Published: June 2026 Technical Level: Advanced Category: Protection Systems
The integration of distributed energy resources into distribution feeders disrupts the three foundational assumptions on which conventional overcurrent coordination is built: unidirectional fault current flow from the substation source, a stable and monotonically decreasing fault current magnitude with electrical distance from the source, and fault current levels that are large relative to load current, providing reliable discrimination margins. When inverter-based and synchronous DER sources are present at multiple points along a feeder, fault current flows bidirectionally, the available fault current during islanded operation may be only marginally above rated load current, and the fuse-recloser coordination sequences that protect the majority of overhead distribution circuits in North America are violated at penetration levels as low as 15 percent of peak feeder load. This paper establishes the conventional coordination baseline in quantitative terms, derives the four principal failure modes — relay blinding, fuse-recloser miscoordination, sympathetic tripping, and islanding non-detection — with explicit mathematical conditions for each, and presents the engineering solutions that restore coordination integrity. The solutions range from adaptive dual-setting-group schemes achievable with existing digital relay hardware to directional overcurrent elements, line differential protection, and IEEE 1547-2018-compliant anti-islanding logic. Throughout, the analysis is grounded in the interconnection requirements of IEEE 1547-2018, the coordination methodology of IEEE 242, and the CT application guidance of IEEE C37.110, with worked examples drawn from two documented field deployments.
Distribution feeder protection in North America has been engineered, for most of its history, around a single and reliable physical premise: electric power flows from a transmission source through a substation transformer and radially outward toward loads, and fault current, when it occurs, flows from the substation toward the fault location. This premise justified a protection philosophy of extraordinary simplicity and effectiveness: place overcurrent devices at successive points along the feeder, calibrate each to operate faster than the one immediately upstream, and any fault will be cleared by the nearest device while all upstream devices remain in service. The result is the time-overcurrent coordination scheme that underlies virtually all North American distribution protection practice, and whose graphical expression — overlaid time-current characteristic curves on a log-log diagram — has been the primary deliverable of protection coordination studies for decades.
The simplicity of this scheme derives directly from the radial, unidirectional nature of the fault current. When a fault occurs at a point on the feeder, the available fault current is the Thévenin equivalent of the transmission and substation sources referred to the fault location through the series impedance of the feeder between the source and the fault. This impedance increases monotonically with distance, so the fault current decreases monotonically with distance from the substation. Because every overcurrent device on the feeder sees the same current for a fault in its protected zone — and that current is always larger than for a fault farther from the source — grading time delays between successive devices produces inherent selectivity. The downstream device, being closer to the fault, sees a larger current and operates faster; the upstream device, seeing the same current but set to operate more slowly, remains in service.
Distributed energy resources disrupt each element of this logic simultaneously. A solar photovoltaic installation connected at a lateral tap mid-feeder introduces a current source between the substation and the end of the feeder. For a fault on the main feeder between the substation and the PV installation, fault current flows from both the substation source and the PV installation toward the fault from opposite directions. The downstream relay protecting the section between the PV connection point and the far end of the feeder — which was selected, set, and coordinated assuming it would only see current flowing outward from the substation — now also sees the PV-sourced current flowing in the reverse direction during this fault. Depending on the relay's directionality (or lack thereof), it may operate on this reverse current, disconnecting a healthy feeder section unnecessarily.
The problem is further compounded by the difference in fault current character between inverter-based DER and synchronous rotating DER. An inverter-based source — a grid-following solar inverter or a battery energy storage system — is current-limited by its power electronics to approximately 1.0 to 1.2 times its rated current during a fault. This is a fundamental physical property of semiconductor switching devices, not a control choice: the switching elements that form the inverter will be destroyed by currents exceeding their rated limits, so the current controller enforces this ceiling at all times, including during faults. A synchronous generator, by contrast, contributes fault current of 5 to 8 times its rated current in the subtransient period immediately after fault inception, decaying toward a steady-state level determined by its synchronous reactance. The protection engineer who treats all DER equivalently — applying the same fault current model regardless of technology type — will arrive at incorrect coordination settings for both.
