Island Mode Operation
A refinery loses its grid connection. Its combined heat and power plant now has a few seconds to decide whether the refinery keeps running or goes dark. Getting it wrong means an uncontrolled shutdown: units tripped, product to the flare, a day of lost production and a mechanical inspection before restart.
We have implemented islanding on an operating refinery CHP plant, proved it on the running plant, and maintained it since.
The measurable result
The plant this was built for recorded twelve electrical supply incidents in 2010, four of them caused by operator action. By 2016 it recorded two, none of them caused by operator action.
| Year | Incidents | Of which caused by operator action |
|---|---|---|
| 2010 | 12 | 4 |
| 2011 | 10 | 3 |
| 2012 | 8 | 3 |
| 2013 | 4 | 0 |
| 2014 | 4 | 1 |
| 2015 | 3 | 1 |
| 2016 | 2 | 0 |
Islanding was one part of that programme. The rest was differential protection with single-phase auto-reclosing on four 110 kV overhead lines, breaker replacement at both ends of each line, and an optical ground wire. The automation is what removed the operator from the critical seconds.
What has to happen, and in what order
Detect the separation
Not "notice the frequency moving" — establish that the connection to the grid is gone, fast enough that the next steps still have time to act. Frequency deviation alone is a slow and ambiguous criterion. We extended the detection to include the position of the breakers that actually define the island: the 110 kV breaker on the three-winding transformer and the 11 kV breaker, brought into the DCS as hard signals, each with an enable key so the criterion can be taken out of service for maintenance without disabling the whole function.
Transfer the governor
The turbine governor runs in droop while synchronised to a grid that sets the frequency. In an island there is no grid to follow: the machine itself sets the frequency, and the governor has to move to isochronous control. That transfer happens once, under load, and cannot be rehearsed on the running plant.
Know the load before it arrives
The island the machine finds itself in depends on which breaker opened, and so does the load it must pick up. The control system keeps a running snapshot — refreshed every ten seconds — of the generation and consumption balance on the 6 kV busbars, together with the operating state of the turbines and the circulating fluidized bed boiler. From that snapshot it continuously computes the setpoints the boiler and turbine controllers will need for each possible separation, and holds them ready. When the breaker opens, the setpoint is already calculated for that specific case rather than being derived while the frequency is falling.
Take the turbogenerator off plant load control
In grid-parallel operation the TG follows a plant load target. In the island that target is meaningless; the machine moves to holding its own inlet pressure and the island frequency instead.
Shed load by priority
Generation left in the island is smaller than the load that was being served. Non-critical consumers go, in a sequence worked out in advance, fast enough that the frequency excursion stays inside what the turbine will tolerate. Which consumer is non-critical is a process question, not an electrical one, and getting the list wrong shuts down the refinery just as effectively as losing the plant.
Hold frequency and voltage
In the island the plant is the grid. Frequency and voltage control that were someone else's problem are now the control system's problem.
Resynchronise
The control system matches frequency and voltage at the breaker chosen for resynchronisation — which one depends on how the island formed, and may be the 110 kV breaker, the 11 kV breaker, the 6 kV bus coupler or the generator breaker. Closing is on the dispatcher's command.
Proven, then maintained
The algorithm was implemented in the DCS and tested on the running plant with the incoming lines to the refinery deliberately opened, so that the turbogenerator carried the refinery's own consumers. Two trials were run, before and after a plant overhaul, holding 13–14 MW in the island. Both were agreed in advance with the transmission and distribution system operators, because a deliberate separation affects the network on the other side of the breaker too.
It is still in service. A historical trend recorded during an islanding event in February 2025 shows the turbogenerator at 10.4 MW and 49.9 Hz with the island mode flag set, speed dipping below 2,980 rpm and recovered by the governor, and 100 bar steam flow to the turbine re-established — the whole transient inside seventy seconds.
Turbine acceptance testing on the same units included disconnection of the generator from the grid, with the machine held on house load: the same event under controlled conditions.
Islanding a hydro unit is a different problem
On a steam turbine the constraint is the machine. On a hydro unit the constraint is the water column.
We carried out the risk assessment for islanding a micro-hydro unit onto isolated load, and the finding was that it could not be done as the plant stood. The nozzle valves take 30 to 45 seconds for full travel — deliberately slowed, because closing them faster raises pressure in the penstock beyond what the derivation would take. A governor that cannot act in seconds cannot hold frequency in an island.
That is a real answer, and it is the one the plant needed. What followed from it:
Detect the separation by rate of change of frequency
Where the control system has no breaker position signal to tell it the line has opened, df/dt detects the separation from the electrical behaviour itself, and trips the unit before the frequency excursion damages anything.
Then ask how much load
Tripping is right when the island would be 5 MW and the machine is small. It is wrong when the island is comparable to the unit's own no-load and auxiliary demand, because then the machine can hold it and the penstock never sees a sharp flow reduction. The control logic can distinguish the two: below a defined rejected load, transfer to isolated operation on frequency control; above it, trip.
Which case applies is not an engineering decision alone
It depends on what the network operator leaves connected when their infeed drops, and that has to be agreed with them before the logic is written.
On the vertical machine we maintain, transferring the frequency and power controller to an isolated district is a tested function in the periodic maintenance programme, not a theoretical capability.
Islanding is worth doing where it is possible and worth refusing where it is not. Knowing which is which is the part that takes a process engineer.
What islanding detection can be built on
| Criterion | What it is good for | What it misses |
|---|---|---|
| Breaker position, hard-wired into the DCS | Unambiguous, immediate, tells you which island formed | Only the breakers you have wired; needs an enable key per criterion for maintenance |
| Rate of change of frequency, df/dt | Works when no position signal exists | Can be fooled by disturbances that are not separations |
| Frequency deviation alone | Simple | Slow and ambiguous; by the time it is certain, the excursion has happened |
| Power flow direction at the connection point | Confirms the others | Not sufficient on its own |
We use breaker position as the primary criterion where the signals can be brought in, and df/dt where they cannot.
Why it is rare
An automation contractor can write the logic. Running it on a plant that a refinery depends on requires someone the plant owner will let near the turbine, agreement from two network operators, a load shedding list somebody has to be confident about, and the willingness to be on site when the breaker opens.
We also review this work for others. A completed functional test protocol for a turbogenerator — governor behaviour under load rejection at 5 and 15 MW, transfer from load control to speed control on leaving the grid, automatic change of control law from P to PI on entering the island, overspeed protection, automatic synchronisation and 6.3 kV automatic transfer switching — was given to us for expert review, to establish what had not been demonstrated and where the conclusions did not follow from the measurements.