Energized DC Array Safety Standard

Purpose

A PV array cannot be turned off. Light on the glass makes voltage and there is no switch on a module. Every other trade's safety standard is built on isolating a source; on a roof at noon the source is the sky, so this one is built on three different things: knowing the maximum voltage you can encounter today, never breaking a connector that is carrying current, and proving dead only where dead is achievable.

The failure this prevents is specific. A DC arc has no current zero crossing to help it extinguish, unlike a 60 Hz AC arc that passes through zero 120 times a second, so a DC arc drawn at a connector tends to sustain rather than self-quench. A tech who pulls a live string connector out of habit gets a welded connector and a burn, where the same habit on an AC branch circuit would have produced a spark and nothing else.

Scope

Covers all work on or near energized PV DC circuits: service calls, module changeouts, string troubleshooting, combiner work, and any task on a roof with a live array present, including work by trades the shop is supervising.

Does not cover the rapid shutdown functional test and its labeling, which is its own SOP. Does not cover battery DC, where the source cannot be reduced by covering anything. Does not replace your employer's written electrical safety program; it is how this shop executes that program on a PV array.

Roles and responsibilities

Procedure

1. Set the boundary and name the second person before the ladder goes up. Establish a ground-level exclusion zone under the work area, tell the customer where it is and that nobody enters it, and confirm a second person on site who knows the stop signal and where the AC disconnect is. Acceptance: a stated boundary, a named second person, a confirmed AC disconnect location. Wrong looks like a solo call with a customer following the tech around. Stop rule: no second person means no work on energized DC that day; monitoring review and AC-side inspection can proceed, array work cannot. The instruction to the customer is plain and physical: stand behind this line and touch nothing on the wall while I am on the roof.

2. Dress for a DC hazard, not a general electrical one. Wear rubber insulating gloves rated for the voltage class you will meet with leather protectors over them, arc-rated clothing selected per your program under NFPA 70E-2021, and use a meter and leads rated at or above the circuit's category and voltage. Acceptance: the glove rating and the meter rating both exceed the corrected maximum system voltage from step 3, and the glove pair is inside its test date. Wrong looks like a 600 V meter on a commercial 1000 V string, which fails at the moment it matters. Stop rule: gloves out of test date or a meter of unknown rating stops the work, no exceptions; the meter is the one tool a shop cannot borrow from a customer's garage.

3. Compute the maximum voltage you can meet today, from the datasheet. Take the module's open circuit voltage and its temperature coefficient of open circuit voltage from the module datasheet, the count of modules in the longest series string from the as-built, and the lowest expected ambient temperature from the design data your jurisdiction uses, and correct per NEC 690.7 in your adopted edition. Acceptance: a single written number for this site, posted where the tech and the second person can both see it. Wrong is using nameplate voltage from a warm afternoon; open circuit voltage rises as cell temperature falls, so the cold morning string is the high-voltage case, and a tech who plans around the warm number is under-rated for the condition they actually meet. Hazard: this number sets the glove class and the meter category, so it is computed before the truck is loaded, not on the roof.

4. Open in sequence, AC first, then DC, and prove what can be proved. Open and lock the AC disconnect so the inverter stops drawing from the array, wait the inverter's stated discharge time for its DC bus capacitors, then open the DC disconnect. Apply lock and tag per 29 CFR 1910.333(b)(2) for general industry and 29 CFR 1926.417 on construction. Prove dead by live-dead-live per NFPA 70E-2021, 120.5 on the AC conductors and on the inverter-side DC terminals. Acceptance: both read at or near zero with a meter proved on a known source before and after. Wrong is proving one side and assuming the other. Stop rule: a circuit that will not prove dead with the disconnect open means the disconnect is not doing what its handle claims, so stop, tag it, and treat everything downstream as live. Hazard: the array-side conductors are not covered by this step and remain at the step 3 voltage, so opening a DC disconnect does not make the roof safe.

5. Verify no current before you separate any connector. Clamp each conductor of the pair with a DC-capable clamp meter and read the current before you touch the latch. Acceptance: under 1 A on both conductors, ideally under 0.1 A. Wrong looks like 6 to 10 A, meaning the circuit still has a path and the connector will arc when it opens. Stop rule: any current above the threshold means you do not open that connector; you find the path first, whether that is a second inverter still online, a combiner fuse still in, or a disconnect pole that failed to open. Hazard: never break a PV connector under load and never pull one to see what happens, because a sustained DC arc welds contacts, destroys the housing, and is the mechanism behind a large share of rooftop PV fires. Where a connector must come apart and current will not go to zero, the work moves to a time of day or a shading condition that removes the source.

