Module-Level Rapid Shutdown for Commercial Applications
Inside this Article
The fire service wants module-level rapid shutdown. But is this commercially viable in nonresidential applications? And will this reduce hazards within the array?
While it has proven relatively easy for solar companies to comply with the rapid-shutdown requirements in NEC 2014, many in the solar industry are justifiably concerned about the implications of the revised and more restrictive rapid-shutdown requirements adopted as part of the 2017 cycle of revisions. Specifically, the International Association for Fire Fighters introduced language that seeks to mandate module-level rapid shutdown for PV systems on buildings. This would, of course, require module-level disconnecting devices for all building-mounted PV modules, including those on commercial rooftops, which is a daunting paradigm shift in terms of both system reliability and economic viability.
In this article, I explore different perspectives on the prospects of deploying module-level power electronics (MLPE) in commercial rooftop applications in light of these evolving rapid-shutdown requirements. Generally speaking, there are two sides to the debate. On one hand, fire service representatives and some MLPE vendors contend that module-level rapid shutdown will improve safety for firefighters and first responders. On the other, the Solar Energy Industries Association (SEIA) and some of its most prominent constituents—including SolarCity, SunPower and Sunrun—point out that there is no scientific basis for using module-level rapid shutdown to protect emergency responders and that doing so could have unintended negative consequences. Staking out a middle ground, UL promises to take a science-based approach as it develops an NEC 2017 rapid-shutdown PV array product safety standard.
Evolving Rapid-Shutdown Requirements
Introduced as part of the 2014 cycle of revisions and significantly revised for the 2017 Code, the goal of NEC 690.12 is to reduce shock hazards for emergency responders.
2014 version. Under NEC 2014, rapid shutdown of PV system circuits on buildings is accomplished by limiting the potential of controlled conductors to 30 V or less beyond 5 or 10 feet of the array, depending on whether the conductors enter the building or travel along its exterior. Markets have generally shrugged off this Code change and continued apace. Certainly, states that adopted NEC 2014 early, such as Massachusetts, experienced some growing pains associated with rapid-shutdown compliance and enforcement. However, system designers were quick to identify and implement a standard set of cost-effective and application-specific approaches to rapid shutdown.
Where the 2014 version of rapid shutdown becomes the law of the land, residential markets shift away from string inverter–based designs in favor of MLPE-based designs. Arguably, the design response is even simpler in commercial applications. Many commercial project designers started switching from central inverter–based to 3-phase string inverter–based designs to meet the dc arc-fault protection requirements in NEC 2011. To ensure that these distributed inverter designs comply with the 2014 version of rapid shutdown, designers simply need to locate these 3-phase string inverters on the roof within 10 feet of the array.
This is good news for installation companies in the largest US solar market, as well as for the North American solar market in general. Though it will throw some AHJs and inspectors for a loop when California adopts NEC 2014 on January 1, 2017, experiences in other states have shown that this level of rapid-shutdown compliance is relatively straightforward and not overly disruptive to business as usual. (For more about the intent and design implications of 2014 rapid shutdown, see Bill Brooks’ article “Rapid Shutdown for PV Systems,” SolarPro, January/February 2015.)
2017 version. Under NEC 2017, the rapid-shutdown language in section 690.12 expands from a mere 133 words to more than 1,100. Many of the people who previously bemoaned the lack of specificity in NEC 2014 may find themselves longing for those halcyon days of yore. Without a doubt, the number one complaint about 2017 rapid shutdown is that it is overly prescriptive.
From a design point of view, there are two main differences between the versions of rapid shutdown. First, the 2017 Code shrinks the “not more than 30 V” zone on the roof from a maximum of 10 feet to not more than 1 foot from the array in every direction, as shown in Figure 1. Second, whereas 2014 rapid-shutdown requirements apply to conductors outside the array boundary only, the 2017 version has requirements both for conductors outside the array boundary and for conductors inside the array boundary. It is fair to say that there is general consensus on the first count. Both firefighters and solar industry stakeholders agree that shrinking the array boundary when controlling PV circuits will tangibly improve safety for proximity firefighting. Opinions differ, however, about what should happen inside the array boundary.
Which Side Are You On?
