Solar farm lockout tagout: OSHA electrical safety field guide
OSHA 29 CFR 1910.147 has governed the control of hazardous energy since 1989, and it still drives every solar farm lockout tagout decision made on a PV site today. Opening a single DC disconnect does not deenergize a plant: strings keep producing, capacitors hold charge, battery racks stay live, and the collection system can backfeed from the utility. Isolation is a sequence, not a switch, and verification closes it.
Which tasks require a solar farm lockout tagout procedure?
Any servicing or maintenance task where a worker could be injured by unexpected energization, start-up, or release of stored energy needs an energy control procedure. On a PV plant that covers combiner fusing, inverter skid work, tracker gearbox repair, MV termination, and battery rack service. Cord-and-plug exemptions almost never apply at utility-scale.
The trigger in OSHA 29 CFR 1910.147, the control of hazardous energy standard is exposure, not voltage class. If a worker places any part of the body into a danger zone created by machinery or circuits that could energize or move, the task needs a written procedure. Troubleshooting with a circuit intentionally live is a different category and falls under energized work rules instead.
The OSHA control of hazardous energy safety and health topic page lists the covered servicing activities, and every one of them maps to a solar farm lockout tagout task on a PV site: setting up, adjusting, inspecting, modifying, lubricating, and clearing jams. Three task families cause most of the confusion. Module and string work looks low risk because each module sits under 60 V, yet a full string runs well above touch-safe limits in sunlight. Inverter work looks finished when the AC breaker is open, but the DC side and the auxiliary supply remain. Tracker work looks mechanical, so crews skip electrical isolation and get caught by stored torque in the drive train.
Scope the procedure list once, then tie each procedure to the work order type your CMMS or SCADA alarm queue generates, so a planner cannot select a task that has no matching isolation plan. Arc flash study results tell the crew what to wear while the plan is executed.
How crews identify multiple electrical energy sources
Source identification is a counting exercise done on paper before anyone touches a wrench. Walk the single-line diagram from the point of interconnection inward, mark every device that can isolate, and list what stays live when each one opens. Stored and residual energy gets its own column. A typical 100 MW-DC block carries six to eight distinct isolation points once string combiners, recombiners, inverter DC and AC sides, the MV transformer, and auxiliary power are each counted on their own line, and skipping one of them is the most common citation OSHA inspectors write on multi-source equipment. The table below breaks that count down by asset so a planner can see which isolation point and verification method apply before the crew opens a single cabinet door.
Solar plants retain hazardous energy from PV strings, DC link capacitors, battery racks, rotating equipment, and the grid connection after one source is opened. That single fact separates a solar farm lockout tagout plan from a factory procedure: the generation source is the sun, and it cannot be switched off. Work at NREL, the National Renewable Energy Laboratory and the US Department of Energy Solar Energy Technologies Office documents how distributed DC architecture multiplies isolation points across a site.
Fuse pulling at the combiner deserves its own line in the procedure. A fuse holder is not an energy-isolating device unless it is designed and rated for that use, so crews treating a touch-safe holder as a lock point are outside the standard. Combiner box design and NEC 690 overcurrent protection decides whether a lockable load-break switch exists at all; where it does not, isolation moves upstream and the outage window gets longer. OSHA 1910.333 on the selection and use of electrical work practices is the companion rule for the test-before-touch step.
| Asset block | Hazardous energy sources | Isolation point | Verification method |
|---|---|---|---|
| String field | PV source circuits under irradiance | String disconnect at combiner | Voltage test, each conductor to ground |
| Recombiner and DC feeder | Parallel string current, residual charge | Load-break DC switch | Absence-of-voltage test, then temporary ground |
| Inverter skid | DC link capacitors, AC backfeed, aux supply | DC and AC disconnects, aux breaker | Observe discharge time, test all phases |
| MV collection and pad transformer | Utility backfeed, capacitive charge | MV switchgear, visible-break switch | Test, ground, apply cluster bars |
| BESS DC block | Battery racks, DC bus, thermal system | Rack breakers, string contactors, HVAC feed | Rack-level voltage test at terminals |
| Tracker row | Motor control power, stored mechanical torque | Tracker controller disconnect | Test control power, pin or block the drive |
The six-step solar farm lockout tagout sequence for qualified workers
OSHA sets an ordered sequence: prepare for shutdown, shut the equipment down, isolate it from every energy source, apply locks or tags, relieve or restrain stored energy, and verify isolation and deenergization. The order matters, and the last step is the one audits find missing most often.
Verification is explicit in the standard: the authorized employee shall verify that isolation and deenergization of the equipment have been accomplished before work begins. On a PV site that means an absence-of-voltage test on every conductor the crew will contact, using a meter rated for the system and proven live-dead-live. A solar farm lockout tagout walkdown that ends at the padlock is incomplete. Crews working the MV collection system also fall under OSHA 1910.269 for electric power generation, transmission, and distribution, which adds grounding and clearance duties on top of the sequence.
REIG's own commissioning team learned this the hard way on a 120 MW-DC site near Pecos, Texas, in March 2022. A startup electrician read an open combiner circuit at 6 V under a heavy overcast sky, called it dead, and reached for the lockout hasp before a second technician insisted on a live-dead-live check instead of trusting the first reading. The sun broke through forty minutes later and the same conductor read 612 V open-circuit. Nobody was hurt, but the near miss rewrote the site procedure: every PV string test now runs twice, once as found and once after a short wait, with both readings logged on the permit.
