Most microgrid projects that disappoint do not fail because of the battery or the generators. They fail at the seam between them - the moment the grid disappears and something has to decide, in milliseconds, which assets carry which loads, in what order, and how to get back.

That "something" is the microgrid controller. It is the single component most often specified loosely, bought as an afterthought, and blamed later for behaviour nobody tested.

This guide separates the controller from the systems it is routinely confused with, sets out the functions that actually matter, and gives you the questions to ask before signing.

Four layers that are not the same thing

Procurement documents routinely conflate four distinct layers. Getting them straight is the first step in selecting anything.

Protection relays. Detect faults and open breakers. Operate in milliseconds. They are not programmable logic for energy management, and they must remain independent of any controller.

PCS or inverter local control. Runs the power electronics loop: current control, voltage regulation, droop, fault ride-through. A grid-forming PCS can establish voltage and frequency on its own; a grid-following one cannot.

The microgrid controller (MGC). Supervises the system: decides operating mode, issues setpoints, coordinates multiple assets, manages transitions, executes load shedding and restoration, and sequences black start. It operates on seconds, not microseconds.

The site EMS. Handles economic dispatch - tariffs, demand charges, arbitrage, reporting, dashboards. It operates on minutes to hours.

A vendor selling "an EMS with microgrid features" is usually selling the fourth layer with some of the third's functionality. That is acceptable for a site that never islands. It is not acceptable for a site whose value depends on islanding reliably.

The four transitions - where controllers earn their price

A microgrid controller is judged on transitions, not on steady-state operation.

Planned islanding. The site disconnects from the utility deliberately, typically for a maintenance window or a demand-response event. The controller must balance generation and load before opening, or the transition produces a voltage excursion or a generator trip.

Unplanned islanding. The utility disappears without warning. The controller must detect islanding within the anti-islanding window, establish a reference (usually via a grid-forming source), and arrest frequency and voltage within the ride-through envelope of the connected loads. Motors, drives and UPS systems all behave differently here.

Reconnection. Synchronising back to the utility requires matching voltage, frequency and phase angle within the reconnect window. A controller that reconnects too early trips protection; one that waits too long leaves the site on generators unnecessarily.

Black start. With everything de-energised, the controller must bring up a source, energise a bus, add load in blocks, and avoid overloading the first source. This is the hardest sequence and the least frequently tested.

Ask every vendor to demonstrate all four, on your topology, not a reference site's.

Functions to specify explicitly

Multiple grid-forming sources. If you have two or more batteries or a battery plus a generator, the controller must coordinate them. Droop settings, virtual impedance and master-slave arrangements all need to be defined, and the controller must handle the loss of the master.

Transition timing. For most C&I loads, a transfer in the range of a few seconds is acceptable; for sensitive loads, you need a seamless or near-seamless transfer measured in cycles, which usually requires the PCS to be grid-forming and the load to be on a UPS-backed bus. Specify the number, not the adjective.

Load shedding and restoration. Define load blocks, priorities, and the criteria for re-adding them. The controller should shed on under-frequency or source overload and restore with hysteresis, not by timer alone.

Generator coordination. Gensets need a minimum loading to avoid wet stacking, a start delay, a cool-down period, and reverse-power protection. The controller must prevent the battery from back-feeding the generator and must not command a genset to absorb power.

SOC management across multiple batteries. With two or more BESS units, the controller must balance state of charge, not just power. Unequal SOC leads to one unit hitting its limit while the other is half full, which reduces available capacity precisely when it is needed.

Renewable coordination. PV curtailment, export limiting, and smoothing during islanded operation. If the site has PV, the controller must be able to reduce it when the battery is full and the load is low.

Communications and protocol coverage. At minimum: Modbus TCP/RTU, DNP3 for utility interfaces, IEC 61850 where substation automation is involved, and OpenADR or a comparable demand-response protocol if the site participates in programmes. SunSpec for inverters. Confirm the exact protocol list and the number of simultaneous client connections, not just "supports Modbus."

Cybersecurity. IEC 62443 alignment, role-based access, signed firmware, network segmentation between the OT microgrid network and the corporate IT network, and an audit log. A controller with a cellular modem and a default password is a liability, not a feature.

Redundancy and fail-safe behaviour. What happens if the controller loses communications with the PCS? With the utility meter? With the generator? Define the fallback for each: hold last setpoint, revert to local droop, trip to a safe state. "The controller restarts" is not a fail-safe design.

Time synchronisation and event recording. Sequence-of-events logs with millisecond resolution are how you diagnose a failed transition. Without them, every incident becomes an argument.

Standards alignment. IEEE 2030.7 defines functional requirements for microgrid controllers, and IEEE 2030.8 covers testing. Referencing them in the specification gives you a common vocabulary and a defensible acceptance basis. Grid-interconnection behaviour falls under IEEE 1547 and UL 1741 SB in North America, with equivalents elsewhere.

