GoodWe Removes Internet Connectivity From Japanese Industrial Solar Inverters

At the edge of a solar field, the most consequential change can be an absence. A cabinet still hums. Direct current still arrives from rows of modules, and alternating current still leaves for the grid. The maintenance crew can still see operating data from afar. A utility’s instruction can still reduce output. But there is no Ethernet conversation inside the inverter, no Wi-Fi radio waiting for a password, no Bluetooth pairing mode and no USB port offered as a convenient path into the machine.

That is the proposition GoodWe Japan announced for Japanese-market versions of its industrial GT and SMT power-conditioning systems, or PCS. The units will expose RS-485 for site communications and omit the other external interfaces named by the company. A third-party data logger bearing Japan’s JC-STAR ★1 conformity label will collect data over that serial link, connect outward, and carry remote monitoring and output-control functions.

The sentence “removes internet connectivity” is therefore accurate only at the boundary of the inverter body. It is not an air gap, and the solar plant is not disconnected from the internet. GoodWe has moved the place where internet trust begins. Instead of treating every inverter as a network endpoint, the design puts a gateway between a field bus and the outside world.

That distinction matters because modern solar equipment is both power electronics and information technology. An inverter synchronizes with the grid, protects itself, measures its own performance and increasingly obeys remote instructions. Its communications can help operators find a failed string before revenue disappears. The same pathway can become a route to change settings, interrupt generation or pivot through a poorly managed network. GoodWe’s response is simple enough to sketch on a service van’s clipboard: fewer native interfaces, one controlled bridge.

What GoodWe actually took away

The release uses two slightly different formulations. Its opening says TCP/IP, Wi-Fi, Bluetooth and USB external communications are not installed. A later section emphasizes that the PCS has no TCP/IP function and that site-side communications are restricted to RS-485. Read together, the intended architecture is clear: the inverter is not directly addressable as an ordinary internet device, and the familiar local wireless and removable-media routes are absent.

These are not equivalent technologies. TCP/IP is the protocol family that makes routable networks possible. Ethernet is a common way to carry it over cable, though the release does not separately enumerate Ethernet hardware. Wi-Fi and Bluetooth add radio paths. USB can be used for service tools, configuration or removable media. Removing them does not prove the firmware is flawless, but it eliminates whole classes of reachability and configuration path from the PCS.

RS-485 is different. Defined in 1983, it specifies the electrical behavior of balanced, differential drivers and receivers on a multipoint line. Its resistance to electrical noise and ability to connect equipment over long cable runs made it a fixture of factories, building controls and energy sites. It is a physical layer, not a security system. It says how voltages represent communication; it does not, by itself, authenticate a command, encrypt a message or decide whether the logger is allowed to change an inverter setting.

GoodWe does not identify the application protocol running over the RS-485 wire. Modbus RTU is common in industrial energy equipment, but it would be speculation to say this system uses it. That restraint is more than pedantry. A cyber review needs the actual register map, write permissions, addressing, error behavior and control logic—not a guess based on the shape of the connector.

The plant still has a path to the internet

Follow the electricity first. Photovoltaic modules produce DC. The GT or SMT unit tracks the operating point of one or more strings, converts that DC to grid-compatible AC and applies protection and control logic. Now follow the information. Each inverter sends measurements across RS-485 to the logger. The logger translates, stores or forwards them. Its external connection reaches a monitoring service, operator or output-control system. Commands can travel back through the same chain.

GoodWe says it tested the three functions that make this a real operating architecture rather than a read-only meter: data acquisition, status monitoring and remote output control. The last item establishes a return path. Whatever the diagram looks like, this is bidirectional operational technology. The logger is a protocol boundary and a security boundary; it is not a diode.

This is network segmentation by product design. It may be stronger than asking every installer to remember to disable a service after commissioning, because the omitted interface is not available to be accidentally enabled. But a segmented system is only as strong as the controls on its bridge. The logger should default-deny unnecessary traffic, separate monitoring from administrative access, authenticate remote users, protect update keys, record commands, keep time accurately and fail safely when its network disappears.

The failure behavior deserves special attention. If the logger crashes, does generation continue at the last safe operating state? If the external network is unavailable, can local protection still act independently? When communications recover, are delayed commands discarded or replayed? GoodWe’s announcement confirms functional compatibility. It does not answer these system-engineering questions.

