC protection strategy. In AC systems, a transmission line fault typically only involves fault detection and fault clearing. The rest of the AC system "automatically" recovers once the fault is cleared. In other words, the healthy part of the AC system is required to ride through the AC fault. In HVDC grid protection, after fault clearing, further actions may be required to restore the power flow. Particularly in non-selective or partially selective philosophies, the strategy to recharge the DC network and restore the power flow is crucial to avoid unacceptable impacts on the AC systems due to prolonged power flow interruption [126]. In a fully selective protection philosophy, it is essential to define the DC-FRT requirement of the converters, so that the system can be restored in a timely manner to maintain stable operation. Moreover, removing overvoltage following a pole-to-ground fault in high-impedance grounded HVDC grids is indispensable for protecting DC-side components against overvoltages and restoring the DC voltages [26]. As a result, it is necessary for relevant standards or a future HVDC grid code to define functional requirements at the system level, for example, DC voltage and power restoration time, to fulfil the constraints from the hybrid AC/DC system.

Broad interoperability scope
Although the interoperability challenges discussed in [119] focus on HVDC control issues, these general aspects can also be applied in HVDC grid protection. In [119], functional, integration and organisational and contractual levels are considered necessary to achieve interoperability. The integration level deals with interoperability when integrating control and protection pieces of different control layers to real hardware and software. The organizational and contractual level ensures organisational and contractual aspects being designed to achieve interoperability.
Recently, ENTSO-E has published the third position paper on offshore development focusing on interoperability [120]. This position paper distinguishes technical and legal interoperability issues. The technical aspects include (i) functional and operational requirements, (ii) demonstration in target environment, (iii) power system engineering and (vi) planning and standardisation of system and equipment. The legal aspects include (i) intellectual properties, (ii) Contractual relations and warranties and (iii) regulation and legal framework.

Summary
Based on these concepts proposed in recent literature, iterations are likely needed to reach a consensus on the scope of multivendor interoperability in HVDC grid protection. Considering the complex nature of developing an HVDC grid, interoperability frameworks including both technical and non-technical aspects at each stage are necessary to achieve a high interoperability level.

Design methodologies for multi-vendor interoperable HVDC grid protection
The complexity of multi-vendor interoperability in HVDC grid protection calls for fundamental protection system design methodologies to ensure that HVDC grid protection can achieve interoperability through design and can deal with fastevolving AC/DC systems. Recent literature focuses on (i) coordinated design of DCCBs in fully selective protection strategies [97,98,127,128] and (ii) high-level frameworks for HVDC grid protection system-level design [28,129].

5.2.1
Coordinated design of DCCBs in fully selective protection strategies The fault current limiting inductors associated with DCCBs are key parameters when designing HVDC grid protection and control systems, since these inductances have a significant impact on the selectivity of fault detection algorithms, converter DC-FRT behaviour, HVDC grid stability and protection coordination between DCCBs and protection IEDs [28]. However, the main parameters of the DCCBs and converter DC-FRT behaviour are interdependent with one another so that changing one will have an impact on the rest of the parameters. This means multiple sets of solutions may exist to achieve the required converter DC-FRT behaviour and system restoration speed. A multi-objective optimization approach has thus been taken to coordinate the design of DCCBs in HVDC grids [97,98,127,128].
Both time-domain simulations [127,128] and analytical approximations [97,98] are used to find the optimal sets of parameters, such as inductance, breaker opening time, breaker interruption capability and breaker energy absorption capability. A multi-objective genetic algorithm (GA) is proposed in [127] to optimize key parameters of a hybrid DCCB using a combined Matlab-EMTP implementation. Although the timedomain simulation-based approach can give accurate calculations, it requires intensive computational resources even when dealing with simplified models of the point-to-point HVDC systems [127]. The analytical approximations typically give a good approximation for DCCBs with very fast operating speed, as the converters may not be blocked in this time frame. However, it is difficult to obtain analytical approximations when DCCBs with slow operating speeds are considered [98].
In [98], three converter DC-FRT scenarios are classified based on the converters operation requirements during DC fault conditions. The requirements of DCCBs are then discussed for each converter DC-FRT scenario. To prevent all converter from temporary blocking, large inductances and fast operating DCCBs were found necessary. By contrast, allowing temporary blocking of converters reduces the requirements for the line inductors [98]. A consensus on the required DC-FRT behaviour of converters is necessary to provide guidelines to coordinate the design FIGURE 6 A generic design approach for DC line protection in point-to-point and multi-terminal HVDC system with a single-vendor scheme of DCCBs, fault detection algorithms, and converter internal control and protection [17]. Furthermore, a combination of both time-domain simulations and analytical optimization approaches may be necessary to mitigate the common trade-off between speed and accuracy.

