Electric shock during inverter maintenance

During intrusive maintenance in the direct current (DC) compartment of a battery energy storage system (BESS) inverter, an engineer received a DC electric shock.

The equipment had been locally isolated and proved dead before work began, but the battery DC supply route had not been isolated and locked off at the battery containers in accordance with the maintenance procedure.

While the work was underway, a site demand command was issued for other operational equipment on site.

This caused the battery DC breakers to close, restoring the DC supply to the section of the inverter being worked on and creating the conditions for the shock.

The engineer remained conscious, alert and responsive. Precautionary medical advice and a hospital assessment were obtained, and no physical injury was reported.

All site activities were suspended, additional isolation of the battery containers was carried out, and a full investigation followed.

Local isolation of the inverter was mistaken for full isolation of the system. The battery DC supply remained a live route back into the equipment and was not identified, communicated or controlled.

The pre-task discussion did not fully establish or communicate that the work involved intrusive access to the DC compartment and proximity to DC busbars.

The single-line diagram showed multiple routes of energy into the inverter, but the local inverter DC isolator alone did not remove all sources of energy.

Commissioning and testing activity was taking place on other equipment at the same time. The interaction was not formally reassessed, and the permit, method statement and risk assessment were not amended before the site demand command was issued.

Opportunities to challenge assumptions were missed, including confirming the exact scope, verifying every possible energy source and questioning whether other site activity could re-energise the isolated equipment.

The approved procedure required manual battery isolation, lock-out/tag-out, verification and key handover. These steps were not fully carried out.

Before intrusive DC-side work, identify every possible source of energy using the single-line diagram and manufacturer documentation, not just the local isolator.

Fully implement the approved procedure, including manual battery isolation, lock-out/tag-out, isolation verification and key handover, before work begins.

Attach an isolation verification sheet to each permit to work involving electrical isolation, with the full sequence completed, verified and countersigned.

Treat changes in site activity, including commissioning, testing or operational demand commands, as a trigger for a formal simultaneous operations (SIMOPS) reassessment before work continues.

Independently verify all required isolations and ensure everyone understands the exact work scope through toolbox talks and permit briefings.

Verify isolation and SIMOPS controls during site inspections. Stop work whenever uncertainty exists about the scope, isolation status or interaction with other activities.

If an electric shock occurs, stop work, make the area safe, raise the alarm, report the shock, arrange accompanied medical assessment, preserve the scene and do not re-energise until the cause is understood and controls are restored.

How can something like this happen here, for example on our site?

What safety measures, procedures and controls do we have in place to identify and isolate every possible source of electrical energy?

How do we verify that battery isolation, lock-out/tag-out and zero-energy checks have been completed before intrusive DC-side work begins?

How do changes in commissioning, testing or operational activity trigger a formal SIMOPS reassessment before work continues?

What should we improve in our permits, briefings, verification sheets or site inspections to prevent equipment being re-energised during maintenance?