How the inverter became a networked machine

Japan’s solar story began long before a power conditioner could have an IP address. After the 1973 oil shock exposed the country’s dependence on imported fuel, the government launched the Sunshine Project in 1974. It was Japan’s first long-term, comprehensive program for new-energy research, with solar among its central technologies. In those years, the great problem was conversion efficiency and cost: how to make a semiconductor surface turn enough sunlight into useful electricity.

As photovoltaic systems moved from laboratories to roofs and fields, the inverter became the hinge between a variable DC source and a tightly disciplined AC grid. Early monitoring was local: lamps, meters, front-panel displays and logs retrieved on site. RS-485 gave multiple devices a practical way to speak across a noisy industrial environment. A logger could poll a row of machines without giving each one a full network stack.

Then connectivity became a product feature. Ethernet, cellular modems, Wi-Fi dongles and vendor clouds let an owner see yesterday’s generation from a city office, compare sites, receive alarms and diagnose faults without a truck roll. Firmware could be updated. Aggregators could coordinate distributed resources. Advanced inverters became two-way grid participants rather than silent conversion boxes.

The benefit was real. So was the architectural change. A device expected to operate for a decade or more entered an internet ecosystem where libraries, certificates, cloud APIs and attacker techniques change far faster. Ownership often crossed several firms: panel installer, EPC contractor, O&M company, asset owner, inverter maker, logger vendor, telecom provider, cloud operator and utility. When a vulnerability appeared, no single organization necessarily held the complete inventory and update authority.

The pendulum has not swung back to dumb equipment. Remote awareness and grid control remain valuable, and sometimes required. The more interesting movement is toward explicit layers: a conversion device with a narrow field interface, a gateway with defined external responsibility, and a managed service beyond it. The old serial wire is being used not because the industry rejects data, but because a physical boundary can make the data path easier to see.

Japan’s 2012 solar boom reaches replacement age

The timing is as important as the topology. Japan introduced its feed-in tariff in July 2012, after the Fukushima disaster intensified the search for alternatives to nuclear generation and imported fossil fuels. The initial tariff for business-scale solar was ¥40 per kilowatt-hour before tax, guaranteed for 20 years. It made project revenue legible to banks and brought developers, landowners and equipment suppliers into the market at extraordinary speed.

By 2016, renewable capacity covered by the program was roughly two and a half times the 2012 level. The boom also produced queues of approved but unbuilt projects, grid constraints, uneven construction quality and a heavy concentration in solar. Later reforms lowered tariffs, strengthened operator duties and shifted mature projects toward market-linked FIP arrangements. Yet the physical legacy remains: thousands of sites designed around the equipment, communications and commercial assumptions of the early 2010s.

Those sites are now fourteen years older. Modules commonly generate for 20 to 30 years. Power electronics do not always last as long. The U.S. Department of Energy says string inverters commonly last 10 to 15 years and may need replacement during the life of the array; another DOE program described a typical power-electronics lifetime around ten years. Climate, loading, component quality and maintenance change any individual result, but the broad mismatch explains why an intact field of modules can need a new electronic heart.

GoodWe calls the opportunity repowering rather than simple replacement. The company says the Japanese market has around 80 GW of installed PV. IEA PVPS, using a DC-capacity estimate and different market boundaries, puts Japan at roughly 100 GWdc by the end of 2024. The two figures should not be treated as directly interchangeable. Both describe a fleet large enough that replacement practice is now industrial policy by accumulation: decisions repeated across old sites will shape reliability, cyber exposure and operating cost for another decade.

A repowering project begins with constraints. The modules and DC cabling already exist. Strings may face different directions, carry different currents or have aged unevenly. Transformers, switchgear, protection settings, land agreements, utility interconnection conditions and FIT approvals limit what can change. A new PCS must fit the electrical envelope and the legal one.

Repowering changes both reliability and cyber risk

GoodWe proposes replacing aging central PCS with distributed string units. Its GT and SMT pitch emphasizes multiple maximum-power-point trackers, support for high input and short-circuit currents, and voltage options intended to accommodate varied legacy arrays. Separate MPPT channels can extract more energy when strings differ in orientation, irradiance or condition. If the existing combination is compatible, the installer may avoid wholesale DC rewiring.

