Skip to content

How this self-assessment tool is structured

The self-assessment tool is divided into 3 main topics:

  1. Site management of key safety system elements
  2. Management of Major Industrial Risks
  3. Management of Risks Related to Critical Components

Each main topic is divided into subtopics. The subtopics are described as shown in the table below:

[ X ] – Subtopic description

Description Summary of subtopic description
References to existing ENGIE rules or standards
Indicators Metrics that measure the risk exposure for this subtopic
Recurrence/Frequency Indicates how often the measure is to be checked

1. Site management of key H&S system elements

Goal of this section is to ensure that organisational measures are in place to manage risks related to solar parks.


The key policies exist. This includes:

  • Health / Occupational Safety / Industrial Safety
  • Asset Integrity
  • Engineering Management
  • Environmental Compliance
  • Site security
  • Cybersecurity
  • Operation & Maintenance …
Indicators The policies must be approved and shared and applied on the site.
Recurrence/Frequency N/A

Risk identification and assessment are crucial to ensure specific job-related risks are identified and precautionary measures can be taken. The risk assessment must be performed at several stages from the design phase up to operation and decommissioning. Risk assessment is important for every situation at risk which includes every change and each work performed.

Several types of assessment exist, and amongst others:

  • those that deal with risk to personnel and assets during the work interventions (occupational safety)
  • those that deal with risk to personnel and assets due to failure of the process or the asset (industrial safety)

Management should ensure that a comprehensive hazard identification and risk assessment process systematically identifies, assesses and manages the risks.

For recommendations on this section, please refer to:


Indicators Risk assessment must be performed, and action plan must be put in place.
Recurrence/Frequency Regular update of the risk assessment is required at least after each important modification (industrial hazard assessment) and before each type of work (occupational job safety analysis).

Operating manuals and required procedures must be developed and maintained.

For recommendations on this section, please refer to:

Indicators Operating manuals and procedures are identified, available, accurate, up-to-date, understood and effectively used.
Recurrence/Frequency N/A

Enforce a management of change (MoC) program for all permanent, temporary or emergency modifications to equipment, procedures and parts. This program must consider change of:

  • Plant or installation
  • Supplier
  • Equipment repaired, modified, upgraded or replaced
  • Procedure(s)
  • Organisation or personnel

It is important that all changes are described, reviewed and approved by designated competent personnel before they are implemented and appropriate systems are in place to monitor and audit the management of change process.

Role and responsibilities of individuals and departments in this process must be clearly defined.

For recommendations on this section, please refer to:

  • Proposed changes must be reviewed and approved.
  • Monitoring and auditing system must be put in place.
  • Risk must be assessed in case of change.
Recurrence/Frequency Periodically review and update procedures based on experience.

Operational readiness process is important to assure a safe and efficient operation in case of new or modified plant or equipment. This procedure includes the H&S risks as well as process safety risks introduced by commissioning and start-up of this new/modified element.

The operational readiness process should include several aspects like human and organisational factors but also hardware, software and procedures. It is important to note that one modification can have an impact on all those aspects. For example, a hardware or software modification, can require a review of procedures and human and organisational factors.

For recommendations on this section, please refer to:

  • Operation readiness process must be put in place and checked regularly.
  • This process must include human & organisational factors, hardware & software and procedures.
Recurrence/Frequency Process is reviewed in case of (near) incident or accident.

A crisis and emergency response plan must be put in place so that the organisation can respond effectively to any crises, emergency situation or incident. The goal of this is to reduce the consequences in case of event thanks to appropriate actions.

This element covers:

  • Crisis management planning
  • Local emergency planning
  • Availability of emergency and safety equipment

For recommendations on this section, please refer to:

  • Identification of crisis and emergency scenarios.
  • Preparation and testing of the different scenarios.
Recurrence/Frequency Annual testing of crisis and emergency response plan.

Appropriate work control and permit to work arrangements are employed to assure the safety of personnel, plant, process and the integrity of the asset during work activities.

Work permits help to check if the risks related to the planned works are identified and managed and to control the access to the asset.

The work permit should consider at least electrical risks (including lock out tag out certificates), work in confined spaces, and hot works which requires a specific permit.