In the first draft of NEC 2017 690.12(B)(2), fire service representatives established a voltage limit of 80 Vdc within the array boundary, effectively mandating MLPE for all building-mounted PV modules. SEIA and other PV industry leaders pushed back during the public comment stage, even going so far as to commission the independent engineering firm DNV GL to study firefighter rooftop operations and hazards encountered while working around PV arrays, and to compare mitigation methods (see Resources).
Unless you actively track the Code development process, you may have missed out on the industry-wide gnashing of teeth regarding the module-level rapid-shutdown language in NEC 2017. The public comments associated with the first draft of section 690.12, “Rapid Shutdown for PV Systems on Buildings,” make for interesting reading because they illustrate the lines of debate and clarify the major concerns on both sides. Excerpts from this debate, edited for length and clarity, follow.
ALL IN FAVOR, SAY AYE
Firefighters are the most vocal advocates of the 80 V limit within the array, undoubtedly because module-level rapid shutdown sounds like it might render an array touch-safe. Not surprisingly, several vendors with module-level rapid-shutdown solutions also support the 80 V limit.
“Representing firefighters, I support the effort to shut down PV systems to the module level during emergencies. The recent proliferation of solar systems in our jurisdiction is having an impact on firefighters’ ability to respond to fire emergencies. Access and egress during rooftop operations and the inability to control utilities for the entire structure are concerns. It is vital that the Code development process recognize the need to protect firefighter safety. This proposal utilizes existing technology to do just that.”
—Richard Doane, fire marshal, Chico Fire-Rescue
“[PV system] circuits remain energized anytime the modules are illuminated and up to the maximum system voltage of 1,000 Vdc. This results in increased danger to first responders when the structure has been damaged. Historically, this has been accepted since there was no practical way to isolate a PV module from the PV source circuit that would operate remotely and on all PV modules in an array simultaneously. Module-level products were not readily available to provide this functionality. Today, this is no longer true: Many reliable products are available that can be either incorporated into a PV module or added to a PV module in the field to provide PV module isolation by remote control. The reliability concerns from 2014 are no longer relevant today, and market data estimates that up to 10 million units capable of module-level isolation are now in service.”
—James Penn, fire inspector, Compton Fire Department
“[The] Fire Marshal’s Association of Colorado supports the language in the first revision as well as the work from the Firefighter Safety and PV System Task Group. PV systems on rooftops can present several hazards to firefighters, the most serious being electric shock in an emergency situation. This section and the proposed change is a significant step forward in improving firefighter safety.”
—David Lowrey, fire marshal, Boulder Fire-Rescue
“[No] other appliance [is] allowed to be used in and around populated areas where there is not a clearly designated switch, plug or other de-energizing method for fully deactivating the system. Why should solar be any different? This industry inconsistency results in an even greater hazard to those untrained in solar, as the default expectation is that all electrical systems can be turned off and are fundamentally safe.”
—Tim Johnson, vice president of customer quality, Ten K Solar
“Enphase Energy supports the language proposed by Code Making Panel-4 [CMP-4], especially the reduced voltage level within an array when initiated by emergency personnel. Rooftop PV arrays should be able to [be] shut down to safe voltage levels in the event of emergency conditions. This is particularly important when considering the life span of a system, as older systems may present electrical hazards to emergency personnel.”
—Mark Baldassari, director of codes and standards, Enphase Energy
ALL OPPOSED, SAY NAY
SEIA and several prominent member solar companies, both small and large, vigorously oppose module-level disconnection as a sole means of reducing shock hazards for emergency responders. Public comments suggest this opposition is not due to an unwillingness to develop and adopt more-rigorous safety standards, but rather due to questions about the efficacy of the 80 V limit as a means of accomplishing these goals.
“SEIA understands and largely agrees with the fire service’s intent to further enhance rapid-shutdown requirements in the 2017 NEC. SEIA disagrees, however, with the specific requirement limits [as] the incorporation of these limits into the NEC would effectively mandate module-level electronics, resulting in a variety of negative consequences.
“SEIA’s strong contention is that, given the absence of any independent technical justification for the proposed module-level electronics mandate, it is inappropriate for the NFPA to set voltage requirements within the array equipment. Indeed, the NFPA would be setting an arbitrary level of safety based solely on statements from a few existing product manufacturers and not fact-based testing involving a wide selection of performance criteria.
