Ground-fault protection of equipment (GFPE) field guide

What ground-fault protection of equipment is

Ground-fault protection of equipment, GFPE, is a sensing and tripping system that opens a service or feeder disconnect when current leaks to ground at a level too low for the phase overcurrent device to clear quickly. It exists to protect the equipment, the switchgear and switchboard, from being destroyed by an arcing ground fault that the breaker or fuse alone would let burn.

The thing to fix in your head first: GFPE protects gear, not people. A 2000 A main breaker is sized to carry 2000 A and trip on a bolted fault of many thousands of amps. A line-to-ground arc on a 480Y/277 bus can sit at a few hundred amps. That is below the breaker's effective trip threshold, so the breaker does nothing while the arc eats copper, steel, and insulation until the bus burns open or the fault escalates to a phase-to-phase event. GFPE watches for that low-level leakage and trips the disconnect before the gear is gone.

It is built into or added to the service equipment, set to pick up well below the phase rating, and tied to the shunt trip or the breaker's electronic trip unit. When the sensed ground current crosses the pickup, after the set time delay, the disconnect opens all phase conductors at once.

What is the difference between GFPE and GFCI?

GFPE and GFCI sense the same physical thing, current going to ground, but they protect different things at wildly different levels, and confusing them is the fastest way to misapply both. GFPE protects equipment and trips at high current. GFCI protects people and trips at milliamps.

A GFCI, the personnel device on the bathroom and kitchen receptacle, trips on ground current between roughly 4 and 6 mA. That is the level set to keep a person from being electrocuted, well below the let-go threshold. It is a Class A device and it is about the human body.

GFPE has nothing to do with that. Its pickup is set in hundreds of amps, up to a 1200 A maximum under the NEC service rule, because its job is to catch an arcing fault before it burns down a lineup, not to protect a person from shock. A 1200 A ground fault would have killed someone many times over long before a GFPE acts. They are not interchangeable, they are not the same device scaled up, and a GFPE is never a substitute for the GFCI protection the code requires for people.

The arcing ground fault problem

An arcing ground fault is a line-to-ground arc that draws far less current than a bolted fault, and that is exactly what makes it dangerous to the gear. The arc has impedance. On a 480Y/277 system a phase-to-ground arc might settle at a few hundred amps, sometimes less, where a bolted fault at the same point would be tens of thousands.

Here is the trap. The phase overcurrent device is sized for the load and to clear a bolted fault. A few hundred amps of arcing current is below its instantaneous pickup and sits down on the long part of its time-current curve, so the breaker treats it like a small overload and waits. Meanwhile the arc is dumping energy into the enclosure at one spot. It vaporizes copper, it carbonizes insulation, it walks along the bus, and within seconds to minutes it has burned a hole through the gear. The industry calls the result a burndown.

The 277 V phase-to-ground voltage is part of why this became a code issue. A 277 V arc does not self-extinguish the way a 120 V arc often will. It restrikes and sustains. A wave of switchgear fires on 480Y/277 systems in the 1960s and 70s is what drove the GFPE requirement into the NEC. GFPE catches the low-level fault the breaker ignores.

When does the NEC require GFPE?

The NEC, at 230.95, requires ground-fault protection of equipment on each service disconnecting means rated 1000 A or more, on a solidly grounded wye system of more than 150 V to ground but not exceeding 1000 V phase-to-phase. The classic system that hits all three triggers is 480Y/277. That is the one you will see this on most.

Walk the triggers, because all of them have to be true. Solidly grounded wye, so the neutral is bonded to ground without an impedance in the path. More than 150 V to ground, which 277 V clears and 120 V does not, so a 208Y/120 service is out. Not over 1000 V phase-to-phase, which keeps it in the low-voltage class. And the disconnect rated 1000 A or more. Miss any one and the rule does not apply, which is why a 480 V delta or a 208Y/120 service of any size is not covered by 230.95.

The rule also caps the protection. The maximum setting is 1200 A, and the system must clear a ground fault of 3000 A or more within 1 second. Those ceilings keep the device from being set so high or so slow that it lets the gear burn anyway. The exact ampere thresholds, the voltage limits, and the section number can shift between code cycles and editions, so confirm them against the NEC edition the jurisdiction has actually adopted and any local amendments before you cite them on a submittal.

Feeders and building disconnects

The service is not the only place this comes up. The NEC carries the same protection to feeders at 215.10 and to building or structure disconnects at 240.13, using the same triggers as 230.95: solidly grounded wye, more than 150 V to ground, not over 1000 V phase-to-phase, disconnect rated 1000 A or more.

