Islanding and Black Start:
What Happens When the Grid Goes Away

A facility can generate electricity every day and still go dark when the utility supply disappears. Resilience is not a nameplate feature. It is a sequence of electrical states that the complete site must enter, sustain, leave, and prove safely.

Section 01Separate ride-through, islanding, and black start

Owners often use “backup,” “islanding,” and “black start” as if they describe the same capability. They do not. Ride-through is continuity across a disturbance. Intentional islanding is operation inside a defined electrical boundary after separation from the utility. Black start is restoration from a de-energized condition without relying on the absent grid. Reconnection is another state, with its own synchronization and authorization requirements.

The U.S. Department of Energy describes a microgrid as interconnected loads and local energy resources within clearly defined electrical boundaries, acting as a single controllable entity with respect to the grid. It can operate connected to the utility or independently in islanded mode.¹ That definition puts three owner questions ahead of technology selection: what is inside the boundary, what controls it, and what must remain operating?

There is also a practical difference between a seamless transition and a restart after interruption. Some business functions need no-break power. Others can stop briefly and restart in order. Still others should remain off throughout an outage. The same source portfolio can be adequate for one of those objectives and inadequate for another. State the operating objective before asking whether a system is “island capable.”

A generator is a source. An island is a controlled electrical system.

Section 02Draw the boundary before sizing the sources

The first useful drawing is not a technology layout. It is the outage boundary. Identify the point of common coupling with the utility, the devices that separate the island, the buses and feeders that remain energized, and every load or source that sits inside or outside that boundary. The responsible electrical professionals must determine the actual arrangement; an owner-side study should make the decision inputs visible without pretending to complete that design.

A boundary that is too broad can make an otherwise practical resilience plan expensive or unstable. A boundary that is too narrow can omit a pump, control panel, communication link, cooling system, or fuel auxiliary needed by the supposedly protected operation. Trace the business process, not just the main electrical load. The smallest forgotten dependency can determine whether a large source is useful.

DOE's Federal Energy Management Program shows a campus example in which backup generators, a central plant, photovoltaic generation, feeders, and critical buildings are coordinated during grid-connected and islanded operation.² The lesson is architectural rather than site-specific: distributed assets become an island only when switching and controls make them operate together within the selected boundary.

Keep ownership and authority on the drawing as well. A tenant may not control the service equipment. A facility team may operate loads but not the utility interface. A packaged source supplier may stop at its terminals. Those facts do not select a technology, but they can disqualify a proposed boundary before detailed work begins.

Section 03Classify the loads by outage behavior

A normal utility bill does not reveal the outage sequence. Start with three load groups. The first is no-break: controls, safety functions, or processes that cannot tolerate a visible interruption. The second is restartable: loads that can return after a controlled delay. The third is deferrable: loads that can remain off until the grid returns. These are business and safety classifications to be validated by the responsible facility and engineering teams.

For every retained load, record steady demand, startup behavior, allowed interruption, acceptable operating range, and restart priority. Motors, transformers, compressors, and process equipment can draw or behave differently at energization than during steady operation. An annual or monthly energy total is therefore a weak basis for black-start planning.

Include the loads required to create power. Engines, turbines, fuel cells, batteries, and controls may need ventilation, cooling, heaters, pumps, fuel conditioning, compressed air, lubrication, communications, or control power. A resource that can serve the running island may still need another resource to start. The startup chain should end in a source that is actually available when the bus is dead.

Load shedding is not automatically a failure. It can be the deliberate mechanism that keeps essential operations stable when a source is lost or a large load cannot be accepted. Define which loads may drop, who may restore them, and what evidence the controller uses. Avoid an undefined promise to “serve critical loads” without a controlled list and sequence.

Section 04Know which device establishes voltage and frequency

In grid-connected operation, the utility system normally supplies the voltage and frequency reference. In an island, something inside the boundary must establish and regulate that reference. A synchronous machine may perform that role when configured for island operation. An inverter-based resource requires the appropriate grid-forming controls. A conventional grid-following inverter waits for an external waveform and cannot create the dead bus by itself.

DOE's inverter guidance, checked September 1, 2026, distinguishes grid-following inverters from grid-forming inverters and states that grid-forming inverters can start a downed grid. It also says solar-plus-storage systems can operate without grid support only when designed to do so.³ The words “solar,” “battery,” or “inverter” do not establish that design.

DOE separately notes that ordinary solar systems generally switch off when grid power is lost and that stand-alone operation needs a properly configured inverter and storage. Solar plus storage may support restoration if the complete system is designed and sized for it.⁴ Daylight availability, battery state of charge, load acceptance, protection, and control logic remain part of the answer.

Ask the supplier and engineer for the specific operating modes of the proposed equipment, not a general technology claim. Which device forms the island? Which resources follow it? What happens if that device is unavailable? How does the system move between modes? Marketing language about resilience should be converted into a control narrative and testable requirements.

Section 05Build the restoration sequence around a dead bus

A black-start sequence begins with less available than normal operation. The utility reference is absent. Some controls may be on limited power. The primary source may be stopped. The island should therefore be restored in deliberate steps, each small enough for the available source and protection scheme to accept.

DOE's microgrid-controller reference specification treats activation, black start, intentional islanding, unintentional islanding, resynchronization, and shutdown as separate controller functions.⁵ This is a useful specification discipline even when a project uses a different technical standard: name each state and describe the required transitions rather than asking for generic “microgrid controls.”