This paper develops the quantitative basis for understanding these interactions and presents the engineering solutions that have been validated in field deployments. The discussion is organized as follows. Section 2 establishes the conventional coordination baseline and explains, in mathematical terms, how it achieves selectivity. Section 3 derives the four principal failure modes that DER introduces. Section 4 addresses adaptive overcurrent coordination as the minimum effective response. Section 5 develops the directional element application. Section 6 presents differential protection criteria. Section 7 provides case study data from two documented deployments. Section 8 addresses IEEE 1547-2018 requirements that directly constrain the protection engineer's choices. Section 9 concludes with implementation guidance.
A radial distribution feeder is protected by a hierarchy of overcurrent devices placed at the substation (a time-overcurrent relay controlling the feeder breaker), at intermediate points along the feeder (sectionalizing reclosers or relay-controlled switches), and at lateral branches (fuses protecting individual lateral circuits). Each device in this hierarchy is characterized by a time-current relationship — the time required to operate as a function of the current through it — and selectivity is achieved by ensuring that for any fault current within the protected zone, the nearest device operates before any upstream device.
The time-overcurrent relay operates according to the inverse-time characteristic, which expresses the relay operating time as a function of the ratio of the fault current to the pickup setting. The IEC standard inverse-time characteristic, which is widely used in North American digital relays alongside the ANSI/IEEE curve families, is given by:
Where: is the relay operating time in seconds.
is the time-dial setting (a dimensionless scalar that shifts the entire curve up or down in time).
is the fault current seen by the relay in amperes.
is the pickup current setting in amperes, and and are characteristic constants that define the curve shape. For the IEC Normal Inverse characteristic.
and ; for the IEC Very Inverse.
and ; for the IEC Extremely Inverse.
and . The key property of all inverse-time curves is that the operating time decreases as the fault current increases — a relay near a large, close-in fault operates quickly, while the same relay operating on a small, distant fault operates slowly, allowing downstream devices time to clear the fault first.
The coordination time interval (CTI) is the minimum time separation required between the operating time of a downstream device and the operating time of the upstream device at the same fault current. The CTI must be large enough to accommodate the downstream device's total clearing time — from the moment of fault current inception through arc extinction — plus the upstream relay's timing error:
For modern numerical relays with ±2 percent timing accuracy and vacuum circuit breakers with 3-cycle interrupting time at 60 Hz, the minimum CTI is approximately 0.15 seconds. For electromechanical relays with oil circuit breakers, the minimum is approximately 0.25 seconds. This interval must be maintained across the full range of fault currents that both devices will experience — not merely at the maximum fault current used in the coordination study — because inverse-time curves are non-parallel, and the CTI varies with fault current in a way that can produce a coordination failure at intermediate current levels even if the CTI is adequate at the maximum current.
Figure 1 — Recommended Diagram: Time-current characteristic plot on log-log axes showing a two-relay coordination pair (upstream feeder relay R1 and downstream lateral relay R2) plus a downstream lateral fuse (F1). X-axis: fault current in amperes (secondary values). Y-axis: operating time in seconds. Show the three curves properly graded, with R2 and F1 to the left of R1 at all currents. Draw vertical arrows at three current levels (minimum fault current at the far end of F1's zone, maximum fault current at the F1-R2 boundary, and maximum bus fault current) showing the CTI at each level. Annotate the minimum CTI requirement. This figure establishes the visual language for all subsequent discussion of how DER shifts these curves relative to one another.
The most common protection arrangement on overhead distribution feeders is the fuse-recloser combination: a recloser at the substation or on the main feeder trunk, with expulsion fuses protecting individual lateral branches. The recloser is programmed with a fast curve (typically one or two instantaneous or fast inverse-time operations) followed by one or more slower time-overcurrent operations before lockout. The coordination philosophy is that for a temporary fault on a fused lateral — the majority of overhead distribution faults — the recloser's fast operation clears the fault before the fuse has time to melt, allowing the feeder to be restored by the recloser's automatic reclose without any manual intervention. For a permanent fault, the recloser allows the fuse to melt and isolate the faulted lateral during one of its slower operations.