5.2.2
High-level frameworks for HVDC grid protection system-level design Currently, for point-to-point and multi-terminal HVDC systems, DC protection systems are typically designed following a non-selective protection strategy with a single vendor scheme with the exception of recent Chinese projects. Designing a protection system with the possibility of various protection strategies for HVDC grids with a complete multi-vendor scheme is a very challenging task. This section first reviews protection system design approaches for existing HVDC systems using a single-vendor scheme. Then, recent progress on high-level frameworks to design HVDC grid protection supporting multivendor grid development is summarized.

HVDC system protection design with a single-vendor scheme
A generic design approach for DC line protection in point-topoint and small-scale multi-terminal HVDC systems is illustrated in Figure 6. Typical requirements from the AC systems allow for a permanent stop of active and reactive power transfer of the whole HVDC system. The constraints on HVDC protection primarily come from the HVDC system itself, such as the overcurrent and overvoltage constraints of the converter and the transmission line. In these single-vendor schemes, the vendor typically has the freedom to design the HVDC C&P system using vendor-specific implementations to fulfil the system constraints. For instance, current limiting inductances such as the arm reactor and transformer impedance can be selected to limit the maximum fault current level exposed to the converter during a DC fault [29,130]. Surge arresters are chosen to have the desired overvoltage protection levels to protect the components against overvoltages.
The main factors that influence the choice of DC line protection include HVDC configuration, grounding scheme and transmission line type. In particular, for overhead line-based or mixed overhead line and cable systems, fast automatic recovery is typically required, considering that overhead lines are subjected to temporary faults. Different recovery strategies may be adopted depending on the vendor, such as recharging from the AC-side [131] or DC-side [132]. The power flow recovery time is typically in the order of one second, considering a de-ionization time of a few hundred milliseconds [131][132][133]. On the contrary, the power flow is interrupted for a much longer time for cablebased systems as repairing the faulty section can take days to months [134,135].
A combination of fault detection principles can be selected to identify a DC line fault, such as DC undervoltage, voltage unbalance, DC overcurrent and current differential [5]. For mixed overhead line and cable systems, a distinction between faults on overhead line and cable sections is made so that automatic recovery sequence can be initiated accordingly [132]. The converters are blocked as soon as a DC fault is detected to prevent overcurrent in the power electronic switches and further discharge of the submodule capacitors.
Standardised ACCBs are used in point-to-point and multiterminal HVDC systems for fault interruption with an opening time of 40 to 80 ms [136]. DC current and voltage transformers with high bandwidth are typically used to capture the fast transients for fault detection. Protection thresholds can then be calculated considering the worst fault location and operation conditions. Rigorous tests using offline and online simulations and/or staged faults in real systems are then carried out to validate the performance of the protection system [131,132].
To fulfil the functional level requirements, existing DC protection system design approaches (e.g. Figure 6) may be applicable during the initial grid development stage when a nonselective protection strategy using ACCBs can be used. However, existing protection design approaches face challenges when different technologies or protection strategies are used. For instance, existing protection design approaches cannot deal with the scenarios when mixed converter station types (e.g. FFC+DCCB and FBC) are used in a non-selective protection strategy or when partially selective or fully selective protection strategies are required.