“There are multiple approaches to significantly reduce the risk of shock hazard to firefighters operating within the PV array boundary. In contrast, a module-level electronics mandate would favor certain technologies over others. This is an overly prescriptive approach, which will create a disincentive to develop competing technologies and [will] stifle innovation. It should also be recognized that nearly all module-level electronic devices being sold today are principally designed for power conversion and monitoring—not rapid shutdown.
“The long-term reliability of module-level electronics is also relatively unproven. Indeed, few devices currently being sold for module-level rapid shutdown have undergone long-term reliability testing in the field.
“Reliability is not only a concern for firefighters but also for PV service personnel exposed to the inherent hazards of roof work. The concern here is that unreliable rapid-shutdown devices will significantly, and unnecessarily, increase the amount of time PV installers and electricians spend on rooftops to replace or repair failed devices. And while PV installers and electricians recognize and accept the inherent risks of rooftop environments, no one should have to accept unnecessary exposure to such hazards.”
—John Smirnow, principal, Smirnow Law (representing SEIA)
“The current language requires that only the devices controlling conductors inside the array boundary limit the voltage to 80 V. There is no mention of the conditions under which this device must function; no mention of whether the device needs to periodically self-test; no mention of whether it needs to be fail-safe; no mention of immunity to heat, electrical noise or moisture. To be clear, we don’t think that these requirements should be spelled out in the NEC, but they are essential to the safe and reliable operation of these devices. Hence, we request that the 80 V requirement be replaced with a new certification requirement. It is critical that this certification requirement be distinct from the other rapid-shutdown requirement, because it will need to provide functionality that is distinct from [that of] the other devices. The rapid-shutdown devices outside the array boundary only need to isolate certain conductors. The devices inside the array boundary need to limit the electrical hazards on the components directly connected to the PV modules, which are always energized. The present language is also silent about the amperage requirement, which is the physical quantity that actually causes harm to humans. With 80 V and no limit on current, it is still possible to electrocute a human.”
—Mark Albers, electrical systems engineer, SunPower
“While SolarCity supports the fire service in its intent to increase safety within the boundary of the array, the first draft of section 690.12(B)(2) has been written in such a way that effectively prescribes a specific type of electronic solution. [MLPE] are complicated devices, with a wide array of functions, but they were never designed for the sole purpose of ‘turning off’ solar modules. Because of their complexity, these devices cannot last as long as solar panels.
“[It] is important to remember that not a single firefighter has been killed while on a building with solar, suggesting that existing safety provisions for PV have been largely effective. Meanwhile, falls remain the number one cause of death among all construction workers. Mandating one device beneath every solar module will directly increase the time solar construction workers will have to spend on the roof to replace them. More time on the roof [equates to] a higher risk of falling.
“Even when [MLPE] devices work as advertised, the [PV] system is never truly shut down. UL confirmed as recently as June, in its evaluation of firefighter [personal protective equipment], that voltages below 80 V still pose a risk. [Reducing the voltage without eliminating] the hazard gives unsuspecting firefighters a false sense of security that only puts them at risk.”
—Duncan Cleminshaw, director of product compliance, SolarCity
“Representatives of the fire service tell us that they need to quickly ventilate a structure that is on fire, and as a 10-year veteran of the fire service and chief of a rural fire department, I can tell you that they are right. However, the position that vertical ventilation is the best and only way to ventilate, and that the fire service therefore needs full and unlimited access to the roof, does not align with modern fire science. Studies performed by the NIST [National Institute of Standards and Technology] and others have shown that positive-pressure ventilation is more effective than traditional vertical ventilation. According to this research, vertical rooftop ventilation can no longer be considered the gold standard for effective fireground operations.
“Section 690.12 should ensure that a local source of electricity (the PV array) can be easily disconnected from a building electrical system in the event of a fire, and 690.12(B)(1) achieves that goal. Requiring conductors within the array zone to be controlled to 80 V does not provide a touch-safe environment, and there are thousands of legacy PV installations currently installed that are not controlled within the array zone; therefore, 690.12(B)(2) creates a false sense of security for the fire service. Fire operations should not be in the array zone when there are better options.”
