SunSpec Model 3 — Secure Dataset Read Request
SunSpec Model 3 is a protocol-level model defined by the SunSpec Alliance for issuing cryptographically authenticated dataset read requests over Modbus TCP. It is used with SunSpec-compliant DER devices such as inverters, battery storage systems, and energy meters that implement the Secure SunSpec Modbus specification. The template exposes the full request structure: the target model index, up to 50 data-point offsets, a client-supplied timestamp and millisecond component for replay protection, a sequence number, a role authorization field, and the algorithm identifier and signature-length registers. It gives integrators a direct view into the secure read handshake without opening the SunSpec specification document.
- Protocol
- Modbus TCP
- Connection
- Ethernet, Modbus TCP
- Registers
- 59, read and write
- Brand
- SunSpec
- Last updated
Registers (59)
59 read, 55 write
| Name | Unit | Access | Address (Hidden until you enter your email) | Function (hidden) | Type (hidden) |
|---|---|---|---|---|---|
| id | Read | ||||
| l | Read | ||||
| x | Read and write | ||||
| off1 | Read and write | ||||
| off2 | Read and write | ||||
| off3 | Read and write | ||||
| off4 | Read and write | ||||
| off5 | Read and write | ||||
| off6 | Read and write | ||||
| off7 | Read and write | ||||
| off8 | Read and write | ||||
| off9 | Read and write | ||||
| off10 | Read and write | ||||
| off11 | Read and write | ||||
| off12 | Read and write | ||||
| off13 | Read and write | ||||
| off14 | Read and write | ||||
| off15 | Read and write | ||||
| off16 | Read and write | ||||
| off17 | Read and write | ||||
| off18 | Read and write | ||||
| off19 | Read and write | ||||
| off20 | Read and write | ||||
| off21 | Read and write | ||||
| off22 | Read and write | ||||
| off23 | Read and write | ||||
| off24 | Read and write | ||||
| off25 | Read and write | ||||
| off26 | Read and write | ||||
| off27 | Read and write | ||||
| off28 | Read and write | ||||
| off29 | Read and write | ||||
| off30 | Read and write | ||||
| off31 | Read and write | ||||
| off32 | Read and write | ||||
| off33 | Read and write | ||||
| off34 | Read and write | ||||
| off35 | Read and write | ||||
| off36 | Read and write | ||||
| off37 | Read and write | ||||
| off38 | Read and write | ||||
| off39 | Read and write | ||||
| off40 | Read and write | ||||
| off41 | Read and write | ||||
| off42 | Read and write | ||||
| off43 | Read and write | ||||
| off44 | Read and write | ||||
| off45 | Read and write | ||||
| off46 | Read and write | ||||
| off47 | Read and write | ||||
| off48 | Read and write | ||||
| off49 | Read and write | ||||
| off50 | Read and write | ||||
| ts | Read and write | ||||
| ms | Read and write | ||||
| seq | Read and write | ||||
| role | Read and write | ||||
| alg | Read | ||||
| n | Read |
Loading registers…
Send your device list
If a device is not in the library yet, we build the template for free as soon as we have the register data.
Use cases
- Verify that a DER device returns a correctly signed dataset response when polled via Modbus TCP.
- Monitor the sequence number register to detect skipped or replayed secure read transactions over time.
- Track the role register to confirm that client authorization levels are set correctly before issuing control commands.
- Audit the algorithm register to verify which signature algorithm is active on a connected SunSpec device.
- Compare timestamp and millisecond registers against server time to identify clock-drift issues on DER equipment.
Installation
Enable Secure SunSpec Modbus on the target DER device under its communication or security settings, and confirm the device supports Model 3 by checking its model list starting at the SunSpec base address.
Connect the device to the same LAN as the ModbusCloud Gateway using a standard Ethernet cable, and ensure TCP port 502 (or 802 for mbaps) is reachable from the Gateway.
In your ModbusCloud portal, add the Gateway, import the SunSpec Model 3 template, and assign the correct unit ID used by the target device (commonly 1 or 126 depending on manufacturer).
Spot-check the id register: it must read 3, and the l register must match the documented block length; if either reads 0xFFFF the model is not implemented on this device.
Things to watch for
The id register returns 0xFFFF. What does that mean?
A value of 0xFFFF in any SunSpec model header register means the model is not implemented on this device. Confirm the device firmware supports the Secure SunSpec Modbus specification and that you are addressing the correct base register offset where Model 3 sits in the device's model chain.
All off1 through off50 registers read zero. Is that normal?
Yes, until a client writes the desired point offsets into those RW registers, they default to zero. Write the offsets of the data points you want included in the signed response before triggering a read. Writing all zeros will result in an empty or invalid signed dataset response from the device.
The device rejects my secure read request with an exception code. Why?
The most common cause is a stale or mismatched timestamp in the ts and ms registers. The device checks the client-supplied timestamp against its own clock to prevent replay attacks. Ensure your Gateway clock is synchronized via NTP, and that the ts value you write is current within the device's accepted tolerance window.
Is it safe to write the role and seq registers repeatedly in a polling loop?
Write the role register only when changing authorization level; do not write it in every poll cycle. The seq register must be incremented with each new request, not held constant. Writing role with an invalid or unsupported value will cause the device to return a Modbus exception, and repeated invalid writes may trigger a security lockout depending on the device implementation.
Knowledge base articles for this device
SunSpec Modbus: one register map for many inverters
SunSpec Modbus is the open register map SMA, Fronius, SolarEdge and Kostal share. The layout, int+SF vs float, the TCP port per brand and reading a mixed fleet.
Fronius Modbus: read a Symo GEN24 over Modbus TCP
Fronius Modbus explained: enable Modbus TCP on the Symo GEN24 on port 502, choose between int+SF and float, read the right SunSpec registers and scale them correctly. Practical guide for solar installers.
SMA Modbus: reading a Sunny Boy over Modbus TCP (installers)
SMA Modbus explained: enable the Modbus TCP server on port 502, choose between the SMA profile (unit ID 3) and SunSpec (unit ID 126), read the right registers, and handle the NaN values at night. Practical guide for installers.
Want to see how it works?
