Load Following and Island Detection for Campus and Industrial CHP Plants

An engineering guide to controlling on-site generation against utility import, detecting the loss of the grid, and riding through the transition without dropping the site.

Combined heat and power plants on university campuses, hospitals, refineries and manufacturing sites are usually asked to do two things that pull in opposite directions. First, follow the site load closely enough that the plant never exports to the utility. Second, keep the site energized when the utility goes away. The first requirement pushes the plant to operate with a very small import margin. The second requirement becomes much harder to satisfy the smaller that margin gets.

Most of the engineering difficulty in these projects sits in that tension. This article walks through how we design load-following control and island detection as one integrated scheme: the measurements, the control architecture, the protection elements, the operating modes, and the voltage-control coordination that has to come with them. It closes with a frequently asked questions section covering the issues owners raise most often.

1. Why the front end of a project now decides its outcome

It is tempting to treat these as two separate scopes: a control project and a protection project. In practice they share the same measurement points, the same breakers, the same mode logic and the same failure modes. Designing them separately produces schemes that disagree with each other in the field.

The coupling is direct. A load-following controller that holds import to a few hundred kilowatts is deliberately minimizing the power imbalance across the utility point of interconnection. That imbalance is exactly the quantity passive island-detection elements rely on. Tighten the control and you shrink the signal that protection needs to see. A scheme designed without accounting for that will pass its factory test and fail in service.

The central trade-off

• Tighter import control means a smaller power mismatch when the utility opens.
• A smaller mismatch means slower voltage and frequency excursions after separation.
• Slower excursions mean conventional under-voltage and under-frequency elements may never pick up.
• Therefore: the tighter the load following, the less you can rely on passive island detection alone.
  

2. Load following: what the controller actually has to do

2.1 Import setpoint, deadband and bias

The controller regulates net utility import at a configurable setpoint, typically a few hundred kilowatts per bus or per electrically connected group of buses. Import is measured as the sum of real power flowing through every utility source serving that group. Two design choices matter more than the setpoint value itself.

• Deadband. Without one, the governors chase every load fluctuation on site and the units cycle continuously. The deadband should be wide enough to ignore normal load noise and narrow enough to keep import inside the agreed band.
• Positive bias. The setpoint should sit far enough above zero that normal load swings and measurement error never carry the site into export. Import is cheap; an export event may be a contractual violation.

2.2 Topology awareness

Industrial and campus substations are rarely a single bus. They are usually two or three buses with normally-open ties, each fed from more than one transformer, with generation connected through its own tie breaker. The set of buses that are electrically connected changes whenever an operator closes a tie or takes a transformer out of service.

A controller that assumes a fixed arrangement will allocate setpoints incorrectly the first time the configuration changes. The controller should therefore include a topology processor: a piece of logic that reads every main, tie and generator breaker position, determines which buses are currently connected, and recalculates the import measurement, the setpoint allocation and the source count for each group in real time.

2.3 Preventing export: control first, protection second

Export prevention deserves two independent layers, because a control action and a protective trip serve different purposes.

• Control layer (runback). When group import falls below a low-import threshold, the controller reduces generator output at the maximum available ramp rate. This is what should prevent export in normal operation.
• Protection layer (directional power). A two-stage directional power element (device 32) on each utility source provides the backstop. Stage one alarms and confirms the runback on any reverse flow. Stage two trips on a defined magnitude and time, set from the interconnection agreement's export allowance.

One decision deserves explicit discussion with the owner and the utility: what stage two trips. Tripping the generator tie stops the export and keeps the site connected to the grid, which is usually the preferred outcome. Tripping the utility source stops the export by islanding the site, which is a far more disruptive action to take on a condition that is not a fault.

2.4 Source counting and close permissives

Most of these substations carry a limit on how many sources may be paralleled onto one bus, set by the bus bracing and breaker interrupting ratings. Because the tie arrangement lets an operator create new combinations, this limit has to be enforced by logic rather than by procedure.

We recommend enforcing it twice. The automation controller blocks any close command that would exceed the limit and tells the operator why. Separately, hardwired close permissives in the breaker close circuits enforce the same limit without depending on software or communications. The first layer is for usability; the second is because the consequence of getting this wrong is a bus fault beyond the equipment rating.