This scheme depends on two conditions being simultaneously satisfied. First, the fuse must not melt during the recloser's fast operation — the recloser must clear the fault faster than the fuse minimum melting time. Second, the recloser must be able to clear the fault — the available fault current must be sufficient to drive the recloser through its fast curve within the fault duration limit. Both conditions are violated, in specific ways, by the presence of DER on the feeder, as derived in Section 3.2.
The most fundamental change introduced by DER is the reduction in fault current available to drive overcurrent relays when the system is operating in a partially or fully islanded configuration. Inverter-based DER resources are current-limited: during a fault, the inverter's current controller enforces an upper limit on output current to protect the semiconductor switching elements. The maximum fault current contribution from an inverter-based resource is:
Where: is the inverter's rated output current and is the manufacturer-specified current-limit multiplier. This is a hard physical upper bound — the inverter cannot contribute more current than this regardless of the fault impedance. For a feeder island supplied exclusively by inverter-based DER, the total available fault current is bounded by the sum of all inverter current limits:.
In a typical residential solar penetration scenario — 5 MW of rooftop PV on a feeder with a 10 MW peak load — the island fault current is bounded at approximately 1.1 to 1.2 times the total inverter rated current, which is typically comparable to the feeder's rated load current. If the feeder's overcurrent relay has a pickup setting of 3.0 times rated load current — a common setting on a moderately loaded feeder — the relay will not operate for any fault in the islanded feeder. The region of the feeder within which fault current is insufficient to drive the relay is the blind zone, whose radial extent from the relay location is:
Where: is the per-unit-length feeder impedance ().
is the Thévenin source voltage.
is the Thévenin source impedance, and is the relay pickup current. For a feeder with .
(13.8 kV system).
(DER source), and , the blind zone radius is:.
This result — a blind zone radius that exceeds the physical feeder length — indicates that the relay will not detect any fault on the feeder during islanded operation with this configuration. Every fault during the island period will go undetected until the battery or PV resource trips on its own protective functions, which may occur seconds to minutes later. During this interval, the faulted feeder remains energized and presents arc flash and step-and-touch voltage hazards to anyone in the vicinity of the fault.
Figure 2 — Recommended Diagram: One-line diagram of a 13.8 kV radial feeder approximately 12 km in length, with the substation transformer at the left end and DER installations at 4 km, 7 km, and 10 km. Show the recloser location at 6 km and three lateral fuses at branch points. Shade the "blind zone" — the entire feeder beyond the recloser — in a distinct color to indicate that relay R1 at the substation cannot detect faults in this zone during islanded DER-only operation. Annotate the available fault current at the 10 km point during islanded operation (e.g., 245 A) versus the relay pickup setting (275 A), demonstrating the 30 A shortfall.
DER connected on lateral branches or at load-side points on the main feeder introduces a back-feed current during main feeder faults that violates the fuse-recloser coordination logic described in Section 2.2. Consider a fault on the main feeder between the recloser and the substation. In the absence of DER, no current flows through the lateral fuses during this fault — all fault current flows from the substation through the recloser toward the fault, and the lateral fuses see only the portion of load current that diverts through the fault path, which is typically negligible. The recloser clears or isolates the fault, and the fuses remain intact.
When DER is present on the lateral branches, these DER sources feed current toward the main feeder fault from their lateral connections. This DER-sourced back-feed current passes through the lateral fuses in the direction from the lateral branch toward the main feeder — the reverse of the normal load direction. If this reverse current is large enough and sustained long enough, the fuse element heats and melts, interrupting the lateral even though no fault exists on the lateral. The condition for fuse misoperation is:
Where: is the DER back-feed current through the fuse.
is the fault duration before the recloser clears, and is the fuse minimum melting current at the back-feed current level. Because the DER back-feed current is limited to for inverter-based resources, this failure mode is most severe when DER penetration is high enough that the combined back-feed current approaches the fuse minimum melting threshold, and the fault duration is extended — as it would be if the upstream recloser is operating on a slow curve to coordinate with downstream devices.
It is therefore evident that increasing DER penetration on a fuse-protected lateral without re-evaluating the fuse rating and the recloser fast curve timing is a quantifiable engineering error. Field data from several utility systems with DER penetration above 20 percent of peak load has documented fuse operations on unfaulted laterals at rates 3 to 7 times higher than pre-DER baselines, with direct consequence in customer interruptions and labor costs for fuse replacement and investigation.
