- What anti-islanding protection is required to do
- Trip, ride-through, and support are not the same job
- Equipment protection sits beside the grid rules
- What to ask before the inverter is treated as protected
- Frequently asked questions
- Does every solar inverter have to stop within 2 seconds of a grid outage?
- Can ride-through override anti-islanding?
- Is a tripped inverter a de-energized array?
- Sources and references
The protection functions of a solar inverter are the controls that stop it feeding a fault, a dead line, or a voltage the local grid cannot accept. The function with a clock on it, in the interconnection standard used across much of the United States, is unintentional islanding. IEEE Std 1547-2018 requires a distributed energy resource to detect an island and cease to energize the area electric power system within 2 seconds. That limit is a grid-safety rule. It is not a claim that every inverter sold in every country uses the same thresholds, and it is not a substitute for the disconnect a firefighter or a technician uses by hand.
An island, in this sense, is a pocket of the utility system that has separated from the main grid and is still being powered by local generation. Line crews can meet voltage where they expected a dead conductor. The National Renewable Energy Laboratory’s 2022 primer on this requirement, written with Sandia National Laboratories, is explicit that for most residential and commercial equipment the function is built in by the manufacturer and type-tested before the product family is fielded. In the United States that testing is typically done to IEEE 1547.1-2020 and recorded under UL 1741, the safety standard for inverters and interconnection equipment used with distributed energy resources. Certified hardware is then installed under the National Electrical Code, with whatever extra rules the local utility adds. A brochure that says “full protection” without naming the standard and the test laboratory has not finished the sentence.
What anti-islanding protection is required to do
The primer’s requirement is narrow and strict. The inverter must detect the island and stop energizing the area system, and it must trip, within 2 seconds of the island forming. The type test that supports a UL 1741 listing is run on one representative unit of a product family, not on every serial number, and it is valid for other units of the same design. Under UL 1741, anti-islanding is tested after the grid-support functions, so the unit has to pass while voltage support, frequency support, and the mandatory ride-through settings are active. The test opens an isolation device, the way a maintenance switching operation would. It does not depend on a short circuit to start the clock.
A later multi-inverter study published by the National Laboratory of the Rockies looked at the same tension in hardware. Volt-var control, with watt priority, and frequency-watt control did not, in the cases tested, make island detection worse. In some cases run-on time got shorter. Voltage and frequency ride-through did slow detection, which is the worry utilities raise, but every configuration they reported still finished inside the 2-second limit. Collaborative controls reduced that delay. Those are laboratory results for the configurations in the study. They are not a field measurement of an unnamed plant, and they do not license a designer to disable the function because ride-through is also required.
Trip, ride-through, and support are not the same job
IEEE 1547-2018 added ride-through because a grid with a lot of inverter-based generation cannot afford every unit to drop offline at the first dip. Ride-through keeps the inverter connected through a disturbance that the bulk system needs it to survive. Tripping removes it when the voltage or frequency is outside what the standard allows. The primer records the priority the standard sets, so the functions do not fight:
| Order | What wins | Practical reading |
|---|---|---|
| 1 | Permit-service disable | If the inverter is not allowed to run, nothing else keeps it exporting. |
| 2 | Tripping | Abnormal voltage or frequency that requires a trip outranks staying online. |
| 3 | Ride-through | The standard allows island detection to end a ride-through. Support of the bulk system does not override an island. |
| 4–6 | Power limits and voltage regulation | Volt-watt behavior, an active-power cap, and voltage regulation sit below the trip. |
Read the table as a priority, not as a menu you can reorder in software to chase yield. A setting that holds the inverter online through an island so that a voltage-support curve can finish is the failure the test is written to catch. The primer also notes that if an islanding evaluation fails, the investigation has to find which enabled function caused it. Unity power factor, a non-unity setting, and a constant reactive mode are different operating points, and the conformance has to be known before anyone treats the unit as cleared.
Equipment protection sits beside the grid rules
Grid interaction is only half of what people mean by protection. Pacific Northwest National Laboratory’s solar operations page treats the switchgear as its own set: disconnects, breakers, building isolation, and lightning arresters. For an emergency shutdown it says to open the main AC disconnect and then the main DC disconnect, and it says the National Electrical Code requires those disconnects within sight of the inverter, along with posted shutdown instructions. Modules keep producing in daylight even when the inverter has stopped and even in cloud. That is why “the inverter tripped” is not the same sentence as “the roof is dead.”
Temperature is the other limit that shows up in field data rather than in the islanding clause. A Sandia and NREL thermal study of operating inverters found component temperatures rising with the power the inverter was dissipating, following the day and the season, and moving with wind. Fans and heat sinks exist because that heat shortens the life of capacitors, semiconductors, and boards. The temperature at which a given model folds back its output or stops is on that model’s manual. Copying a number from a different cabinet is how a protection setting becomes a nuisance trip, or fails to trip at all.
Overcurrent, ground-fault detection, and insulation monitoring are real functions on many inverters. Which of them a unit must have, and at what threshold, depends on the product standard and the code at the point of installation. This article does not invent a universal ampere or megohm setting. The document that does is the certificate and the manual for the exact model, read against the local code. A category claim such as “all solar inverters include DC arc-fault protection” is the sort of sentence that fails as soon as the destination country changes.
What to ask before the inverter is treated as protected
Ask which edition of the interconnection standard the unit was tested to, and whether anti-islanding was demonstrated with the grid-support functions enabled. Ask who can change the trip and ride-through curves after installation. A utility may require a defined setting file. A password that any owner can rewrite is a protection function in name only. Ask where the AC and DC disconnects are, whether they are within sight, and who is allowed to operate them. Visual checks and alarm logs are maintenance. Opening the cabinet is qualified electrical work. How those records feed a later repair is covered in photovoltaic power station maintenance. How the same alarms should read on a screen is covered in what a solar monitoring system measures.
None of this makes a distributed array harmless. It makes the export stop under the conditions the standard names, if the unit was actually built and set to that standard. The next question, whether the array as a whole is a safe thing to put on a roof or a yard, depends on mounting, wiring, and fire access as well as on the inverter. That is a different problem from the trip logic inside the box.
Frequently asked questions
Does every solar inverter have to stop within 2 seconds of a grid outage?
IEEE Std 1547-2018 requires distributed energy resources under that standard to cease energizing an unintentional island within 2 seconds. The National Renewable Energy Laboratory primer describes this as the US interconnection rule, implemented through type testing and, typically, UL 1741. A country that interconnects under a different grid code can use a different time. Check the rule that applies where the inverter will be connected.
Can ride-through override anti-islanding?
No. The primer’s priority list puts tripping above ride-through, and it quotes the standard to the effect that ride-through may be ended when an unintentional island is detected. Laboratory work still found that ride-through can slow detection. In the cases reported, the result stayed inside 2 seconds.
Is a tripped inverter a de-energized array?
No. Pacific Northwest National Laboratory states that modules produce in daylight regardless of weather or disconnect status. Shutdown means opening the AC disconnect and then the DC disconnect, and only trained people should connect or disconnect wiring.
Sources and references
Unintentional islanding, the 2-second limit, UL 1741 type testing, and the function priority list: Narang, Gonzalez, and Ingram, NREL/TP-5D00-77782, April 2022. Multi-inverter tests of volt-var, frequency-watt, and ride-through against that limit: National Laboratory of the Rockies, IEEE 1547 anti-islanding evaluation. Disconnect order, live modules in daylight, and switchgear: Pacific Northwest National Laboratory, solar photovoltaic O&M. Component temperature versus power and weather: Sorensen and colleagues, thermal study of inverter components, NREL/Sandia preprint.