2.5 Behavior on loss of data

Every softwired signal needs a defined behavior when it goes stale or invalid. The safe default for a load-following controller is to freeze the current output setpoint, raise the import bias, alarm, and hold — never to ramp generation up on missing data. Quality flags and a watchdog heartbeat between the automation controller and the plant control system are what make this possible.

3. Control and communications architecture

The architecture question that comes up on every one of these projects is which signals should be hardwired and which can be carried over a protocol. The answer follows from consequence, not from convenience.

Figure 1 — Typical three-tier architecture: substation devices, an automation controller with parallel hardwired I/O, and the plant control layer.

3.1 The tag database is a deliverable, not an afterthought

Where these projects lose schedule is almost always at the interfaces between the substation relays, the automation controller, the turbine control systems and the plant control system. Each vendor has its own point naming, scaling and protocol support. The way to keep that from becoming a commissioning problem is to publish a single tag database early and make every party work from it. For each exchanged point it records the tag name, description, protocol and address, data type, scaling and engineering units, deadband, quality handling and the defined fail-safe value.

4. Operating modes

Every plant of this type runs in several distinct configurations, and the control and protection behavior differs in each. Writing them down as an explicit mode matrix, with entry and exit conditions, is what keeps the logic reviewable.

5. Island detection: the part that is genuinely hard

5.1 The non-detection zone

When a site separates from the utility, the initial rate of change of frequency is governed by the power mismatch at the moment of separation and the stored rotational energy of the island:

df/dt  =  f₀ × ΔP  /  (2 × H × S)

where f₀ is nominal frequency, ΔP is the mismatch, H is the inertia constant of the connected machines and S is their rating. The consequence is straightforward. A site that was importing two percent of its connected generation sees an initial ROCOF of well under a quarter of a hertz per second, against typical ROCOF pickups of half a hertz per second or more. Governor response then closes the gap further, and voltage may barely move at all if the reactive balance happened to be close.

This is the reason a tightly controlled CHP plant cannot rely on under-voltage and under-frequency elements to detect the loss of the grid. Those elements are necessary — they are dependable backup — but they are not sufficient, and any scheme that rests on them alone should be challenged.

5.2 A layered scheme

The design approach we recommend is to provide several independent detection paths, arranged so the fastest and most secure path acts first and the slower paths provide dependable backup.

This is the reason a tightly controlled CHP plant cannot rely on under-voltage and under-frequency elements to detect the loss of the grid. Those elements are necessary — they are dependable backup — but they are not sufficient, and any scheme that rests on them alone should be challenged.

5.2 A layered scheme

The design approach we recommend is to provide several independent detection paths, arranged so the fastest and most secure path acts first and the slower paths provide dependable backup.

Figure 3 — Layered, bus-selective island detection and the actions it initiates.

• Layer 1 — Direct transfer trip. If the utility can provide a trip signal from the remote line terminals, this is the most secure and fastest indication available, because it reports the actual event rather than inferring it. It is always worth asking for early, since the answer changes the rest of the architecture.
• Layer 2 — Upstream status. Circuit switcher and source breaker positions, combined with loss-of-source logic, cover local openings directly and cheaply.
• Layer 3 — Fast passive elements. Vector shift (78VS) and rate of change of frequency (81R), supervised by voltage and by measured import so they do not operate on large on-site load steps or motor starts.
• Layer 4 — Backup passive elements. Time-delayed under- and over-voltage and under- and over-frequency elements, plus directional power and loss-of-import logic, providing dependable backup inside the required cessation time.

Where synchrophasor measurement is available, comparing the local phase angle against a remote reference provides another independent path that does not depend on the local power balance.

5.3 Separate selectively

Not every loss of a source is an island. In a substation where each bus is fed from two transformers, losing one transformer leaves both of the buses it served still connected to the grid through their other source. No island has formed. What has happened is that the on-site generation can now backfeed a de-energized transformer and the utility line behind it, which is an unacceptable condition for utility personnel and equipment.

The scheme has to distinguish these cases. Loss of a single source should trip only the affected utility connections and leave the buses grid-parallel. A true island — loss of every utility source feeding a bus or a connected group — should trip those sources and assert island mode for that group alone, while other groups continue running grid-parallel.



