Mechanism-Based Online Security Boundaries of Grid-Following Converters in Weak Grids with a Verified One-Sided Risk Limit

The post-fault security of a grid-following converter plant on a weak network is decided by the synchronization of its phase-locked loop under current limiting, which static indices and offline databases misjudge where a fast decision is most needed. This paper derives the mechanism and builds a verified online boundary on it. The synchronization dynamics reduce to a swing equation of the loop with the limiter law embedded in it, which is independent of the bandwidth in normalized time; the existence of its equilibrium gives a power-independent critical short-circuit ratio for active-current priority and a dependence on the pre-fault reactive set-point for reactive-current priority, and the switching relations at clearing give the frequency spike, the injected kinetic energy, and two energy-based re-synchronization criteria. The electromagnetic transient (EMT) margin is estimated by a physics-structured residual model over static and phasor levels, and the probability that an accepted operating point is insecure is bounded per topology and controller group by an exact one-sided binomial limit on an independent verification set measured with the identification error of the online decision; changes in the operating distribution, model updates, and conditions outside the calibration are covered by a bounded-ratio limit, fresh verification, and a residual check that withdraws the result. On a 100 MVA plant with about 20,000 EMT runs, the mechanism accounts for 99% and 95% of the insecure operating points of the two priorities. The risk limits are 0.54% and 1.13% at 97.5% confidence, with 63% and 59% acceptance. The insecure-acceptance rates on an independent pool are 0.10% and 0.55%, against 4.6–8.0% for short-circuit-ratio rules and 0.8–2.7% for reference rules at the same verified level. The verified boundary lies inside the EMT boundary in all 24 combinations of priority, support gain, and loop bandwidth within the verified domain. Resetting the reactive set-point regains 45–64% of the insecure points at no curtailment. A switching-model check of 200 accepted points per group bounds the risk against the switching model at 2.75% and 3.57%, with the verified result being stated for loop natural frequencies up to 40 Hz.