Risk identification and assessment are crucial to ensure specific job-related risks are identified and precautionary measures can be taken. The risk assessment must be performed at several stages from the design phase up to operation and decommissioning. Risk assessment is important for every situation at risk which includes every change and each work performed.

Several types of assessment exist, and amongst others:

• those that deal with risk to personnel and assets during the work interventions (occupational safety)
• those that deal with risk to personnel and assets due to failure of the process or the asset (industrial safety)

Management should ensure that a comprehensive hazard identification and risk assessment process systematically identifies, assesses and manages the risks.

For recommendations on this section, please refer to:

• Global Care Group Rule
  • GR04 Risk assessment and control
  • GR05 Permit to work system
• Global Care Industrial Safety Framework:
  • Item 06 (Hazard identification and risk assessment)
  • Item 17 (Work control, permit-to-work and task risk management)

INCOME – IND2C010

Operating manuals and required procedures must be developed and maintained.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 08 (Operating manuals and procedures)

Enforce a management of change (MoC) program for all permanent, temporary or emergency modifications to equipment, procedures and parts. This program must consider change of:

• Plant or installation
• Supplier
• Equipment repaired, modified, upgraded or replaced
• Procedure(s)
• Organisation or personnel

It is important that all changes are described, reviewed and approved by designated competent personnel before they are implemented and appropriate systems are in place to monitor and audit the management of change process.

Role and responsibilities of individuals and departments in this process must be clearly defined.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 12 (Management of Change & Project Management)
• Global Care Group Rule
  • GR04 Risk assessment and control
• INCOME – IND2C060

• Proposed changes must be reviewed and approved.
• Monitoring and auditing system must be put in place.
• Risk must be assessed in case of change.

Operational readiness process is important to assure a safe and efficient operation in case of new or modified plant or equipment. This procedure includes the H&S risks as well as process safety risks introduced by commissioning and start-up of this new/modified element.

The operational readiness process should include several aspects like human and organisational factors but also hardware, software and procedures. It is important to note that one modification can have an impact on all those aspects. For example, a hardware or software modification, can require a review of procedures and human and organisational factors.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 13 (Operational readiness and process start-up)

• Operation readiness process must be put in place and checked regularly.
• This process must include human & organisational factors, hardware & software and procedures.

A crisis and emergency response plan must be put in place so that the organisation can respond effectively to any crises, emergency situation or incident. The goal of this is to reduce the consequences in case of event thanks to appropriate actions.

This element covers:

• Crisis management planning
• Local emergency planning
• Availability of emergency and safety equipment

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 14 (Emergency preparedness)
• Global Care Group Rule
  • GR13 (Supporting the victims of a serious event)
• Global Care crisis management framework
  • Crisis management guidelines

• Identification of crisis and emergency scenarios.
• Preparation and testing of the different scenarios.

Appropriate work control and permit to work arrangements are employed to assure the safety of personnel, plant, process and the integrity of the asset during work activities.

Work permits help to check if the risks related to the planned works are identified and managed and to control the access to the asset.

The work permit should consider at least electrical risks (including lock out tag out certificates), work in confined spaces, and hot works which requires a specific permit.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 07 (Work control, permit control, and task risk management)
• Global Care Group Rule
  • GR05 (Permit to work system)
• INCOME IND3C030 & IND3C040
• ENGIE 9 Life-saving rules
• Global Care – technical guidelines – Work in confined spaces

• Work authorization procedure is in place and used. Workers without authorization are not given access to the asset.
• Permit to works are delivered to manage critical risks. Amongst others, a specific work permit is required for hot works.

• Risk analysis available for each work/
• Permit to work delivered before each activity defined as high risk (confined spaces, electricity, hot works etc.)

• Clear policy that every (near) incident and HiPo must be reported.
• Procedures to report (near) incidents are available and used.
• Each incident is investigated, the root cause is analysed.
• Dedicated industrial safety performance indicators are defined and tracked, in addition to health and safety indicators.
• Action plan is put in place to avoid accidents to happen again.
• Fatal external cases are reviewed internally.

Inspections and maintenance are key for a safe and healthy asset. It will prevent unplanned unavailability and damages. It is important to identify safety critical equipment and to control, inspect and perform preventive maintenance on those equipment’s.

Independently of the maintenance scenario, a Supervisory Control And Data Acquisition (SCADA) system and a remote monitoring must allow permanent monitoring of performance, condition and health. It should deliver alarms for minor deviations and stop/disconnect the asset in case of major event.