Sympathetic tripping occurs when a relay on a healthy feeder operates because DER on that feeder contributes fault current toward a fault on an adjacent feeder, and the relay interprets this reverse DER current as a forward fault. The condition for sympathetic tripping of the healthy feeder relay R is simply:
Where: is the total DER fault current from the healthy feeder flowing toward the substation bus during the fault on the adjacent feeder, and is the pickup setting of R. Because is bounded by the inverter current limits, sympathetic tripping from inverter-based DER alone requires pickup settings below the total inverter capacity of the healthy feeder. The more dangerous sympathetic tripping scenario involves synchronous DER, which can contribute 5 to 8 times rated current toward the adjacent feeder fault. A 2 MW synchronous gas generator at rated current of 84 A (at 13.8 kV) can contribute subtransient fault current up to 670 A, which may exceed the pickup setting of the healthy feeder relay and cause it to trip.
This relationship is further complicated by the directionality (or lack thereof) of the healthy feeder relay. A relay without directional supervision cannot distinguish between current flowing away from the substation toward a load or fault — the desired direction of operation — and current flowing toward the substation sourced by DER during an adjacent fault — a direction in which operation is undesired. Directional overcurrent elements resolve this ambiguity, as developed in Section 5.
IEEE 1547-2018 requires that DER cease to energize the local EPS within a specified time after the utility source is disconnected, preventing the formation of an undetected energized island. This requirement is enforced by anti-islanding protection in the DER interconnection relay. Anti-islanding methods fall into two categories: passive methods that detect the power-quality anomalies that accompany islanding (voltage and frequency deviations, ROCOF, phase jump), and active methods that inject small disturbances into the system and detect the response characteristic of an island.
The fundamental challenge with passive anti-islanding methods is the non-detection zone (NDZ): the range of load and generation conditions under which the DER-island power balance is close enough to unity that the islanding event produces no detectable power-quality anomaly. The NDZ for the passive over/underfrequency method is the set of load conditions satisfying:
Where: and are the DER active and reactive power outputs.
and are the island load active and reactive power demands, and and are the minimum power imbalances required to produce detectable frequency or voltage deviation. For a unity-power-factor PV installation supplying a unity-power-factor load in the islanded zone.
, and if the PV output equals the load.
, placing the island squarely within the NDZ. Under these conditions, the frequency and voltage of the island may remain within normal limits indefinitely, and the passive anti-islanding relay will not detect the island.
Active anti-islanding methods — positive feedback schemes, Sandia frequency shift, slip-mode frequency shift — reduce the NDZ by introducing a systematic perturbation whose response is detectably different in an island versus a grid-connected state. IEEE 1547-2018 does not mandate any specific anti-islanding method but requires that the DER cease to energize the local EPS within 2 seconds for Category I and Category II installations, and mandates that active anti-islanding be used when the NDZ of passive methods exceeds specified limits.
The protection study for a feeder with inverter-based DER must use the correct fault current model for each DER type. Grid-following inverters — the dominant architecture for rooftop PV and most utility-scale solar — contribute fault current bounded by the current limit:
This current is delivered at approximately unity power factor (the inverter's current controller maintains the power factor angle close to zero during fault conditions) and is essentially instantaneous — there is no subtransient period and no dc offset, because the inverter's switching frequency is orders of magnitude above the power frequency. The absence of dc offset is important for CT design: the dc offset component of synchronous machine fault current is the primary driver of CT saturation during close-in faults, and inverter-sourced fault current does not create this CT design challenge.
Grid-forming inverters — increasingly deployed in battery energy storage systems for microgrid and black-start applications — can be programmed to deliver fault current profiles that more closely resemble synchronous machines, including deliberate dc offset and overcurrent ratios up to 2.0 to 3.0 times rated current. The protection engineer must determine the grid-forming inverter's fault current profile from the manufacturer's specification for the specific project, as the profile is controlled by firmware and varies between products and configurations.
