What happens when rooftop PV fire prevention fails?

Better components, installation and monitoring reduce the chance of a rooftop PV fire, but they cannot eliminate it. Olivier Langejan applies five established risk models to one question: if ignition still occurs above a combustible roof, what must the roof itself achieve?

By Olivier Langejan
Architectural and building engineering background | AllShield

I am commercially involved with AllShield, developer of BarrierSheet. The analysis below is product-neutral. Where a product is discussed in the full paper, it is identified explicitly and assessed within the boundaries of its test evidence.

Prevention reduces the chance of fire. It does not remove it.

Rooftop PV fire safety rightly begins with prevention: component quality, correct installation, inspection, monitoring and electrical protection. Nothing in this analysis reduces the importance of those measures.

But prevention has a limit. FM research shows that better products, design, installation and maintenance reduce the likelihood of ignition but cannot eliminate it. The same research shows that PV modules change the fire itself: flames are constrained closer to the roof surface, increasing radiative and convective heat transfer to the roof below.

Incident data points in the same direction. QBE European Operations reported 212 solar-panel-related fires in the UK in 2025, compared with 91 in 2022. More relevant for asset protection, the number of fires reported as spreading beyond the PV installation rose from 33 to 88 over the same period.

The question I examined

My question starts one step after prevention: if PV is installed above combustible roof construction, what must the roof-PV design achieve to limit escalation if ignition still occurs?

That is a different risk question. A measure that reduces the probability of ignition does not necessarily limit the consequences once ignition has occurred. To test this, I applied five established fire-safety and risk-engineering frameworks to the same scenario. They were chosen precisely because they look at risk through different lenses: a fire-safety concepts tree, a barrier model, a forward sequence, a backward causal analysis and a protection architecture.

Five frameworks, one direction

The five frameworks differ in purpose, method and terminology. None of them prescribes a product, and none of them proves that a particular material performs. Yet applied to the same narrowly defined scenario, they converge on the same asset-protection principle: do not leave an uninterrupted physical fire path from the PV fire into the building.

The incident chain

To make that principle practical, I use a simplified escalation sequence:

Electrical fault → ignition → PV fire → roof involvement → propagation through the roof build-up → involvement of deeper layers → internal building fire

Not every incident passes through every stage, and the chain is not a prediction of how each fire develops. It shows something more useful: every safeguard has a point of influence. Connector quality, electrical design and installation act mainly before ignition. Once a physical fire exists, they can no longer determine whether the roof becomes involved.

Shutdown is a good example. Electrical isolation can work correctly while material that has already ignited continues to burn and expose the roof to heat and flame. Isolation is not extinguishment.

This leads to the central principle of the paper:

A downstream consequence cannot be managed solely by an upstream control once the incident has already passed that control's point of influence.

Why the roof belongs in the fire strategy

Once a fire develops beneath a PV array, the roof is the physical pathway between the fire above and the building below. That makes the roof build-up part of consequence management, even when the initiating fault is electrical.

Defense in Depth adds a second argument. Most preventive and active controls share dependencies on competent installation, timely detection, power, software or human response. A passive physical layer has its own design and installation dependencies, but at the moment of fire exposure it does not need power, communication or anyone to act. Layers with different functions and different dependencies are less likely to fail in the same way.

From risk logic to a design requirement

Combined with current guidance, the analysis supports a product-neutral specification principle:

For PV installed above combustible roof construction, provide an evidenced consequence-limiting roof-PV strategy that prevents or interrupts downward fire propagation into combustible layers and is validated for the intended roof-PV assembly.

The wording deliberately describes a function, not a material. The complete assembly, interfaces, attachments, penetrations and PV configuration all remain relevant.

New roofs and existing roofs are different problems

For new construction, a roof build-up based on non-combustible insulation is the most direct route where it is practical. It is also the primary recommendation in the 2026 ZAG Fire Safety Guideline for PV on flat roofs.

Existing lightweight industrial roofs are a different case. Structural reserve is a finite budget, and replacing combustible insulation with a much heavier non-combustible build-up can consume the capacity needed for the PV itself or trigger structural strengthening. In those cases the right question is not whether a lighter alternative is "the same as" non-combustible insulation. The question is whether that alternative demonstrates the required consequence-limiting function. ZAG states that such solutions should show similar robustness in tests of the complete roof segment with several PV modules.

What the risk models do not prove

The models establish why consequence limitation belongs in the design. They do not prove that any single product is sufficient, that combustible insulation becomes safe in every configuration, or that prevention can be reduced. Penetrations, rooflights, edges and other details can create separate fire pathways. Test results and approvals apply only within their stated field of application.

The models define what the roof must do. Fire testing of the complete assembly determines whether a specific roof actually does it.

Read the full whitepaper

The full paper applies each framework in detail and sets out the current evidence from FM, ZAG, Kiwa and Efectis. It also examines BarrierSheet as one evidenced implementation and discusses the boundaries of that evidence.

📄 Download the full whitepaper (PDF)

About the author
Olivier Langejan has an architectural and building engineering background and has been directly involved in developing and supervising fire-test programmes for commercial roof assemblies and rooftop PV systems. His whitepapers examine rooftop PV from the perspective of the complete roof system: structure, build-up, fire behaviour, insurability and economics.