Rapid Shutdown Verification and Labeling

Purpose

Rapid shutdown is two things that get shipped separately and must not be: a function that measurably works, and a permanent marking that tells a firefighter it exists. The common defect is a system carrying a correct, code-compliant label that nobody ever tested, because the label goes on during trim-out and the measurement is nobody's named job.

That defect stays invisible for years and then costs everything at once. A firefighter cuts a roof over an array whose label promised the conductors would be at a safe potential, while the module-level device that never got commissioned held one module's voltage on that conductor the whole time. This procedure makes the measurement the thing that authorizes the label, in that order, with a number written down.

Scope

Covers functional verification and marking of rapid shutdown on new systems at commissioning, after any module-level device replacement, and after an inverter or transmitter changeout.

Does not interpret the code requirement or choose the compliance path - the NEC 690.12 compliance reference owns which architectures satisfy which edition, and this verifies whatever path the approved plan set committed to. Does not cover general energized DC work practice, which is the energized DC array safety standard. Does not replace the AHJ's inspection; passing this does not guarantee a sign-off, and an inspection sign-off does not substitute for this.

Roles and responsibilities

The geometry the measurement depends on

    modules and their circuits sit INSIDE the boundary
    +-------------------------------------------+
    |  [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ]  |
    |  [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ]  |
    +-------------------------------------------+
    .... 1 ft array boundary, all directions ....
                       |
             controlled conductors leaving
             the boundary: this is where the
             outside-boundary reading is taken
                       |
              inverter and DC disconnect

The boundary is 1 ft from the array in all directions under NEC 690.12(B) in the 2017 and later editions, and outside it controlled conductors must fall to not more than 30 V within 30 seconds of initiation. Inside it the permitted options differ by edition and include a listed PV hazard control system and a reduction to not more than 80 V within 30 seconds, so read the option your plan set claims in the edition your AHJ adopted, not the one you tested last year.

Procedure

1. Read the approved plan set and write down which path this system claims. Identify the compliance option named on the plans, the listing of the equipment that delivers it, the initiation device and its location, and the point outside the array boundary where the measurement will be taken. Acceptance: all four written on the test sheet before any tool comes out. Wrong is testing by habit, which produces a pass against a limit that is not this system's. Stop rule: a plan set that names no option, or roof equipment that does not match the plans, stops the test and goes back to the designer, because you cannot verify a claim nobody made.

2. Set up for a live DC measurement. Use a meter and leads rated at or above this system's corrected maximum voltage, wear the glove class that voltage calls for with leather protectors, and station a second person. Acceptance: meter category and rating exceed the corrected maximum system voltage from the module datasheet and the site's lowest expected ambient. Wrong is a 600 V meter on a commercial string. Hazard: this test runs on conductors that are live before initiation and may still be live after it, which is the point of measuring, so treat every conductor at the measurement point as at full string voltage throughout and follow the energized DC array safety standard.

3. Verify what the initiation device actually is, and that it initiates. Locate the device named on the plans, confirm it is accessible from outside the building and identified, and confirm operating it changes the signal path the design relies on. Acceptance: an observable change - the transmitter's indicator, the inverter's state, or the measured decay in step 4. Wrong looks like a system where the customer's idea of "off" is a wall switch that does nothing to the array. Stop rule: a device producing no observable change is not an initiation device, so trace the signal path before proceeding.

4. Initiate, time 30 seconds, and read outside the boundary. Start the timer at initiation and at 30 seconds measure at the designated point outside the array boundary: conductor to conductor, and each conductor to ground. Acceptance: not more than 30 V on every measured pair. Wrong is a reading that hovers at roughly one module's open circuit voltage, which is the signature of exactly one module-level device that did not respond, or a reading equal to full string voltage, which points at the transmitter or the signal path rather than at any single device. Stop rule: any reading above the limit red-tags the system - no label goes on, the job is not called commissioned, and the customer is told the array is being left in service without a verified shutdown or taken out of service, whichever the crew lead decides that day.

5. Address the inside-boundary requirement by the path the plans claim. Where the design claims a listed PV hazard control system, verify the installed equipment carries that listing and that the array configuration matches the listing's conditions, since a hazard control system is listed as an assembly and substituting a component voids the claim. Where the design instead relies on a voltage reduction inside the boundary, measure it as in step 4 against that option's limit. Acceptance: either the listing verified against the equipment labels, or a measured value inside the limit. Wrong is assuming module-level electronics satisfy the inside-boundary requirement because they satisfy the outside one. Stop rule: a mismatch between installed equipment and the listed assembly goes to the designer, not to a field call.