HVDC grid protection design with a multi-vendor scheme
HVDC grid protection design considering the various protection strategies is discussed in [28,129]. [129] outlines the key aspects of design cost-effective and reliable HVDC grid protection as (i) determine the likelihood of faults in the system, their impact and the type of equipment available for fault clearing; (ii) determine the constraints of the connected AC systems and FIGURE 7 Protection system design framework supporting multi-vendor grid development (FS/PS/NS: fully/partially/non-selective protection strategy) [28] the HVDC grid itself to derive the functional requirements of HVDC grid protection. First, the overall design of the HVDC grid, such as the HVDC grid topology, power rating of converters, system configuration and grounding and the transmission line types determines the probability of faults in the system and their impact without HVDC grid protection. A risk analysis of different faults can be used to determine which type of faults should be dealt with by HVDC grid protection. Faults which lead to unacceptable impact or unacceptable risk should be dealt with priority, while faults with acceptable impact or extremely low risks may be dealt with lower priority, such as using secondary protection means. Once the fault types and fault clearing equipment are determined, the functional requirements of HVDC grid protection can be defined based on the constraints to ensure the secure operation of AC/DC systems. For instance, the maximum power loss during a DC fault should be limited to avoid frequency deviation specified by AC grid codes. Furthermore, HVDC grid protection may be required to ensure the continued operation of the HVDC grid itself. This in turn determines the voltage level to be maintained during a DC fault and converter DC-FRT behaviour.
A high-level HVDC grid protection design framework is proposed in [28], focusing on functional level interoperability. Five steps as shown in Figure 7 are proposed to specify the functional requirements of the HVDC grid system to achieve functional interoperability during the initial design/planning of an HVDC grid, system extension, refurbishment of key components, and changes in the AC system constraints.
Step 1: Given an HVDC grid topology and its connected AC systems, the first step is to obtain the AC system constraints on HVDC grid protection, in terms of allowed active and reactive power interruption. Note that for AC system extension to DC systems, similar requirements will be given. The protection of an HVDC grid can result in loss of active and/or reactive power to the AC systems, which could influence the stability of the AC systems. The HVDC grid protection strategy impacts the frequency, rotor angle, and voltage stability of the connected AC systems [137][138][139]. The constraints on frequency operation limits and rotor angle stability impose the maximum magnitude and duration of active power loss and the minimum post-fault power level per AC system. The voltage stability is related to the reactive power capability of the converter stations, which depends on both the choice of the converter station and the HVDC grid protection strategy. For a weak AC system, it could be important to regain reactive power support or provide nearly continuous reactive power support throughout the fault to improve the voltage stability [139].
AC system constraints, in terms of inertia and stability requirements, may significantly or fundamentally change since conventional power units are gradually replaced by converterinterfaced renewable generation units [140]. Depending on the cost, benefit, and technology readiness, novel control and protection solutions to adapt AC systems to large-scale HVDC grids may be an alternative way to achieve the required reliability of the hybrid AC/DC system in the future.
Step 2: The protection strategy and applicable converter station types are selected based on the constraints from the AC systems.
In general, if the maximum allowed active power loss ΔP loss of the AC system is larger than the total capacity of the converters connected to the AC system, any protection strategy following one of the three protection philosophies are applicable, as deenergising the whole HVDC grid is acceptable to the AC system. In such a case, the most cost-effective protection strategy could be selected. If losing the whole HVDC grid is no longer allowed by the AC system constraints or economically infeasible, a partially selective or fully selective protection strategy needs to be applied.
The converter station types suitable for the protection strategy should be selected to fulfil active and reactive power requirements at each PoC-AC. In particular, as discussed in Section 2.3, different converter station types may provide continued, temporarily, or permanently interrupted reactive power support, regardless of the adopted protection strategy. The suitable converter station type can thus be selected per PoC-AC based on the reactive power support requirement of the AC connection point.
Step 3: Based on the AC/DC system constraints, this step specifies the functional requirements of the HVDC grid protection. For a partially selective strategy, the functional requirements of the HVDC grid and its sub-grids should be specified. For an HVDC grid using a fully selective protection strategy, maintaining a stable operation following a DC fault is likely to be required by the HVDC grid itself [141]. The continued operation requirement from the HVDC grid is likely to coincide with the transient loss constraint from the AC systems as discussed in Step 1. Consequently, maintaining DC voltage lev-els and converter DC-FRT are required to fulfil the DC grid constraints.
Step 4: For the protection strategy used in the HVDC grid or sub-grid, this step identifies all key components involved in the protection process and defines their functional requirements to achieve multi-vendor interoperability. If a partially selective strategy is used for protecting the HVDC grid, it is necessary to define the functional requirements of the interfacing components. The aim of a partially selective strategy is in principle to separate the sub-grids so that DC faults in one sub-grid have minimal impact on the healthy sub-grids. This implies that separating the sub-grids needs to be very fast, which requires fast fault detection IEDs and fault separation equipment.
Step 5: Define the qualification indicators or validation methodologies for the functional requirements of the HVDC grid and all the key components. In an ideal scenario, international standards are used for qualification. Due to the lack of standardisation in HVDC grid protection today, qualitative comparison of different solutions from multiple vendors, offline and/or on-line simulation, or qualification tests can be used as alternatives until relevant standards are established.
These high-level HVDC grid protection design frameworks provide useful guidelines when building multi-vendor interoperable HVDC grids. However, further research is seen as necessary to specify the AC/DC system constraints on HVDC grid protection.