6. Treat everything inside the array boundary as live for the whole visit. Do not lay tools across module frames, keep the free ends of any opened circuit capped and separated from each other and from ground, and do not mate connectors across brands even when they physically click together, because intermatability is a listing property and the NEC addresses connectors at 690.33 in your adopted edition. Acceptance: at every pause, every open end is capped and none is within reach of a frame or rail. Wrong is a pair of loose leads hanging over a rail while the tech goes to the truck. Stop rule: if an open end was left unattended and you did not personally cap it, re-verify with the meter before assuming its state. Note that operating rapid shutdown reduces conductors outside the array boundary but does not de-energize the modules and circuits inside it, so a shutdown initiation is not a substitute for any part of this step.

7. Re-prove after any interruption. After a break, a shift change, another trade entering the area, or any time you leave the roof, re-verify every circuit you had established, including a fresh live-dead-live on anything proved dead. Acceptance: a second proving logged with a time. Wrong is resuming on the assumption that your lock is still the only thing holding the circuit. Stop rule: any lock or tag you did not personally apply and cannot account for stops the work until the person who applied it is reached.

8. Restore in reverse order and confirm production. Reconnect the DC circuits, close the DC disconnect, then remove the AC lock and close the AC disconnect, and watch the inverter through its full connect sequence rather than walking away at the first light. Acceptance: normal running state with no fault, and string current or per-module reporting within the expected spread for the irradiance at that moment. Wrong is a green light taken as proof while one string sits at zero. Stop rule: a fault on restore is a service event, not a completed call, and the array is not left in an unknown state at the end of a shift.

The record this produces

One energized work record per visit, on the job ticket:

• Voltage basis: module open circuit voltage, temperature coefficient, series count, lowest expected ambient, corrected maximum system voltage, and the source of each.
• PPE: glove class and test date, meter model and rating, arc-rated layer.
• Boundary: exclusion zone, second person's name, time set.
• Proving: each circuit proved dead, the time, the known source used before and after.
• Current checks: every connector opened, with its clamp reading beside it.
• Exceptions: any stop rule taken, what triggered it, who was called, what was decided.

The service manager reads the exceptions weekly, because the same stop taken twice at one site is a system defect rather than a technician's caution. When an insurer or an AHJ asks how the shop works live DC, this record is the answer, and a record that shows a stop being taken is stronger evidence of a working standard than a hundred clean ones.

A worked pass, including the step that failed

Service call on a residential system, two strings of 12 modules, string inverter, a January morning.

Step 1: boundary set on the driveway under the eave, homeowner told plainly to stay behind it, second person confirmed with the AC disconnect location. Step 2: gloves in test date, meter rated above the number about to be computed.

Step 3: the module datasheet gives open circuit voltage of 41.0 V and a temperature coefficient of open circuit voltage of -0.29 percent per degree C; the design data gives a lowest expected ambient of -10 C. The correction spans 35 degrees C below the 25 C rating condition, so voltage rises 0.29 x 35 = 10.15 percent, giving 41.0 x 1.1015 = 45.2 V per module and 45.2 x 12 = 542 V for the string. On a warm afternoon the same string would read about 492 V. The posted number for the day is 542 V, and it sets the glove class and meter category.

Step 4: AC disconnect opened and locked, inverter discharge time observed, DC disconnect opened. AC conductors and inverter-side DC terminals both prove dead live-dead-live against a known source.

Step 5 fails. Clamping the string 1 positive conductor at the roof reads 7.4 A with the DC disconnect open, well above the 1 A threshold. The stop rule runs and no connector is separated. Tracing back finds the cause at the disconnect, where one pole did not open with the handle. It is tagged defective, string 1 work stops, and string 2 is re-verified at 0.02 A and is safe to open.

Step 6: string 2's opened ends are capped and separated before the tech leaves the roof to call the service manager. Step 7: after that call and a twenty minute wait, both circuits are re-verified before work resumes. Step 8: string 2's work completes and the system restores to normal running, while string 1 stays out of service with the defective disconnect scheduled and the customer told why in writing.

Outcome: a failed pole that would have arced a connector at 7.4 A DC in the tech's hand was found by a clamp meter rather than by a burn, and the record shows which reading stopped the work.

References

• 29 CFR 1910.333(b)(2) for general industry and 29 CFR 1926.417 on construction, safe work practices and lockout and tagging for electrical work; note 29 CFR 1910.147 expressly excludes electrical utilization work at its own (a)(1)(ii)(C).
• NFPA 70E-2021, 120.5, for the live-dead-live proving sequence, and its PPE selection provisions, in the edition your employer's electrical safety program adopts.
• NEC 690.7 for maximum PV system voltage and its low-temperature correction, and NEC 690.33 for connector requirements, in the edition your AHJ has adopted.
• Module datasheet for open circuit voltage and temperature coefficient; meter and glove manufacturer documentation for category, voltage rating and test interval.
• See related: the rapid shutdown verification and labeling SOP, and the inverter fault service call SOP.