The fault current contribution from a synchronous machine (gas generator, synchronous condenser, or flywheel) follows the classical three-stage decrement model. The instantaneous fault current at time after fault inception is:
Where: .
, and are the subtransient, transient, and synchronous direct-axis reactances in per unit.
and are the corresponding open-circuit time constants in seconds.
is the pre-fault terminal voltage.
; and is the voltage angle at fault inception. The dc offset component is:.
Where: is the armature dc time constant and is the armature resistance. For a typical 1.0-MVA diesel generator with , the peak subtransient fault current reaches approximately 8.3 pu at . This is the current that the protection relay must be able to interrupt, and its magnitude determines the required interrupting rating of the interconnection breaker.
The foregoing analysis demonstrates that a feeder with mixed DER technology — inverter-based PV plus synchronous backup generation — presents the protection engineer with two distinct fault current profiles that must be analyzed separately. The protective device sizing and coordination settings for the synchronous contribution are governed by the subtransient fault current, while the relay blinding and fuse miscoordination analysis for islanded operation is governed by the inverter current-limit.
Figure 3 — Recommended Plot: Two time-domain waveforms on the same axes, comparing fault current from a 1-MVA synchronous generator (upper trace) and a 1-MVA grid-following inverter (lower trace) for a three-phase fault at the machine terminals. X-axis: time in milliseconds (0 to 500 ms). Y-axis: current in per-unit of rated current. Show the synchronous machine's high initial peak (8.3 pu), dc offset, subtransient decay, transient decay, and steady-state level (approximately 0.83 pu of rated at synchronous reactance). Show the inverter's flat, limited-amplitude output (1.1 pu) commencing within the first half-cycle with no dc offset. This waveform comparison is the single most effective illustration of why the two DER types require fundamentally different protection approaches.
The fundamental engineering response to DER-induced coordination degradation is to recognize that a single fixed relay setting cannot simultaneously achieve adequate sensitivity for islanded operation (where fault current is low) and appropriate selectivity for grid-connected operation (where fault current may be much higher). Modern numerical relays resolve this through multiple setting groups — pre-programmed sets of pickup and time-dial settings that can be activated automatically by the relay's protection management system in response to a measured change in network topology, DER dispatch level, or islanding status.
A minimum effective adaptive scheme uses two setting groups: Group A for grid-connected operation and Group B for islanded or low-DER-dispatch operation. The relay operating time follows the IEC inverse-time characteristic given in Section 2.1, and the coordination criterion must be satisfied independently in each group:
The critical procedural requirement — one that distinguishes competent coordination from inadequate coordination — is that this inequality must be verified at the minimum fault current in each operating mode, not only at the maximum fault current used in the initial study. Inverters do not produce fault currents that are multiples of rated current in the way that utility-source faults do, so the minimum fault current condition (a high-impedance ground fault at the end of the feeder during low-DER-dispatch island operation) is the binding constraint for Group B settings, while the maximum fault current condition (a three-phase bolted fault at the substation during grid-connected operation with all sources in service) is the binding constraint for Group A settings.
The procedure for developing adaptive settings begins with a systematic fault current calculation for each combination of operating mode and fault type. For each relay location and each operating mode , the engineer calculates the maximum three-phase fault current and the minimum single-line-to-ground fault current using the appropriate source impedance for mode .
The pickup setting for the most downstream relay is established by the requirement that it must detect the minimum fault current with a 2.0 times margin above pickup, while remaining above the maximum load current by 1.5 times to prevent operation on overload:
Once the pickup is established, the time-dial setting is selected to achieve the fastest operation compatible with the downstream device's total clearing time at maximum fault current. For a downstream fuse, the relay must not operate before the fuse total clearing time plus the CTI:
Working upstream from the most downstream device, each successive relay's TDS is set to operate at least CTI after the downstream relay at the fault current seen by both devices simultaneously:
This calculation must be performed for each setting group independently, using the fault current values appropriate for that group's operating mode.
Directional overcurrent elements resolve the sympathetic tripping and reverse-reach problems by adding a directionality criterion to the overcurrent operating condition. A relay equipped with a directional element operates only when both conditions are simultaneously satisfied: the measured current exceeds the pickup threshold, and the current is flowing in the forward (trip) direction rather than the reverse (block) direction.
