The id register returns 0xFFFF. What does that mean?

A value of 0xFFFF in any SunSpec model header register means the model is not implemented on this device. Confirm the device firmware supports the Secure SunSpec Modbus specification and that you are addressing the correct base register offset where Model 3 sits in the device's model chain.

All off1 through off50 registers read zero. Is that normal?

Yes, until a client writes the desired point offsets into those RW registers, they default to zero. Write the offsets of the data points you want included in the signed response before triggering a read. Writing all zeros will result in an empty or invalid signed dataset response from the device.

The device rejects my secure read request with an exception code. Why?

The most common cause is a stale or mismatched timestamp in the ts and ms registers. The device checks the client-supplied timestamp against its own clock to prevent replay attacks. Ensure your Gateway clock is synchronized via NTP, and that the ts value you write is current within the device's accepted tolerance window.

Is it safe to write the role and seq registers repeatedly in a polling loop?

Write the role register only when changing authorization level; do not write it in every poll cycle. The seq register must be incremented with each new request, not held constant. Writing role with an invalid or unsupported value will cause the device to return a Modbus exception, and repeated invalid writes may trigger a security lockout depending on the device implementation.

Free Modbus template: SunSpec Model 3 — Secure Dataset Read Request

Name: SunSpec Model 3 — Secure Dataset Read Request
Brand: SunSpec
SKU: 24334b55-76de-4e32-ad91-87ffa412195c

SunSpec Model 3 is a protocol-level model defined by the SunSpec Alliance for issuing cryptographically authenticated dataset read requests over Modbus TCP. It is used with SunSpec-compliant DER devices such as inverters, battery storage systems, and energy meters that implement the Secure SunSpec Modbus specification. The template exposes the full request structure: the target model index, up to 50 data-point offsets, a client-supplied timestamp and millisecond component for replay protection, a sequence number, a role authorization field, and the algorithm identifier and signature-length registers. It gives integrators a direct view into the secure read handshake without opening the SunSpec specification document.

Registers (59)