MULTI-VENDOR HVDC GRID PROTECTION: CHALLENGES AND FUTURE RESEARCH NEEDS
Based on the literature review in Sections 2 to 5, this section identifies the challenges and future research needs for achieving multi-vendor interoperability in HVDC grid protection.

Challenges
This section first elaborates the main challenges associated with the four interoperability layers discussed in Dimension 2: Interoperability layers. Then particular challenges blocking interoperable HVDC grid protection are discussed considering stepby-step grid development.

Electrical interface interoperability
New challenges arise in multi-vendor HVDC grids when specifying the ratings for continuous operation and short-/long-time withstand abilities, particularly due to: (i) complex control interactions and operation modes especially with different converter technologies and control implementations [7], (ii) various converter transformer configurations and grounding schemes [136,142], (iii) novel fault interruption equipment with unique operating principles and a wide range of main circuit parameters such as the transient interruption voltage (TIV) of DCCBs and inductor sizes [16], and (iv) multi-vendor DC-side overvoltage protection equipment such as surge arresters and dynamic braking systems.

Functional interoperability
Specifying the functional requirements of the HVDC system and components during DC faults is considered the most challenging aspect related to multi-vendor interoperability in HVDC grid protection. First of all, the specification of functional requirements of HVDC grid protection poses a challenge as a stable operation of the hybrid AC/DC system must be guaranteed. Such a specification must consider constraints from the AC/DC system in its current form and due to future expansions/changes, existing technologies and future development. A comprehensive list of AC/DC interaction studies including both electromechanical and electromagnetic dynamics needs to be developed to specify the functional requirements of the overall protection system and its components.
Second, specifying the DC fault response or DC-FRT requirement of the converter stations is needed to fulfil the constraints from the AC system and the HVDC grid protection strategy. This is challenging because of the large variations of converter technologies in combination with switchgear or auxiliary devices [83].
Third, the availability of numerous DCCB technologies complicates HVDC grid protection since: (i) the series line inductors associated with DCCBs have implications on the converter C&P system design, HVDC grid stability, protection algorithms design and DCCB requirements. A generic approach considering all relevant constraints is thus necessary particularly when designing a multi-vendor HVDC grid. (ii) A wide range of functions is provided by hybrid (or power electronic) DCCBs. It is necessary to specify which functions may be used to ensure interoperability between these DCCBs and other equipment. (iii) Interactions of DCCBs with converters and other equipment need to be investigated to avoid adverse impact.
Fourth, functions of DC protection IEDs are more complex than those in point-to-point HVDC systems or AC protection IEDs. From a functional point-of-view, the IEDs used for protection and post-fault restoration in an HVDC grid can be categorised into three groups: line protection, substation and master IEDs, as illustrated in Figure 8. These functionalities need to be standardised for each protection philosophy in order to achieve functional level interoperability of protection IEDs.