For recommendations on this section, please refer to:

  • Work authorization procedure is in place and used. Workers without authorization are not given access to the asset.
  • Permit to works are delivered to manage critical risks. Amongst others, a specific work permit is required for hot works.
  • Risk analysis available for each work/
  • Permit to work delivered before each activity defined as high risk (confined spaces, electricity, hot works etc.)

Anomalies and incident reporting is extremely important to detect shortcomings in existing practices or procedures. Appropriate actions must be taken to prevent their recurrence.

The reporting is of primary importance for high-potential incidents called HiPos. Those incidents could have caused one or more fatalities under other circumstances.

It is important to ensure that all incidents, HiPos and “near misses” are consistently reported and investigated (according to their potential severity) and that actions are defined and implemented on a timely basis.

The reporting and sharing of good practices must also be promoted.

For recommendations on this section, please refer to:

  • Clear policy that every (near) incident and HiPo must be reported.
  • Procedures to report (near) incidents are available and used.
  • Each incident is investigated, the root cause is analysed.
  • Dedicated industrial safety performance indicators are defined and tracked, in addition to health and safety indicators.
  • Action plan is put in place to avoid accidents to happen again.
  • Fatal external cases are reviewed internally.
Recurrence/Frequency After each incident.

Inspections and maintenance are key for a safe and healthy asset. It will prevent unplanned unavailability and damages. It is important to identify safety critical equipment and to control, inspect and perform preventive maintenance on those equipment’s.

Independently of the maintenance scenario, a Supervisory Control And Data Acquisition (SCADA) system and a remote monitoring must allow permanent monitoring of performance, condition and health. It should deliver alarms for minor deviations and stop/disconnect the asset in case of major event.

Safety Critical Equipment must be identified via a formal process such as Process Hazard Review or Engineering Risk Assessment.

For recommendations on this section, please refer to:

  • An ENGIE contract manager evaluates the service providers. The internal asset monitoring system (AMS) allows performance reviews (for example Darwin).
  • A condition monitoring system (CMS) and expertise team is in place. The CMS monitors critical individual components allowing in the best cases to receive early warnings to avoid failures.
  • Safety critical equipment are identified, controlled, maintained.
  • Degraded modes are reviewed, and action plans are put in place when necessary.
  • Yearly meeting/evaluation with service provider.
  • Permanent monitoring through AMS and CMS.

All ENGIE and contractor personnel having access to the solar farm must have completed safety awareness training on topics that could impact their safety, or the safety of the installation, and have gone through an induction process.

Specific trainings for electrical safety are also required following local regulations.

More generally, a training plan must in place and should help identify which person / function needs to conduct which type of training. This concerns health & safety training, industrial safety related training, or technical training.

For recommendations on this section, please refer to:

Indicators An adapted safety awareness and training procedure exists, is applied, and is up-to-date
  • Procedure & training material are reviewed on a yearly basis.
  • Training is refreshed according to local regulations.

All contractors active in or for a specific site should be registered to allow proper tracing of interventions, modifications and replacement of parts.

In order to assess the quality of service (beyond the obliged compliance) they should be routinely reviewed.

All HSE clauses should apply to subcontractors active on ENGIE (managed) sites.

In addition to HSE plans, bridging documents are sometimes in place in the industry. A bridging (or interface) document is a documented plan that defines how diverse organisations agree on which safety management elements will be used when co-operating on a project, contract or operation.

For recommendations on this section, please refer to:

–        Global Care Industrial Safety Framework:

o    Item 18 (Contractor and supply, selection and management)

–        Global Care Group Rule

o    GR02 (Health & safety with regard to subcontracting)

o    GR09 (Health & safety in projects and acquisitions)


Definition : 

“Bridging documents”:  in addition to HSE plans, bridging documents are sometimes in place in the industry. A bridging (or interface) document is a documented plan that defines how diverse organisations agree on which safety management elements will be used when co-operating on a project, contract or operation.


Contractors are registered and apply the same procedures and guidelines.

Contractors are regularly trained/ updated with necessary skills/ information.

Recurrence/Frequency Before/ during each intervention.

2. Management of major industrial risks

Goal of this section is to ensure that measures are in place to manage the major industrial risks related to wind turbines.


Fire on a solar park can lead to a complete destruction of the park because of the remote location of the park or the accessibility of a roof. A fire can also occur at the solar park grid connection. The fire risk must be managed with a high priority.

