What Happens If a Rapid Shutdown Device Fails in the ON Position?

A rapid shutdown device (RSD) is designed to do one thing: when an emergency occurs—whether a fire, a maintenance operation, or a system fault—it disconnects the module and drops rooftop conductor voltage to safe levels within seconds. The National Electrical Code requires that PV conductors be reduced to 30V or less within 30 seconds of shutdown initiation.

But what happens when the safety device itself fails—specifically, when it gets stuck in the ON position and refuses to shut down?

This is not a theoretical concern. Failing RSDs have been linked to more than 74 high-risk reliability issues and thermal damage events since 2021, and 21 rooftop fires during that period were caused by RSD failures. Paradoxically, these safety devices have become the cause of commercial rooftop PV system fires known to HelioVolta, an independent renewable field inspection firm.

This article examines what happens when an RSD fails in the ON position, why it happens, how to detect it, and what to do about it.

The Immediate Consequence – Loss of Shutdown Capability

When you press the shutdown button or activate the rapid shutdown initiation device, the system sends a signal to every RSD on the roof. In a properly functioning system, each device receives that command and opens its internal contacts, dropping the module output voltage to a safe level.

But if an RSD is stuck in the ON position, that device simply doesn't respond. The shutdown signal is sent, but the faulty RSD ignores it. The module connected to that RSD continues to output full DC voltage—potentially up to 1500V DC in commercial systems—while every other module on the array has been de-energized.

What the Inverter Shows

Depending on the system design, the inverter display may show:

• Communication-based systems: The inverter may display “RSD communication normal” because the device is still responding to heartbeat signals—it just isn't executing the shutdown command. This creates a dangerous false sense of security.

• Systems without shutdown verification: Many basic RSD systems can only detect communication loss, not whether the shutdown command was actually executed.

The key point: a device that communicates normally is not necessarily a device that shuts down properly.

The Safety Risk – Hazard for Firefighters and Maintenance

The most serious consequence of an RSD stuck in the ON position is the safety risk it creates for first responders and maintenance personnel.

The Rooftop Scenario

Imagine a rooftop fire. Firefighters arrive, locate the rapid shutdown initiation device, and activate it. They wait the required 30 seconds, assume the array is de-energized, and begin their work on the roof.

If one RSD is stuck in the ON position, that specific module's connectors and cables may still be carrying hazardous DC voltage—up to 1500V in commercial systems. Firefighters, working in smoke and low visibility, may cut or contact those energized conductors, creating an extreme electrocution hazard.

As one industry expert notes: “Firefighters presume that the array is actually de-energized, so if this doesn’t happen, the risk might even be greater than it would be without the shutdown procedure at all.”

Code Compliance Issue

NEC 690.12 requires that controlled conductors outside the array boundary be reduced to not more than 30 volts within 30 seconds of rapid shutdown initiation. Inside the array boundary, the limit is 80V within 30 seconds.

A single RSD stuck in the ON position means the entire system fails this requirement. The system is non-compliant, and more importantly, it presents a real and present danger to anyone who assumes the array is safe.

Why Do RSDs Fail in the ON Position?

RSDs can fail in the ON position through several mechanisms:

Mechanical Welding of Contacts

If an RSD is forced to interrupt current under load—particularly during a fault condition or an emergency shutdown while the module is producing full power—the internal contacts can arc. DC arcs are especially dangerous because they have no natural zero-crossing point; once initiated, they can sustain themselves indefinitely, generating temperatures exceeding 3,000°C.

This extreme heat can melt and weld the contact surfaces together. Once welded, no amount of signal or spring force can separate them.

Contactor Spring Failure

RSDs rely on spring mechanisms to pull contacts apart when the shutdown signal is received. Over time, these springs can lose their tension due to:

• Thermal cycling

• Mechanical fatigue from repeated operation

• Corrosion or contamination inside the sealed enclosure

When the spring force drops below the force required to separate welded or stuck contacts, the device remains closed.

Control Circuit Failure

The receiver circuit inside the RSD—which listens for the shutdown signal—can fail due to:

• Power surges or lightning strikes

• Component aging

• Moisture ingress damaging the electronics

When the control circuit fails, the device may remain in its last state (ON) and never receive or process the shutdown command.

How to Detect a Stuck-ON RSD

Detecting an RSD stuck in the ON position requires active testing—it cannot be reliably detected through passive monitoring alone.

Manual Voltage Testing

The most reliable method is direct measurement:

1. Activate the rapid shutdown function.

2. Wait the required 30 seconds.

3. Using a non-contact voltage detector or a multimeter rated for the system voltage, measure each module's output voltage at the connector level.

4. If any module still shows voltage while others are at zero, its RSD is likely stuck in the ON position.

Thermal Imaging

During normal operation, all RSDs run warm. But during a shutdown test:

• Functioning RSDs cool down as they stop conducting current.

• A stuck-ON RSD continues to conduct and will remain warm—or even heat up—while others cool.

This thermal difference can be detected with an infrared camera during a shutdown test.