The directional measurement is made by comparing the measured current angle against a polarizing reference quantity. For phase directional elements, the conventional polarizing reference is the sequence or phase voltage at the relay bus. The element operates in the forward direction when the angle between the measured current and the polarizing voltage falls within the forward operate zone:
Where: is the measured fault current angle.
is the polarizing voltage angle.
is the maximum torque angle (typically 45° to 60° for inductive distribution feeders), and is the operate zone half-width (typically 87° to 90°, producing a forward operate zone of 174° to 180°). Currents with an angle outside this range are classified as reverse and blocked.
The choice of polarizing reference is not a trivial setting parameter — it determines whether the directional element maintains correct operation during all fault types and system conditions that may occur in service. Positive-sequence voltage polarizing ( as the reference) is the default and is reliable as long as the positive-sequence voltage at the relay bus remains above approximately 10 percent of nominal during the fault. For close-in three-phase faults — where the faulted bus voltage may collapse to near zero — positive-sequence voltage polarizing fails because the polarizing reference is below the minimum threshold for reliable angle measurement. In this case, voltage memory polarizing provides the solution: the relay uses the pre-fault voltage angle stored in a short-term memory buffer as the polarizing reference, maintaining correct directionality during the initial cycles of the fault.
For single-line-to-ground faults, negative-sequence voltage and zero-sequence voltage provide more reliable polarizing references than positive-sequence voltage, because the faulted phase produces strong negative and zero-sequence components while the positive-sequence voltage depression may be relatively modest. Negative-sequence directional elements (function 67N) are particularly effective on DER-connected feeders because they maintain correct directionality even when the positive-sequence bus voltage is significantly depressed, and because DER-sourced unbalanced fault current produces a distinct negative-sequence signature that the 67N element exploits.
Line differential protection eliminates the blind zone and sympathetic tripping problems entirely by applying the principle that the sum of currents entering a protected zone must equal zero under normal conditions, while any departure from this balance indicates an internal fault. For a two-terminal protected zone with currents entering from terminal 1 and entering from terminal 2, the operate and restraint quantities are:
The differential relay operates when the operate quantity exceeds the percentage-restraint threshold:
Where: is the percentage restraint slope (typically 0.20 to 0.50) and is the minimum operate level (typically 0.20 to 0.30 pu of rated current). The dual-slope characteristic — a low slope region below a breakpoint current and a higher slope above it — provides high sensitivity for weak internal faults at low current while providing strong restraint against operation on through-faults with CT saturation. The DER mix on the feeder has essentially no effect on differential protection performance, because the protection principle depends on current balance rather than current magnitude.
The practical barrier to differential protection on distribution feeders is the communication infrastructure required to exchange current phasor data between the two terminals. IEEE C37.113 recommends a communication latency below 2 milliseconds for protection-grade differential applications, which requires either dedicated fiber or IEC 61850 GOOSE messaging over a switched Ethernet network. For feeders where energy management or SCADA communication infrastructure already exists, the incremental cost of upgrading to a protection-grade channel is primarily relay hardware at each terminal ($8,000 to $15,000 per zone for current-generation digital relays). For feeders without any communication infrastructure, the full cost of fiber installation or radio communication must be included in the cost-benefit analysis, and adaptive overcurrent with directional supervision is typically the more cost-effective solution.
IEEE 1547-2018 establishes mandatory voltage and frequency ride-through requirements for DER interconnections that directly constrain the protection engineer's ability to use DER trip functions as a supplemental protection mechanism. Category I and Category II DER must remain connected and continue to supply current during voltage and frequency disturbances that fall within specified ride-through envelopes. For Category II — which applies to DER installations intended to remain online during grid disturbances and which is increasingly specified by utilities for large DER interconnections — the DER must ride through voltage excursions in the range of 0.50 to 1.20 pu and frequency excursions between 56.5 and 66 Hz for durations specified in the standard's Table 2.
