4.1 PV Electrical Hazards

4.1 PV Electrical Hazards

City & Guilds 2922-34 assesses working safely with solar photovoltaic (PV) systems as Learning Outcome 2. The practical competence is demonstrated in unit 302, but the knowledge still has to be taught: an installer who cannot explain why an illuminated array stays live will not isolate it correctly on a roof. This independent study material is for 2922-34 learners installing and maintaining PV in the United Kingdom, applying the Electricity at Work Regulations 1989, BS 7671, and associated Health and Safety Executive guidance. OpenExamPrep provides independent study for 2922-34; it is not an official City & Guilds publication and does not claim partnership or approval.

Modules that cannot be turned off

A PV module is a semiconductor current source. Photons generate a current as soon as daylight reaches the cells. There is no switch on the laminate, no firmware command that stops conversion, and no fuse that turns the panel off. Opening a downstream DC isolator, shutting the inverter, or covering some of the glass changes current in parts of the circuit. It does not make an illuminated module inert.

Treat every module, unterminated lead, and exposed connector contact as live in daylight. That includes early morning, late evening, and bright overcast. Street lighting and strong albedo from snow, pale render, or neighbouring glazing can also produce voltage. The only honest default is: if light can reach the cells, assume generation. Maintenance in winter does not create a free pass. A low sun still illuminates a south pitch, and a technician kneeling on a wet membrane is a better earth path than a dry summer roof.

Installers who trained only on conventional AC circuits often import a mental model that does not fit. On a lighting radial you isolate at the consumer unit, prove dead, and trust the circuit to stay dead because the public supply is the only source and it has been locked off. On a rooftop string that model fails. The array is an independent source that cannot be switched off at the generator. Isolation downstream of the modules limits what is connected to them; it does not extinguish Voc on the module side of an open device.

Unexpected shock, burns, and arc

Shock and burns occur at three electrical locations, and the incident energy is not the same at each.

PV arrays and string cabling. Domestic strings commonly sit at several hundred volts DC open-circuit. Ten modern crystalline modules in series routinely approach 400 V to 500 V Voc on a cold bright morning, when voltage is highest. Commercial arrays go higher. Shock paths include module frame to earth (especially with damaged insulation or wet coverings), pole-to-pole across a DC pair, and contact with a damaged cable. Direct current does not reverse 100 times per second, so muscle tetanus can lock a hand onto a live part until someone else breaks the circuit. Wet roofing felt, moss, and standing water on a flat roof lower insulation resistance and widen the shock path.

DC equipment. Isolators, combiner boxes, optimiser leads, hybrid battery connections, and inverter DC compartments can present voltage after the array is isolated. Capacitors hold charge. Parallel strings can backfeed a bus. Covering three modules does not de-energise a ten-module string. A technician who proves dead only at the inverter DC terminals and then opens a combiner still meets live string inputs.

AC equipment. The inverter AC output, generation meter tails, and consumer-unit generation circuit behave like other live AC sources, with two extra traps. Some inverters keep AC terminals live from the grid even when DC is isolated. After the inverter is switched on, AC output may take up to five minutes to appear, so a dark display is not proof of isolation and is not proof that the AC side will stay quiet.

Arc risk sits beside shock. Unmating a loaded DC connector, opening a device that is not rated to break load, or parting a faulted cable can draw a DC arc. Alternating current in the UK supply passes through zero 100 times per second, and that zero-crossing helps many AC arcs collapse. Direct current does not cross zero, so the arc continues until the gap is large, a true DC-rated device interrupts it, or material burns away. The plasma can ignite roof coverings, destroy connector housings, and throw molten metal toward eyes. That is why DC connectors are not disconnection devices under load, and why a method statement must shut the system down so that current has stopped before anyone separates a plug.

Current-limiting behaviour: Isc is not much more than Imp

A PV module's current-voltage curve runs from short-circuit current (Isc) at zero volts to open-circuit voltage (Voc) at zero current. Maximum-power current (Imp) sits only a little below Isc, often a few percent, not a factor of ten. Shorting a string therefore does not produce the huge multiple of load current that a stiff mains transformer produces when a phase is bolted to earth.