A conceptual sequence may open the utility connection, verify the intended boundary, energize control power, establish voltage and frequency, energize selected buses, start supporting equipment, add sources, pick up loads in priority order, and hold or shed loads when operating limits are approached. This is not a switching procedure. The actual sequence requires site-specific engineering, protection coordination, equipment instructions, and authorized operators.

Restoration should also define failed starts. What if a source does not reach ready status? What if a large load causes unacceptable voltage or frequency movement? What if communications are lost? The controller should not keep adding load because the schedule expects it. Owners need a clear fallback state and a record of what happened.

Section 06Protection and grounding change with the electrical state

The fault-current source, grounding path, direction of power flow, and available protective-device response can differ between grid-connected and islanded operation. Inverter-based resources can behave differently from rotating machines. Protective settings that work with a strong utility source may not detect or clear the same condition in a small island. These are engineering questions, not settings to infer from this paper.

Unintentional energization of utility equipment is a separate hazard from serving an approved local island. The California Public Utilities Commission describes Rule 21 as the tariff for interconnection, operation, and metering of generation facilities connected to investor-owned utility systems, with safety and reliability among its purposes.⁶ PG&E's Rule 21, checked September 1, 2026, defines an unintended island and contains the utility's current interconnection requirements.⁷

Do not read those sources as a project approval or a design instruction. The applicable utility, authority having jurisdiction, qualified engineer, equipment listings, and project agreements determine what is required. Obtain the written project-specific basis for isolation, interconnection, protection, grounding, synchronization, and permission to operate.

Reconnection is not merely closing the same device that opened. The island and utility must be brought into acceptable conditions through the approved sequence. Define who authorizes reconnection, what measurements are required, how loads and sources respond, and how a failed attempt is handled.

Section 07Compare complete resilience paths

No single technology wins this decision by category. The following screen compares complete roles in an outage. It makes no project-specific cost, duration, emissions, availability, or performance claim.

The right comparison uses the same outage objective for every path. A low-cost source that cannot start the required auxiliaries is not equivalent to a complete island. A battery with excellent response but insufficient usable energy is not equivalent to fuel-backed duration. A hybrid can cover those gaps, but only if the controller, protection, and operating plan integrate the parts.

Section 08Specify evidence, not adjectives

“Seamless,” “resilient,” “microgrid ready,” and “black-start capable” should trigger questions. For the proposed configuration and software version, request the operating narrative, single-line basis, equipment data, interface responsibilities, protection study, controller requirements, and acceptance test plan. Mark every document with its revision and date.

DOE's 2025 Microgrid System Project Development Checklist identifies planning, design, procurement, and implementation as distinct project stages and points users to technical specifications and distributed-energy checklists.⁸ For a private owner, the general lesson is to carry the operating objective through every stage. A procurement description that loses the control sequence cannot be repaired by assuming the commissioned system will know what the owner meant.

Ask for the evidence that supports each claimed mode. A component test, a factory test, a simulated sequence, a site acceptance test, and a periodic live exercise answer different questions. Record test conditions, unavailable equipment, bypasses, alarms, operator actions, and unresolved deficiencies. Do not call a mode proven when the condition most important to the owner was excluded.

Cybersecurity and communications belong in the same review because the controller depends on trustworthy sensing and commands. Define what continues locally when an external network is unavailable, how authorized changes are controlled, and how configuration is backed up and restored. Keep this bounded to the actual system; do not substitute generic security claims for a reviewed architecture.

Section 09Plan the return to normal before the outage

The island may end because the utility has returned, fuel is low, stored energy is depleted, a source is unavailable, or the operating objective has been met. Each condition needs a controlled response. Identify which loads remain, which stop, how sources are unloaded or shut down, and who decides that the utility supply is acceptable.

Resynchronization can be automatic or operator-directed, but it should not be undefined. The DOE controller reference includes resynchronization among the explicit operational functions of a microgrid controller.⁵ The project-specific sequence must still be reviewed and tested under the applicable design and utility requirements.

After any island event, preserve the event record. Compare the actual disturbance, switching, source response, load shedding, alarms, duration, operator action, and return sequence with the approved basis. A successful outcome does not erase a near miss. A failed mode does not automatically condemn the technology. Both are evidence for correcting the system and operating plan.

Revisit the load list when the facility changes. New equipment can quietly enter a protected panel, while a retired process can leave unnecessary capacity reserved. Fuel arrangements, battery state-of-charge policy, control software, personnel, and maintenance condition also change. Resilience is a maintained operating capability, not a one-time drawing.

Section 10Make the next decision testable

An owner does not need to resolve every design detail before deciding whether islanding deserves further work. The first decision is whether the outage consequence, controllable boundary, and plausible complete paths justify a qualified concept and requirements package. Use the following questions to keep that step bounded.

1. What operating outcome matters?Separate no-break, restartable, and deferrable functions, with an accepted outage objective.
2. Where is the island boundary?Show the utility interface, retained buses, sources, loads, auxiliaries, and responsible parties.
3. What forms the dead bus?Name the exact device and control mode that establishes voltage and frequency without the utility.
4. How are loads restored?Define priorities, startup dependencies, shedding logic, failed-start behavior, and the fallback state.
5. What approvals govern the transitions?Obtain the project-specific protection, grounding, interconnection, synchronization, and operating basis.
6. What evidence will prove the claim?Specify the configuration, test conditions, records, acceptance authority, and periodic revalidation.

The answer may be a smaller protected boundary, a bridge plus a sustained source, a hybrid microgrid, ordinary standby generation, load curtailment, utility service, or no project. Technology neutrality does not mean indifference. It means every path must earn its place against the same outage objective and the same evidence standard.