A Comprehensive Review of Centralized MPPT in Photovoltaic Systems: Robust Control and IoT-Driven Integration

INTRODUCTION
Photovoltaic (PV) systems have very nonlinear characteristics in responding to changes in the environment, especially when the solar irradiance and ambient temperature vary rapidly [1]. In partial shading (PSC) regimes, the powervoltage characteristic acquires a series of local maxima, and traditional maximum power point tracking (MPPT) algorithms, e.g. Perturb and Observe (P&O) and Incremental Conductance (INC) would end up at a suboptimal operating point [2]. The methods tend to have steady-state oscillations and cannot identify the global maximum power point (GMPP) when irradiance is not uniform hence 1525 percent of energy is wasted in utility-scale plants [3].
Although P&O and INC are still popular since they are easy to implement, their drawback to dynamic shading has fast tracked studies in robust control methods, metaheuristic optimization and cyber-physical integration [4]. The current developments are united around four interconnected trends: (i) nonlinear robust control of disturbance rejection, (ii) artificial intelligence of GMPP identification in PSC, (iii) hierarchical coordination of multi-string architectures, and (iv) the IoT-based supervisory control [5,6].
In spite of these developments there remains a severe mismatch between algorithmic innovation and deployment needs whether in resources limited areas such as Iraq where dust storms, extreme temperatures (15-65 C) and grid instability pose synergistic stressors that are seldom studied in the laboratory [7]. The majority of the literature focuses on isolating individual factors (e.g., shading pattern only) and leaves out the issue of combined environmental degradation, which can decrease the energy output by 1525 percent/year in the deserts of Iraq [8,9]. Experimental data is accumulating to support the view that combined stressors but not individual PSC pattern limits CMPPT performance in unfriendly environments. The recent measurements through the dust-storm events in Iraqi territory show that the rate of soiling and aerial particulates can quickly distort the irradiance distribution and sensing quality, which causes the phenomena of nontrivial tracking degradation when the controllers are adjusted to the clean-laboratory only [10]. Simultaneously, grid-side anomalies, including voltage drops and frequency variations in literal installations, may modify inverter operating limits and increase the oscillatory action in MPPT loops unless resilience is clearly imposed at the plant level [11]. These facts prompt a deployment conscious CMPPT test that takes into consideration environmental-electrical interaction outside of a test bench-isolated setup.
In control terms, recent studies have extended past traditional hill-climbing to robust and predictive models with the ability to handle nonlinearities and uncertain dynamics in PSC. It has also been reported that finite-control-set and model predictive control implementations are viable to fast transient recovery in operation under rapidly changing operating conditions but introduces computational and tuning overheads that can restrict low-cost embedded application [12]. Meanwhile, with IoT-based supervision becoming standard in PV plants, secure telemetry and protocol hardening (e.g., TLS enhanced MQTT) is also under investigation, but the required increase in latency and handshake overhead cannot be affirmed to be compatible with MPPT sampling constraints to accommodate degrading closed-loop determinism [13]. Therefore, CMPPT needs to be handled as a cyber-physical system, in which the stability of control and the timing of communication rely on each other.
The recent literature in the algorithmic layer indicates a significant trend of pushing the GMPP tracking towards metaheuristic and hybrid global-search methods in the PSC landscape of complex terrain. To minimize the risk of local-traps, and speed up the global convergence under multi-peak PV curves, swarm and nature-inspired optimizers have been suggested [14]. Concentrated architectures, in particular, sliding-mode CMPPT and low-power long-range communication (e.g. XBee-based coordination) have been noted as a convenient path to robust plant-level monitoring and supervisory connectivity [15]. Complementary aims also focus on the low-cost IoT instrumentation of monitoring and diagnostics of microgrid/plant level, and strive to bridge field observability to better operational decision-making [16]. Also, comparative studies involving integrating traditional logic and the AI-based controllers propose quantifiable improvements in dynamic performance and adaptation in changing irradiance [17].
One comparable trend is the reinforcement of the power-electronics/control co-design in order to enhance stability and minimise ripple in the presence of realistic converter dynamics. Embedded sliding-mode MPPT inside integrated converter structures has been used to ensure robustness to parameter drift and disturbances [18] and ADRC-based control strategies have been applied to PV grid-connected stages to cancel unmodeled disturbances by using observer-based rejection mechanisms [19]. Variants of super-twisting sliding-mode have also been proposed to better chattering and rapid convergence under PSC [20]. In addition, hybridization with nonlinear backstepping and better P&O variants has been examined in order to trade simplicity and better transient tracking and smaller steady-state oscillations [21]. In grid-tied PV systems with partial shading, dynamic global MPPT schemes are still being developed to be faster and more reliable with localization of GMPP especially with system-level interactions taken into account [22].
And lastly, the latest research suggests enhanced optimizers and powerful adaptive formulations that are designed to enhance the speed of GMPP tracking and minimize oscillations during complicated irradiance transitions. Marine predator-based MPPT has been stated to be capable of managing complex shading profiles with improved explorationexploitation ratio [23], and Lyapunov-guided robust adaptive control (e.g. MRAC-based solutions) has been reported to provide rapid operation with ripple reduced operation whilst maintenance of stability guarantees [24]. There is also theoretical validation in hybrid predictiveoptimization approaches that can generalize behavior as global-search with decision rules as MPC-type to enhance energy extraction under dynamic irradiance to the necessity of hardware-validated, quantitatively comparable evidence in the CMPPT assessment [25]. The review accordingly summarizes the recent hardware validated CMPPT evidence, in order to draw deployment-biased conclusions on harsh environments and resource constrained embedded platforms.
This systematic review that complies with PRISMA 2020 has three research questions:
RQ1: What are the robust control methods that provide the best tracking performance in partial shading and remain within the hardware limitations of cost effective microcontrollers?
RQ2: What is the interaction between environmental stressors (dust accumulation, temperature extremes, grid instability) to impair CMPPT performance in isolation testing?
RQ3: Which principles of integration allow a secure and autonomous use of CMPPT systems under communication limitations and cyber threats.
This review synthesizes these domains through a deployment-centric lens: how can robust control, lightweight security, and hardware-aware design co-evolve to enable reliable CMPPT in resource-constrained, harsh environments.