The reason to spread it out is that a service-only GFPE does nothing for a feeder fault on a separate building fed from that service, where the fault is far from the service sensor and the local gear is what burns. So 215.10 puts protection on the qualifying feeder disconnect, and 240.13 puts it on the disconnect that serves a separate building or structure.

There is a coordination wrinkle the code recognizes. If the service already has GFPE that will protect the feeder, you generally do not stack another required level on that feeder under these rules, and adding levels without coordinating them is how you turn one protected system into a chain of devices that all trip together. The point of putting it on the feeder is to cover the case the service device cannot see in time. Confirm which disconnects in the lineup actually require it under the adopted edition, because 215.10 and 240.13 reference back to 230.95 and the conditions have to be met at each location.

The exceptions: continuous process and fire pumps

Two situations turn the requirement off, and both come down to the same logic: there are loads where an unplanned trip is more dangerous than the fault. The NEC writes these as exceptions, and you have to know them because installing GFPE where it is prohibited is its own violation.

The first is a continuous industrial process where a nonorderly shutdown would introduce additional or increased hazards. If dropping the service mid-cycle would be worse than riding through the fault, the rule recognizes that and does not force GFPE. This is narrow. It is meant for real process hazards, not for an owner who simply dislikes downtime, and the design has to justify it.

The second is the fire pump, and this one is stronger than an exception. The NEC prohibits GFPE in a fire pump power circuit, handled at 240.13 and in Article 695. The fire pump runs to failure on purpose. It is better to let the motor windings melt while it keeps pushing water than to trip it and lose the building, and a ground fault during a fire, from water and contamination, is exactly the nuisance you cannot tolerate. So a fire pump gets no GFPE, full stop. Verify the exact wording against the adopted edition, but the fire pump prohibition has been consistent.

How GFPE senses a ground fault

GFPE works on one idea: in a healthy circuit, the currents in all the conductors add up to zero, and a ground fault breaks that balance because some current returns through ground instead of through the conductors. The sensor measures the imbalance, and an imbalance means current is leaving the circuit to ground.

Residual sensing puts a current transformer on each phase and on the neutral and sums them electrically. With no ground fault the sum is zero. When current escapes to ground, the phase and neutral CTs no longer cancel, and the residual current the relay sees is the ground-fault current. This is common on breaker-based systems with an electronic trip unit that already has CTs on each pole.

Zero-sequence sensing, sometimes called the window or donut method, runs all the phase conductors and the neutral through a single CT. As long as everything that goes out comes back through that window, the net flux is zero and the CT reads nothing. Let some current return through ground, outside the window, and the CT reads the difference directly. It is sensitive and it is clean, but every current-carrying conductor including the neutral has to pass through the one window, and that is a wiring detail people get wrong.

The ground-return sensing method

There is a third way to sense it, and on large service mains it is often the simplest: put the CT on the neutral-to-ground bonding connection itself. This is the ground-return or ground-strap method, and it measures the fault current where it comes home.

The logic is direct. On a solidly grounded wye service the only intended connection between the neutral and ground is the main bonding jumper at the service. Ground-fault current that has left the system and is finding its way back to the source has to cross that bond to get home. Clamp a CT on the main bonding jumper, the strap between the neutral bus and the ground bus, and any current on it is by definition returning ground-fault current, because in normal operation almost nothing should flow through that bond.

The whole method depends on that bond being the only path. That is the link to the grounding electrode system and the single-point neutral rule. If there is a second neutral-to-ground bond anywhere downstream, normal neutral current splits and part of it sneaks back across the service bond, and the ground-return CT reads it as a fault. The sensing is only as good as the one-point bonding behind it.

Why must the neutral be bonded to ground at one point?

The neutral has to be bonded to ground at exactly one point, the service, and nowhere downstream, or the GFPE will sense normal neutral current as a ground fault and trip. This is the single most common cause of GFPE nuisance trips, and it is a wiring problem, not an equipment problem.

Think through what a second bond does. Neutral current is supposed to return to the source on the neutral conductor, through the sensor, and balance out. If someone bonds neutral to ground again at a downstream panel, transformer, or piece of equipment, the metallic ground path now runs in parallel with the neutral conductor. Part of the normal neutral current leaves the neutral, travels on conduit and ground, and comes back outside the sensor. The GFPE cannot tell that diverted neutral current from real ground-fault current. It sees an imbalance and it trips, sometimes immediately, sometimes only under load.

