Worked example · ROCOF / Loss of Mains · G99 context

One Event, Two Failure Modes — Tuning ROCOF on a Low-Inertia Grid

The same ROCOF element can be both too sensitive and too insensitive. Tune it one way and it nuisance-trips a benign event; the other way and it misses a real island. A worked demonstration of the method, not a specific site installation.

Published 2026-08-04 · EI Portal

The same ROCOF element can be both too sensitive and too insensitive. Tune it one way and it nuisance-trips a benign event; the other way and it misses a real island. Here is the dilemma worked through on one model.

The grid

A lower-inertia network with embedded generation. After a disturbance, frequency moves fast — to first order:

RoCoF ≈ ΔP · f₀ / (2H)
      

so less inertia means a steeper df/dt and a deeper nadir. In the worked model (mixed synchronous + inverter source, islanding event, 32% severity): at low inertia the nadir is 48.83 Hz with a measured peak df/dt of 0.88 Hz/s; drop to very low and it becomes 48.24 Hz at 1.32 Hz/s — into the load-shedding region; raise to high and the same event barely registers at 49.47 Hz and 0.40 Hz/s.

The reference scheme

• ROCOF 1.0 Hz/s with a time delay (the GB post-ALoMCP basis)
• Underfrequency stages 49.0 Hz (1 s) and 47.5 Hz (0.5 s)
• Overfrequency 51.5 Hz · UFLS reference 48.8 Hz
• Averaging window 0.5 s on the df/dt measurement — short is fast but noisy, long is secure but slow

Note the opening tension: the default islanding case peaks at 0.88 Hz/s against the 1.0 Hz/s pickup — 0.12 Hz/s below — so the reference scheme itself flags a possible missed islanding detection before a single setting is touched.

Failure mode 1 — too sensitive

Set ROCOF to 0.18 Hz/s and apply a benign weak-grid event — the kind that should ride through:

The element trips in 1.425 s. Decision: possible nuisance trip.

Across many embedded generators, that is a large, unnecessary, self-reinforcing loss of generation — the exact failure that pushed GB from 0.125 to 1.0 Hz/s.

Failure mode 2 — too insensitive

Set ROCOF to 8 Hz/s, drag the underfrequency stage down to 45 Hz, and apply a genuine islanding event:

The peak df/dt sits 7.12 Hz/s below pickup. ROCOF doesn't assert. Underfrequency doesn't assert. Decision: possible failure to detect islanding.

A live island left connected is a safety and power-quality failure — the reason loss-of-mains protection exists at all.

The source mix shifts it again

• Grid-following dominated → the nadir crashes to 47.73 Hz and the security margin is flagged as tight.
• Grid-forming supported → the same event holds at 49.45 Hz, restrained — the inverters arrest the fall instead of riding it.

Same event, different response — so the right setting depends on the source type, not just the inertia number.

The lesson

Every ROCOF / loss-of-mains setting is a deliberate position between nuisance tripping and missed islanding — and low inertia narrows the gap between them. Test both ends against the same model before you commit, and re-test when the source mix changes.

The dynamics here are an illustrative scenario model paired with rigorous protection-element logic — not an EMT/RMS study or a grid-code compliance verdict. Follow the applicable grid code (e.g. UK G99).