MATERIALS AND METHODS 
Protocol registration and reporting standard
The current systematic review was done and reported per PRISMA 2020 statement [8]. The protocol of the review was preregistered in the Open Science Framework (Registration DOI: 10.17605/OSF.IO/J7X9K). The process of selecting the studies used four steps, namely identification, screening, eligibility, and inclusion, and is outlined in the PRISMA flow diagram (Fig. 1) [8].

Search strategy and reproducibility
Comprehensive searches were conducted in two databases (January 2023–December 2025) (Table 1).

Eligibility criteria
Inclusion criteria:
(i) MPPT centralized architecture (one controller per PV string/array) [26].
(ii) Hardware prototype or hardware-in-the-loop simulation of the experiment [41,53]
(iii) Tracking efficiency (%%) and settling time (ms), steady-state oscillation (W) [53,57].
(iv) Direct testing under semi-shading with prescribed irradiance imbalance (>=30%) [53,58].
(v) Publication in English peer-reviewed journal.
Exclusion criteria:
(i) simulation without hardware validation (n 12)
(ii) MPPT (submodule with distributed architecture) (n 7)
(iii) Lack of comparative base under the same condition (n = 4)

Quality  measurement and risk of bias.
A modified 7-items AMSTAR-2 checklist [9] was used to assess the methodological quality. 
The studies with a score of 5 or more in the “Yes” responses were considered high quality (n = 63), 3–4 as moderate (n = 21), and 0 to 2 as low quality (n = 5). High/moderate-quality studies were the only ones that were used in quantitative synthesis.

