galderdi wrote: To protect the occupants from electric shock am I better off-
A) Connecting the earth side of the high voltage to the chassis and relying on the fuse blowing before the occupants happen to touch the chassis or
B) not connecting the high voltage to the chassis at all and then having a relay connected to the chassis that would trip if it sensed any significant voltage thus disconnecting the high voltage crcuit.
NCOP14 requires B:
viewtopic.php?title=ncop-14-29-chassis-leakage&t=2619
If you connect one end of the pack to the chassis, then almost any accidental connection from a cable to chassis will result in an arc, heat, bright light, UV light, metal snot, and probably a blown fuse and loss of traction. An accidental touch of the other end of the pack will result in a nasty shock, perhaps death.
By contrast, if you get one such failure with an isolated system, there is none of this, and the vehicle continues to work. An accidental touch to either end (before the insulation failure), then there is likely only a very slight shock, almost certainly not fatal. The insulation monitoring system should detect the fault (perhaps only at next start), and should issue a warning. If you ignore the warning, then the next accidental connection will likely result in the arc and all the attendant excitement, and any accidental touch will result in the painful shock. But then you will be stupid for having ignored the warning.
What have other people done to protect the occupants?
Mexy, our red MX-5, with a 720 V pack, has a fully floating pack as required, and there is an insulation monitoring capability built into a part of our battery monitoring system. There are two "IMUs" (Insulation Monitoring Units), one for each half of the pack. That was mainly because we started off with the two half-packs in parallel (360 V), and wanted to switch to both half packs in series (720 V, as it now stands). All the IMUs do is switch a 100kR 7W resistor in series with an opto-isolator between one end of the pack and ground. The opto isolator effectively measures the current; if there is enough current to make the phototransistor conduct, then the test has failed. You always need two tests (so two resistors, relays, and optos in our case), because no matter where you do the test, if the leakage / short happens to be there, you won't detect it. The test position is a sort of blind spot for the insulation tester. So you test one end of the pack, disconnect, then test the other end. This all takes a fraction of a second, and is built into the delay whenever the key-switch comes on.
viewtopic.php?title=weber-and-coulombs- ... 111#p48111
[ Edit: I forgot, this capability is also built into our latest BMS master, which we call a BMU (Battery Master Unit). ]

Nissan Leaf 2012 with new battery May 2019.
5650 W solar, 2xPIP-4048MS inverters, 16 kWh battery.
1.4 kW solar with 1.2 kW Latronics inverter and FIT.
160 W solar, 2.5 kWh 24 V battery for lights.
Patching PIP-4048/5048 inverter-chargers.