Distribution also changes the failure domain. One failed central machine can remove a large block of generation. With several smaller PCS units, one failure may stop only its attached strings. A replacement can be lighter and more modular. The trade-off is more devices, terminations, environmental seals and addresses to inventory. Reliability is not created by device count alone; it comes from spare strategy, access, heat, workmanship, monitoring and a maintenance organization able to find the failed unit quickly.

The cyber analogy is revealing. Distributed IP-connected inverters create many network endpoints. GoodWe’s design keeps many power-conversion devices but removes their native IP presence, then concentrates external communication in a logger. The electrical blast radius becomes smaller while the cyber trust point becomes more centralized. That can be a good exchange—if the gateway is engineered and operated as critical equipment.

Remote output control shows why the site cannot simply pull the cable. Japan’s grid operators curtail renewable output when supply exceeds demand or when a transmission constraint would be breached. OCCTO was still validating curtailment events across multiple regions in 2026. Tokyo Electric Power Grid explains that online control retrieves instructions over a dedicated line or the internet, while offline control relies on telephone or email and manual action. Connectivity is part of how a high-solar grid stays balanced.

Security therefore cannot mean making the useful function impossible. It must preserve authorized control while making unauthorized control difficult, visible and recoverable. That is the promise of GoodWe’s split: a narrow internal path, an explicit gateway and one place to impose internet-facing controls. It is an architectural claim, not yet public evidence of the controls themselves.

The monitoring box is now critical equipment

The solar industry already has a warning from a device one step away from the inverter. SolarView Compact, made by Japan’s Contec, is monitoring equipment for photovoltaic systems. A command-injection vulnerability affecting version 6.00 received CVE-2022-29303 and a critical 9.8 severity score. The U.S. Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities catalog in July 2023, evidence that attackers were not merely discussing the weakness in theory.

SolarView is not the unnamed logger in GoodWe’s design, and the vulnerability does not implicate GoodWe. The lesson is architectural: removing the inverter from the internet does not make the bridge trustworthy by definition. Monitoring appliances are computers. They parse network traffic, store credentials, expose web interfaces, receive updates and often possess the authority to talk to many field devices. A compromised gateway can become a translator for malicious intent.

A broader 2025 study by Forescout’s Vedere Labs reported 46 newly discovered vulnerabilities across products from Sungrow, Growatt and SMA. GoodWe was not among those three vendors. The commercial security researchers also reviewed 93 solar vulnerabilities disclosed over the prior three years and classified 80 percent as high or critical; the affected vendors patched the newly reported issues after coordinated disclosure.

The numbers are not a census of all inverter brands, and a vulnerability is not the same as a successful grid attack. They do show why scale changes the threat model. A flaw in one home appliance may inconvenience one household. A common cloud or gateway flaw across a fleet can make simultaneous action possible. That simultaneity—many devices changing output together—is what turns ordinary embedded security into an electricity-system concern.

Japan’s policy has been moving in the same direction. METI’s ERAB Cybersecurity Guideline began in 2017 and reached version 3.0 in May 2025 as aggregators, direct device links and IoT threats evolved. In June 2025, METI issued a guide for supply-chain security in electricity control systems, emphasizing specification checks and device management. The policy message is that procurement, inventory, vendor support and operations are inseparable from technical defense.

What one JC-STAR star really means

JC-STAR is Japan’s scheme for showing that connected products conform to defined cybersecurity requirements. METI set its policy in August 2024; the Information-technology Promotion Agency began accepting ★1 applications in March 2025 and issued the first labels that May. The baseline harmonizes with international references including ETSI EN 303 645 and NISTIR 8425, giving buyers a common vocabulary for matters such as authentication, updates, vulnerability handling and protection of data.

At ★1, the vendor assesses its own product against the common baseline and submits a checklist. IPA grants the label and can inspect, surveil or revoke when conformity is in doubt. This is a self-declaration route, not an independent laboratory certification. IPA reserves third-party evaluation for the higher ★3 and ★4 levels intended for more critical categories; ★2, like ★1, is also vendor-declared.

That does not make ★1 meaningless. A published baseline, a registered product record, a security contact and a defined update commitment can improve procurement over a box chosen only on price and protocol compatibility. Labels normally last two years, and the product information page shows status, security information and contact details. A buyer can put a model and registration number into an asset register and verify that the label remains valid.