This is why the grounding-electrode and bonding work matters so much to a GFPE system, and the rule is covered in the grounding electrode system and bonding guide. Keep the main bonding jumper at the service. Float the neutral from ground at every panel and transformer downstream. On a separately derived system, bond the neutral once at that source and treat its GFPE the same way. Before you ever chase the relay, look for the extra bond.

The neutral and the sensor

Even with the bonding correct, the neutral has to pass through the sensor correctly, and getting it wrong gives you the same false imbalance as a downstream bond. The neutral carries unbalanced load current, and the sensor has to account for it, not be blind to it.

On a residual scheme, that means a CT on the neutral as well as on the three phases, all summed, so unbalanced neutral current cancels against the phases it returns. Leave the neutral CT out, or wire it backwards, and the relay reads normal unbalance as ground fault. On a zero-sequence window, the neutral conductor has to go through the same window as the phases. Run the phases through the donut and route the neutral around it, and every amp of unbalanced neutral looks like a ground fault to the CT.

The detail that bites crews is the neutral disconnect link and where the bonding jumper lands relative to the sensor. The bond and the load-side neutral have to be on the correct side of the sensor so that fault current is sensed and normal neutral current is not. Get the geometry of phases, neutral, and the bonding jumper around the sensor right, or the most careful relay settings will not save you.

The coordination problem with service-only GFPE

Put GFPE only on the service main and you have bought a coordination problem: a ground fault anywhere downstream, on any feeder or branch, trips the service main and drops the entire building. The protection works, but it works too broadly, because the only ground-sensing device in the system is the one at the top.

This is the same selectivity issue the selective coordination guide covers, applied to ground faults. The phase devices downstream may be perfectly coordinated, so a phase fault on a small branch only opens that branch. But a ground fault that the downstream phase device cannot see at all is sensed by the one GFPE at the service, and the service has no way to know the fault is three levels down. It trips itself. One ground fault on a single branch circuit, and the whole service goes dark.

For a warehouse that might be acceptable. For a hospital, a data center, or any facility where a total outage is its own emergency, it is not. The answer is not to raise the service pickup until it ignores faults, which defeats the protection. The answer is to add ground-fault sensing at the downstream level and coordinate the two so the device nearest the fault clears first.

Adding a second, coordinated level

A second level of GFPE downstream, coordinated with the service device, keeps a downstream ground fault from dropping the whole service. The downstream device senses its own ground fault and clears it, while the service GFPE holds, because it is set to wait long enough or is interlocked to stand down.

Two ways to coordinate them. The first is time and pickup: set the downstream GFPE faster and at a lower pickup than the service, with enough separation in the time-current bands that the downstream clears before the service device times out. The catch is the service device still has to clear a 3000 A ground fault within 1 second under the NEC ceiling, so you do not have unlimited time to stack delays. The window for coordinating ground-fault levels by time alone is narrow.

The second, and the better answer for critical power, is zone-selective interlock. The downstream GFPE sends a restraining signal up to the service device when it sees the fault, telling the service device to wait. If no downstream device reports the fault, the service device knows the fault is in its own zone and trips with no added delay. Zone interlock gives you fast clearing at every level without giving up coordination. It is worth specifying on any service where a total trip is unacceptable. The grounding-conductor sizing and the bonding still have to be right under it, the same as the service guide describes.

The performance test required at installation

The NEC, at 230.95(C), requires that the GFPE be performance tested when it is first installed on site, in accordance with the manufacturer's instructions, and that the test be documented. This is not the same as the factory test and it is not optional. A GFPE that has never been performance tested on site does not meet the code, no matter how good the gear is.

What makes it a performance test rather than a function check is current injection. You inject a known current through the current transformers and verify that the system picks up at or below the set value and operates within the required time. A push-button test on the relay proves the relay's electronics work. It does not prove the CTs are wired correctly, in the right polarity, with the neutral and bond on the correct side of the sensor. Only injected current through the actual sensing path proves that, and wiring errors in the sensing path are exactly the failures that make a GFPE useless or make it nuisance-trip.

Keep the record. The written record of the performance test, the injected current, the measured pickup, the measured time, and the date, is part of the installation. An inspector can ask for it, and the next person to maintain the gear needs the baseline. The exact subsection and wording can change between editions, so verify 230.95(C) against the adopted NEC, but the requirement to performance test at install has been consistent.

