An inverter firmware update is complete only when the required project functions have been checked, not when the progress bar finishes. The device may restart normally while an export setting, battery interface, parallel arrangement or backup behaviour has changed. A successful upload proves that software was installed; it does not prove that the installation still provides the contracted service.
For EPCs and distributors, treat the update as a controlled engineering change. Document the reason, confirm the exact hardware and firmware combination, save the approved configuration and decide which functions need retesting. Apply urgent security or manufacturer-required updates through an appropriate risk review; do not use change control as an excuse to ignore a safety or security instruction.
Define the reason for the release
Separate a security correction, a manufacturer-required change, a fault remedy and a new feature. Each has a different justification and may require different scheduling. A feature that is irrelevant to the project is not, by itself, evidence that an operating installation benefits from an immediate upgrade.
Before updating an HMX solar inverter, request the applicable release notes and supported update procedure for its exact model and hardware revision. Confirm any dependencies involving the battery BMS, meter, communications gateway or controller. Do not assume a file for a similar model is acceptable.
Use a named person to authorize the change and a named person to confirm the result. In a small project those may be members of the same installation team, but the responsibilities should still be recorded. The customer should know whether the update interrupts service and what temporary arrangements are required.
| Record | Information required | Release decision it supports |
|---|---|---|
| Purpose | Relevant correction, requirement or project feature | Why this change is needed |
| Equipment identity | Model, serial, hardware and installed software versions | Whether the target file applies |
| Dependencies | Supported battery, meter, controller and parallel-device versions | Whether the system combination is supported |
| Configuration baseline | Approved export, backup, charging and access settings | What must remain correct after the update |
| Service window | Expected interruption and customer arrangements | When the change can safely take place |
| Recovery route | Manufacturer-approved recovery and support contacts | How an unsuccessful change will be managed |
Do not assume every update preserves settings
A useful comparison comes from two current documents within the same manufacturer’s library. The general VictronConnect firmware guide describes preservation of applicable settings and history, while explicitly directing VE.Bus products to a separate guide. Reading only the general statement would miss an important product boundary.
The separate VictronConnect guide for VE.Bus products warns that its update process resets settings to factory defaults and requires multiple-unit configurations to be reprogrammed. That behaviour is specific to the documented products and process; it is not a claim about HMX equipment.
The procurement lesson is straightforward: ask whether this model and update method preserve, migrate or reset each relevant setting. Save a configuration export where supported, together with human-readable records of essential settings. A file that cannot be restored to the new version is not a complete recovery plan.
Record the current approved values rather than copying defaults from a manual. Defaults may not match the site’s grid approval, battery limits or backup design. Restoring an old configuration also needs review if the new release changes a parameter’s meaning or supported range.
Build the retest around what the project actually uses
Choose regression tests before installing the update. Include the functions touched by the release notes and the functions whose failure would matter to the customer. A storage project may depend on battery charge permissions and backup transitions even when the update is described as a communications improvement.
Map the equipment relationships first. The distinction between BMS, power conversion and energy management functions helps identify which device supplies a limit or operating command. A number visible on the display does not establish that the inverter follows the latest permitted value.
| Function used by the project | Verification focus | Evidence to retain |
|---|---|---|
| Battery operation | Communications, active charge/discharge limits and alarm handling | Matched device versions and observed operating records |
| Export control | Meter interpretation, setpoint and response within the approved arrangement | Settings and measured test outcome |
| Backup supply | Approved transfer, actual loads and return to grid | Event timeline and service observations |
| Parallel or multiphase operation | Supported version combination and configured roles | Topology and approved functional results |
| Remote monitoring | Current telemetry, alarms and permitted access | Fresh timestamps and tested notification path |
| Scheduled dispatch | Time zone, operating windows and permissions | Final policy and observed transitions |
All electrical switching and protective-function testing require qualified personnel following the applicable procedure. Do not change grid protection to speed up a demonstration, bypass an interlock or force a battery fault. Where a function cannot be tested immediately, keep it explicitly outstanding rather than declare the release fully accepted.
Preserve the difference between software rollback and safe recovery
A previous firmware file does not prove that downgrading is supported. Settings formats, hardware revisions or manufacturer restrictions may prevent it. Obtain a supported recovery route before the change. That route may involve local service or a replacement controller rather than a software downgrade.
For a project that uses a residential battery system for essential loads, arrange an approved alternative supply where necessary. Recovery time should not be guessed from another installation. Confirm personnel availability and support access for the agreed service window.
Keep a version baseline that service teams can trust
NIST SP 800-128 configuration-management guidance, published in 2011 and updated in 2019, explains managing and monitoring configurations while supporting required business functions. It is general information-system guidance, not a new inverter certification requirement. Its baseline principle is useful when applied carefully to a storage project’s records.
After the update, save the actual installed versions, approved final settings and test results. Record any differences from the previous baseline, unresolved issues and the person who accepted the change. Capture evidence before and after the update so a later technician can distinguish a release-related change from an unrelated site problem.
For fleets of installations, verify the relevant hardware and configuration groups before expanding a rollout. A pass on one model does not qualify every unit in the fleet. Manufacturer-approved staging can reduce uncertainty, but it must not delay a mandatory correction beyond the permitted response.
Close the change on function, not installation status
The release record should answer: why was the update required, what changed, which functions were retested and what remains open? When those answers are clear, the distributor can support the installation without relying on memory or screenshots taken before the upgrade. The final acceptance point is restored and verified service, not a new version number.