But IPA states the limit plainly: the presence of a label does not assure complete or perfect security. A ★1 mark belongs to a particular product and version, not to every configuration around it. It does not show that installers changed default credentials, that the logger sits behind correct firewall rules, that cloud accounts use strong authentication, or that an incident-response team knows who can shut off remote access at 2 a.m.

GoodWe’s release leaves the most basic verification step unavailable to the public: it does not identify the logger maker, model or JC-STAR registration number. An owner considering the design should request those details, the product’s current IPA record, support period, update mechanism, vulnerability disclosure policy and results of the compatibility test. “JC-STAR-compatible architecture” is a useful starting sentence. It is not a bill of materials.

The new choke point: secure the logger

Concentration makes defense possible and failure consequential. One gateway is easier to inventory, patch, monitor and place behind a firewall than dozens of separate IP endpoints. It is also a single point from which an attacker—or an authorized operator with a mistaken command—may reach dozens of PCS units. The design needs layers around that point.

Start with identity and least privilege. Monitoring accounts should not automatically have control rights. Vendor support should use time-limited, approved access rather than a permanent shared password. Administrative access should come from a managed network or secure jump host with multifactor authentication. Certificates and keys need rotation, revocation and protection in hardware where appropriate.

Then constrain the serial side. The gateway should permit only required device addresses and functions. If normal operation needs to read telemetry and write a limited output setpoint, a change to protection parameters should be blocked or require a separate maintenance state. Rate limits and plausibility checks can prevent abrupt fleet-wide changes. A local controller should reject out-of-range commands even if they arrive through an authenticated logger.

Finally, build evidence. Logs should record who issued a command, through which service, to which PCS, with what old and new values. Time must be synchronized. Copies should leave the logger so an intruder cannot erase the only record. Alerts should distinguish a communications loss from a generation fault. Backups must include configuration and the knowledge required to restore a replacement unit without reopening every service.

This is why product cybersecurity cannot be reduced to a sticker or a port count. The U.S. Department of Energy’s distributed-energy baselines and the national-laboratory DER Cybersecurity Framework similarly treat governance, technical management and physical security as one posture. A secure plant knows what it owns, who may change it, how it notices trouble and how it continues safely while people respond.

Fewer doors, clearer ownership

GoodWe’s announcement is notable because it uses hardware and system architecture to answer a governance problem. An interface that does not exist cannot be exposed by a forgotten setting. A PCS without a routable stack does not require the same IP patching and firewall attention as an ordinary network endpoint. A single gateway gives the owner a natural place to enforce policy and collect evidence.

The approach also resists a seductive exaggeration. “No internet in the inverter” is not “no cyber risk.” The PCS still runs firmware. It still accepts serial data. Engineers still connect service equipment. The logger still reaches external systems, and its authority may span the whole site. The cloud, accounts, telecom link, O&M laptop and human approval chain remain inside the security boundary even when they are physically distant.

Owners should therefore judge the design as a complete control path. Ask GoodWe and the logger vendor for the exact tested combination. Put both products and their support dates into the contract. Define which company patches what, how quickly critical flaws are handled, who pays when a component reaches end of support, and how the plant will be run during an incident. Test isolation and local operation before commercial acceptance, then repeat the drill after major updates.

The economic case is unusually favorable during repowering. A project already has engineers on site, drawings open, protection studies under review and capital approved. The marginal cost of documenting data flows, segmenting the logger, commissioning named accounts and witnessing failure modes is smaller than returning later to reconstruct an undocumented plant. Cybersecurity becomes part of quality assurance rather than a retrofit sold after fear.

In the long view, the humble RS-485 pair carries a useful irony. A communications standard born in 1983 is helping define a boundary for a fleet created by the 2012 feed-in tariff and managed through 2026 cloud services. The old wire is not magically secure. Its value is legibility. It makes the question “Where does the internet end?” answerable.

At a well-run site, the answer will be visible in the drawings, firewall, asset register, logger label, account list, test report and incident plan. The inverter can keep doing the precise physical work for which it exists: turning sunlight into synchronized current. The gateway can do the dangerous connective work, deliberately and under watch. GoodWe has removed four doors from the machine. The real measure of the design will be how carefully Japan’s owners guard the one that remains.