5.4 How fast is fast enough

Three separate limits apply, and the design must satisfy the most restrictive of them.

• Utility reclosing. Separation must be complete before the utility's reclose dead time expires. An out-of-phase reclose onto an energized island can destroy a turbine-generator, and this is normally the binding constraint.
• Islanding-cessation requirements. Where IEEE 1547 applies, unintentional islanding must cease within two seconds. Whether that standard governs, and which edition, depends on how and at what voltage the plant is connected.
• Site ride-through. The island must form quickly enough that the voltage and frequency excursion stays inside what site processes and motor loads can tolerate.
  

6. Making the transition seamless

Detecting the island is only the first half. The plant then has to change how it controls itself, within cycles.

• Governor mode. Units move from import or load control to isochronous control. If several units are paralleled inside the island, one runs isochronous and the others follow, or all run with isochronous load sharing. This transfer should be initiated by a hardwired or GOOSE signal, not by a supervisory command.
• Excitation mode. Excitation systems move from power factor or VAR control to voltage control. Left in VAR control inside an island, the machines regulate to a reactive setpoint that no longer has a grid behind it, and island voltage drifts.
• Load shedding. If any credible island configuration leaves generation short of load, under-frequency or status-based load shedding on selected feeders is required. This has to be checked mode by mode, not once for the best case.
• Motor reacceleration. The voltage dip during the transition has to be checked against motor contactor dropout and adjustable-speed drive ride-through, which are often the first things to trip on site.
• Resynchronization. Return to grid-parallel operation is supervised by sync-check (device 25) across the utility connection, with a defined restoration sequence and a deliberate delay after utility voltage returns.



The honest position on the word seamless is that it is a modeling claim before it is a commissioning result. Demonstrating it in advance requires a dynamic or electromagnetic transient simulation of island formation, load rejection and the mode transfer for each credible configuration. Without that study, the first proof anyone has is the first real event.

7. Protection has to be re-examined for island operation

This is the most commonly missed scope item in CHP island projects, and it matters a great deal.



• Fault current collapses. With the utility contribution gone, available fault current is limited to what the on-site machines can supply, and it decays as machine reactance moves from subtransient to synchronous values. Overcurrent elements set for grid-parallel duty may be slow or may not pick up at all.
• The ground source moves. Grounding that was provided by the utility transformer is replaced by the generator neutral grounding resistors, which are typically far more restrictive. Ground overcurrent sensitivity changes completely, and neutral overvoltage may become the practical ground-fault detection method.
• Coordination changes. Time-current coordination that is correct grid-parallel is not automatically correct in an island. Both cases have to be checked.
• Settings groups are the usual answer. Modern microprocessor relays support multiple settings groups. Assigning an island-mode group, switched by the same logic that asserts island mode, is cleaner and more reviewable than trying to find one set of settings that works acceptably in both states.
• Incident energy changes too. Because clearing times change, arc-flash incident energy in island mode can differ substantially from the grid-parallel case. If the site labels equipment for arc flash, both operating states should be evaluated.
  

8. Voltage control: tap changers, excitation and capacitor banks

8.1 Tap changers and excitation systems regulate the same voltage

A transformer load tap changer in automatic mode and a generator excitation system in voltage-control mode are two independent regulators acting on the same bus. Left alone, they hunt: the excitation system raises output voltage, the tap changer sees high voltage and taps down, the excitation system responds again, and the plant ends up with taps at one end of their range and machines at a reactive limit. There are two standard remedies.

• Block the tap changer. Place the tap changer in manual whenever generation is supplying the bus, and return it to automatic, after a delay and a settling check, when generation is lost. This is straightforward and easy to verify, but it gives up automatic voltage regulation while the plant runs.
• Run the machines in power factor or VAR control. Leave the tap changer in automatic with an extended time delay and let the excitation systems regulate reactive output rather than voltage. This keeps automatic regulation available, at the cost of a scheme that depends on the machines respecting their limiters.

Both are defensible. The right choice depends on the site's reactive requirements at the interconnection, the tap changer controller's capabilities, and how the buses are fed. Where two transformers feed a common bus, circulating-current control between them — master-follower or reactive-current compensation — has to be reviewed as part of the same exercise.