• Line protection IED: responsible for identifying the faulty line, ordering opening/closing of the associated fault interruption equipment (such as DCCBs or HSSes), collecting the status of the fault interruption equipment, and communicating the status to the substation IED. As shown in Figure 8, a DC line protection IED will interface with local measurement devices, the associated fault interruption equipment (e.g. DCCB or HSS in a fully selective or non-selective protection strategy), the substation IED, the adjacent IEDs for In addition to fault detection for long transmission lines, another challenge for line protection IEDs is coordination with DCCB functions. As discussed in Section 2.1.2, some DCCB technologies provide breaker-level fault detection and protection functions, such as self-protection, breaker failure internal detection and driver-level protection [143]; therefore, coordination between line protection IEDs and various DCCB technologies is necessary to ensure interoperability between IEDs and DCCBs. • Substation IED: responsible for coordinating protection and control actions at the substation level (such as with the converter C&P system, AC-and DC-side pole rebalancing devices in high-impedance grounded systems) and communicating with the master IED for restoration. Furthermore, the substation IED may also be in charge of tripping/reclosing the ACCB or the converter-side DC switchgear if present. Alternatively, dedicated IEDs may be implemented and interfaced with the substation IED to achieve these functions. • Master or grid-level IED: can be used to coordinate the recovery sequence and send new operation setpoints in case of a permanent fault. The master IED may be implemented as part of the coordinated HVDC grid control which oversees control coordination of the HVDC grid.

Syntactic and semantic interoperability
Protection IEDs play a key role in HVDC grid protection for fault detection and coordinated recovery by interfacing with other IEDs and the associated primary equipment. Standardising these interfaces, the data format and communication protocols are necessary to achieve interoperability in HVDC grid protection.
Although at this moment it is still not clear which communication architecture and protocols will be used for HVDC substations and HVDC grid protection, one possible solution is to adopt a structure similar to the one defined by IEC 61850 (Figure 9), but with higher requirements on communication speed and bandwidth [3]. The current IEC 61850 standard supports 80 samples/cycle for sampled values and maximum 3 ms delay for generic object-oriented substation event (GOOSE)

FIGURE 9
An example of digital DC substation protection and control architecture based on IEC 61850 [3] message. However, fast communication is likely to be required for both local and remote communication in HVDC grid protection: • Local communication: High speed and bandwidth are required for communications within the HVDC substation to collect high fidelity measurements for protection and to enable fast fault clearing. The existing 3 ms delay for GOOSE messages will not be feasible for HVDC grid protection when high speed communication is required, particularly in fully selective protection strategies. Considering the operating times of line protection IEDs and DCCBs are in the order of milliseconds, the communication delays between the IEDs and DCCBs are expected to be much shorter. It is likely that HVDC grid protection will require several 10s of ksamples/s for sampling and hundreds of microseconds for sending GOOSE messages to achieve fast fault clearing [3,144]. • Remote communication: High speed, bandwidth and reliability communication is required between remote substations to realise communication-based protection algorithms and post-fault recovery coordination. In particular, in nonselective protection strategies, communication may play a key role in coordinating post-fault recovery [44]. Communication delay and reliability are the key challenges to be tackled to ensure safe and stable system recovery.
Moreover, communication requirements are likely to be different depending on the protection strategies. Relevant system studies need to be carried out in order to specify the communication requirements within a substation and between remote terminals considering different protection strategies.