6. Restore and confirm the system comes back. Reset the initiation device and watch the system through its full restart, timing it. Acceptance: the inverter returns to normal running within its stated reconnect delay, commonly around five minutes under the grid-support settings in its listing, and every module-level device reports. Wrong is walking away at the first green light while one device stays offline, which is how a verified shutdown becomes an unverified one an hour later. Stop rule: any device not reporting after restart is a live defect, not a slow reporter, and is chased before the crew demobilizes.

7. Apply the labels only after the measurement passed. Apply the rapid shutdown marking required by NEC 690.56 in your adopted edition: the label identifying the initiation device, and the plaque or directory showing which conductors are shut down and which are not, at the location the code and your AHJ require. Field-applied hazard markings must be permanent, durable for the environment, and not handwritten, per NEC 110.21(B). Acceptance: labels legible from a normal standing position, adhered to a clean dry surface, with the diagram matching this as-built rather than a generic drawing. Wrong is a laser-printed label on a sunlit wall, unreadable within a season, or a plaque copied from another job. Stop rule: no label goes on a system that has not passed step 4 today, and a label already applied to a failed system comes off before the tech leaves.

8. Hand it over to the people who will use it. Walk the customer to the initiation device, have them operate it once and watch the array come back, and tell them plainly that the switch is for emergency responders and that operating it stops production until reset. Acceptance: the customer operates it themselves and can point to it afterwards. Wrong is a line in a manual nobody opens. Stop rule: if the customer is not present at commissioning, the walkthrough is scheduled rather than skipped and the ticket stays open until it happens.

The record this produces

One rapid shutdown verification sheet per system, per test date:

• Basis: compliance option claimed, plan revision, equipment make and listing, initiation device type and location, measurement point.
• Measurements: initiation time, the 30 second reading conductor to conductor and each conductor to ground, the inside-boundary result or listing verification, meter model and rating.
• Restart: time to normal running, devices reporting against devices installed.
• Labels: photograph of each label in place, and the plaque diagram as installed.
• Exceptions: any red-tag, the reading that caused it, the correction, the re-test result.

The AHJ inspector reads it at inspection. The next service tech reads it to know what the system is supposed to do before judging whether it still does. If a fire happens at this address, this sheet and its photographs are the shop's record that the function was verified and not merely labeled.

A worked pass, including the step that failed

New residential system, module-level electronics, 26 modules, commissioning on a cool morning.

Step 1: the plan set names its outside-boundary option, the module-level equipment and its listing, the initiation device at the exterior AC disconnect, and a measurement point at the DC conductors entering the inverter, outside the boundary. All four written down. Step 2: meter rated above the corrected maximum system voltage for this site, gloves in date, second person stationed. Step 3: operating the disconnect produces an observable state change at the inverter, so it is initiating.

Step 4 fails. At 30 seconds the reading conductor to conductor is 46 V against a 30 V limit. That is close to one module's open circuit voltage corrected for the morning's temperature by the method in the energized DC safety SOP, which points at a single device rather than the transmitter, since a signal path failure would have left the reading near full string voltage. The stop rule runs: no label applied, system red-tagged, crew lead called from the roof.

The cause shows in the monitoring portal: one module-level device was swapped during install and never paired to the transmitter, so it was never under shutdown control. It is paired and the test is re-run in full rather than on that string alone. The 30 second reading is now 4 V conductor to conductor and under 2 V each conductor to ground.

Step 5: the inside-boundary path is verified against the equipment labels and the listing's conditions. Step 6: the initiation device is reset and the inverter returns to normal running within its stated reconnect delay, with 26 of 26 devices reporting. Step 7: labels applied, the plaque diagram matching the as-built, photographed in place. Step 8: the customer operates the switch, watches the system drop and come back, and can point to it afterwards.

Outcome: a device that would have held one module's voltage on a controlled conductor indefinitely was found by a timed measurement, and the label on that wall now means what it says.

References

• NEC 690.12 for rapid shutdown requirements and the array boundary, NEC 690.56 for rapid shutdown marking, and NEC 110.21(B) for field-applied hazard markings, in the edition your AHJ has adopted.
• Equipment listing and installation manual for the module-level devices, transmitter or hazard control system, including pairing and commissioning steps and the inverter's reconnect delay.
• See related: the NEC 690.12 rapid shutdown compliance reference for which architectures satisfy which edition, and the energized DC array safety standard for the measurement's safety practice.