It is important to work on all aspects to limit the risks:

  1. Prevention of fire: Smoking restriction, separate storage of flammable substances, hot work procedure applied, presence of handheld fire extinguishers
  2. Detection of fire: automatic fire detection systems must be installed throughout all buildings and critical plant.
  3. Avoid propagation of fire:
    1. For substations: sealing of all penetrations including cable paths are important to prevent propagation of fire and/or smoke
    2. For transformers, cleanliness and oil/grease leakage avoidance are keys.

In addition, a maintenance program should be established for fire detection, alarm and fire-fighting equipment.

Hot works should be compliant with the NFPA51B procedure, including delivery of a hot work permit.

For recommendations on this section, please refer to:

ENGIE Life-saving rules

  • Procedures when fire occurs are in place, tested and available.
  • Fire prevention procedures are in place and used.
  • Fire detection devices are periodically checked and monitored.
  • Fire procedures are reviewed yearly. New procedures are tested (in line with NFPA applicable guidelines).
  • Fire suppression systems and/or extinguishers are yearly checked.
  • Fire detection devices are yearly checked and 24/7 monitored.

Lightning can lead to damage of the solar modules or electrical system.

It is important to set up a testing program for the lightning protection.

The Lightning Exposure Assessment has been done according to the requirements of the standard IEC 62305 latest Edition.

The solar farm lightning protection system is certified according to the standard IEC 62305 latest Edition including all the parameters defined in the applicable Lightning Protection Level.

Indicators Lightning protection system is installed and is periodically checked.
Recurrence/Frequency Lightning protection system is checked visually every year.

Industrial control systems (ICS) need to be protected against unauthorized access, use, disclosure, disruption, modification or destruction in conformity with the ENGIE ICS security Policy.

To address this, ENGIE developed the ICS Security Framework and its Progress Reporting tool which allows the sites to self-assess and follow-up its security maturity level.

By implementing the ICS Security Framework security controls, cybersecurity risks can be mitigated to an acceptable level and incidents can be avoided.

However, in the case of nations or industries submitted to comply with regulatory requirements, specific security measures may be mandatory and additional security controls might be needed.

For recommendations on this section, please refer to:

  • Group Security Policy for lndustrial Control Systems.
  • ICS security framework.
  • Overall security level in the Progress reporting tool.
  • Secured network connection in place.
Recurrence/Frequency N/A
Description Burglary or vandalism in the solar park or wind turbine could lead to damage and/or production loss. The burglars could also harm themselves. Therefore it is important to detect and (if possible) prevent intrusion.

Locking systems and gates are in place to prevent intrusion

Systems for intrusion detection (e.g. door sensors) are in place, monitored and maintained. A response plan is ready in case of intrusion.

Recurrence/Frequency N/A
Description An unstable grid can lead to high production losses. It is therefore important that backup power is foreseen so that in case of grid failure, the vital parts of the park stay supplied. This way the inverters will be stopped in a controlled manner and important safety systems will stay operational. The inverters can automatically restart when the grid failure disappears.
  • Backup power is foreseen and the installation is maintained, inspected and tested.
  • Frequency of grid failures.
Recurrence/Frequency UPS system is preventively replaced after 10 years.

Snow can cause a significant load on the structure and modules. Some care is therefore needed in the design:
Leading Edge Height (Ground to Module) Space between the modules and ground is needed to allow for snow to shed and accumulate. Additional clearance for snow accumulation between rows may also be needed. Snow Load : Verify modules are rated for the snow load. Make necessary adjustments in racking and clearances for high snow loads. The basic criteria for structural engineering of PV arrays are based on applicable codes. Check with the local building department for the adopted code version.

  • The installation has been design according snow load.
  • There is a testing report for hail impact.
Recurrence/Frequency N/A

The main risks linked with extreme weather conditions concern:

  • Flooding
  • Heavy wind
  • High/low temperatures
  • Seismic activity
  • Lightning (is already assessed in a specific topic)

Concerning seismic activity, the Eurocode 8 (or local equivalent) specifies the design requirements of structures for earthquake resistance. The design will depend of the seismic activity of the solar park location.