6.1.4
Challenges during HVDC grid protection system planning Another challenge blocking interoperability in HVDC grid protection is optimal system design considering long-term planning. Although different protection strategies can be applied to an HVDC grid at different stages to fulfil the AC/DC system requirements, it may not be straightforward to convert a nonselectively protected grid into a fully selectively protected one simply by replacing HSSes with DCCBs. This is because the functional requirements of the protection IEDs, converter stations, communication, and key components are drastically different in the various protection strategies. In addition, physical space considerations may also be a constraining factor [93]. A comparison of the required functions in the various protection strategies is summarised in Table 2.
In non-selective and partially selective protection strategies, the converter stations are required to actively participate in fault clearing by preventing AC-side contributions to a DC fault and to recharge the DC network. On the contrary, in a fully selective protection strategy, the converter stations are "passively responding" to a DC fault and are required to ride through the DC fault. Moreover, as additional series line inductances are used in a fully selective protection strategy, the control bandwidth of the converters may vary from those in a non-selective protection strategy [145].
A master IED is essential for restoration in non-selective and partially selective strategies. The requirements on the communication speed and bandwidth between the substation IEDs and the master IED are expected to be very high to achieve the required restoration time. However, the function of the master IED and associated communication requirements in a fully selective protection strategy are expected to be low as restoration is achieved primarily by local controls. Fast fault discrimination is crucial in partially selective and fully selective protection strategies. For local measurement-based fault detection algorithms, fast substation level communication is required [144]. If communication-based fault detection algorithms are used in a fully selective protection strategy, the required speed of remote communication between two line protection IEDs is expected to be much higher than those in non-selective protection strategies.
HVDC grid protection system design should consider a long planning horizon to determine the most appropriate protection philosophy and anticipate future interconnections. If expansions to a large-scale HVDC grid are not planned, nonselective/partially selective protection strategies could be viable options from a techno-economic point-of-view. Otherwise, it may be beneficial to apply a fully selective protection strategy from an early development stage to ensure multi-vendor interoperability, considering the technical difficulties and cost to convert non-selective/partially selective protection strategies to a fully selective one.

Future research needs
Although major progress has been made in HVDC grid protection, particularly on the realization of fast DCCBs and FBCs, further research is seen necessary to tackle the main challenges identified in the previous section in order to achieve interoperability at all four layers and establish relevant standards. In particular, the following topics are considered deserving further attention.

6.2.1
New methodologies for quantifying functional requirements As discussed in Section 5.2.2, protection and system restoration studies have been provided in the literature on non-selective and fully selective protection strategies [26,27,48,91]. However, these studies have focused on specific implementations with a set of fixed system parameters. Therefore, the results may not be adequate to deal with the generality of a protection philosophy for ensuring technical neutrality. General methodologies need to be developed to define the system studies required to quantify the functional requirements in the first four steps of the proposed framework. These system studies include: (i) AC system impact studies to derive the AC system constraints and (ii) protection and restoration studies to specify the functional requirements of the protection system and its components. Further effort is especially necessary to standardise the DC-FRT requirements of converters, the functionalities of DCCBs and IEDs in each protection philosophy.

6.2.2
Standardised validation tests for de-risking interoperability issues Although "plug-and-play" is a desired feature of an HVDC protection system from the end-users, validation studies are considered necessary to verify that components from multiple vendors can achieve the desired level of interoperability [7]. New methodologies should be developed to define the necessary dynamic studies to validate the level of interoperability of a given protection system or component. In such a way, the risk of interoperability issues can be minimised before integrating these components to the DC network. Both "offline" studies and "online" (or real-time) studies using hardware-in-the-loop are important tools for evaluating the level of interoperability at all four layers.