The protection engineering implication is that DER interconnection relays set to trip on voltage or frequency conditions within the ride-through envelope are non-compliant with IEEE 1547-2018, and this non-compliance may itself become a grid reliability problem. If a large DER fleet trips en masse during a recoverable grid disturbance — because the interconnection relay settings are more conservative than the Category II ride-through requirements — the sudden loss of generation can amplify the disturbance rather than supporting the recovery. The protection engineer developing interconnection relay settings for a large DER installation must verify that the proposed settings are compatible with the applicable category's ride-through requirements.
IEEE 1547-2018 Section 8.7 requires that DER cease to energize the local EPS within the specified clearing times after detection of an unintended island condition. These clearing times are 2.0 seconds for Category I and Category II at nominal voltage and frequency. The protection engineer must verify that the anti-islanding detection method used — whether passive, active, or communication-based — achieves the required clearing time across the full range of island load conditions, including those within the NDZ of passive methods as described in Section 3.4.
Where the NDZ of passive anti-islanding methods is unacceptably large — a condition that occurs most commonly on circuits with high DER penetration and substantial coincident load — communication-based anti-islanding schemes provide a reliable alternative. In these schemes, the DER inverter receives a transfer trip signal from the utility feeder breaker via a direct communication channel, and trips immediately on receipt of the signal regardless of the local voltage and frequency conditions. The communication channel latency must be below 100 milliseconds to ensure that the total clearing time (detection plus inverter trip) remains within the IEEE 1547-2018 limit.
A 13.8 kV urban distribution feeder serving a dense commercial-residential load area had accumulated 12 MW of rooftop solar PV across 47 interconnection agreements over a four-year period. The original protection scheme — a SEL-351 relay at the substation breaker with a single fixed setting group (IEC Normal Inverse, , ) plus three 65T lateral fuses — was designed for a maximum load current of 280 A and a minimum fault current of 890 A at the far end of the 6.2 km feeder under maximum source impedance conditions.
Problem identified: At 12 MW of PV penetration, the island-mode fault current at the far end of the feeder under minimum-load, maximum-PV-dispatch conditions was measured by primary current injection to be 310 A — below the relay pickup of 420 A. Three of the 47 solar inverters were using positive-sequence voltage polarized anti-islanding, and under the minimum-load island conditions tested, the island persisted for 6.3 seconds before the passive frequency deviation exceeded the trip threshold — far exceeding the 2.0-second IEEE 1547-2018 Category II limit.
Solution implemented: A dual-setting-group adaptive scheme was implemented on the SEL-351 relay. Group A (grid-connected) retained the original settings. Group B (island or low-DER-dispatch, triggered by monitoring the 13.8 kV bus voltage at the substation) reduced the pickup to and . Coordination of Group B was verified at the minimum island fault current of 310 A; the relay operating time was 0.48 seconds against a CTI requirement of 0.15 seconds from the lateral fuses. Negative-sequence directional supervision (67N, using polarizing) was added to prevent sympathetic tripping during adjacent-feeder faults. The three non-compliant PV inverters were modified to use the Sandia frequency shift active anti-islanding algorithm, reducing the island detection time to under 0.9 seconds in all tested conditions.
Outcome: Verification injection testing at the far end of the feeder confirmed relay operation in 0.48 seconds under island-mode minimum fault current, within the IEEE 1547-2018 Category II 2.0-second limit. No sympathetic tripping was observed during 12 months of post-modification monitoring. The modification required 28 engineering hours and no new hardware — only relay firmware setting changes and inverter firmware updates.
An industrial campus on a 4.16 kV microgrid system combined 5 MW of rooftop solar PV with two 1.5-MW diesel generators, serving a 7.5 MW peak load. Three operating modes existed: grid-connected with all DER online, diesel-plus-PV island, and PV-only island. The protection challenge was that fault current in the three modes varied from 22,400 A (grid-connected, maximum source) to 1,850 A (PV-only island, minimum fault at the far end of the longest bus section).
Setting strategy: A three-setting-group scheme was implemented on each of the four feeder relays. Group A: grid-connected, , . Group B: diesel+PV island, , . Group C: PV-only island, , , supplemented by distance supervision (apparent impedance element, mho characteristic, reach set to 90 percent of the feeder section length) to provide backup coverage for faults whose current fell below the Group C pickup. Setting group switching was automated based on the open/closed status of the utility interconnection breaker and the diesel generator status contacts, communicated to the relay via digital input channels.