The following documents are typically expected from the equipment manufacturer:

  • Type Certificate.
  • Module technical specification.
  • « Site Suitability Load Analysis » for certified lifetime of the solar structure.
  • Adequacy between solar structure and wind class (IEC 61215).
  • Solar park location.
  • Weather conditions assessment performed during development stage based on standards IEC 61215.
Recurrence/Frequency  N/A

Some risks are due to the specific conditions of the site and must be taken into account. Risks taken into account:

  • Thief
  • Assault
  • Social unrest
  • Animals
Indicators Solar park location.
Recurrence/Frequency Inspection of insulations on regular basis.

3. Management of risks related to critical components

Goal of this section is to ensure that measures are in place to manage risks related to critical components.


An internal maintenance organization or a long-term solar park maintenance contract with a service provider will allow a guaranteed time or energy availability.

Critical equipment must be identified, and it is important that the maintenance contract includes sufficient spares to perform the manufacturer’s required maintenance.

Failure of critical equipment can lead to long downtimes. Business continuity and process start-up procedures are needed to control this downtime by preparing actions before the failure happens.

Accessibility of the site is also a key issue if spare parts of large dimensions must be transported.


Critical equipment”: Equipment which failure can lead to long downtime, such as (but not limited to): MV transformer, switchgear, UPS, (string) inverters, PV modules, tracking motors. PR” : The Performance Ratio is the ratio of the energy effectively produced (used), with respect to the energy which would be produced if the system was continuously working at its nominal STC efficiency. The PR is defined in the norm IEC EN 61724. Some PV contract has a PR warranty is foreseen.

Guaranteed time availability”: as defined in the maintenance contract. Depending on the contract, guaranteed availability may be in time or “energy”.

  • A maintenance contract (internally or externally) is in place. The contract is managed so contractual agreements are respected.
  • Critical spares must be identified and available.
  • Contract, spare parts, management of obsolete components, procedures,… are in place over the business plan duration (and potential lifetime extension) to minimize downtime.
  • Site is easily accessible.
  • Strategy over the business plan are reviewed on a regular basis and minimally at major events on the fleet and contract modifications.
  • Procedures are reviewed at each modification

PV modules are exposed to various weather conditions and different degradations can occur. This can have a significant impact on the production of the park. Adequate maintenance is needed and spare parts must be available.

ENGIE recommendations are:

  • Flashtest of the modules at installation
  • Visual inspection or drone inspections every year –> Frequency to be adapted in function of PV modules quality and ageing.
  • Periodic IV curve measurement with PID detection.

Inspection results (high resolution pictures, web platform access and documented reports) to be shared by the OEM or ISP.

Indicators Visual inspection of the modules and connectors.
  • Drone inspection every year.
  • Periodic IV curve measurement.

A good structure and foundation are essential in the PV design to avoid PV modules displacements, cracks and other deteriorations. The structure has to be design according to the wind and snow category of the location. A good anti-corrosion coating is also important for the structure.

If there are trackers, it is important to monitor them well to report any problems with the tracker.

  • The structure is in a good condition and they are no modules misaligned.
  • Alarms on the tracker monitoring
  • Maintenance and torque check of the support structure every year.
  • Repair of tracker in case of alarm

The junction and array boxes are used to connect the photovoltaic strings in parallel. The combined DC power is fed to the inverter. It includes photovoltaic string protection, overvoltage protection and a DC output switch isolator. Problems with combiner boxes can lead to total string loss.

The maintenance of the solar cables is really important to avoid RISO problems or even total string loss.

  • The junction and array boxes are adequately maintained (tight connections, fuses ok, corrosion, water infiltration).
  • Inspect cabling for signs of cracks, defects, pulling out of connections, overheating, arcing, short or open circuits, and ground faults.
  • The Junction and array boxes are visually inspected annually.
  • The DC cabling and attachments are visually inspected annually.
  • A thermography is performed on the cables, connectors and junction boxes annually.
Description The aim of earthing in electrical installations and circuits is to enhance the safety of the installation by reducing the level of danger inherent to fault currents. Fault currents may be caused by different factors. Therefore, it is very important to design an earthing system according to the installation’s characteristics.
  • The structures, modules frames and junction boxes are earthed
  • The inverters and transformers are connected to the ground
  • The grounding has been tested during commissioning
  • The PV plant is equipped with insulation monitoring device (IMD)
  • The PV plant is equipped with Ground fault Detection and Interruption device (GFDI)
Recurrence/Frequency Automatic insulation check is performed at each start of operation (preferably daily).