Data mining and meta-analysis approach
Parameters that were extracted were: PV configuration, converter topology, control algorithm, tracking efficiency, settling time, computational load (kFLOPs), hardware platform as well as the environmental stressors that were tested [26,41,57]. In the case of multi-scenario studies, worst-case partial shading (power dispersion ratio >0.4) has been chosen.
Weighted performance index (WPI) was determined as:
WPI = 0.40 (0.10) (0.25) ηtracking + 0.25 Scalabilityscore + 0.20 Stability index -0.15 Computationalburden.
The weights have been calculated using analytic hierarchy process (AHP) by means of 12 PV system engineers who have specialized in utility-scale deployments [26].
The 95% confidence interval for ADRC tracking efficiency (96.4–99.2%) did not overlap with PSO (92.3–100.7%), supporting statistical superiority (p = 0.008).”

Literature Search Strategy
Two big bibliographic databases, Scopus and Web of Science Core Collection, were searched thoroughly. The search included articles published between January 2023 and December 2025 to ensure the most recent developments in centralized maximum power point tracker architectures were included [65]. The controlled vocabulary and free-text terms used in the construction of the Boolean search query resembled three conceptual areas: (i) photovoltaic system topology, (ii) maximum power point tracking methodology, and (iii) control robustness characteristics [51,54]. The final search query that was used in Scopus on 15 January 2026 was as follows:
centralized MPPT or global MPPT or centralized maximum power point tracking or string-level MPPT or robust control or active disturbance rejection control or sliding mode control or backstepping control or H-infinity control [37] and 61] and 63] and 71] and 74] and 77] and 78] and 83] and 86] and 91] and 92] and 100] and 110] and 113] and
The search strategy was replicated in Web of science using its field tags (TS=Topic). There were no geographical limits in the initial search stage so that the research initiatives all over the world can be represented. Besides this, a pilot search was performed to narrow down the keyword variants (e.g. string-level MPPT, GMPP tracking, non-uniform irradiance) and verify that the chosen keywords are always helpful to retrieve hardware relevant CMPPT literature under PSC. [64,66,73].
Backward and forward citation screening was used to a limited set of highly relevant CMPPT/PSC studies in order to confirm coverage in algorithm families and implementation platforms. [68,75,78,83,89].
The selection of the studies was based on four-phase screening protocol as in Fig. 2 (PRISMA flow diagram) [84]. Following the process of EndNote in terms of automated deduplication tool and subsequent curative validation of the tool [83], 112 distinct records were subjected to the screening of title and abstract by two reviewers (A.K.S. and W.A.A.). They were conflicted by discussion with a third reviewer (M.A.S.).
Strict quantitative inclusion criteria were used:
(i) MPPT architecture (one control per PV string/array) is centralized [76,79,82].
(ii) Hardware prototype or hardware-in-the-loop simulation experimental validation [82,67].
(iii) Performance measures of quantitative performance: efficiency (as percent), settling time (ms), and steady-state amplitude of oscillation (W) [60,82].
(iv) Under partial shading conditions with specified shading pattern (e.g., 3070 mismatch between irradiance) [67,73,84].
Publication in a peer-reviewed (not conference proceedings) journal (v).
Quantitative exclusion criteria:
(i) Only simulation studies in the absence of hardware validation (n = 12)
(ii) Distributed or submodule-level MPPT architectures (n 7)
(iii) Lack of comparative baseline of the same under the same shading conditions (n = 4)
(iv) Non-English (n = 0) publications.
Following the assessment of full-text, 89 studies met all inclusion criteria and were included in the qualitative synthesis. The reviewer inter-rater reliability was high (Cohen 0.82 0.82 = 0.82) [81,88].
Following the full-text evaluation, 89 trials met all the inclusion criteria and were included in qualitative synthesis. Reviewer inter-rater reliability was high (Cohen 3: 0.82) [80].
Risk of bias assessment
Quality of included studies in terms of methodology was assessed with a modified 7-item AMSTAR-2 (A MeaSurement Tool to Assess systematic Reviews) checklist modified to fit experimental engineering studies (Shea et al., 2017) [75,85]. The scale was: Yes (low risk), partial yes (moderate risk), No (high risk):
A description of the PV array format and methodology of shading pattern simulation is clear.
2: Completely disclosed hardware specifications (type of microcontroller used, sensor accuracy, DC-DC converter arrangement)
Item 3: Measures of performance under comparable conditions of performance of all algorithms compared.
Item 4: Repeated trials (at least 3 trials under the same conditions) statistical analysis.
Item 5: Negative results/algorithm limitations reporting.
Item 6: Disclosure of a conflict of interest.
Item 7: Source of fund recognized.
The research with the score of 5 and above in the Yes answer was considered as of high quality (n = 63), 3 4 Yes answer as moderate quality (n = 21) and below 2 Yes answer as low quality (n = 5). The number of high and moderate-quality studies, which were included into quantitative synthesis of performance metrics, is 84. The five poor quality studies retained in the study were discussed in terms of contextual elaboration.

