Controlled islanding and system separation schemes

What controlled separation is

After a severe disturbance, such as the loss of a heavily loaded tie or a fault cleared late, two parts of the system can start swinging against each other until they lose synchronism. If nothing controls it, the distance protection of many lines sees the swing, some of them trip at places that make no sense for the grid, and the event can end in a wide-area blackout.

Controlled system separation opens the grid at points chosen in advance, so that each part, or island, is left with reasonably balanced generation and load. Each island is then stabilized with load shedding or generation tripping, and the operator resynchronizes them. When separation is decided by a controller from states and measurements, rather than by an impedance relay, it is treated as a remedial action scheme. It is a system-level scheme; see the map of protection schemes.

Which protections are involved and how they are coordinated

• Out-of-step 78 on the separation lines: detects the unstable swing and trips at the planned point. It uses the line CTs and VTs.
• Power swing blocking 68 on the other lines: keeps distance protection from tripping on the swing where separation is not wanted.
• Frequency and voltage (81, 27, 59) as additional separation criteria in some schemes.
• Load shedding or generation tripping in each island, for the balance.
• Synchronism check 25 at the reconnection points.
• Wide-area measurement with synchrophasors in more advanced schemes.

Logic and sequence

1. A disturbance starts a swing between two areas.
2. 68 blocks the distance zones of the lines that must not open.
3. The 78 on the separation line classifies the swing as unstable and trips, at the point of the swing its logic defines.
4. The two areas are separated. In the area left with a deficit, frequency drops and load shedding acts; in the area left with a surplus, frequency rises and the controls or generation tripping act.
5. Once the islands are stable, the operator checks conditions and reconnects them with 25.

Grid code and utility requirements

Separation points, settings and periodic testing of these schemes are defined by the system operator and the transmission owners, through their stability studies and the local grid code. Where the system-wide load shedding is not enough, for example in radial areas, supplementary schemes are installed to keep part of the load and generation. A plant or a transmission owner implements what those studies and the utility’s requirements specify.

Variants by voltage level

• Extra-high and high voltage: separation at interties and transmission corridors, with 78 and wide-area logic.
• Subtransmission and distribution: supplementary schemes in radial areas with local generation.
• Industry with cogeneration: separation of the plant during an external disturbance (frequency, voltage, directional power, loss of the grid) and internal load shedding to run as an island.
• Distributed generation: the opposite, unintentional islanding is prevented with anti-islanding protection.

Design criteria

• Separation points defined by stability studies, leaving viable islands.
• Ability of the generation in each island to regulate frequency and voltage.
• Load shedding and generation tripping coordinated with the separation.
• Coordination of 78 with 68 in the rest of the grid.
• Resynchronization procedure and synchronizing equipment at the reconnection points.
• In industry, an agreement with the utility on island operation and reconnection.

There are no generic settings: everything comes from the system or plant studies.

How each manufacturer implements it

Line relays from Siemens SIPROTEC (DIGSI), SEL (AcSELerator QuickSet), Hitachi Energy Relion 670 (PCM600), GE Vernova Multilin UR (EnerVista) and MiCOM (MiCOM S1 Agile) include power swing detection and out-of-step tripping, with different characteristics and logic (blinders, timers, slip counting). For industry, interconnection and generator relays offer frequency, df/dt, vector shift (a sudden jump in the voltage angle when the grid is lost; manufacturers name it differently and it has no single ANSI number) and directional power. Many utilities and interconnection standards discourage vector shift as an anti-islanding method; on synchronous machines 81U/O and 32 may be used alone, while in inverter-based plants transfer trip is usually the main method, with passive elements only inside a hybrid logic. Wide-area schemes usually use dedicated controllers.

Why it fails or misoperates

• Separation at the wrong point: 78 or 68 poorly coordinated, the distance protection of another line trips first.
• Island that collapses: deficit larger than expected, insufficient load shedding, generation without regulation capability.
• Industrial plant that does not separate during an external fault, or that separates on disturbances the grid would have ridden through.
• Failed resynchronization because conditions are out of range.

How it is tested

78 and 68 are tested by secondary injection with impedance trajectories that simulate stable and unstable swings. The complete scheme is verified with functional tests up to the separation breakers and the load shedding stages, and with end-to-end tests when there are remote trips.

Does your plant need to separate from the grid in a controlled way, or do you have a separation scheme to review? At Tiza Group we configure these schemes remotely. See remote relay configuration or contact us.

References

• IEEE C37.250-2020, Guide for Engineering, Implementation, and Management of System Integrity Protection Schemes.
• IEEE C37.113-2025, Guide for Protective Relay Applications to Transmission Lines.
• IEEE 1547-2018, Standard for Interconnection and Interoperability of Distributed Energy Resources with Associated Electric Power Systems Interfaces.
• P. Kundur, Power System Stability and Control.

Frequently asked questions