Specifications of component ratings
As discussed in Section 6.1, new challenges exist in specifying the component ratings in multi-vendor HVDC grids due to the complexity introduced by multi-vendor equipment. New methodologies need to be developed to specify the ratings of DC-side components considering the complex interactions of controls and the actions of protection equipment. In particular, in existing HVDC systems, the characteristics of surge arresters for over-voltage protection are well matched by a single manufacturer, which can, in turn, ensure the desired protection level (1.5 to 1.85 pu) and even sharing of energy dissipation between the surge arresters [136,146,147]. First of all, standardised overvoltage protection levels need to be defined so that DC-side components can be connected without being exposed to damaging overvoltages. Then a methodology needs to be developed to coordinate the characteristics of the DCside overvoltage protection equipment from multiple vendors within the HVDC grid, particularly with those in close vicinity to avoid overloading due to uneven energy dissipation, considering that the "same" DC voltage is shared throughout the HVDC grid.

Communication architecture and protocols
Although an IEC 61850-like communication structure is also applicable for HVDC grid protection, detailed studies need to be carried out in order to identify the required speed, bandwidth, latency, and reliability for substation and remote communication in the three main protection philosophies. Developing communication protocols or extending IEC 61850 standards to fulfil the required bandwidth and speed for fully selective protection strategies is seen as a necessary step to realise large-scale HVDC grids using multi-vendor components.

6.2.5
Simulation models and information exchange A clear classification of the required modelling details is needed to provide a guideline on carrying out the necessary studies using appropriate models. For instance, detailed modelling of protection equipment is essential to study the stresses on individual components is, however, not necessary when studying the impact of HVDC grid protection on AC systems. Corresponding to the required system studies, a comprehensive classification of the various models, such as AC systems, HVDC grid, and HVDC grid protection needs to be developed. During a step-by-step growth of the HVDC grids, system studies are necessary at the design and validation phases to achieve a high level of interoperability, possibly involving multiple vendors. To perform such system studies, information regarding the HVDC grid and its protection system will need to be "publicly" available to a third party or another vendor. This information could include key parameters of the components, protection settings and methodologies. There is a great need to define the scope of such open specifications to achieve the best performance possible of a protection system and to protect the intellectual properties of the vendors for fair competition.

CONCLUSION
This paper has provided a comprehensive review of the stateof-the-art of HVDC grid protection, focusing on multi-vendor interoperability. Recent technological breakthroughs on the realisation of fast DC protection IEDs, DC circuit breakers and fault blocking converters have greatly increased the prospect of building large-scale HVDC grids with DC-side protection. The key aspects of multi-vendor interoperability in HVDC grid protection are protection philosophy and four layers of interoperability.
Multi-vendor interoperability in HVDC grid protection can only be meaningfully defined within one protection philosophy or among different protection philosophies using a partially selective protection philosophy. In each protection philosophy, multi-vendor interoperability can be divided into four layers, including function, electrical, information, and communication layers. Interoperability at all four layers needs to be achieved to realise multi-vendor interoperable HVDC grid protection. This paper has identified the challenges associated with achieving multi-vendor interoperability in HVDC grids and proposes solutions to tackle these. In particular, the challenges are (i) specifying the ratings of key components, considering the complex control and multi-vendor components with different configurations and characteristics; (ii) specifying the functional requirements of the HVDC grid protection, converter DC-FRT behaviour, DCCBs, and DC protection IEDs; and (iii) standardising the necessary interfaces and communication protocols for HVDC grid protection to achieve syntactic and semantic interoperability.
To ensure interoperable HVDC grid protection by design, comprehensive system design methodologies are necessary. Recent progress focuses on the coordinated design of DCCBs in fully selective protection and high-level protection system design frameworks. Further challenges along the road are identified as being: (i) developing new methodologies for quantifying the functional requirements of HVDC grid protection, (ii) standardising overvoltage protection levels for DC-side components and developing new methodologies to coordinate DCside overvoltage protection equipment from multiple vendors, (iii) assessing the communication needs for each protection philosophy and developing the necessary communication protocols to ensure reliable performance of HVDC grid protection, and (iv) standardising the necessary models used for system studies and specifying the necessary information to be exchanged with a third party or between vendors.