Worked numbers make the trap obvious. A typical 400 W module might be marked Imp 10.85 A and Isc 11.55 A. A bolted short on that string raises current by 0.70 A, about 6 percent. A 15 A gPV fuse sitting in the circuit may never see the multiple of rating it needs to operate in a useful time. Contrast a 32 A Type B miniature circuit-breaker (MCB) on a 230 V final circuit, where prospective fault current is commonly hundreds or thousands of amperes. The magnetic trip is designed around that stiff source. On the PV string, the same instinct — short it and the protective device will clear — is false.

That physics changes fuse and MCB behaviour on DC PV circuits. Do not wait for an overcurrent device to make it safe. Isolation is the control. Current-limiting also fools people into thinking a shorted string is harmless. Isc still burns, still arcs at the fault, and still appears on every parallel path that can feed the fault. What it does not do is guarantee that the protective device will operate. Parallel strings make the picture worse for equipment, not better for people: neighbouring strings can backfeed a faulted string, but the available current is still measured in tens of amperes, not kiloamperes, and may still sit below a fuse's reliable operating band.

Why prove-dead-then-stays-dead fails on an illuminated array

The classic AC safe-isolation sequence — identify, isolate, lock off, prove the tester, prove dead, prove the tester again — still applies. The assumption that a successful test means the circuit stays dead does not.

Three independent reasons:

1. The source is still generating. Proving dead at the inverter DC terminals after the isolator is opened says nothing about voltage still present on the array side of that isolator.
2. Irradiance can change after the test. A string that looked low under heavy cloud can climb to full Voc when the sun returns, or when a reflective facade throws extra light onto the array.
3. Series and parallel grouping can put voltage on both sides of a connector. Opening one plug does not de-energise the other side if another string or another series group still feeds that node.

Prove dead at the exact point of work, immediately before the work, after every source that can feed that point has been isolated, and again if you leave and return, if light changes, or if anyone has operated a switch. Modules remain considered live whenever they can see daylight. A lunch break under thickening cloud followed by a bright interval is a classic incident pattern: the first prove-dead was honest; the array did not stay dead.

Opaque covers versus true isolation

Opaque sheets, blankets, or cardboard are sometimes used to reduce generation while a connector is made off or a damaged module is handled. They are a risk-reduction measure, not isolation.

Wind on a roof can lift a sheet and restore full Voc without warning. Light leaks at edges, from the rear on some glass-glass constructions, and from albedo still produce voltage. Partial covering of a series string does not drive string voltage to zero; uncovered modules still add their Voc. Covers do not lock off, do not carry a caution notice, and do not satisfy the duty under the Electricity at Work Regulations 1989 to isolate where isolation is reasonably practicable.

True isolation for DC work means: shut the inverter down so it is not drawing load; open DC isolating devices that are suitable for switching or disconnection on load at the voltage and current present, or ensure there is no load if they are not; lock them off; prove dead with a DC-capable instrument and GS 38-compatible probes at every point of work; and treat remaining module leads that have not been isolated as live. Covers may support that sequence. They never replace it.

Scenario: sheets on the row versus isolation

Two installers on a south-facing domestic roof need to remake a damaged string connector. One proposes throwing black sheets over the row, unplugging, remaking, and finishing. That is not isolation. Sheets can blow off. The rest of the string may still be uncovered. The inverter may still be drawing current. The competent sequence is: shut the inverter down using its internal control so load current falls; isolate DC at a device confirmed as suitable for switching on load, or confirm no load if it is not; isolate the inverter AC output and any other AC source that can feed the work; prove dead at the connector location with a suitable DC instrument; lock off and label; then, and only then, separate the connector. Sheets may be added to reduce residual generation at module leads that still have to be handled, but the isolation and prove-dead steps are what make the work defensible under the Electricity at Work Regulations 1989.