Testing and periodic maintenance

The install performance test is the start, not the end. GFPE drifts and ages like any protective system, and the CTs, the relay, and the trip mechanism all have to keep working together for the protection to mean anything. Periodic testing is how you confirm it still does.

NETA acceptance and maintenance testing specifications give the framework for this on the maintenance side, primary injection through the CTs, verification of pickup and time, and a check of the trip path through to the breaker. Primary injection is the meaningful test because it exercises the whole chain the way a real fault would. Secondary injection at the relay terminals checks the relay alone and is faster, but it skips the CTs and the wiring, which is where the field problems live.

How often depends on the facility and the owner's program. Critical power systems get tested on a tighter cycle than a general commercial service. The practical rule: if the gear has been opened, modified, or had work done that touched the neutral, the bonding, or the sensing wiring, retest the GFPE before you call it done, because that work is exactly what introduces the second bond or the miswired CT that defeats it.

Pickup and time-delay settings

Two settings define a GFPE: the pickup, the ground current at which it acts, and the time delay, how long it waits before it trips. The NEC bounds both on the service device, and the design picks values inside those bounds to balance protection against coordination.

Pickup has a hard ceiling of 1200 A on the service disconnect under 230.95. You set it below that, often well below, low enough to catch an arcing fault early but high enough to ride through normal imbalance and the transient surges that are not faults. Set it too high and the arc burns longer before the device acts. Set it too low and you invite nuisance trips on normal system noise. The right number comes from the equipment and the study, not from habit.

Time delay is bounded by the requirement to clear a 3000 A ground fault within 1 second. Inside that, a short delay lets the device ride through harmless transients and lets a downstream device clear first if you are coordinating levels. The delay is also the lever you use for coordination, and it is the one that fights the 1-second ceiling. There is not much room, which is why zone-selective interlock beats stacking time delays on a system that needs both fast clearing and selectivity. Confirm the ceiling values against the adopted edition before you set the device.

What causes a GFPE nuisance trip?

A GFPE nuisance trip, the service going dark with no real ground fault, almost always traces to current the sensor mistakes for a ground fault. The order to check them in is roughly the order of how often they bite.

A downstream neutral-to-ground bond is the number one cause. A second bond past the service lets normal neutral current split onto the ground path and return outside the sensor, and the GFPE reads that diverted current as a fault. Find the extra bond and the trips stop. Check every panel, transformer, and piece of equipment that someone may have bonded neutral to ground a second time.

After the bond, look at the sensing itself. A neutral CT left out, wired backward, or the neutral routed around a zero-sequence window instead of through it, all read normal unbalance as ground fault. A bonding jumper landed on the wrong side of the sensor does the same. Surge and transient events, lightning, capacitor switching, large motor starts, can momentarily unbalance the system enough to trip a pickup set too low or a delay set too short. And a genuinely failing relay or a shorted CT lead can fire on its own. But before you replace anything, prove the bonding is single-point and the sensing geometry is right, because that is where the fault almost always is.

Commissioning a GFPE system

Commissioning a GFPE is where the install performance test, the bonding verification, and the settings come together, and it is the last chance to catch the wiring error before the gear is energized for real. Do it in an order that finds the common failures first.

Start with the bonding. Confirm the main bonding jumper is at the service and verify there is no neutral-to-ground bond anywhere downstream, because that is the error that will nuisance-trip the system the day it goes live. A simple check is to measure for current on the grounding conductors and the bonding path under load, or to ohm out the neutral-to-ground separation downstream with the main bond temporarily lifted. Then verify the sensing geometry: phases, neutral, and bonding jumper on the correct sides of the sensor for the method used.

Then set and prove the device. Set the pickup and the time delay to the values from the coordination study, inside the NEC ceilings. Perform the current-injection performance test through the CTs, confirm pickup at or below the set value and operation within the required time, and confirm the trip actually opens the disconnect, not just that the relay changes state. Document all of it. A GFPE that was set from the study but never injection-tested through its own CTs is a system nobody has actually proven works.

GFPE on large services and data centers

On a data center, hospital, or any large 480Y/277 service, GFPE collides head-on with the requirement that the facility not go dark, and that tension shapes the whole design. The service is large enough to require GFPE under 230.95, and a total trip is exactly the outcome the facility exists to avoid.

This is where the second coordinated level and zone-selective interlock stop being optional refinements and become the design. A service-only GFPE on a data center means one ground fault on one downstream feeder drops the room. Zone interlock lets the fault clear at its own level while the rest of the load stays up, which is the entire point of the facility's power design. It also has to live alongside the selective coordination of the phase devices, so the ground-fault and phase strategies get planned together, not bolted on separately.