A string inverter system aggregates the power output of groups of solar panels in your system into “strings”. Multiple strings of panels then connect to a single inverter where electricity is converted from DC to AC electricity.

Failure of the string inverters can result in the loss of several strings at once. It is therefore essential to inspect the inverters regularly and replace them if necessary.

  • Inspect inverter housing or shelter for physical maintenance required if present.
  • Observe instantaneous operational indicators on the faceplate of the inverter to ensure that the amount of power being generated is typical of the conditions.
  • Frequent monitoring analysis.
Recurrence/Frequency The maintenance interval of the inverters is yearly.

The inverter is the heart of every PV plant : it converts direct current of the PV modules into grid-compliant alternating current and feeds this into the public grid. At the same time, it controls and monitors the entire plant. This way, it ensures on the one hand that the PV modules always operate at their radiation- and temperature-dependent maximum power. On the other, it continually monitors the power grid and is responsible for the adherence to various safety criteria.

Good maintenance of the central inverters is essential in a solar project, because if a central inverter fails, a large part of the plan will be interrupted and significant losses will occur. The main reason for failure is aging of electronic components, but it is also greatly affected by the operational conditions. A demanding environment, such as high ambient temperature, humidity, dirt, dust and cyclic heavy loads, can shorten component lifetime as well as maintenance and component replacement intervals.

  • The ITS is arc flash proof
  • A Lock out/ Tag out or an interlock system with physical locks is present and used
  • The inverters are protected against over- or under-voltage from the grid
  • The inverters are protected against overcurrent’s (short-circuit protection)
  • The inverters are protected against over- or under-frequency events
  • The operating conditions are monitored and alarms are set
  • The container/ housing can be accesses without electrical risks exposure? (sufficient space, insulation of all live wiring/ bars, etc)
  • The container ventilation is appropriate to avoid overheating? (Natural or forced ventilation)
  • The operating conditions have been assessed based on local environmental conditions?
  • The ITS maintenance is done according to supplier recommendation.
  • The maintenance of the MW switchgears is done according to supplier recommendation.
Description ITS transformer is provided at the output to boost the AC voltage and provide isolation.
  • The transformer is adequately maintained
  • Transformer oil analysis is performed.
  • Transformer is protected with DGPT2 or RIS or equivalent.
  • The transformer protections are included into ITS emergency loop.
  • The maintenance interval of the transformer is every two years or shorter.
  • Transformer oil analysed periodically (at least every 3 year)

The solar park grid connection consists of switchgear and eventually a transformer. The transformer typically transforms the produced electricity from medium voltage to high voltage when the grid is requiring it. The switchgear on the other hand is designed to connect and disconnect, detect grid faults and protect the solar park. A failure of one of these component almost directly lead to an unavailability of the complete solar park or at least one of the branches.

Also the substation needs to be maintained and visually inspected.

It is recommended that an arc flash study is performed on all electrical power cabinets (LV) and switchgear (MV/HV). This study would thus concern equipment in the substation, but also extend to the equipment within the solar park.

Oil and dissolved gases analysis should be performed on transformers according to the manufacturer’s recommendations.

  • Contingency plan for main transformer must exist and is complete
  • The transformer and switchgear are adequately maintained
  • Transformer oil and dissolved gas analysis is performed
  • Transformer is protected with a Buchholz relay or equivalent
  • Arc flash analysis
  • The maintenance interval of the substation is yearly or shorter
  • Transformer oil analysed periodically (at least every 3 year)
Description A good and well maintained SCADA and monitoring devices is the key to have a view on the health of the park. An autonomous power supply is important to avoid loss of data and keep track of the power breakdown.
  • Periodic recalibration of the instrumentation is planned
  • The on-site sensors are easily and safely accessible for maintenance
  • There is a redundancy of on-site sensors
Recurrence/Frequency Spot-check annually monitoring instruments (e.g., pyranometer) with handheld instruments to ensure that they are operational and within specifications
Description Remote control is essential to take control of the park if it’s needed for example if there are some problems on the grid.
  • The communication connection to the plant is redundant
  • There is a monitoring of the communication link.
  • The is a protocol in place when the plant loses connection to remote control room.
Recurrence/Frequency N/A
Back To Top