Safety Critical Equipment must be identified via a formal process such as Process Hazard Review or Engineering Risk Assessment.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 15 (Inspection and maintenance)
  • Item 16 (Management of Safety Critical Devices)
• INCOME – IND2C010 & IND2C030

• An ENGIE contract manager evaluates the service providers. The internal asset monitoring system (AMS) allows performance reviews (for example Darwin).
• A condition monitoring system (CMS) and expertise team is in place. The CMS monitors critical individual components allowing in the best cases to receive early warnings to avoid failures.
• Safety critical equipment are identified, controlled, maintained.
• Degraded modes are reviewed, and action plans are put in place when necessary.

• Yearly meeting/evaluation with service provider.
• Permanent monitoring through AMS and CMS.

All ENGIE and contractor personnel having access to the solar farm must have completed safety awareness training on topics that could impact their safety, or the safety of the installation, and have gone through an induction process.

Specific trainings for electrical safety are also required following local regulations.

More generally, a training plan must in place and should help identify which person / function needs to conduct which type of training. This concerns health & safety training, industrial safety related training, or technical training.

For recommendations on this section, please refer to:

• Global Care Industrial Safety Framework:
  • Item 03 (Employee selection, placement and competency)
• INCOME – IND2C040

• Procedure & training material are reviewed on a yearly basis.
• Training is refreshed according to local regulations.

“Bridging documents”:  in addition to HSE plans, bridging documents are sometimes in place in the industry. A bridging (or interface) document is a documented plan that defines how diverse organisations agree on which safety management elements will be used when co-operating on a project, contract or operation.

Contractors are registered and apply the same procedures and guidelines.

Contractors are regularly trained/ updated with necessary skills/ information.

Lightning can lead to damage of the solar modules or electrical system.

It is important to set up a testing program for the lightning protection.

The Lightning Exposure Assessment has been done according to the requirements of the standard IEC 62305 latest Edition.

The solar farm lightning protection system is certified according to the standard IEC 62305 latest Edition including all the parameters defined in the applicable Lightning Protection Level.

Industrial control systems (ICS) need to be protected against unauthorized access, use, disclosure, disruption, modification or destruction in conformity with the ENGIE ICS security Policy.

To address this, ENGIE developed the ICS Security Framework and its Progress Reporting tool which allows the sites to self-assess and follow-up its security maturity level.

By implementing the ICS Security Framework security controls, cybersecurity risks can be mitigated to an acceptable level and incidents can be avoided.

However, in the case of nations or industries submitted to comply with regulatory requirements, specific security measures may be mandatory and additional security controls might be needed.

For recommendations on this section, please refer to:

• Group Security Policy for lndustrial Control Systems.
• ICS security framework.

• Overall security level in the Progress reporting tool.
• Secured network connection in place.

Locking systems and gates are in place to prevent intrusion

Systems for intrusion detection (e.g. door sensors) are in place, monitored and maintained. A response plan is ready in case of intrusion.

• Backup power is foreseen and the installation is maintained, inspected and tested.
• Frequency of grid failures.

Snow can cause a significant load on the structure and modules. Some care is therefore needed in the design:
Leading Edge Height (Ground to Module) : Space between the modules and ground is needed to allow for snow to shed and accumulate. Additional clearance for snow accumulation between rows may also be needed. Snow Load : Verify modules are rated for the snow load. Make necessary adjustments in racking and clearances for high snow loads. The basic criteria for structural engineering of PV arrays are based on applicable codes. Check with the local building department for the adopted code version.

• The installation has been design according snow load.
• There is a testing report for hail impact.

The main risks linked with extreme weather conditions concern:

• Flooding
• Heavy wind
• High/low temperatures
• Seismic activity
• Lightning (is already assessed in a specific topic)

Concerning seismic activity, the Eurocode 8 (or local equivalent) specifies the design requirements of structures for earthquake resistance. The design will depend of the seismic activity of the solar park location.

The following documents are typically expected from the equipment manufacturer:

• Type Certificate.
• Module technical specification.
• « Site Suitability Load Analysis » for certified lifetime of the solar structure.

• Adequacy between solar structure and wind class (IEC 61215).
• Solar park location.
• Weather conditions assessment performed during development stage based on standards IEC 61215.

Some risks are due to the specific conditions of the site and must be taken into account. Risks taken into account:

• Thief
• Assault
• Social unrest
• Animals

PV modules are exposed to various weather conditions and different degradations can occur. This can have a significant impact on the production of the park. Adequate maintenance is needed and spare parts must be available.

ENGIE recommendations are:

• Flashtest of the modules at installation
• Visual inspection or drone inspections every year –> Frequency to be adapted in function of PV modules quality and ageing.
• Periodic IV curve measurement with PID detection.

Inspection results (high resolution pictures, web platform access and documented reports) to be shared by the OEM or ISP.

• Drone inspection every year.
• Periodic IV curve measurement.

A good structure and foundation are essential in the PV design to avoid PV modules displacements, cracks and other deteriorations. The structure has to be design according to the wind and snow category of the location. A good anti-corrosion coating is also important for the structure.

