Rapid Shutdown: Why a Live Roof Is the Problem

A photovoltaic module has no off switch. It generates whenever light falls on it, and that remains true when the building is disconnected, when the inverter is off, and when the utility supply has failed.

Everything about rapid shutdown follows from that one property.

The Hazard

A conventional electrical disconnect isolates a circuit from its source. Open it and the conductors downstream are dead.

A PV array inverts that relationship. The modules are the source and they are on the roof, and they cannot be switched off. Opening a disconnect at the inverter stops current flowing toward the building, while the conductors between the modules and that disconnect remain a live hazard energised by the modules themselves. Only a qualified electrician should work anywhere near them.

For a firefighter cutting through a roof, or anyone working on a structure during an incident, that means live conductors in an environment where equipment is being cut, water is being applied, and the array cannot be seen under smoke.

DC also behaves differently from AC in a fault. An AC arc extinguishes naturally at each zero crossing; a DC arc has no zero crossing and can sustain itself. See arc fault protection.

What the Requirement Does

The requirement, found in the electrical code, establishes a boundary around the array and states that conductors outside that boundary must be brought to a limited voltage within a short period after shutdown is initiated.

The specific values matter and they are the part this page deliberately does not state. The boundary distance, the voltage limit, and the time allowed are defined in the code edition the jurisdiction has adopted, and they have changed between editions. A figure quoted generally is as likely to be from a superseded edition as from the one that applies.

Later editions have extended the concept to conductors inside the boundary as well, which is what drove the shift toward module-level shutdown capability.

How It Is Implemented

The common pattern is a permission signal: the devices pass voltage only while they receive it, so losing power, losing the signal, or pressing the initiator all cause them to stop. That fail-safe direction is deliberate, because the hazard exists precisely when things have gone wrong.

The Initiator

Somewhere accessible there is a means of initiating shutdown, labelled so that emergency responders can find and use it without knowing the system.

Labelling and placement are part of the requirement rather than an afterthought. A shutdown facility that cannot be located under pressure is not providing what it was fitted for.

Nuisance and Maintenance

Module-level shutdown devices are components on a roof, exposed to weather and heat for the life of the array, and they are one more thing that can fail.

A failed device typically takes its module out of production, which presents as unexplained underperformance rather than as an obvious fault. That is one of several reasons monitoring at module level is useful on systems that have it; see monitoring.

Testing and Commissioning

Rapid shutdown equipment is tested at commissioning, and that test is worth being present for or asking about in writing.

The test establishes that initiating shutdown does what the design says: that the devices stop passing voltage, that the voltage outside the boundary falls within the time the code allows, and that the initiator is where the documentation says it is.

Equipment that is never tested is equipment nobody knows the state of. Because the shutdown path is a fail-safe that operates on loss of signal, it can sit unexercised for years, and a fault in it produces no symptom during normal operation.

Some monitoring platforms report the state of module-level devices, which turns a silent failure into a visible one. Where that capability exists it is worth having configured rather than left at defaults.

Retrofits and Older Systems

A system installed before the current requirements applied is generally not obliged to be brought up to them, though a substantial modification can trigger compliance under the rules the jurisdiction applies.

Where an older string system is being extended, or its inverter replaced, that is the moment the question arises. It is better answered before the work is quoted than after.

Retrofit shutdown devices exist for string systems and are fitted at each module, which means roof access across the whole array. That is a meaningful piece of work, and it argues for settling the question at the point any other roof work is planned.

What People Get Wrong About This

The first mistake is believing the array is safe once the inverter is off. The modules are the source and they are still generating.

The second is quoting figures from an older code edition. The voltage, timing and boundary have changed, and jurisdictions adopt editions at different times.

A third is assuming a ground-mounted array away from buildings has the same requirements as a rooftop one. It is treated differently, and the reason is the hazard being addressed.

A fourth is treating the labelling as paperwork. The initiator exists to be found by someone who has never seen the building.

And the last is assuming one product satisfies the requirement everywhere. Compliance is determined by what the jurisdiction has adopted and by the authority having jurisdiction.

For a Specific Project

Ask which code edition applies where the system is being installed, how the design satisfies the requirement, where the initiator will be located, and what the labelling will say.

Those four questions have concrete answers, and an installer working in the jurisdiction will have them. Nothing here substitutes for the adopted code or for the authority having jurisdiction.