—Phil Undercuffler, director of strategic platforms, OutBack Power
The Compromise Solution
As a result of this pushback, CMP-4 developed a second revision of NEC 2017 690.12 that provides three compliance options inside the array boundary, each of which offers a unique set of challenges. The first option is to use a listed rapid-shutdown PV array, which assumes the existence of an as-yet-unwritten UL product safety standard. The second option is to limit the potential of controlled conductors to not more than 80 V. This option assumes that UL fire testing will show that divergent product classes (such as microinverters, ac modules, dc-to-dc converters and smart modules) provide an as-yet-unproven level of shock hazard mitigation under abnormal operating conditions—most important, after a fire has compromised and damaged the PV modules and associated solid-state devices. The third option is to deploy PV arrays with no exposed wires or conductive parts at least 8 feet away from exposed grounded conductive parts, which seems to belong in a product safety standard rather than in the NEC.
While the requirements for what should happen inside the array boundary are contentious, areas of common ground do exist. For example, both fire service and solar industry representatives on CMP-4 seem to agree that the compromise solution is not ideal. A common concern from stakeholders on both sides is whether the three compliance options allowed inside the array boundary provide an equivalent level of safety. Given that no one seems particularly happy with 690.12(B)(2) as written, it seems fortunate that this subsection will likely come with a delayed enforcement date of January 1, 2019. This delay will give UL and its standards technical panel members time to develop a rapid-shutdown PV array product safety standard that meets NEC 2017.
Ultimately, 14 of 17 eligible voters on CMP-4 voted in the affirmative, which suggests that the formally adopted 2017 rapid-shutdown language, due out in October, will adhere closely to the second revision, for better or worse. Bill Brooks, a solar industry representative on CMP-4, voted in favor of the second revision. However, he concedes: “The new version of 690.12 is a significant step in PV system safety that will be difficult for the PV industry to master in the first several years of enforcement.”
Brooks continues, explaining his affirmative vote: “While [compliant] products are commonly available and used in the residential market, the more difficult market is the commercial PV market. In the commercial market, margins are even tighter, and costs and reliability have to be carefully managed. Once these new standards and products become mature, the PV industry and all those whom it affects will have safer and better PV systems. Much work is necessary between now and then.”
Commercialized MLPE are competitive in residential applications. GTM Research data show that in 2014, when US states began adopting rapid-shutdown requirements, the combined market share for module-level solutions—including microinverters, dc optimizers, ac modules and smart modules—already accounted for more than half of the total residential product mix. Since that time, the market share for string inverters has eroded—presumably because more rapid-shutdown markets come on line each year—from 48% in 2014 to 40% in 2015. GTM Research estimates that the residential market share for string inverters could fall to 30% in 2017, which may prove optimistic given that California is now poised to adopt rapid shutdown.
What is less clear is whether commercially available MLPE can have the same success in nonresidential applications. Two charts from the “US Solar Market Insight Report: 2015 Year in Review,” published by GTM Research and SEIA, put the challenge in stark contrast. The first chart compares average system costs by market segment (residential, nonresidential and utility). According to these data, average costs in the residential market segment were roughly $3.50 per watt in both Q4 2014 and Q4 2015, suggesting that it may be difficult for system integrators to drive costs out of residential systems while transitioning from string inverter–based to MLPE-based designs. In contrast, average costs in the nonresidential segment have steadily declined quarter over quarter, from roughly $2.20 per watt in Q4 2014 to about $2.00 per watt in Q4 2015. The gap between $3.50 per watt and holding, and $2.00 per watt and falling, is substantial.
The second chart compares installed PV capacity by market segment over time. These data show that the residential PV market is the fastest-growing market segment in the US, with more than 50% annual growth for 4 years running. By comparison, GTM Research describes the nonresidential solar market as “essentially flat for the third year in a row.” Here again, the gap between these two markets—one growing at a record pace and the other stagnant—is substantial.
When one considers these two data sets side by side, as shown in Figure 2, it seems fair to wonder whether the nonresidential PV market might contract, at least initially, under the cost burden of an MLPE mandate. While that mandate would undoubtedly prove good for some—perhaps paving the way for integrated ac PV modules, smart modules and other junction box– or cell string–level disconnection devices—it could be a net loss for the industry at large, especially for commercial project developers and EPC firms working in states that will adopt NEC 2017 early, such as Massachusetts and Colorado.