Outcome: Fault injection testing over 47 scenarios — covering three fault types, five locations, and three operating modes — produced correct operation for all 47 cases, with clearing times between 0.21 and 0.86 seconds depending on the scenario. The PV-only island scenario, previously the binding constraint with the original single-setting scheme, produced consistent 0.21 to 0.34 second clearing times using the combined Group C overcurrent plus distance supervision scheme.
The most consequential finding is that DER penetration does not modify conventional coordination at the margin — it requires re-evaluating every relay setting, fuse rating, and recloser curve against fault-current models that account for the DER fleet's technology mix, dispatch level, and topology at the moment of the fault. The single most dangerous condition is the blind zone: conventional overcurrent settings calibrated for grid-connected operation will fail to detect faults during islanded or low-dispatch operation whenever the island fault current falls below relay pickup, and on a feeder with inverter-based DER this is not an edge case but the expected state during high solar output and low load.
The most common field failure is fuse-recloser miscoordination from DER back-feed, which appears at penetration as low as 15 to 20 percent of peak load on fuse-protected laterals and cannot be cured by any blanket policy, because the corrective recloser-curve and fuse-rating calculations are specific to each location. The minimum effective response is an adaptive dual-setting-group scheme switched automatically by the relay's management system — no new hardware on modern digital relays, typically 20 to 40 engineering hours per feeder — justified easily against the sustained arc-fault exposure and regulatory liability of operating a feeder with demonstrated blind zones.
The engineer should next set the analysis thresholds that govern escalation: evaluate differential protection wherever penetration exceeds 30 percent of peak load, islanded operation is routine, or coordination-failure consequences are high; and begin every DER coordination study by confirming each installation's IEEE 1547-2018 category, because the ride-through and anti-islanding requirements directly constrain the settings available and are not regulatory paperwork but a boundary condition on the entire protection scheme. The communication infrastructure that differential protection demands is the dominant barrier, and the next problem is leveraging the SCADA or energy-management communications a site may already have to bring it within reach.
The analysis in this paper connects to several companion studies in this library. Readers concerned with the upstream and downstream engineering will find DER Integration and Distribution System Protection develops a closely related aspect of the same problem, while Protection Coordination Study extends the treatment into an adjacent domain. For the broader methodological context, Microgrid Protection Systems provides complementary depth.
[1] IEEE Standard 1547-2018, Standard for Interconnection and Interoperability of Distributed Energy Resources with Associated Electric Power Systems Interfaces, IEEE, 2018.
[2] IEEE Standard C37.113-2015, Guide for Protective Relay Applications to Transmission Lines, IEEE, 2015.
[3] IEEE Standard 242-2001, Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems, IEEE, 2001.
[4] P. P. Barker and R. W. De Mello, "Determining the impact of distributed generation on power systems: Part 1 — radial distribution systems," Proc. IEEE PES Summer Meeting, 2000, pp. 1645–1656.
[5] H. Zeineldin, E. El-Saadany, and M. Salama, "Distributed generation micro-grid operation: control and protection," Proc. Power Systems Conference, 2006.
[6] NERC, Distributed Energy Resources: Connection Modeling and Reliability Considerations, North American Electric Reliability Corporation, 2017.
[7] IEC 60255-151:2009, Measuring Relays and Protection Equipment — Functional Requirements for Over/Under Current Protection, IEC, Geneva, 2009.
[8] IEEE Standard C37.110-2007, Guide for the Application of Current Transformers Used for Protective Relaying Purposes, IEEE, 2007.
[9] CIGRÉ Working Group B5.34, The Impact of Renewable Energy Sources and Distributed Generation on Substation Protection and Automation, Technical Brochure 421, 2010.
[10] W. H. Kersting, Distribution System Modeling and Analysis, 4th ed., CRC Press, 2017.
[11] J. L. Blackburn and T. J. Domin, Protective Relaying: Principles and Applications, 4th ed., CRC Press, 2014.
[12] Schweitzer Engineering Laboratories, SEL-351 Protection System Instruction Manual, SEL, 2022.