Fail-safe / Offline Operation

Status: DRAFT

Document behavior for:

• VPN unavailable
• NATS unavailable
• backend unavailable
• DNS unavailable
• invalid/malformed command
• inverter timeout
• repeated Modbus CRC failures
• reboot during scheduled operation
• clock/time synchronization loss

Target principle

Loss of cloud connectivity must not place the energy installation into an unsafe or uncontrolled state.

TODO: define whether the device keeps the last valid schedule, switches to an idle/default mode, or delegates operation entirely to the inverter for each failure mode.