Supply bottlenecks are another concern. Today, commercial project developers have access to multiple product lines and vendors. If one of these vendors exits the market (as happened with Advanced Energy) or has supply-chain issues, system integrators can substitute compatible product platforms from other vendors prior to construction or even during operations. Though MLPE vendors have made great strides in recent years, this is nevertheless a relatively immature market, largely populated with vendors who offer mutually exclusive products. Innovation and proprietary interfaces, rather than substitutability and cross-compatibility, characterize the sector.
If an MLPE mandate went into effect today, project developers would likely be forced to either put all of their eggs into one of two baskets—Enphase Energy or SolarEdge (which dominate in terms of market share)—or qualify an alternative solution with a limited track record. This is not a recipe for resilience, but rather a precarious situation susceptible to market distortion. SMA’s partnership with Tigo, which the companies announced in April 2016, suggests that supply chain could be strategically important under an MLPE mandate. In exchange for acquiring a 27% stake in Tigo Energy, SMA obtains exclusive worldwide sales rights, for a period of 30 months, to Tigo’s TS4 R product platform, which is a retrofit solution designed to add MLPE functionality to conventional PV modules.
Many in the industry, myself included, believe that MLPE are inevitable and perhaps necessary in the long term. In spite of the technological hurdles, the vendors pioneering this space have largely proven their doubters and naysayers wrong. If we could fast-forward into the future, we would likely see that module-level and perhaps even cell string–level power electronics will prove the norm, perhaps sooner rather than later. Some industry experts even predict the eventual rise of cell-level power electronics. While today’s products work well, tomorrow’s more advanced products will work even better and more reliably.
What remains to be proven is whether MLPE are the most effective way to reduce shock hazards for emergency responders within the array boundary. Do MLPE perform better in this regard than other hazard mitigation methods? While solar and fire service stakeholders agree that rapid shutdown outside the array boundary reduces risks for firefighters, initial fire research and engineering evaluations suggest that current product safety standards do not eliminate shock hazards within a damaged PV array.
Fire research. In 2011, UL conducted the first experimental investigation of the impact fielded PV systems have on fire suppression, ventilation and overhaul activities. UL’s research engineers started by reviewing the literature and standards associated with electric shock, impedance of the human body, touch-safe voltage levels, and safe distances between water hoses and live electrical equipment. They then developed electrical and fire performance experiments that would identify and quantify the electrical shock hazard associated with specific PV-involved firefighting scenarios. UL published its findings in the report “Firefighter Safety and Photovoltaic Installations Research Project” (see Resources).
In addition to testing equipment such as firefighter gloves and boots for their insulating properties, the research engineers also sought to define safe working distances between water hoses and live electrical equipment. These tests indicate, for example, that firefighters can eliminate hose stream shock hazard by working at a distance of 15 feet from a 600 Vdc power source or 20 feet from a 1,000 Vdc source. Alternately, firefighters can reduce the measured current to below the level of perceptibility by changing the hose stream from a solid stream to a 10° cone pattern. Other tests confirmed that tarps are not reliably effective as a means of de-energizing a PV array, that light striking a PV array from a fire or a fire truck is sufficient to pose an electrical hazard, and that cutting into PV modules or source circuits is a bad idea. This is all very practical information for firefighter training purposes.
Perhaps the most important UL fire test results are those showing that damaged PV arrays are inherently hazardous. For these experiments, researchers installed test arrays on a wood truss roof, ignited a fuel load inside the structure and then let the fires burn uncontrolled until the roof collapsed. The post-fire analyses revealed that while some portions of the arrays were completely destroyed and produced no power, other significantly damaged areas still produced partial or even full power. Based on these findings, the report concludes, among other things: “Severely damaged PV arrays are capable of producing hazardous conditions ranging from perception [of current] to electrocution. Damage to the array can create new and unexpected circuit paths.”
Unless follow-up fire research shows otherwise, it would be irresponsible to bet any lives on the premise that the presence of MLPE would change these findings in any meaningful way. According to UL standards, the safe voltage level in wet conditions is 30 V. In the absence of cell string–level disconnects, most PV modules are capable of putting out more than 30 V under normal operating conditions. Since module-level or cell string–level rapid shutdown does not change the inherent properties of PV cells, it is prudent for emergency responders to assume that a fire-damaged array presents a shock hazard due to the potential for inadvertent and unexpected circuit paths.