Group lockout and shift transfer are where long PV outages fail. The primary authorized employee holds accountability for the group, each member applies a personal lock to the group device, and a shift handover transfers that accountability in writing before the first crew leaves the site.
How solar farm lockout tagout controls backfeed from PV, inverters, and BESS
Backfeed is any path that re-energizes a locked section from a direction the crew did not isolate. On PV sites the usual suspects are the auxiliary transformer, the inverter AC side during anti-islanding ride-through, station service UPS circuits, and battery racks that stay closed while the DC bus is worked. Each of those paths earns its own line in the procedure because each one fails differently. An auxiliary transformer can re-energize a control cabinet from the grid side even when the main breaker is locked, a UPS circuit keeps a relay panel alive for hours after the building supply is cut, and an inverter riding through a grid disturbance can briefly re-close onto a line the crew already treated as dead. A solar farm lockout tagout plan that only isolates the obvious DC source misses all three.
DC link capacitors hold charge after the disconnects open, so the manufacturer discharge time belongs in the procedure rather than in a technician's memory. Interconnection and protection standards developed through IEEE, the Institute of Electrical and Electronics Engineers describe the ride-through and trip behaviour a solar farm lockout tagout plan has to account for, because an inverter energized from the grid side can hold its AC terminals live after the DC side is dead.
Battery blocks change the arithmetic. A rack cannot be deenergized, only disconnected, and the cells stay at full potential behind the contactor. EPRI, the Electric Power Research Institute publishes storage research that owners use to shape service rules, and site teams pair it with NFPA 855 fire safety requirements and EPRI capacity testing methods so that service windows, thermal management, and isolation boundaries all appear in one document instead of three.
Solar farm lockout tagout records, audits, and training controls
Owners carry three documentation duties: a written energy control program, a periodic inspection of each procedure at least annually by an authorized employee other than the one using it, and training records for authorized, affected, and other employees. Retraining follows job changes, procedure changes, and any inspection finding.
The inspection is a field observation, not a binder review. The inspector watches a crew run the procedure and corrects deviations on the spot. Keep the solar farm lockout tagout procedure set versioned against as-built drawings, because a repowering project or an added storage block invalidates isolation points that were correct last year. Site ground grid design under IEEE 80 matters here too, since temporary protective grounds are only as good as the permanent grid they attach to.
Owners with interconnection obligations should fold clearance practice into the compliance calendar they already keep for NERC reliability standards, and contractor safety material from SEIA, the Solar Energy Industries Association helps subcontractors align with owner rules before mobilization. Where SCADA tagging exists, mirror the physical tag in the HMI so the control room cannot issue a remote start or a tracker stow command on a locked asset.
Frequently asked questions
Do I need a solar farm lockout tagout procedure to pull combiner fuses?
Yes, where a worker could be exposed to unexpected energization or stored energy, and in most combiner work that exposure exists. A touch-safe fuse holder is not an energy-isolating device unless it is designed and rated for isolation, so pulling fuses by itself does not satisfy a solar farm lockout tagout procedure. Isolate at a lockable load-break switch, apply the lock, then test for absence of voltage on both poles before touching conductors. The typical minimal procedure published in OSHA 1910.147 Appendix A shows the format most PV sites adapt for string and combiner tasks.
How do you verify a PV string is actually deenergized?
Use a meter rated for the system voltage and measurement category, prove it on a known live source, test every conductor combination including conductor to ground, then prove the meter again. Run the test under the same lighting the crew will work in, because a string that reads low under heavy cloud returns to full open-circuit voltage when the sun comes back. Record the reading on the permit next to the tester name and time. OSHA 1910.335 on safeguards for personal protection sets the glove, tool, and barrier requirements for the person making that test.
Does lockout tagout apply to battery storage at a solar plant?
It applies, with the understanding that a battery cannot be deenergized. Opening a rack breaker disconnects the rack from the DC bus but leaves the cells at full potential behind the contactor, so the procedure must name the boundary the crew may not cross and the protective equipment for working near it. Thermal management, fire suppression, and gas detection interlocks each need their own isolation step and restoration check. Energy storage safety guidance from the US Department of Energy Office of Electricity describes the layered safety architecture owners are expected to document for a storage block.
Who can apply locks and tags at a utility-scale solar site?
Only an authorized employee, meaning a person trained and designated to lock out or tag out equipment for servicing and maintenance. Affected employees operate the equipment or work in the area and must recognize the procedure without applying it. Contractors run their own program, and the host owner and the contractor have to inform each other of their respective procedures before mobilization. Group lockout needs a primary authorized employee who holds accountability for the crew plus a device that lets every member apply a personal lock. OSHA 1910.332 covers the training obligation behind those roles.
How often does OSHA want energy control procedures inspected?
Each energy control procedure needs a periodic inspection at least annually, performed by an authorized employee other than the one using the procedure for that task. The inspector observes the work in progress, identifies deviations, and certifies the inspection with the equipment identified, the date, the employees involved, and the inspector name. Many owners run the solar farm lockout tagout inspection alongside seasonal maintenance so the sample covers real jobs rather than staged demonstrations. The OSHA law and regulations index links the current standard text and the related electrical safety rules.
Can a solar site use tagout instead of lockout?
Only where an energy-isolating device is not capable of being locked out. If the device can accept a lock, lockout is the required method. A tagout program must provide protection equal to lockout, which in practice means an additional safety measure such as removing an isolating element, blocking a control switch, opening an extra disconnect, or removing a valve handle. Tagout also carries expanded training on what a tag can and cannot do, since a tag is a warning device with no physical restraint. The OSHA law and regulations index holds the governing text.