solar-inverter

How it is built

Architecture overview

A grid-tied solar inverter converts the direct current of a PV array into alternating current that is in step with the utility grid, and keeps doing so safely for ten or more years without a technician. Inside it are two worlds. The power stage (a switching bridge, a DC link capacitor, a filter and a relay to the grid) moves the energy; a microcontroller or DSP closes several control loops around it at fixed rates, thousands to tens of thousands of times per second, and decides when it must stop. Around that sits a communications and update path (a local fieldbus for installers and an uplink to a cloud monitoring service), and behind the uplink a backend that stores the telemetry of a whole fleet.

The idea that holds it together is a hard real-time control core with a protective shell. The control loops run from a timer interrupt on a fixed schedule, using integer or fixed-point maths so that behaviour is identical on every unit. Independent protections (hardware trips, a safety monitor, a watchdog) sit beside the loops and can force the inverter off without asking the software that might be at fault. Grid codes (IEEE 1547 in the US; UL 1741 and IEC 62109 for product safety; European codes such as VDE-AR-N 4105) define what the inverter must do when the grid misbehaves, and these rules shape the architecture more than efficiency does.

Product families differ in where the power conversion sits: string inverters (one box per string group), microinverters (one small inverter per panel, as Enphase builds) and optimiser-plus-central-inverter systems (as SolarEdge builds). The blocks below are the same; the number of control cores and the communication topology differ.

Parts:

• Power stage drive — turns duty commands into gate signals, protects the switches — PWM generation, gate-drive-desat-protection (no page yet, not in the graph)
• Sensing chain — ADC sampling aligned to the PWM, filtering, RMS and power computation — IIR and FIR filters, DMA transfers (no page yet), RMS power metering DSP (no page yet), Deterministic fixed-point math
• Control loops — current loop, DC-link voltage loop, maximum power point tracking — Fixed-rate control loop, PID controller, Interrupt handling, maximum-power-point-tracking (no page yet, not in the graph)
• Grid interface — synchronise to the grid, detect islanding, support the grid — Phase-locked loop (digital), anti-islanding-detection (no page yet, not in the graph), Droop control (no page yet)
• Safety shell — independent protection and fault handling — Safety monitor architecture (no page yet), Watchdog timer, Fault detection, isolation and recovery (no page yet), Safety-critical coding standards
• Local communications — installer tools, meters, batteries, multi-inverter systems — Modbus protocol (no page yet), CAN bus framing (no page yet)
• Cloud uplink — telemetry and commands to the monitoring service — MQTT protocol (no page yet), Mutual TLS
• Firmware update — safe field upgrades — A/B partition updates
• Monitoring backend — stores and serves fleet telemetry — Primary-backup replication, Point-in-time recovery, Process supervision, Graceful draining, HDR histogram (no page yet), Deterministic simulation testing, Coverage-guided fuzzing

  PV array ─► DC input (MPPT) ─► DC link ─► inverter bridge ─► filter ─► relay ─► grid
                  ▲                 ▲            ▲   gate drive            ▲
                  │ V, I            │ V          │ PWM                     │ V, I
  ┌───────────────┴─────────────────┴────────────┴─────────────────────────┴─────────┐
  │ MCU / DSP                                                                         │
  │  ADC ─DMA─► filter ─► [ISR @ fixed rate: PLL ─► current loop ─► PWM compare]     │
  │                       [slower task: DC-link loop, MPPT, ride-through, droop]     │
  │  safety monitor + watchdog ──► hardware trip / relay open     (independent path) │
  │  Modbus / CAN ◄──► installer, meter, battery        TLS + MQTT ──► cloud         │
  └───────────────────────────────────────────────────────────────────┬──────────────┘
                                                                       ▼
        fleet backend: ingest ─► time-series store (replicated, PITR) ─► dashboards, alerts, OTA

How the parts fit together

Power stage drive

PWM generation is the actuator: a timer compares a carrier counter with a duty value and drives the bridge's gates, with dead time so the upper and lower switches of a leg never conduct together. A new duty value takes effect at a defined point of the carrier (shadow registers), so the control loop and the output stay in step. The gate driver adds protection that does not depend on firmware: desaturation detection turns a switch off when its collector-emitter voltage shows a short circuit (gate-drive-desat-protection, no page yet and not in the graph). The contract is that firmware can request a duty, but a hardware path can always override it.

