Grid codes and inverter protection settings explained

A grid code is a set of technical rules that a network operator publishes to describe how anything connected to its wires must behave. For a photovoltaic installation, the part of the grid code that matters most day to day is not the connection procedure but the small table of numbers loaded into the inverter's protection firmware: voltage trip thresholds, frequency trip thresholds, trip delay times, reconnection rules, and ramp rates. Get these numbers wrong and the inverter either trips too often, damaging the relationship with the network operator and the system owner, or fails to trip when it should, which is a safety and compliance problem.

This article works through where those numbers come from, how they are structured in the major reference documents, how to read a settings sheet without guessing, and what typically goes wrong when installers copy a parameter set from a different country or a different inverter family. By the end you should be able to look at a commissioning certificate or an inverter's protection page and understand what each parameter is actually protecting against, not just that it needs a tick in a box.

Why protection settings exist

Inverter protection has two distinct jobs that are easy to conflate. The first is anti-islanding and safety: the inverter must stop energising the local network within a bounded time after the network disappears, so that utility staff working on de-energised lines are not exposed to a live circuit fed from someone's roof. The second job is grid support: modern inverters are also expected to ride through minor voltage and frequency disturbances rather than tripping immediately, because a large fleet of small generators all disconnecting at once during a minor disturbance can itself destabilise the network. These two goals pull in opposite directions — one wants fast disconnection, the other wants tolerance — and grid codes exist to draw the line between them with specific thresholds and timers.

Historically, older standards such as IEC 61727 and early national rules erred heavily toward fast disconnection, because the installed base of distributed generation was small enough that losing it all during a disturbance did not matter. As PV and storage penetration increased, this stopped being true: an aggressive, uncoordinated trip-and-reconnect cascade across thousands of inverters can turn a minor voltage dip into a supply interruption. This is the reasoning behind the shift toward the newer generation of grid codes such as EN 50549-1 and updated versions of IEEE 1547, which introduce staged trip curves and mandatory ride-through bands rather than a single fixed threshold.

The structure of a settings table

Most grid codes express protection requirements as a small number of zones on a voltage-time or frequency-time plane, sometimes called trip curves. A typical structure looks like this:

The exact numeric thresholds differ by network operator and by nominal voltage (Un), and the point of this table is not to hand you numbers to copy but to show the shape every code follows: two or more voltage stages, two or more frequency stages, and a mandatory delay before reconnecting after a trip. :::diagram inverter-topologies:::

Worked example: checking a trip decision

Suppose a network operator specifies an undervoltage stage 1 threshold of 0.87 x Un with a 2.0 second trip delay, and a stage 2 threshold of 0.50 x Un with a 0.16 second trip delay, on a nominal single-phase voltage of 230 V.

1. Stage 1 threshold in volts: 0.87 x 230 = 200.1 V.
2. Stage 2 threshold in volts: 0.50 x 230 = 115.0 V.
3. The line voltage sags to 195 V for 1.4 seconds during a fault elsewhere on the feeder, then recovers.
4. 195 V is below the stage 1 threshold of 200.1 V but the disturbance lasts only 1.4 s, which is shorter than the 2.0 s stage 1 delay. The inverter should ride through and continue operating.
5. If the same sag had instead dropped to 100 V, that is below the stage 2 threshold of 115.0 V, so even though 100 V is a shallower percentage away from nominal than some faults, it crosses into the fast-trip zone and the inverter should disconnect within 0.16 s.

This arithmetic is exactly what the inverter's protection relay does internally, sampling voltage and comparing it against each stage's threshold and running timer. Commissioning engineers can reproduce it with a voltage sag generator on a test bench to confirm the unit is actually implementing the intended curve rather than a factory default.

Reading a commissioning certificate

A properly completed commissioning record for grid code compliance should show, at minimum: the country or network operator profile selected in the inverter firmware, the firmware version, the measured or configured values for each protection stage, the frequency ride-through settings, the ramp rate for post-fault power recovery, and the reactive power or power factor mode in force (covered in more depth in a companion article on reactive power support). Anyone auditing a fleet of installations should be able to pull this sheet and compare it against the network operator's published profile without opening the inverter.

