The id register returns 0xFFFF. What does that mean?

A value of 0xFFFF in any SunSpec model header register means the model is not implemented on this device. Confirm the device firmware supports the Secure SunSpec Modbus specification and that you are addressing the correct base register offset where Model 3 sits in the device's model chain.

All off1 through off50 registers read zero. Is that normal?

Yes, until a client writes the desired point offsets into those RW registers, they default to zero. Write the offsets of the data points you want included in the signed response before triggering a read. Writing all zeros will result in an empty or invalid signed dataset response from the device.

The device rejects my secure read request with an exception code. Why?

The most common cause is a stale or mismatched timestamp in the ts and ms registers. The device checks the client-supplied timestamp against its own clock to prevent replay attacks. Ensure your Gateway clock is synchronized via NTP, and that the ts value you write is current within the device's accepted tolerance window.

Is it safe to write the role and seq registers repeatedly in a polling loop?

Write the role register only when changing authorization level; do not write it in every poll cycle. The seq register must be incremented with each new request, not held constant. Writing role with an invalid or unsupported value will cause the device to return a Modbus exception, and repeated invalid writes may trigger a security lockout depending on the device implementation.

Free Modbus template: SunSpec Model 3 — Secure Dataset Read Request

Name: SunSpec Model 3 — Secure Dataset Read Request
Brand: SunSpec
SKU: 24334b55-76de-4e32-ad91-87ffa412195c

SunSpec Model 3 is a protocol-level model defined by the SunSpec Alliance for issuing cryptographically authenticated dataset read requests over Modbus TCP. It is used with SunSpec-compliant DER devices such as inverters, battery storage systems, and energy meters that implement the Secure SunSpec Modbus specification. The template exposes the full request structure: the target model index, up to 50 data-point offsets, a client-supplied timestamp and millisecond component for replay protection, a sequence number, a role authorization field, and the algorithm identifier and signature-length registers. It gives integrators a direct view into the secure read handshake without opening the SunSpec specification document.

Registers (59)

59 read / 55 write

Name	Address	Function	Type	Access
id SunSpec model identifier, fixed value 3 for this model.	0	FC03	uint16	R
l Length of this model block in 16-bit registers.	1	FC03	uint16	R
x Index of the target dataset model to be securely read.	2	FC03	uint16	R/W
off1 Offset of data point 1 within the target dataset model.	3	FC03	uint16	R/W
off2 Offset of data point 2 within the target dataset model.	4	FC03	uint16	R/W
off3 Offset of data point 3 within the target dataset model.	5	FC03	uint16	R/W
off4 Offset of data point 4 within the target dataset model.	6	FC03	uint16	R/W
off5 Offset of data point 5 within the target dataset model.	7	FC03	uint16	R/W
off6 Offset of data point 6 within the target dataset model.	8	FC03	uint16	R/W
off7 Offset of data point 7 within the target dataset model.	9	FC03	uint16	R/W
off8 Offset of data point 8 within the target dataset model.	10	FC03	uint16	R/W
off9 Offset of data point 9 within the target dataset model.	11	FC03	uint16	R/W
off10 Offset of data point 10 within the target dataset model.	12	FC03	uint16	R/W
off11 Offset of data point 11 within the target dataset model.	13	FC03	uint16	R/W
off12 Offset of data point 12 within the target dataset model.	14	FC03	uint16	R/W
off13 Offset of data point 13 within the target dataset model.	15	FC03	uint16	R/W
off14 Offset of data point 14 within the target dataset model.	16	FC03	uint16	R/W
off15 Offset of data point 15 within the target dataset model.	17	FC03	uint16	R/W
off16 Offset of data point 16 within the target dataset model.	18	FC03	uint16	R/W
off17 Offset of data point 17 within the target dataset model.	19	FC03	uint16	R/W
off18 Offset of data point 18 within the target dataset model.	20	FC03	uint16	R/W
off19 Offset of data point 19 within the target dataset model.	21	FC03	uint16	R/W
off20 Offset of data point 20 within the target dataset model.	22	FC03	uint16	R/W
off21 Offset of data point 21 within the target dataset model.	23	FC03	uint16	R/W
off22 Offset of data point 22 within the target dataset model.	24	FC03	uint16	R/W
off23 Offset of data point 23 within the target dataset model.	25	FC03	uint16	R/W
off24 Offset of data point 24 within the target dataset model.	26	FC03	uint16	R/W
off25 Offset of data point 25 within the target dataset model.	27	FC03	uint16	R/W
off26 Offset of data point 26 within the target dataset model.	28	FC03	uint16	R/W
off27 Offset of data point 27 within the target dataset model.	29	FC03	uint16	R/W
off28 Offset of data point 28 within the target dataset model.	30	FC03	uint16	R/W
off29 Offset of data point 29 within the target dataset model.	31	FC03	uint16	R/W
off30 Offset of data point 30 within the target dataset model.	32	FC03	uint16	R/W
off31 Offset of data point 31 within the target dataset model.	33	FC03	uint16	R/W
off32 Offset of data point 32 within the target dataset model.	34	FC03	uint16	R/W
off33 Offset of data point 33 within the target dataset model.	35	FC03	uint16	R/W
off34 Offset of data point 34 within the target dataset model.	36	FC03	uint16	R/W
off35 Offset of data point 35 within the target dataset model.	37	FC03	uint16	R/W
off36 Offset of data point 36 within the target dataset model.	38	FC03	uint16	R/W
off37 Offset of data point 37 within the target dataset model.	39	FC03	uint16	R/W
off38 Offset of data point 38 within the target dataset model.	40	FC03	uint16	R/W
off39 Offset of data point 39 within the target dataset model.	41	FC03	uint16	R/W
off40 Offset of data point 40 within the target dataset model.	42	FC03	uint16	R/W
off41 Offset of data point 41 within the target dataset model.	43	FC03	uint16	R/W
off42 Offset of data point 42 within the target dataset model.	44	FC03	uint16	R/W
off43 Offset of data point 43 within the target dataset model.	45	FC03	uint16	R/W
off44 Offset of data point 44 within the target dataset model.	46	FC03	uint16	R/W
off45 Offset of data point 45 within the target dataset model.	47	FC03	uint16	R/W
off46 Offset of data point 46 within the target dataset model.	48	FC03	uint16	R/W
off47 Offset of data point 47 within the target dataset model.	49	FC03	uint16	R/W
off48 Offset of data point 48 within the target dataset model.	50	FC03	uint16	R/W
off49 Offset of data point 49 within the target dataset model.	51	FC03	uint16	R/W
off50 Offset of data point 50 within the target dataset model.	52	FC03	uint16	R/W
ts Unix timestamp written by client for replay-attack prevention.	53	FC03	uint32	R/W
ms Millisecond sub-second component of the client-supplied timestamp.	55	FC03	uint16	R/W
seq Sequence number incremented per request to prevent replay attacks.	56	FC03	uint16	R/W
role Client authorization role level for this secure read request.	57	FC03	uint16	R/W
alg Signature algorithm identifier used to sign the response dataset.	58	FC03	uint16	R
n Count of signature registers appended after this model block.	59	FC03	uint16	R