The exceptions matter here too. A continuous process load may qualify for the orderly-shutdown exception, and the fire pump that protects the building takes no GFPE at all. Map which disconnects require it, which are exempt, and where the second level goes, before the gear is bought, because retrofitting ground-fault sensing and interlock into a lineup that was not designed for it is expensive and slow.

What to document

A GFPE system is only as defensible as its record, and the record is what an inspector asks for and what the next technician needs. The install performance test alone is a code requirement to document, and the rest of it answers the questions that come up later when the system trips or gets modified.

Capture the disconnect rating and system voltage that put it under the rule, the sensing method, the pickup and time-delay settings with the study they came from, the install performance-test results with the injected current and measured time, the verification that the neutral is bonded at one point only, and the coordination scheme if there is a second level. If a disconnect is exempt, record why, because the next person will wonder where the GFPE is.

Common mistakes

• No GFPE on a service or feeder disconnect that meets the 230.95 triggers, which is a straight violation.
• A downstream neutral-to-ground bond that splits neutral current onto the ground path and nuisance-trips the system.
• Skipping the install performance test required at 230.95(C), or doing a relay button-test instead of current injection through the CTs.
• Service-only GFPE with no coordinated second level, so a downstream ground fault drops the whole service.
• Treating GFPE as GFCI, or assuming GFPE protects people, when it acts at hundreds of amps and GFCI acts at milliamps.
• Installing GFPE on a fire pump power circuit, where the NEC prohibits it.
• Setting the pickup at the 1200 A cap or the delay near the 1-second ceiling, so the gear burns longer than it should.

Field checklist

Standards and references

The NEC, NFPA 70, is where the requirement lives. Ground-fault protection of equipment on services is at 230.95, which sets the 1000 A and 480Y/277 triggers, the 1200 A maximum setting, the requirement to clear a 3000 A fault within 1 second, the continuous-process exception, and the install performance test at 230.95(C). The same protection extends to feeders at 215.10 and to building or structure disconnects at 240.13, both referencing back to 230.95.

The fire pump prohibition is handled at 240.13 and in Article 695, which bars GFPE in a fire pump power circuit. The emergency and standby system articles, NEC 700 and 701, sit alongside this where the facility also requires selective coordination, which is its own topic. The single-point neutral bonding that a GFPE depends on is governed by Article 250, covered in the grounding electrode system and bonding guide.

On the testing side, NETA acceptance and maintenance testing specifications give the procedures for primary injection and periodic verification. The equipment manufacturer's instructions govern the actual install performance test under 230.95(C) and the specific settings the gear supports. Code section numbers, ampere thresholds, and voltage limits shift between editions, so confirm 230.95, 215.10, 240.13, and the fire pump articles against the NEC edition the jurisdiction has adopted and any local amendments before citing them.

Units and terms

GFPE work mixes a few terms that get used loosely, and getting them straight keeps the protection conversation clear from the design through the field.

Ground-fault protection of equipment is GFPE, sometimes just ground-fault protection, GFP, and it is not GFCI. The sensing methods go by their geometry: residual, zero-sequence or window CT, and ground-return or ground-strap. Pickup is the ground-current level that starts the trip, given in amps. Time delay is the deliberate wait before tripping, given in seconds or cycles. Zone-selective interlock, ZSI, is the restraining signal between levels that lets the device nearest the fault clear first.

GFPE / GFP

Ground-fault protection of equipment, which protects the gear from arcing burndown, not people

GFCI

Ground-fault circuit interrupter, a personnel device tripping at about 4 to 6 mA

Arcing ground fault

A line-to-ground arc drawing far less than the phase device trip level, which burns the gear

Residual sensing

Summing CTs on all three phases and the neutral, where the net should be zero

Zero-sequence sensing

A single window CT around all conductors that reads the net imbalance directly

Ground-return sensing

A CT on the main bonding jumper that reads returning ground-fault current

Pickup and time delay

The ground current that triggers the trip and the deliberate wait before it acts

ZSI

Zone-selective interlock, a restraint signal so the device nearest the fault clears first

Related tools

Calculators and readiness checks for this work

Compare your options

FAQ

People also ask

• What is selective coordination?
• What is the difference between grounding and bonding?
• What is an isolated ground receptacle?
• What is cathodic protection?
• What is the difference between switchgear and a switchboard?