Are Distributed Solar Systems Safe?

Distributed solar power generation is not “safe” as a property of the panels. It is a set of hazards that standards try to bound: a conductor that stays live in daylight, an inverter that must stop feeding a separated grid, and a roof or yard that still has to be built so people can shut it down and get off it. Pacific Northwest National Laboratory states the first hazard without decoration. Modules produce electricity in daylight regardless of weather and regardless of whether a disconnect is open. A tripped inverter is not a dead array.

The second hazard is the island. IEEE Std 1547-2018, as explained in a 2022 primer from the National Renewable Energy Laboratory and Sandia, requires a distributed energy resource to detect an unintentional island and cease to energize the area electric power system within 2 seconds. In the United States that behavior is type-tested, typically under UL 1741, and the installation is then supposed to follow the National Electrical Code plus the utility’s own rules. A system that was never listed to that standard, or that was listed and then had its settings rewritten, is not covered by the sentence “solar is safe because of anti-islanding.”

Which danger is electrical, and which is access

PNNL separates the work. Servicing a photovoltaic system can be lethal without the right training because of the voltage. Shutdown instructions should be posted on the inverter. The Code, in that page’s summary, requires the main AC and DC disconnects within sight of the inverter. The order they give for a fire or other emergency is specific: open the main AC disconnect, then the main DC disconnect. Only trained and authorized people with the right gear should connect or disconnect wiring. A visual walk that looks for scorch marks, loose lugs, or a moved mount is a different permission from opening a combiner.

That split matters on a house and on a megawatt roof equally. The energy is smaller on a house. The rule that the modules are a current source whenever light hits them is the same. Shade cloth, a cloudy hour, and an open AC breaker do not turn the DC connectors into spare parts you can unplug with bare hands. If a connector is warm, cracked, or the wrong mate for the other half, the repair belongs to someone qualified for that voltage, with the drawing and a lockout, not to the person who noticed the heat.

What the inverter test does not certify

Anti-islanding and ride-through answer a utility question: will this box stop, or stay, when the grid voltage moves. The 2022 primer puts the functions in an order so they do not cancel each other. A command that disables service comes first. Tripping on abnormal voltage or frequency comes next. Ride-through, which keeps a large fleet from dropping off during a disturbance the bulk system needs it to survive, may be cut short if an island is detected. Voltage support sits lower still. Laboratory work at the National Laboratory of the Rockies found that volt-var and frequency-watt did not spoil island detection in the cases tested, and that ride-through could slow it, while the reported runs still finished inside 2 seconds.

None of those tests measure whether the rack will hold a snow load, whether the roof penetrations leak, whether a firefighter can walk a path, or whether the DC connectors were mixed from two makers. PNNL’s mounting notes are the practical counterpart. Ground arrays are usually the easiest to reach. Carports are popular because they use a parking lot instead of new land, and they are fixed. Roofs are often smaller, and maintenance cost moves with how hard the array is to reach. A distributed system on a fragile roof can pass every inverter test and still be a bad installation. Where a distributed plant is allowed to sit, as a planning category, is a separate question from this safety one and is discussed in distributed photovoltaic scenarios.

Records are part of keeping it safe

PNNL’s inspection list is mostly looking: water in equipment, signs of arcing, loose wiring, dirt, mounts that have shifted, corrosion, roof penetrations, animals, vegetation, erosion, placards, and the monitor itself. Inverter filters, fuses, and connections follow the manufacturer’s timing, not a calendar copied from another site. Soiling is called the largest operations issue and is often hard to see. A low-tilt array in a dry climate may need a summer wash every month. A latitude-tilt array in a rainy climate may never need one. Those are illustrations. They are not a licence to pressure-wash a module the maker said not to walk on.

The same page says a log of production, alarms, downtime, and what was done is how a repeating fault becomes visible, and how a warranty stays valid. A distributed system without that log can be electrically listed and still run for months with a dead string. Comparing output with the season is the point of a solar monitoring system. The comparison does not replace the disconnect or the qualified repair.

Warranties are not a safety rating. PNNL describes typical panel warranties as often 10 years, with some at 25, and inverter warranties as typically 5 years with extensions to 10 or 15. That is a description of contract length on that best-practice page. It is not a measured time until a fault, and a warranty that has expired does not mean the hazard has expired. Modules still produce.

A practical test before anyone calls the system safe

Ask four things, and stop if any answer is missing. Is there a posted shutdown, with AC and DC disconnects in sight of the inverter? Was the inverter listed for the interconnection rule actually used at this site, including anti-islanding with the support functions that will be left on? Who is allowed to open the DC side, and is that written down? Does someone compare production with expected output often enough to notice a fault before it becomes heat? If those are in place, the system is operating inside the controls the cited sources describe. If they are not, the panels can still be a perfectly ordinary product on a dangerous installation.

This is general education. It is not a site assessment, a fire-code interpretation, or permission to work on the array. The authority having jurisdiction and the utility set the binding rules. A US summary is not a European, Chinese, or Australian one.

Frequently asked questions

Are distributed solar systems safe to touch if the inverter shows zero watts?

No. Pacific Northwest National Laboratory states that modules produce in daylight even when disconnects are open and even in poor weather. Zero watts on the inverter screen means the inverter is not exporting. It does not mean the DC wiring is dead.

Does anti-islanding make the roof safe for firefighters by itself?

It addresses one hazard: the inverter must stop energizing a separated utility line, within 2 seconds under IEEE 1547-2018. Access, shutdown placards, and disconnect location are separate requirements. PNNL says those disconnects should be within sight and that only trained people should handle the wiring.

Does a newer inverter remove the need for maintenance?

No. Listing and ride-through do not clean a module, tighten a lug, or record a repeating alarm. PNNL treats soiling as the largest operations issue and treats the service log as part of keeping warranties and performance intact.

Sources and references

Live modules, shutdown order, disconnects, soiling examples, inspection items, and typical warranty lengths: Pacific Northwest National Laboratory, solar photovoltaic O&M. The 2-second islanding limit, UL 1741, and function priority: NREL and Sandia primer on IEEE Std 1547-2018 unintentional islanding, 2022. Ride-through and grid-support tests against that limit: National Laboratory of the Rockies, anti-islanding evaluation.