If there are trackers, it is important to monitor them well to report any problems with the tracker.

• The structure is in a good condition and they are no modules misaligned.
• Alarms on the tracker monitoring

• Maintenance and torque check of the support structure every year.
• Repair of tracker in case of alarm

The junction and array boxes are used to connect the photovoltaic strings in parallel. The combined DC power is fed to the inverter. It includes photovoltaic string protection, overvoltage protection and a DC output switch isolator. Problems with combiner boxes can lead to total string loss.

The maintenance of the solar cables is really important to avoid RISO problems or even total string loss.

• The junction and array boxes are adequately maintained (tight connections, fuses ok, corrosion, water infiltration).
• Inspect cabling for signs of cracks, defects, pulling out of connections, overheating, arcing, short or open circuits, and ground faults.

• The Junction and array boxes are visually inspected annually.
• The DC cabling and attachments are visually inspected annually.
• A thermography is performed on the cables, connectors and junction boxes annually.

• The structures, modules frames and junction boxes are earthed
• The inverters and transformers are connected to the ground
• The grounding has been tested during commissioning
• The PV plant is equipped with insulation monitoring device (IMD)
• The PV plant is equipped with Ground fault Detection and Interruption device (GFDI)

A string inverter system aggregates the power output of groups of solar panels in your system into “strings”. Multiple strings of panels then connect to a single inverter where electricity is converted from DC to AC electricity.

Failure of the string inverters can result in the loss of several strings at once. It is therefore essential to inspect the inverters regularly and replace them if necessary.

• Inspect inverter housing or shelter for physical maintenance required if present.
• Observe instantaneous operational indicators on the faceplate of the inverter to ensure that the amount of power being generated is typical of the conditions.
• Frequent monitoring analysis.

The inverter is the heart of every PV plant : it converts direct current of the PV modules into grid-compliant alternating current and feeds this into the public grid. At the same time, it controls and monitors the entire plant. This way, it ensures on the one hand that the PV modules always operate at their radiation- and temperature-dependent maximum power. On the other, it continually monitors the power grid and is responsible for the adherence to various safety criteria.

Good maintenance of the central inverters is essential in a solar project, because if a central inverter fails, a large part of the plan will be interrupted and significant losses will occur. The main reason for failure is aging of electronic components, but it is also greatly affected by the operational conditions. A demanding environment, such as high ambient temperature, humidity, dirt, dust and cyclic heavy loads, can shorten component lifetime as well as maintenance and component replacement intervals.

• The ITS is arc flash proof
• A Lock out/ Tag out or an interlock system with physical locks is present and used
• The inverters are protected against over- or under-voltage from the grid
• The inverters are protected against overcurrent’s (short-circuit protection)
• The inverters are protected against over- or under-frequency events
• The operating conditions are monitored and alarms are set
• The container/ housing can be accesses without electrical risks exposure? (sufficient space, insulation of all live wiring/ bars, etc)
• The container ventilation is appropriate to avoid overheating? (Natural or forced ventilation)
• The operating conditions have been assessed based on local environmental conditions?

• The ITS maintenance is done according to supplier recommendation.
• The maintenance of the MW switchgears is done according to supplier recommendation.

• The transformer is adequately maintained
• Transformer oil analysis is performed.
• Transformer is protected with DGPT2 or RIS or equivalent.
• The transformer protections are included into ITS emergency loop.

• The maintenance interval of the transformer is every two years or shorter.
• Transformer oil analysed periodically (at least every 3 year)

The solar park grid connection consists of switchgear and eventually a transformer. The transformer typically transforms the produced electricity from medium voltage to high voltage when the grid is requiring it. The switchgear on the other hand is designed to connect and disconnect, detect grid faults and protect the solar park. A failure of one of these component almost directly lead to an unavailability of the complete solar park or at least one of the branches.

Also the substation needs to be maintained and visually inspected.

It is recommended that an arc flash study is performed on all electrical power cabinets (LV) and switchgear (MV/HV). This study would thus concern equipment in the substation, but also extend to the equipment within the solar park.

Oil and dissolved gases analysis should be performed on transformers according to the manufacturer’s recommendations.

• Contingency plan for main transformer must exist and is complete
• The transformer and switchgear are adequately maintained
• Transformer oil and dissolved gas analysis is performed
• Transformer is protected with a Buchholz relay or equivalent
• Arc flash analysis

• The maintenance interval of the substation is yearly or shorter
• Transformer oil analysed periodically (at least every 3 year)

• Periodic recalibration of the instrumentation is planned
• The on-site sensors are easily and safely accessible for maintenance
• There is a redundancy of on-site sensors

• The communication connection to the plant is redundant
• There is a monitoring of the communication link.
• The is a protocol in place when the plant loses connection to remote control room.