Sensing chain

The loops need clean voltages and currents. The ADC is triggered from the PWM timer so that it samples at a repeatable point of the switching cycle, away from switching edges. Results move by DMA into memory (DMA transfers, no page yet), so the processor is interrupted once per block or once per cycle and not once per sample. IIR and FIR filters remove switching noise and offset; grid-frequency quantities (RMS voltage, active and reactive power, THD) come from RMS power metering DSP (no page yet). All of this runs in Deterministic fixed-point math where the processor lacks a floating-point unit: the same input then gives the same output on every unit, which also makes firmware testable bit-for-bit.

Control loops

The core is a Fixed-rate control loop started from a timer interrupt, commonly in the same period as the PWM (switching frequencies for inverters of this type are of the order of 10 to 20 kHz, order of). In a grid-tied inverter the loops are nested:

• Inner current loop (fastest): controls the current injected into the grid so that it follows a sinusoidal reference; a PID controller (usually PI or proportional-resonant) closes it. Bandwidth of the order of a kilohertz, an order of magnitude below the switching frequency.
• Outer DC-link voltage loop (slower): keeps the DC link at its setpoint; the power it demands from the grid side is what the array supplies, so this loop sets the amplitude of the inner loop's reference.
• Maximum power point tracking (slowest): perturbs the array operating voltage and keeps the point of highest power; the common algorithms are perturb-and-observe and incremental conductance (survey: Esram and Chapman 2007). This is the block maximum-power-point-tracking (no page yet, not in the graph).

Each loop must finish before the next one starts; the nesting ratio (each outer loop about ten times slower than the loop inside it) keeps them from fighting. Priorities follow the same order: the current loop's interrupt preempts everything, and communications run in the background.

Grid interface

The current reference must be in phase with the grid voltage, which has to be measured and tracked even when it is distorted. A Phase-locked loop (digital) does this: it estimates the grid phase and frequency from the sampled voltage and feeds the phase into the current reference (Teodorescu et al.; Blaabjerg et al. 2006). Three things build on that estimate:

• Fault ride-through and protection: under- and over-voltage and frequency windows decide when the inverter must stay connected, ride through, or disconnect; these windows come from the grid code.
• Anti-islanding: if the grid disappears but local load and generation roughly match, the inverter must notice and stop energising the line within a time limit set by the standard (IEEE 1547). Detection mixes passive checks (voltage and frequency limits, rate of change) with active methods (small injected perturbations). This is the block anti-islanding-detection (no page yet, not in the graph).
• Grid support: modern codes ask inverters to help the grid, for example by reducing active power as frequency rises or by injecting reactive power with voltage. These characteristics are droop curves (Droop control, no page yet).

Safety shell

A fault should end in a known safe state: the relay open and the bridge off. Three layers do this. Safety monitor architecture (no page yet) covers the independent monitor that checks the main controller (a second processor or a redundant measurement channel that compares grid voltage and current with its own sensors, as product standards typically require for grid disconnection). The Watchdog timer forces a reset if the control interrupt or the main loop stops. Above both, Fault detection, isolation and recovery (no page yet) classifies faults (grid, array insulation, over-temperature, internal) and decides whether to retry after a delay or latch off. The code itself follows Safety-critical coding standards: no dynamic allocation, bounded loops, checked inputs, so the worst-case execution time of the control interrupt can be proven.

Local and cloud communications

Locally the inverter talks to installer tools, energy meters and batteries. Modbus protocol (no page yet) is the common register-based interface, and the SunSpec Alliance defines standard register maps for inverters and meters on top of Modbus, which is why generic monitoring tools can read inverters of different makers. Between several power units inside a system (optimisers, battery modules, multi-inverter clusters), CAN bus framing (no page yet) gives robust short-range messaging. To the cloud, inverters push telemetry on a schedule over MQTT (no page yet), a light publish/subscribe protocol that survives poor links, wrapped in Mutual TLS so both the device and the service prove who they are; a compromised inverter fleet is a grid-scale risk, so authenticated, signed control is not optional.