8.2 Capacitor banks need explicit island rules

Many sites simply switch their capacitor banks off by hand whenever the plant runs, which is a reasonable operating practice and a poor substitute for a design. Four issues drive the engineering.

• Overvoltage at light load. A fixed bank that was correctly sized against utility source impedance can push voltage high on a lightly loaded island, where the source impedance is much larger.
• Generator self-excitation. If capacitive reactive supply exceeds what the machines can absorb, voltage can run away. This is the failure mode that justifies tripping banks on island detection rather than merely blocking further switching.
• Harmonic resonance. The parallel resonant frequency between the bank and the source shifts downward as source strength falls. A bank that sits safely between characteristic harmonics grid-parallel can land on one in an island.
• Switching and reclose. Reclosing onto a charged bank produces severe transients, so reconnection must be interlocked on the bank discharge time as well as on voltage and mode.

The usual recommendation is to permit bank operation only while grid-parallel, under reactive or power-factor control with mode permissives, and to trip and block the banks on island detection, allowing reconnection only after the utility is restored, the bus voltage is inside its window, and the discharge time has elapsed.

9. Standards and reference documents

Which documents govern is a site-specific question, and getting it wrong early distorts the whole design. The interconnection agreement is the controlling document; industry standards fill in the method.

10. What a complete engineering package contains

A design that can actually be built and commissioned includes all of the following. Packages that stop at a control narrative tend to generate change orders during construction.



• Existing system review — as-built drawings, existing relay settings and logic, and an explicit compliance matrix against the interconnection agreement.
• Control philosophy — import control, mode matrix, island detection and separation, voltage-control coordination, and capacitor bank rules, written so a reviewer can follow the logic without reading relay code.
• Communications architecture and tag database — every exchanged point, with protocol, scaling, deadband, quality handling and fail-safe state.
• Updated one-line diagrams — reflecting new elements, metering and logic.
• Schematics — trip and close circuits, permissives, mode-change circuits and tap-changer blocking.
• Wiring and interconnection diagrams, panel schedules and loop diagrams — at a level a contractor can install from.
• Cable schedules — for new and modified circuits.
• Relay setting files with change logs — in native format, including any island-mode settings group.
• Field implementation and test procedures — point-to-point checks, functional tests, mode-transfer tests, acceptance criteria and a rollback plan.
  

11. Eight failure modes worth designing against

1. Relying on 27 and 81 elements alone. The tighter the load following, the less likely these are to operate. Layer the detection.
2. Treating loss of one source as an island. It usually is not. What it is instead is a backfeed path into de-energized utility equipment.
3. Leaving island-mode protection settings unexamined. Fault current and the ground source both change. Use a settings group.
4. Letting the tap changers and excitation systems both regulate voltage. Pick one regulator per bus per mode, and make the handoff explicit.
5. Leaving capacitor banks connected into an island. Overvoltage, self-excitation and resonance all become live risks at once.
6. Softwiring a trip. Protection-critical actions belong on hardwired contacts or GOOSE, with defined performance.
7. Leaving the source-count limit to operating procedure. Enforce it in logic and in the close circuits.
8. Claiming seamless transfer without simulation. If it has not been modeled, the first proof is the first real event.
   

12. How we approach this work

Keentel Engineering provides protection, control and interconnection engineering for generation and large-load facilities from 4 kV through 765 kV. On CHP and campus microgrid projects, our scope typically runs from the existing-system review and compliance matrix through the control philosophy, island detection design, relay setting development, construction drawings and cable schedules, and on into field implementation and functional testing support. Where the transition behavior has to be proven before commissioning, we add dynamic and electromagnetic transient simulation of island formation, load rejection and mode transfer.

Our work is led by licensed professional engineers, with independent QA/QC review of every deliverable and drawings sealed in the state where the project is built.

Frequently asked questions

Talk to us

Keentel Engineering provides power system studies, protection and control design, interconnection engineering and NERC compliance services for utilities, developers, EPCs and large-load owners nationwide, from our offices in Tampa, Austin, Sacramento and Baltimore. If you are planning a CHP islanding or load-following project and want to talk through the approach, we are happy to have that conversation.