Engineering evaluation. The authors of DNV GL’s 2015 advisory, “Rooftop PV Systems and Firefighter Safety,” start by reviewing relevant literature, such as UL’s 2011 fire research findings and a joint PV and fire industry study conducted in Germany. Interestingly, the outcome of the joint industry analysis in Germany, the country with the largest number of rooftop PV installations in the world, was a set of firefighting guidelines that emphasize safe boundaries and tactics. Because module-level technologies and standards are not sufficiently established and have yet to prove their reliability, the German report advises against a MLPE mandate.
After a literature review, DNV GL researchers conducted firefighter interviews and surveys to explore the “procedures, issues and decisions that firefighters face when carrying out operations at a building that has rooftop PV.” The interviews indicate that firefighters welcome the improved setback and pathway requirements in the 2015 fire codes, but still see some room for improvement. With a building-specific approach to pathway layout, for example, AHJs could intentionally align access pathways with the best trench-cut locations for firefighters.
The surveys, meanwhile, indicate that firefighters are indeed very concerned about the inability to eliminate or significantly reduce shock hazard in the PV array. In the short term, they need to be able to identify energized versus de-energized components. On the face of it, this sounds like a collective vote in favor of module-level rapid shutdown. However, the vast majority of interviewees—and all of those in leadership roles—indicated that they would never directly engage with or remove damaged modules for roof ventilation.
According to the report: “Respondents expressed the desire for rapid-shutdown functions to work under damaged conditions, but none expected that they would. All would treat damaged arrays as energized.” The authors later conclude: “The ability to further de-energize circuits within the array is seen as a key to reducing the risk of accidental shock, but not as a rationale for intentional interaction. The real value of enhanced electrical protection is in its impact on decision making, enabling firefighters to carry out and improve operations more confidently.”
Researchers at DNV GL used an engineering evaluation methodology, known as a failure mode and effects analysis, to estimate the risks associated with different electrical hazard mitigation approaches. This methodology accounts for circumstances such as the severity of impact and the likelihood of occurrence and detection. The researchers then characterized the risks associated with different applications and scenarios (residential, normal operation; residential, single fault; commercial, normal operation; and commercial, single fault) in the context of different product topologies or design decisions. These probability-weighted results indicated that there are multiple acceptable risk mitigation options, including module-level shutdown with an 80 V limit, as well as “combinations of 1- and 2-pole string level disconnection, access-limited conductors [and] mechanically protected conductors.” All of these approaches “scored similarly as effective means to reduce the shock hazard within arrays.”
Rapid shutdown array standard. The DNV GL advisory largely supports SEIA’s contention that a prudent approach would be to develop a product standard for PV Equipment Safe for Proximity Firefighting. According to their public comments, some members of CMP-4 believe that rapid-shutdown PV array and PV equipment safe for proximity firefighting can mean the same thing. The safety standard is a work in progress, they suggest, and a rose by any other name would smell the same. In this case, however, the meaning of these words could be a matter of grave import.
To the uninitiated firefighter, equipment safe for proximity firefighting signals: “You can get close to this equipment, but not too close. Please do not touch.” In contrast, module-level rapid shutdown sends a misleading message: “I am now off.” While a touch-safe PV array is undoubtedly the long-term goal, we do not yet have a product safety standard that can render a damaged PV array safe for firefighters. Granted, we can make the roof safer with the touch of a button, but that does not mean the power is off.
Not surprisingly, UL’s representative on CMP-4, Timothy Zgonena, is going into the standards development process with his eyes wide open. Regarding his affirmative vote for the compromise NEC 2017 rapid-shutdown language, Zgonena comments: “UL understands the desired intention of the 80 V limit to reduce shock hazards. Unfortunately, 80 V can be a lethal electric shock hazard in this application. Further, it would be most appropriate to use a listed system consistent with the concept of 690.4(B) to limit the voltage, rather than some assemblage of equipment not specifically listed as a system. UL firmly believes that PV rapid-shutdown equipment specifically listed for this intended purpose is the best solution. We have made good progress since the first revision of 690.12 for the 2017 NEC. UL understands and supports the development of a science-based solution as the basis for the upcoming standard.”
David Brearley / SolarPro / Ashland, OR / solarprofessional.com
Backstrom, Robert, and David Dini, “Firefighter Safety and Photovoltaic Installations Research Project,” UL Report, November 2011
DNV GL, “Rooftop PV Systems and Firefighter Safety,” DNV GL Renewables Advisory, October 2015