Firmware update

An inverter is updated in the field, often remotely, and a failed update at a remote roof has a high cost. A/B partition updates keep two firmware slots: the new image is written to the idle slot, tried once, and if it does not report healthy the bootloader falls back. The safety shell defines what "healthy" means: control loop running, grid sync achieved, relay test passed.

Monitoring backend

The fleet's telemetry arrives as many small time-series writes. The backend keeps them in a store with Primary-backup replication and Point-in-time recovery so a lost node or a bad deployment does not lose history. Process supervision restarts failed services and Graceful draining lets a node leave without dropping in-flight uploads. Latency of queries and ingestion is tracked in an HDR histogram (no page yet) so tail latency is visible. The ingest parsing is exposed to every device on the internet, so it is exercised with Coverage-guided fuzzing, and the fleet logic (retries, duplicate uploads, clock skew) is checked with Deterministic simulation testing.

Data and control flow

One control cycle (every PWM period, order of 50 to 100 microseconds):

1. The PWM timer triggers the ADC; voltages and currents are sampled at the chosen point of the cycle.
2. A DMA transfer or the ADC end-of-conversion interrupt hands the samples to the control ISR.
3. The ISR filters the samples, updates the PLL (grid phase), computes the current error, runs the current controller and writes the new duty values to the PWM compare registers.
4. The ISR kicks the watchdog only if its own sanity checks passed; every N cycles it signals the slower task.
5. The slower task runs the DC-link loop, MPPT and protection windows, and updates the fault state.

A grid disturbance:

1. The grid voltage leaves the allowed window. The ISR sees it within a few cycles, and the independent monitor sees it on its own channel.
2. Depending on depth and duration the inverter rides through (keeps injecting within limits) or stops injecting.
3. If the disturbance lasts longer than the code allows, the bridge is disabled and the relay opens; the fault is logged and a timer starts for the reconnection check.
4. After the grid has been normal for the required time, the inverter re-synchronises with the PLL and ramps up its power in a controlled way.

Telemetry to the cloud:

1. A slow task samples energy, power, temperatures and fault codes into a buffer.
2. Every interval the device opens (or reuses) a mutually authenticated TLS session and publishes a batch via MQTT.
3. The backend validates and stores it in the replicated time-series store; alerts run on top.
4. Commands (a power limit, a firmware version to fetch) flow the other way, signed, and go through the update or configuration path above.

Scaling

The system scales along three different axes:

1. Per device (control quality): faster processor and ADC, more loop bandwidth, better filtering, a second core for the safety monitor. Limit: the worst-case time of the control ISR inside one PWM period.
2. Per site: many inverters on one feeder behave as a group. Limits: grid code requirements for the plant, and communication among units. Levers: a plant controller that distributes power limits, droop settings that are coordinated, and a field bus with deterministic latency.
3. Per fleet (cloud): millions of devices pushing small messages. Limits: ingest rate and storage. Levers: batching on the device, partitioned time-series storage, tiered retention, horizontal ingest behind MQTT brokers. Update campaigns scale the other way: roll out in waves, watch health, stop on regression.

Failure modes

Real implementations

Sources

• IEEE, IEEE Std 1547-2018: Standard for Interconnection and Interoperability of Distributed Energy Resources with Associated Electric Power Systems Interfaces. standard
• UL 1741 (Supplement SB) and IEC 62109-1/-2 (product safety of power converters for PV); named here as the governing standards, not summarised.
• T. Esram, P. L. Chapman, Comparison of Photovoltaic Array Maximum Power Point Tracking Techniques, IEEE Transactions on Energy Conversion 22(2), 2007. DOI
• F. Blaabjerg, R. Teodorescu, M. Liserre, A. V. Timbus, Overview of Control and Grid Synchronization for Distributed Power Generation Systems, IEEE Transactions on Industrial Electronics 53(5), 2006. DOI
• R. Teodorescu, M. Liserre, P. Rodriguez, Grid Converters for Photovoltaic and Wind Power Systems, Wiley, 2011. DOI
• Texas Instruments, C2000Ware DigitalPower SDK. tool page
• SunSpec Alliance models and tools: models, pysunspec2