Anti-islanding protection for PV inverters — why the inverter must disconnect within 2 seconds (NEN-EN 50549-1)

The guide on §712 — PV installations and the guide on the PV fire switch both cover protective measures around a PV installation, but at different levels: the fire-switch article covers rapidly de-energising the DC strings at module level for emergency responders. This article covers a different, grid-side protection function: anti-islanding.

What islanding is

Islanding occurs when a part of the low-voltage network, after the supply from the grid is lost (planned maintenance or a fault), remains energised anyway — fed by local generation (PV inverters, CHP, battery storage) connected within that section of the network. This is dangerous for two reasons:

Safety of technicians: a grid-operator worker who assumes a de- energised line during maintenance or a fault can unexpectedly encounter live conductors.
Synchronisation risk: when the grid operator restores supply without the isolated network section being exactly synchronised in phase and frequency with the restored grid, reconnecting the two produces a damaging current surge for the equipment in that network section.

The requirement: detection and disconnection within 2 seconds

NEN-EN 50549-1 ("Requirements for generating plants to be connected in parallel with low voltage distribution networks") requires that an inverter (or its associated protection relay) detects the loss of the grid and disconnects the installation within a maximum of 2 seconds. This is achieved with a combination of:

Passive detection: monitoring voltage and frequency limits, and the rate of change of frequency (ROCOF) or a phase shift (vector shift), which characteristically deviates as soon as the grid is lost.
Active detection: for inverter-based generation, a small, deliberate disturbance in frequency or impedance is often additionally injected, whose response differs between a connected grid and an isolated island network — a method that also works in situations where passive detection produces too little deviation (for example when a local load happens to match the generated power closely).

Difference from the DC-side fire switch

Anti-islanding protection and the PV fire switch solve two different problems: anti-islanding is an AC-side, automatic grid-protection function that prevents a part of the grid from remaining unintentionally energised after the grid supply is lost; the fire switch is a DC-side, module-level function that, when the AC side is switched off, reduces the remaining voltage on the DC strings themselves, specifically for the safety of emergency responders who need to work at the roof or the inverter. Both functions are needed; neither replaces the other.

Practical relevance

For an installer carrying out switching work near a circuit with local generation, it is important to realise that the assumption "the grid supply is switched off, so the line is de-energised" does not automatically hold as long as local PV or CHP generation is connected to that section of the network — the anti-islanding function must have operated within the specified time, and that remains an automatic function which, like any protection, can fail or respond with a delay. A voltage test before touching therefore remains essential, even when anti-islanding protection is known to be present.

Common mistakes

Assuming a switched-off incoming supply always means de-energised without an own voltage test, while local PV or CHP generation can still briefly keep the relevant section of the network energised.
Confusing anti-islanding protection with the DC-side fire switch — one is an AC-side, automatic grid-protection function, the other a DC-side, module-level function for the safety of emergency responders; they solve different problems.
Changing or relaxing an inverter's grid-protection settings (voltage/frequency thresholds) without permission from the grid operator — these settings are generally fixed and certified according to the grid code.
Not accounting for the detection window of up to 2 seconds when carrying out work shortly after switching off a circuit with local generation — during that window the network section can still briefly remain energised.