We built the monitoring and diagnostics for a battery-powered grid, the layer that sits between the cells and everything that reasons about them. It is the layer the energy transition now leans on hardest, and the one it can prove least about.
What we found there was not exotic. Controllers that were nominally identical, the same vendor and the same version, behaved differently from one another. Undocumented commands moved on the bus, some of them able to disrupt a pack, none of them in any specification. The internal communications carried no authentication and no encryption. None of it sat at the cheap edges; it was in the core battery-management hardware, invisible to anyone reading the documentation instead of the device.
Two controllers, identical on paper, behaving differently in the core of the system.
That mutability is not a property of one project. It is how battery-management hardware is built and integrated: many vendors; many versions; components chosen on supply and price; systems assembled to be reported on, not read. At the bench it is an engineering nuisance. At grid scale, with capital, warranties and dispatch resting on it, the same opacity becomes the thing no one can prove.
The transition is being assembled at a pace the grid has never seen. Stationary storage, renewables and the controllers that knit them together are coming online faster than at any point in its history, and the capital behind them assumes the underlying behaviour is knowable. Not nominally, but to the standard required to argue about it: in a warranty claim; an availability dispute; a capacity test; a curtailment settlement; a post-incident review.
That standard is not being met, and the reason is structural rather than anyone’s fault. The assets were never built to be observed from outside the vendor that made them, so everything above them reasons on what they report, and what they report cannot be independently checked. The gap is the same everywhere, but it shows up most sharply, and most expensively, where the money and the engineering concentrate: grid-scale battery storage, and the renewables that increasingly sit alongside it.
Three accounts, one truth
A grid-scale storage site is months into operation and missing an availability guarantee. The damages are accruing, and the only question that matters is whose fault it is. The owner sees the site underdelivering. The OEM points to the operating contract and says the asset was run outside its envelope. The operator says it was not. Each side arrives with logs, and every log is the device’s account of itself: the BMS says it reported correctly, the PCS says it acted on what it was told, the EMS says it dispatched on what it received. Everyone can show their own box performed to specification, and no one can independently say what the asset was actually doing, because the only account of it is the asset’s own.
It is not a rare shape. When the analytics firm TWAICE surveyed battery storage professionals in 2026, nearly half reported that difficulty holding suppliers accountable to performance promises makes their jobs harder.
The only account of what the device did is the device’s own.
The audit trail only runs one way
Anyone who has commissioned, operated or owned a grid-scale battery site knows the layers: cell, module, rack, the BMS at one or more of them, the PCS, the site EMS, the SCADA layer, the optimiser, the market interface. Each is supplied by a different actor, often a different vendor, and each reasons on what the layer below reports. The PCS acts on a derate from the BMS. The EMS dispatches on availability and state of charge reported up from the BMS. The optimiser places into the market on the EMS’s view. The audit trail runs upward. It does not run downward, and in most architectures it cannot reach the cells at all.
So the failures concentrate exactly where the visibility is weakest, in the integration between vendors. It is the layer we built for, and where we watched nominally identical units diverge. The largest published analysis of grid-scale battery failure incidents, by EPRI with PNNL and TWAICE in 2024, found that of twenty-six with an assignable root cause, only three traced to the cells; ten traced to integration, assembly and construction, the single largest cause. The failures gather in the joins between parts, not the parts themselves. Renewables carry the same pattern in a different vocabulary: inverter fleets, a plant controller integrating the lot, and grid-code obligations, the reactive power or the ride-through a connection agreement requires, that depend on each box doing what the layer above believes it did. When the event is later questioned, the audit trail can show what each layer decided, but not what the inverter or the controller was actually doing at the boundary where the decisions met.
The number the counterparty produces
State of health is the headline case. It is the number on which augmentation timing turns, warranty triggers fire, and a large part of asset valuation rests. It is also a model output: the model is the OEM’s, the inputs are the OEM’s, the calibration is the OEM’s. When it disagrees with what the operator believes about the asset, the independent measurements they can bring are thin. A periodic capacity test is independent but infrequent and costly, taken offline under reference conditions. Third-party analytics that re-model the same vendor telemetry inherit its limits. Even the analytics firms say as much of the layer beneath them: a 2025 study by the battery analytics firm ACCURE, across more than a hundred grid-scale systems, found that one in five collects only low-quality data.
The number that drives the contract is produced by the counterparty to the contract.
It is worth being precise about what would close that gap, because it is easy to overclaim. The operator’s missing piece is not a rival state-of-health figure; deriving one is the capacity test’s job. It is something more basic and more often useful: independent evidence of how the BMS that produces the number is actually behaving and configured, and a direct read of what the device holds beneath the summary its dashboard chooses to show.
What it would take
The missing thing is narrow, and it is not more telemetry, which is the vendor’s account by another name. It is independent evidence of what a specific device was actually doing: what it put on the wire, how it was configured, how it responded, taken from the device itself rather than the layer that summarises it, and available when the question is live. Episodic, brought to the device, under the operator’s control, and any step that touches live equipment is theirs to authorise.
That is the diagnostic Iris is built for, brought to the BMS, the PCS, the inverter or the site controller. In a fault or a dispute, it shows which layer is genuinely misbehaving, so the integrator, the OEM and the owner argue from one account instead of three. Often the asset itself is fine and the fault is in the telling: the device put one value on the wire and the layer above acted on another, a stale or misscaled reading that no dashboard surfaces. And captured at commissioning, it leaves an independent baseline of how each unit actually behaved and was configured, so that when the dispute arrives two years later there is a reference that is not the vendor’s own.
Show which layer is at fault, instead of arguing it.
The limits are the point. Iris reads the controller, not the chemistry behind it: it does not measure a cell’s true state of charge or re-derive its health, and it will not hand you a state-of-health number to set against the OEM’s. It is episodic, brought to a device when there is a question, and it works a device or a sample, not a whole fleet at once. And it stops at the connection point; the grid beyond is someone else’s to see. What it owns is the layer where the disputes actually begin: the controller, its configuration and how it behaves.
Closing
The transition will not wait for the evidence to catch up. Batteries and renewables are already being financed, warranted, insured and dispatched on numbers their own devices cannot independently corroborate. Every contract in the stack assumes that someone can prove what the asset actually did. Today, at the device, no one can, because the asset was never built to let them.
We have stood at that layer and read it directly. That is what Axions brings to it: independent evidence from the device itself, brought to the controller when the question is live, so a battery or a renewables site can prove what it was actually doing.
What is actually happening is mostly invisible until you have the right instrument.