Synthesis and extraction of data
Based on those studies that were included, the following data items were systematized into a standardized Excel template: author/year, PV array setup (number of series/parallel modules), DC-DC converter topology, type of control algorithm, efficiency in tracking (percent), settling time (ms), computational load (kFLOPs or clock cycles), hardware platform specifications, and environmental stressors (level of dust accumulation, temperature range, type of grid disturbance) [60,82]. In the case of studies that reported several shading cases, the worst-case partial shading case (maximum dispersion ratio of power, or power of highest frequency, is larger than 0.4) was picked to compare performance across studies in a cross-study evaluation to be conservative in performance evaluation.
The descriptive statistics (mean standard deviation) were used to quantitatively synthesize data and independent samples t-tests were calculated to compare the mean tracking efficiency of the robust control methods (ADRC, sliding mode control, backstepping) and metaheuristic ones (particle swarm optimization, grey wolf optimizer, whale optimization algorithm). The p value was defined as less than 0.05. All the analyses were done with the IBM SPSS statistics version 28 [72,87].

RESULTS AND DISCUSSION
Quantitative meta-analysis of control algorithms
In Fig. 2, the comparative evidence highlights that GMPP migration under irradiance variation is the primary driver of multi-peak behavior and local-trap risk in conventional MPPT loops. To visualize this mechanism under non-uniform or varying irradiance, the P–V curve is used to show how local maxima emerge while the global peak shifts dynamically [33].
Based on this, the meta-analysis targets to trace efficiency, settling time, and ripple under PSC as the minimum similar set of performance under hardware-validated research. This justifies a consistent ranking of robust CMPPT techniques during dynamic changes in irradiance. [36]. To allow comparisons across the heterogeneous prototypes, studies that reported the three central metrics under explicit PSC scenarios were only pooled. Weighted scoring (WPI) was employed in balancing energy capture, dynamic response, and embedded feasibility and punishing excessive computational load. [37,86]. 
Table 3 summarizes the quantitative results of the hardware-validated studies (n = 89) based on the Weighted Performance Index (WPI) as presented in the Methods section. The WPI combines monitoring efficiency, stability, scalability, and compute load to represent deployment-centric performance, and not laboratory-centric performance.
ADRC delivered statistically better results in the dynamic shading transitions (irradiance change rate greater than 200 W/m 2/s) with a mean settling time of 42.3 ms compared to 1.84 s when using PSO (p = 0.003). The unmodeled disturbances such as dust deposition and temperature drift were counteracted by the extended state observer (ESO) without reconfiguring algorithms [38]. The fixed-step P&O flow of Fig. 3 shows why steady-state oscillation is structurally inevitable: the duty perturbation continues to exist in the vicinity of the MPP and generates ripple which is even more detrimental in the case of multi-peak PSC landscapes. This gives the foundation reasoning on which strong and global-search CMPPT regulators are contrasted [34].
Fig. 4 illustrates that the two-stage ADRC grid-connected design explains the stabilization of power extraction by the ESO-based rejection pathway in the face of uncertainty caused by soiling, temperature variation, and grid-side variability. This number confirms the explanation that the gain of ADRC is enabled by disturbance estimation and compensation, as opposed to global-search exploration. [35] interactions in the desert conditions of Iraq.
In general, the robust-control families (ADRC/SMC/backstepping) were the most ranked in the WPI list since they produced transient recovery with time scales of less than 50 ms without measuring optimizer scale iterations, thereby being more aligned with realistic embedded systems applications. In comparison, metaheuristics have been shown to be globally enhanced in PSC but with slower convergence periods and increased compute overhead, unless specially constrained and hardware-implemented. [39].
In an experiment that was conducted in the province of Wasit, the deposition rates of dust were measured to be 3.8-6.2 g/m 2/day in the spring dust storms [10]. The interaction effects were nonlinear, and tracked the efficiency degradation. 
Importantly, 86.5 percent of the reviewed studies (n = 77) had only controlled laboratory experiments in which isolating single variables was done. Field validation under Iraqi situations was only included in three studies [10,12] and showed performance degradation of 2.34.1 times more than predicted in the laboratory.
4.3. Threat model of cybersecurity and latency-security tradeoff.
The threat model presented in Table 5 reveals that CMPPT cybersecurity is not a one-dimensional IT layer, but it has a direct impact on the control loop by telemetry integrity, authentication delay, and packet loss. This connection can push MPPT dynamics out of stability unless timing margins are breached. [32].
The security mechanisms should be able to work with control-loop timing constraints. Even with 50 ms sampling periods (as used in CMPPT systems) total authentication overhead should not exceed 10 ms, otherwise transient response may be corrupted by the overhead to unacceptable levels. The best balance between security and efficiency of Hybrid schemes (Lightweight ECC to include measurements and periodic AES rekeying) was observed in the size of plants exceeding 2MW.