What goes wrong in practice

The most common and consequential error is applying the wrong country or regional profile. Many inverter families ship with a single firmware image and a drop-down list of dozens of national and regional settings profiles; selecting the wrong one — for example, an adjacent country's profile because it "looked similar" — silently changes trip thresholds, ride-through bands, and reactive power defaults. The inverter will often pass a basic power-on test and even run for months, then fail an actual grid disturbance in exactly the way the correct profile was designed to prevent.

A second common failure is treating protection settings as fixed at commissioning and never revisiting them. Network operators periodically revise grid codes, particularly frequency ride-through requirements, in response to system-wide studies. An inverter commissioned five years ago under an older code may be legally required to have its firmware updated, and in some jurisdictions the network operator can require evidence of this before allowing continued export. Fleet operators without a firmware and settings management process discover this only when an audit or a network operator letter arrives.

A third failure mode is confusing installer-level parameters with password-protected grid-code parameters. Many inverters lock protection settings behind a certified-installer code specifically because changing them without authorisation is both a safety issue and, in some jurisdictions, a legal one. Installers who reset a unit to factory defaults after a fault, without re-applying the correct country profile, can inadvertently revert to overly permissive settings.

Finally, some retrofit storage additions or hybrid inverter swaps overlook that the new inverter needs its own full grid-code parameter set applied; assuming the replacement unit "already knows" the network's requirements because the old one did is not a safe assumption across manufacturers.

Standards and references

IEC 61727 was the earlier reference for small PV grid interconnection with relatively conservative fixed thresholds, since largely superseded for European connections by EN 50549-1 (installations up to low voltage) and EN 50549-2 (medium voltage), which introduce the staged ride-through structure described above. IEC 62116 specifies the anti-islanding test method referenced by many protection standards, described in more detail in the companion article on anti-islanding. IEEE 1547 plays the equivalent role in North America and has, since its 2018 revision, moved toward similar ride-through philosophy. IEC 60255 covers the general performance and testing requirements for protective relays, which underlies how manufacturers validate that their firmware timers actually meet the stated trip-time bands under test rather than only in specification documents. Installers should always confirm which edition of each code the local network operator currently references, since editions matter more here than almost anywhere else in PV design.

For the broader connection process this settings work sits inside, see grid connection and export rules explained and the grid application checklist. Export limits configured alongside protection settings are covered in the companion piece on export limitation and power control.

Frequently asked questions

Who decides the protection settings for my inverter?

The network operator publishes the requirements, usually as a national or regional grid code profile; the installer selects and applies the matching profile in the inverter firmware during commissioning. The installer does not invent the numbers, but is responsible for applying the correct published set and for producing evidence, typically a settings printout or configuration file, that the correct profile was loaded.

Can I change my inverter's protection settings myself?

Generally no. Reputable inverters lock grid-code-relevant protection parameters behind an installer or certified-technician access level precisely because incorrect changes are a safety and compliance risk. Basic parameters such as export limits or scheduling are usually accessible to owners; voltage and frequency trip settings are not, and should not be, adjustable without training and authorisation from the network operator.

What happens if my inverter trips too often on voltage?

Frequent voltage trips usually indicate either an incorrect protection profile (too conservative for the actual network conditions) or a genuine local voltage problem such as an undersized service cable or an overloaded feeder pushing voltage outside normal bounds. The first step is confirming the applied settings match the network operator's published profile before assuming the network itself needs remedial work such as tap changes or reactive power support.

Do protection settings differ between single-phase and three-phase inverters?

The underlying voltage and frequency thresholds are usually expressed as a percentage of nominal and apply conceptually the same way, but three-phase inverters must also decide how to respond when only one or two phases are disturbed. Some codes require tripping only if all phases are outside limits, others require tripping if any single phase is; this detail is often the actual point of divergence between manufacturers claiming the "same" grid code compliance.

Does a firmware update change my existing settings?

It can. Firmware updates sometimes reset custom or region-specific settings to a new default, or add new mandatory ride-through stages that were not present in the version originally commissioned. Anyone managing a fleet of inverters should treat firmware updates as an event requiring a settings verification pass, not just a version bump.

How is this different from anti-islanding protection?

Anti-islanding is a specific subset of protection designed to detect the narrower case where the local network has separated from the wider grid but local generation and local load happen to remain roughly balanced, making voltage and frequency-based detection alone unreliable. It typically uses additional techniques described in the companion article on anti-islanding detection methods, layered on top of the general voltage and frequency protection described here.