SunSpec Model 18 — Cellular Link
SunSpec Model 18 is a standardized network-configuration block defined by the SunSpec Alliance to describe a cellular interface link on any SunSpec-compliant DER device. This template reads the model identifier and block length, and exposes read/write fields for the interface name, modem IMEI, APN, phone number, and SIM PIN over Modbus TCP. Importable with one click into the ModbusCloud portal, it lets installers verify and update cellular connectivity parameters across remote sites without visiting the installation.
- Protocol
- Modbus TCP
- Connection
- Ethernet, Modbus TCP
- Registers
- 7, read and write
- Brand
- SunSpec
- Last updated
Registers (7)
7 read, 5 write
| Name | Unit | Access | Address (Hidden until you enter your email) | Function (hidden) | Type (hidden) |
|---|---|---|---|---|---|
| id | Read | ||||
| l | Read | ||||
| nam | Read and write | ||||
| imei | Read and write | ||||
| apn | Read and write | ||||
| num | Read and write | ||||
| pin | Read and write |
Loading registers…
Send your device list
If a device is not in the library yet, we build the template for free as soon as we have the register data.
Use cases
- Verify the APN string on a remote cellular gateway matches the mobile operator's required configuration.
- Read the modem IMEI to cross-reference hardware assets against your SIM management system.
- Alert on unexpected changes to the cellular interface name, which may indicate unauthorized configuration edits.
- Compare the stored phone number against your SIM inventory to confirm correct SIM cards are installed.
- Track model block length values to detect firmware updates that alter the cellular model structure.
Installation
Confirm that the target DER device supports SunSpec Model 18 by scanning its Modbus holding registers for the 'SunS' marker and checking that model ID 18 appears in the model chain.
Connect the ModbusCloud Gateway to the same network segment as the device, ensuring TCP port 502 is reachable from the Gateway to the device's IP address.
In the ModbusCloud portal, add a new device, select Modbus TCP, enter the device IP address and unit ID, then import the SunSpec Model 18 Cellular Link template and set the correct base address offset.
Spot-check by reading the 'id' register and confirming it returns 18, and read 'apn' to verify the cellular APN string matches your operator's settings.
Things to watch for
The 'id' register reads zero or garbage. What is wrong?
The base address offset may be misconfigured. SunSpec device maps can start at Modbus address 0, 40000, or 50000. Scan from each candidate start address for the 'SunS' marker (0x53756E53), then step through model blocks to locate Model 18. Using the wrong offset shifts all register reads and returns invalid data.
String registers like 'apn' or 'nam' return garbled text. Why?
SunSpec string registers are stored as big-endian UTF-8 byte pairs across consecutive 16-bit holding registers. If your client reads them as raw integers without reassembling the byte stream and stripping null padding, the output will appear garbled. Configure your Modbus client to interpret the register range as a packed ASCII or UTF-8 string.
Writing to 'apn' or 'pin' has no effect on the device. What now?
Some devices require a commit or save action after writing configuration registers. The write may also be blocked if the device is in a read-only state due to an active cellular session. Disconnect the cellular session first, write the register, then trigger a reconnect. Confirm the device documentation for any required follow-up register write.
Is it safe to write the 'pin' and 'imei' registers remotely?
Use extreme caution. Writing an incorrect PIN can trigger SIM lock after a small number of failed attempts, disabling cellular connectivity entirely. Writing the IMEI register, where supported, may violate regulatory requirements or void device warranty. Always verify the correct values offline before committing a remote write, and restrict write access to authorized personnel only.
Knowledge base articles for this device
SunSpec Modbus: one register map for many inverters
SunSpec Modbus is the open register map SMA, Fronius, SolarEdge and Kostal share. The layout, int+SF vs float, the TCP port per brand and reading a mixed fleet.
Fronius Modbus: read a Symo GEN24 over Modbus TCP
Fronius Modbus explained: enable Modbus TCP on the Symo GEN24 on port 502, choose between int+SF and float, read the right SunSpec registers and scale them correctly. Practical guide for solar installers.
SMA Modbus: reading a Sunny Boy over Modbus TCP (installers)
SMA Modbus explained: enable the Modbus TCP server on port 502, choose between the SMA profile (unit ID 3) and SunSpec (unit ID 126), read the right registers, and handle the NaN values at night. Practical guide for installers.
Want to see how it works?