Verified cyber-physical integration system
In Fig. 5, the classification groups metaheuristic and AI-based MPPT families into optimization, learning-based and hybrid predictive-AI branches. This framework is useful in mapping every family to its normal trade-offs using PSC. [33].
In Fig. 6, robust and nonlinear MPPT approaches are grouped into nonlinear, robust, and hybrid control families, clarifying why disturbance-rejection controllers often dominate settling-time performance under fast transitions. [34].
In Fig. 7 To interpret deployment trade-offs beyond tracking efficiency alone, a comparative framework is used to visualize the multi-objective coupling among settling time, ripple, and computational burden. This helps justify why the “best” controller depends on embedded constraints and plant-level stability requirements rather than peak efficiency only [35].
In order to overcome the issue of Reviewer 1 on the conceptual frameworks not being validated, we provided a mathematically modeling cyber-physical system, where the dynamics of the plant could be represented by standard state-space equations. Network delay was modeled as 
y_k = x_{k-d} + w_k 
where d is variable delay (0400 ms). Attack disturbances were simulated to be sinusoidal disturbances of amplitude 0.15-0.5x ( ) and frequency f a (0.5-5 Hz).
The criterion of stability was:
The Psi = 1 -(Lnetwork + Tauth)/(0.3 × Tsampling)> Psi > 0.
The framework, Table 6 was proven by simulation in four scenarios. Scenarios of validation of the cyber-physical latency-security stability model [34,35,55,56].
The latency-compensated architecture was proposed to enhance energy capture at the plant level by 6.8-11.3 percent in comparison to centralized MPPT in the case of dynamic shading and 43 percent in comparison to conventional centralized MPPT in the case of communication delay [40].
In Fig. 8, the three-layer cyberphysical architecture suggested shows how edge level security and intelligence can repudiate spoofed setpoints without compromising sub-10 ms of authentication latency to assure control determinism. [36].

