Protection by automatic disconnection: the principle and the disconnection condition

“I ran the cables, fitted the breakers, done — it’s protected.” It’s a trap even experienced electricians fall into. A breaker that trips on a fault but takes three seconds to do it at a 230 V socket-outlet has — on paper — tripped. In reality it didn’t meet the standard, and it left someone with a hand on a live enclosure for far too long. Protection by automatic disconnection isn’t judged by whether it trips, but by how fast.

Where it applies: the “fault” layer

This is the second half of protection against electric shock (I’ve written about the first — insulation and enclosures — separately). It comes into play the moment the insulation has failed and the metal enclosure of an appliance accidentally becomes live. Per Art. 4.1.4.1.1, automatic disconnection of supply is the most widely used protective measure in installations. The principle, from Art. 4.1.4.1.2, is straightforward: on a fault of negligible impedance between a line conductor and an exposed-conductive-part (or the PE), a device must automatically disconnect the supply within the maximum time laid down.

Translated to the site: if the line touches the enclosure, the fault current returns to the source through the protective conductor (PE). That current has to be large enough to force the protective device to trip before the touch voltage becomes dangerous for whoever puts a hand on the appliance.

A corollary many people forget: if the PE is broken somewhere along the run, the fault loop can no longer close, and the overcurrent protection may not trip at all — the enclosure stays live. That’s why continuity of the protective conductor isn’t a nicety; it’s the condition for this whole mechanism to work.

How fast: the 50 V benchmark and Table 4.1

Why maximum times, and not just “as fast as possible”? Because the standard’s benchmark is the conventional touch voltage limit, U_L = 50 V a.c. — the value on which the maximum disconnection times are based (the note in Table 4.1 says so explicitly). Not that any contact below 50 V is “safe”, but that this is the standard’s reference threshold. From there: the higher the voltage to earth (U₀), the higher the fault drives the touch voltage, so the permitted time goes down. The times in Table 4.1 apply to final circuits not exceeding 32 A (Art. 4.1.4.1.3) — that is, exactly the socket-outlets and lighting in a dwelling.

The band that concerns us directly is 120<U₀≤230 V a.c. — the domestic 230 V network to earth: 0,4 s in TN, 0,2 s in TT. (Note 1 in the table: on d.c. 50–120 V, disconnection may be required for reasons other than shock. Note 2: if an RCD provides the disconnection, Art. 4.1.5.2 applies.) The table also offers a bit of relief: in TT, if an overcurrent protective device provides the disconnection and the equipotential bonding takes in all extraneous-conductive-parts, you may use the TN times.

Why a good breaker may NOT protect you

This is where the opening point comes full circle. For disconnection to happen within the required time, fitting a breaker isn’t enough — the fault-loop impedance has to be small enough for the fault current to reach the tripping threshold. Art. 4.1.4.1.10 puts it as a formula, for TN systems:

• Z_s — the fault-loop impedance: the source + the line conductor up to the fault point + the protective conductor from the fault back to the source (in ohms).
• I_a — the current that causes automatic tripping within the required time. Here’s a common confusion: on an MCB, I_a is not the rated current (16 A, 20 A), but the current at which it trips within the imposed time — and that depends on the curve. A Type C MCB only trips fast (in the magnetic region) at roughly 5–10× In.
• U₀ — the nominal voltage between line and earth (in volts).

In other words: if Z_s rises, the fault current falls — and if it falls too far, a perfectly good breaker no longer trips within the required time. A loop that’s electrically too “long” (thin cable, long run, undersized PE) is exactly that.

That’s why conductor cross-sectional area, choice of protection and meeting the times in Table 4.1 are one and the same problem, not three separate decisions. “I fitted a 16 A MCB” says nothing if the fault loop is too large for the current, on a fault, to reach the fast (magnetic) tripping threshold within the required time.

One note, since the standard states it under the same Art. 4.1.4.1.10: if the protection is an RCD, I_a is the residual operating current — far smaller than an MCB’s threshold. Precisely because it’s small, an RCD “passes” the condition even with a high-impedance loop; its own proper verification, however, has its own rules, which I cover separately.

When it can’t be done in time

The standard doesn’t leave you hanging if you can’t make the time. Art. 4.1.4.1.7: if automatic disconnection can’t be achieved within the applicable time, a supplementary protective equipotential bonding connection must be provided — you don’t give up safety, you add a measure that keeps the touch voltage low.

Where ElectroSchema fits in

Of fault protection, the app checks the part it can “see” from the plan — the presence of residual-current protection where the standard requires it: V05 flags socket-outlets, and V18 lighting circuits without an RCD ≤ 30 mA upstream (Art. 4.1.5.2.1), while V07 requires IP44 in bathrooms. The condition Z_s·I_a ≤ U₀, by contrast, needs the actual loop impedance (site data), so it remains a design check and a measurement at commissioning — not something deducible from the drawing alone. That’s exactly why it’s worth thinking through from the start: cross-sectional areas and routes that keep Z_s low, so the times in Table 4.1 are realistic, not just ticked off in the calculation.