59 read / 55 write

Name	Address	Function	Type	Access
id SunSpec model identifier, fixed value 3 for this model.	•••	•••	•••	R
l Length of this model block in 16-bit registers.	•••	•••	•••	R
x Index of the target dataset model to be securely read.	•••	•••	•••	R/W
off1 Offset of data point 1 within the target dataset model.	•••	•••	•••	R/W
off2 Offset of data point 2 within the target dataset model.	•••	•••	•••	R/W
off3 Offset of data point 3 within the target dataset model.	•••	•••	•••	R/W
off4 Offset of data point 4 within the target dataset model.	•••	•••	•••	R/W
off5 Offset of data point 5 within the target dataset model.	•••	•••	•••	R/W
off6 Offset of data point 6 within the target dataset model.	•••	•••	•••	R/W
off7 Offset of data point 7 within the target dataset model.	•••	•••	•••	R/W
off8 Offset of data point 8 within the target dataset model.	•••	•••	•••	R/W
off9 Offset of data point 9 within the target dataset model.	•••	•••	•••	R/W
off10 Offset of data point 10 within the target dataset model.	•••	•••	•••	R/W
off11 Offset of data point 11 within the target dataset model.	•••	•••	•••	R/W
off12 Offset of data point 12 within the target dataset model.	•••	•••	•••	R/W
off13 Offset of data point 13 within the target dataset model.	•••	•••	•••	R/W
off14 Offset of data point 14 within the target dataset model.	•••	•••	•••	R/W
off15 Offset of data point 15 within the target dataset model.	•••	•••	•••	R/W
off16 Offset of data point 16 within the target dataset model.	•••	•••	•••	R/W
off17 Offset of data point 17 within the target dataset model.	•••	•••	•••	R/W
off18 Offset of data point 18 within the target dataset model.	•••	•••	•••	R/W
off19 Offset of data point 19 within the target dataset model.	•••	•••	•••	R/W
off20 Offset of data point 20 within the target dataset model.	•••	•••	•••	R/W
off21 Offset of data point 21 within the target dataset model.	•••	•••	•••	R/W
off22 Offset of data point 22 within the target dataset model.	•••	•••	•••	R/W
off23 Offset of data point 23 within the target dataset model.	•••	•••	•••	R/W
off24 Offset of data point 24 within the target dataset model.	•••	•••	•••	R/W
off25 Offset of data point 25 within the target dataset model.	•••	•••	•••	R/W
off26 Offset of data point 26 within the target dataset model.	•••	•••	•••	R/W
off27 Offset of data point 27 within the target dataset model.	•••	•••	•••	R/W
off28 Offset of data point 28 within the target dataset model.	•••	•••	•••	R/W
off29 Offset of data point 29 within the target dataset model.	•••	•••	•••	R/W
off30 Offset of data point 30 within the target dataset model.	•••	•••	•••	R/W
off31 Offset of data point 31 within the target dataset model.	•••	•••	•••	R/W
off32 Offset of data point 32 within the target dataset model.	•••	•••	•••	R/W
off33 Offset of data point 33 within the target dataset model.	•••	•••	•••	R/W
off34 Offset of data point 34 within the target dataset model.	•••	•••	•••	R/W
off35 Offset of data point 35 within the target dataset model.	•••	•••	•••	R/W
off36 Offset of data point 36 within the target dataset model.	•••	•••	•••	R/W
off37 Offset of data point 37 within the target dataset model.	•••	•••	•••	R/W
off38 Offset of data point 38 within the target dataset model.	•••	•••	•••	R/W
off39 Offset of data point 39 within the target dataset model.	•••	•••	•••	R/W
off40 Offset of data point 40 within the target dataset model.	•••	•••	•••	R/W
off41 Offset of data point 41 within the target dataset model.	•••	•••	•••	R/W
off42 Offset of data point 42 within the target dataset model.	•••	•••	•••	R/W
off43 Offset of data point 43 within the target dataset model.	•••	•••	•••	R/W
off44 Offset of data point 44 within the target dataset model.	•••	•••	•••	R/W
off45 Offset of data point 45 within the target dataset model.	•••	•••	•••	R/W
off46 Offset of data point 46 within the target dataset model.	•••	•••	•••	R/W
off47 Offset of data point 47 within the target dataset model.	•••	•••	•••	R/W
off48 Offset of data point 48 within the target dataset model.	•••	•••	•••	R/W
off49 Offset of data point 49 within the target dataset model.	•••	•••	•••	R/W
off50 Offset of data point 50 within the target dataset model.	•••	•••	•••	R/W
ts Unix timestamp written by client for replay-attack prevention.	•••	•••	•••	R/W
ms Millisecond sub-second component of the client-supplied timestamp.	•••	•••	•••	R/W
seq Sequence number incremented per request to prevent replay attacks.	•••	•••	•••	R/W
role Client authorization role level for this secure read request.	•••	•••	•••	R/W
alg Signature algorithm identifier used to sign the response dataset.	•••	•••	•••	R
n Count of signature registers appended after this model block.	•••	•••	•••	R

Loading registers…

SunSpec Model 3 — Secure Dataset Read Request

Overview

Use cases

Installation

Things to watch for

Registers (59)

Working with Modbus in your projects?

Question about your setup?

More SunSpec templates

SunSpec Model 709 — DER Trip LF

SunSpec Model 139 — LVRTX

SunSpec Model 19 — PPP Link

SunSpec Model 601 — Tracker Controller DRAFT 2

SunSpec Model 64412 — DER Cyber Exploitation

SunSpec Model 135 — LFRT

More TCP templates

Algodue Energy meter UEM80-2D E

Sigenergy SigenStore EC (grid)

Fronius GEN24

HUAWEI SUN2000 Inverter & LUNA2000 battery

NIBE Nibe S-Series (SG Ready)

Fronius - Modbus TCP