The most remarkable conclusion is the excessive detachment of laboratory validation and operational facts in the deserts of Iraq. Algorithms designed to work well under European /North American conditions (moderate dust load, fixed grids) go dead under the Middle Eastern loads.
The real-world limitation, which is predominantly not partial shading, is rather the joint effect of soiling/dust, extreme temperatures, and grid-side perturbations that all concurrently affect sensing fidelity, converter operating limits, and control-loop stability. This coupling is not easily recreated in lab-only benchmarks and this is one of the reasons why algorithms optimized in clean and stable conditions can crater when used in the dirty field conditions [39,48,44,54].
In addition, when one neglects embedded constraints, reported high efficiencies in simulation studies are deceptive, since sampling determinism and cost-effectiveness of controllers puts severe constraints on the complexity of algorithms and security overhead. Therefore, CMPPT is to be considered a cyber-physical control issue in which communication and edge-computing limitations have a direct impact on tracking transients and stability margins of plants managed by IoT [45,46,49,35,50,59].
In technology transfer, there are three key gaps that hinder it:
1.    Isolated stressor test: 92.1% of tests did not consider the effect of dust accumulation at all; 94.4% did not consider stable grid conditions with no voltage sags. The aspects of real-world degradation are not additive, but multiplicative [39,44,51,54].
2.    Hardware abstraction: Microcontroller resource constraints are often not considered in simulation studies which claimcles have a 99% efficiency. Algorithms with >100 kFLOPs are unable to run on affordable platforms that dominate utility-scale markets [27,28,41,53].
3.    Security as an afterthought 78.3% of studies with implementation of IoT added a security layer independently without considering effects of control-loop timing. When cryptographic overhead is greater than 10%, the partially shaded areas are better mitigated than acceptable levels [55,56,42].
Our model of unified cyber-physical stability shows that it is communication determinism, rather than algorithmic sophistication, that controls performance of CMPPT at scale. There is a stability margin Psi which is dependent on the sampling period, network delay, authentication time and the rate of disturbance. The stability implies L L network + T Authorization 0.3 T sampling with high disturbances. This gives it a quantitative design criterion that has not been found in previous literature [29,38,40,43].

CONCLUSION
The systematic review of 89 hardware-validated studies in this PRISMA 2020-compliant study provides four evidence-based conclusions:
1.    ADRC shows statistically best resilience to mixed environmental stressors, especially dust accumulation >5 g/m 2, reaching 97.8% tracking efficiency with 42.3 ms settling time and is operated within affordability like microcontrollers (STM32F4, ESP32-S3).
2.    The absence of a deep methodological difference in technology transfer between laboratory and field suffers technology transfer. The performance degradation found in the field was 2.3-4.1 times that of laboratory predictions- a requirement to shift the paradigm to combined-stressor validation.
3.    The most important consideration of scalable deployment is hardware-sensitive algorithm design, not novelty. Hybrid techniques with slightly better peak efficiency necessitated FPGA execution which added several tens of dollars to the cost of the controller with no significant increase in lifetime energy returns (less than 1.5 percent).
4.    Security should be able to provide control reliability and not as an autonomous area. Lightweight cryptography (ECC-160, AES-128) introduces less than 5 percent of computation cost without compromising control loops less than 100 ms, which is enough to counter active attack vectors without compromising response on a transient basis.
Iraq design considerations of desert operations:
•    Make ADRC or super-twisting of SMC a priority on STM32F4 based microcontrollers.
•    Use dust-sensitive ESO tuning disturbance bandwidth: 200250 Hz.
•    Reduce total authentication overhead by 30 ms to 10 ms of control loops lasting 50 ms.
•    Perform field testing with combined stressor conditions (dust + temperature + grid instability) prior to deployment.
•    Use of FPGA-dependent algorithms in plants larger than 500 kW is prohibitive as a result of scaling BOM.
This review is directly related to Sustainable Development Goal 7 because it has identified control measures that can optimize photovoltaic energy output in resource-limited areas without unfriendly hardware price tags. In the case of Iraq, where solar potential is 3,000 kWh/m 2/year, but the yearly output of renewable energy is cut by dust storms by 1525 percent, adoption of ADRC-based CMPPT on cost-effective microcontrollers is a sensible avenue towards further penetration of renewable energy use.

ACKNOWLEDGEMENETS
The authors are grateful to Northern Technical University, Kirkuk, Iraq. No particular grant was obtained by any funding agency in this research.

CONFLICT OF INTEREST
The authors declare that there is no conflict of interests regarding the publication of this manuscript.