Decentralized plug-and-play control of grid-forming converters for resilient and scalable AC microgrids: a passivity-based unified architecture

In low-inertia AC microgrids, voltage formation, frequency support, power sharing, and disturbance rejection are performed by grid-forming (GFM) converters. Current systems often design these functions individually for a fixed, cooperatively tuned converter population. Adding, removing, or losing a unit requires retuning, which may jeopardize stability. We present a generic decentralized plug-and-play (PnP) design for all grid-forming (GFM) converters by including the same kernel, i.e., droop primary regulation, adaptive virtual impedance, sparse consensus-based secondary restoration, and trust-weighted resilient coordination, under a local passivity-based admission test. Under explicitly stated assumptions (quasi-stationary lossy lines, a feasible equilibrium, a connected electrical network and a bounded admission rate), we prove that a converter with normalized passivity index exceeding a strictly positive margin can be admitted or removed without neighbor retuning, that stability is preserved during the finite-time admission ramp and not only at its end points, and that the conductive (R/X) coupling of real feeders enters the test as a bounded, locally computable defect. The same certificate bounds the perturbation that false-data-injection (FDI) attacks can cause through the trust-weighted consensus, with an explicit relation between attack magnitude, residual threshold, trust weight, and perturbation. Validation is software-only: a detailed averaged three-converter Simulink model, a small-signal model with the exact lossy Jacobian for $$\:N\:=\:2-128$$ converters, several electrical and communication graphs, heterogeneous ratings and lines, sequential and simultaneous multi-unit events, a documented Monte-Carlo campaign and a 15-scenario FDI campaign. In the detailed model, admitting a converter causes a peak PCC voltage deviation of 1.79% (settling in 58 ms), and the harmonic kernel (current feed-forward plus selective resonant feedback of the PCC voltage) lowers PCC voltage THD from 9.19% to 3.33%, within the 5% limit. The computed minimum passivity index during admission is 0.723 over $$\:N\:=\:2-8$$ and remains between 0.723 and 0.885 up to $$\:N\:=\:128$$ ; the Monte-Carlo violation probability is 0.002 for design tolerances ( $$\:M\:=\:1000$$ ). Real-time hardware-in-the-loop testing was not performed and is identified as future work.