Architecture: three ways to buy one

Embedded in the PCS. The inverter manufacturer supplies the controller as part of its platform. Advantages: tight integration, single warranty, proven behaviour with its own hardware. Disadvantages: limited support for third-party assets, and the controller's roadmap is dictated by the inverter business.

Standalone industrial controller. A dedicated device, often from a specialist, communicating with all assets over open protocols. Advantages: vendor-agnostic, easier to extend, clearer separation of responsibility. Disadvantages: integration effort sits with you or your integrator, and performance depends on the communication links.

Software on an edge server. Increasingly common, with containerised control logic running on industrial hardware. Advantages: flexible, updatable, easy to integrate with analytics. Disadvantages: determinism depends on the host and network, and cyber exposure is higher if not segmented properly.

For a C&I site with one battery and one generator, an embedded controller is often sufficient. For a site with multiple asset types, staged expansion, or a requirement to change vendors later, a standalone controller with open protocols is usually worth the integration cost.

How to score the options

Weight the criteria before you see the proposals, or the scoring will follow the demo.

Proven transition performance on a topology like yours - 25%

Protocol coverage and third-party asset support - 15%

Reliability, redundancy and fail-safe design - 15%

Cybersecurity posture and update process - 10%

Engineering support and local service capability - 15%

Total lifecycle cost, including licences and upgrades - 10%

Roadmap and vendor stability - 10%

Note that "proven" means evidence: test reports, a site visit, a reference customer willing to talk about a real islanding event. Not a brochure claim.

Twenty questions to ask before you sign

Which transitions have you tested on a topology with multiple grid-forming sources?

What is the measured transfer time, and under what load conditions?

What happens if the controller loses communication with the PCS mid-transition?

What happens if the controller itself fails while islanded?

How do you balance SOC across multiple batteries?

How do you prevent reverse power into a generator?

What is the minimum generator loading you enforce, and how?

Can you black start with no external source, and in what sequence?

Which protocols do you support natively, and which need a gateway?

How many simultaneous Modbus/DNP3 connections are supported?

Is the control logic editable by us, or locked?

What licences are required, and what do they cost over ten years?

How are firmware updates delivered and validated?

What is the cyber architecture, and does it align with IEC 62443?

What event log resolution do you record, and for how long?

How is time synchronised across devices?

What is the FAT scope, and can we write the test script?

Who commissions the system, and who is on site for the first islanding test?

What is the mean time to repair, and where are spares held?

Can we export our configuration and data if we change vendors?

Question 20 is the one that protects you in year seven.

Factory and site testing

The controller should be tested against a written matrix, not a demonstration script. Insist on:

Planned island and reconnection, at three load levels.

Unplanned island with the largest motor starting.

Loss of communication with each asset, one at a time.

Controller power loss while islanded.

Generator start, load acceptance, and reverse-power check.

Black start from a fully de-energised state.

PV curtailment and restoration.

SOC balancing with two batteries at different states.

Repeat the critical cases at site acceptance, with the real loads. The factory test proves the logic; the site test proves the wiring, the CTs, the breaker feedback and the network.

Common selection mistakes

Buying an EMS and calling it a controller. The most expensive mistake, because it is discovered during the first outage.

Specifying functions without numbers. "Seamless transfer" and "fast islanding" are not requirements. Milliseconds and seconds are.

Ignoring the generator. Gensets are the least forgiving asset in the microgrid and the most often left out of the control scope.

No cyber scope. The controller sits on a network with a cellular connection and a maintenance VPN. Treat it accordingly.

No exit plan. Proprietary configuration, no data export and per-point licences create a switching cost that exceeds the original purchase price.

FAQ

Is a microgrid controller the same as an EMS?​
No. The controller manages real-time operation and transitions; the EMS manages economics and reporting. Some products combine both, but the transition functions must be specified and tested separately.

Can I add microgrid capability to an existing battery later?​
Usually yes, if the PCS supports grid-forming operation and the controller can communicate with it. Confirm the PCS capability first - it is the harder constraint.

How much does a microgrid controller cost?​
As a rough planning figure, a standalone controller for a C&I site typically represents a single-digit percentage of total project cost, with annual software support on top. Embedded options appear cheaper but bundle the cost into the PCS.

Do I need IEEE 2030.7 compliance?​
It is a useful specification and testing reference rather than a certification. Citing it in the requirements makes vendor responses comparable.

What is the biggest risk in controller selection?​
Untested transitions. Everything else can be fixed with configuration; a controller that cannot island reliably cannot be fixed without replacing it.

The bottom line

Selecting a microgrid controller is an exercise in specifying behaviour under failure, not features under normal operation. Separate it from the EMS, define the four transitions with numbers, require evidence from a comparable topology, and write a test matrix you control.

The battery determines how much energy you have. The controller determines whether you still have power when the grid does not.