Monitoring Systems with Shutdown Verification

Some advanced RSDs include a shutdown verification feature. These devices report back to the monitoring system whether they have successfully opened. If the system sends a shutdown command but does not receive confirmation from a specific device, it can raise an alert.

However, not all monitoring systems have this capability. Many can only report communication status, not actual switch position. Communication is not the same as verification.

What to Do When You Find a Stuck-ON RSD

Discovering an RSD stuck in the ON position requires immediate, careful action.

Immediate Actions

1. Mark the affected string clearly with warning tape or signage.

2. Notify all personnel working on or near the system.

3. Do not assume the array is safe—treat the affected module as fully energized.

Safe Removal

The only safe way to replace a stuck-ON RSD is to eliminate the DC voltage source:

• Option 1: Perform the replacement at night when the module is not producing power.

• Option 2: Disconnect the entire string at the combiner box before approaching the module.

• Option 3: If the system design allows, cover the module with an opaque tarp to block sunlight.

Do Not Attempt to Repair

RSDs are sealed, non-serviceable devices. There are no field-replaceable parts inside. Attempting to open or repair a faulty RSD:

• Voids the UL listing

• Creates additional arc flash and shock hazards

• Almost certainly damages the device beyond any hope of function

Replace, don't repair.

Preventive Measures – How to Reduce the Risk

Prevention is far better than detection when it comes to RSD failures.

Select High-Quality Devices

Choose RSDs with high electrical life ratings and proven reliability. Look for:

• UL 1741 and UL 98B certification

• High DC switching cycle ratings

• Sealed, weather-resistant enclosures

Regular Shutdown Testing

Periodic functional testing is the only reliable way to catch stuck-ON failures before an emergency. Recommendations include:

• Quarterly tests for commercial systems

• Monthly tests for critical infrastructure or high-risk installations

Each test should include:

1. Activating the shutdown

2. Verifying voltage drop with a meter

3. Confirming all modules are de-energized

Proper Installation

Most RSD failures trace back to installation issues. Follow these best practices:

• Use a calibrated torque tool for every terminal connection—do not rely on “feel”

• Follow manufacturer torque specifications

• Re-torque all connections 3 months after installation to account for thermal cycling loosening

• Ensure all connectors are properly seated and sealed against moisture

Select RSDs with Self-Diagnostic Features

Some premium RSDs offer built-in diagnostic capabilities:

• Shutdown verification feedback—the device reports whether it successfully opened

• Real-time status monitoring—temperature, voltage, and current data transmitted to the monitoring platform

• Failure pre-detection—alerts when parameters drift outside normal ranges

These features don't prevent failure, but they enable early detection before an emergency reveals the problem.

Frequently Asked Questions (FAQ)

Q1: Can a rapid shutdown device fail in the OFF position?

A: Yes, and it's actually more common. But failing in the OFF position means the system simply doesn't produce power—it's a nuisance, not a safety hazard. Failing in the ON position is far more dangerous because it creates the illusion that the system is safely shut down when it is not.

Q2: Will the inverter detect a stuck-ON RSD?

A: It depends on the system. Many basic systems can only detect communication loss, not whether the shutdown command was actually executed. If the device is still communicating but ignoring the shutdown command, the inverter may show everything as normal. Only systems with shutdown verification feedback can detect this failure mode.

Q3: Are there RSDs with self-diagnostic features for this failure mode?

A: Yes. Some manufacturers offer RSDs with integrated monitoring that can detect and report shutdown verification status. These devices send confirmation when they successfully open, and the system raises an alert if confirmation is not received. When shopping for RSDs, look for models that explicitly advertise “shutdown verification” or “status feedback” capabilities.

Q4: How often should I test my rapid shutdown system?

A: Industry best practice recommends quarterly functional tests for commercial systems. Each test should include physical voltage verification at the module level, not just a check of the initiation device.

Q5: What's the difference between a rapid shutdown device and a disconnect switch?

A: A disconnect switch is a manual device that an operator physically throws to open the circuit. An RSD is an automatic, electronically controlled device that responds to a signal. RSDs are typically installed at the module level, while disconnects are usually at the array or system level. RSDs are required by NEC 690.12 for building-mounted systems.

Summary & Next Steps

An RSD stuck in the ON position is one of the most dangerous failure modes in a PV system because:

1. It's invisible—the device may still communicate normally

2. It creates a false sense of safety—everyone assumes the array is de-energized

3. It puts lives at risk—firefighters and maintenance personnel can be exposed to lethal DC voltage

The only reliable way to detect this failure is regular, physical testing—activate the shutdown and verify with a voltage meter that every module is truly de-energized.

Don't trust communication alone. Don't assume the system is safe. Test, verify, and confirm.

For systems requiring the highest level of safety assurance, consider RSDs with integrated shutdown verification feedback—devices that don't just receive the shutdown command but confirm that they have executed it. Real-time monitoring of each device's status provides the visibility needed to catch failures before they become emergencies.