Rapid Shutdown Devices: Why Doesn't Switching Off the Inverter Make a Roof Safe?
Published by Quinn Lai | By InverPower Technical Team
Published 22 August 2026 · Last updated 22 August 2026
DIRECT ANSWER
An inverter switch stops the array delivering power; it does not stop the modules producing voltage. In daylight the DC conductors on the roof stay live at string voltage. A module-level rapid shutdown device breaks that at each module on command, dropping the conductors to a low voltage within a defined time.
Ask a building owner what happens when they turn the solar off and most will say the roof goes dead. It does not. The inverter stops, the AC side stops, and every module on the roof carries on making voltage for as long as there is light on it. Anyone who has to be up there — a maintenance team, a roofer, the fire service — is working around a live DC system.
What is actually live after shutdown?
A module produces its open-circuit voltage whenever it is illuminated. Modules in a string add, so a conventional string sits at several hundred volts DC along its whole length, from the first module to the inverter's input terminals. Opening the DC isolator at the inverter removes the voltage downstream of it, and leaves everything upstream — every conductor on the roof — exactly as it was.
Direct current at that level does not let go the way alternating current does, and there is no zero crossing to break an arc. That is why a roof with a conventional array is treated as a live electrical installation until darkness, and why the fire service's default answer to a burning building with rooftop solar has historically been caution rather than access.
Held open by a signal
A rapid shutdown device sits between the module and the string, one per module or one per pair. In normal operation it passes power through and reports back. It is held open — that is, held in the conducting state — by a keep-alive signal from a transmitter at the inverter or the combiner. When that signal stops, whether because someone pressed the initiator, because the AC supply was cut, or because a cable was damaged, every device on the roof opens and the conductors drop to a low voltage within the time the standard allows.
The design consequence is that the fail-safe is the absence of a signal, not the presence of one. A device that needs a command to shut down would be useless in the case that matters most, which is the case where the building's wiring is already damaged.
MLPE is a family, not a feature
Module-level power electronics covers several products that get treated as interchangeable and are not. An optimiser exists to manage mismatch and shading; a microinverter converts at the module; a rapid shutdown device exists to de-energise. Some optimisers and microinverters also provide shutdown functionality, and some do not. The only reliable way to know is the certification, not the category name.
| Device | Primary purpose | Provides shutdown? |
|---|---|---|
| Rapid shutdown device | De-energise rooftop DC conductors on command | Yes, it is the whole function |
| Power optimiser | Per-module tracking, mismatch and shading | Only where certified for it |
| Microinverter | Convert to AC at the module | Inherently — no rooftop DC string |
| Module-level monitoring | Per-module performance data | No |
| String inverter DC switch | Isolate the inverter's input | No — the roof stays live |
| Arc-fault detection | Detect a developing arc in service | No |
The buildings that justify it
There is no blanket statutory requirement here in the way there is in some markets, so the decision is usually made on the building rather than on the code — and where a requirement does apply to a particular building type or authority, confirm it for that project rather than assuming either way. The buildings where it is worth specifying without being asked are consistent: occupied premises with people below the roof, warehouses storing anything combustible, plants where the roof is walked regularly for other services, schools and healthcare buildings, and anywhere the fire service would need to work on or near the array.
It also changes the maintenance conversation. A roof that can be de-energised on demand is a roof where cleaning, thermographic inspection and cable repairs can be scheduled as ordinary work rather than planned around daylight. On a large C&I site that is an operational saving that outlives the safety argument.
Specifying and commissioning it
Match the device to the module's short-circuit current and open-circuit voltage with margin, check the ingress protection and operating temperature against a rooftop that will sit well above ambient, and confirm compatibility with the inverter or transmitter being used. Then plan the physical detail: where the initiator goes so it can be reached from ground level, how the array is labelled so an incoming crew knows what they are looking at, and where the devices are recorded on the single-line.
Commissioning is a test, not a tick. Trigger the shutdown, measure the conductors, record the result and the time taken, and hand that record over with the rest of the pack. InverPower distributes AndSolar module-level and rapid shutdown devices in Malaysia alongside the inverters, connectors and cable — send the array layout and the module datasheet and we will tell you what pairs and what is in stock.
Frequently Asked Questions
Is rapid shutdown a legal requirement in Malaysia?
It is not a blanket statutory requirement in the way it is in some other markets, and the position can differ by building type and authority. Confirm the requirement for the specific project. Plenty of buildings justify it on risk alone — occupancy under the roof, combustible storage, or regular roof access.
How quickly does a rapid shutdown device de-energise the array?
Within the time limit set by the standard the device is certified to, which is a matter of seconds rather than minutes. The figure to quote on a project is the one in the manufacturer's certification for the model supplied, and it should be verified by measurement at commissioning.
Does an optimiser give the same protection?
Not automatically. Optimisers exist to manage mismatch and shading, and only some are certified to provide shutdown functionality. Read the certification for the specific model rather than assuming that module-level electronics implies module-level shutdown.
Can rapid shutdown be retrofitted to an existing array?
Yes, module-level devices can be added to an installed array, since they connect between the module and the string. The work involves handling every module's connections, so it is best combined with other planned roof work, and the array's documentation has to be updated to reflect what is now installed.
Sources
- AndSolar — module-level rapid shutdown device datasheets and installation manuals (ratings, shutdown time, transmitter compatibility) — https://www.andsolar.com
- IEC — IEC 62548, Photovoltaic (PV) arrays: design requirements, including array safety and disconnection — https://webstore.iec.ch
- IEC — IEC 62109-1 and IEC 62109-2, Safety of power converters for use in photovoltaic power systems — https://webstore.iec.ch
- Department of Standards Malaysia — MS 1837:2018, Installation of grid-connected photovoltaic (PV) system — https://www.jsm.gov.my
- Electricity Supply Act 1990 (Act 447) and the Electricity Regulations 1994 — competent person duties at commissioning — https://lom.agc.gov.my
About InverPower
InverPower is Malaysia's A–Z solar component distributor — Sungrow Preferred Distributor and Sunkean Sole Distributor — supplying EPCCs, installers, and government projects nationwide.
Explore the InverPower resource hub at inverpower.com.my
Related InverPower posts:
- String Inverters vs MLPE: How to Decide for Malaysian C&I?
- DC Isolators and Disconnect Switches: What Does Malaysian Code Require?
- MC4 vs "MC4-Compatible": Why Is Cross-Mating a Fire Risk?
