SunSpec Model 4 — Secure Dataset Read Response
SunSpec Model 4 is a protocol-layer information model defined by the SunSpec Alliance for secure, tamper-evident Modbus TCP dataset reads from Distributed Energy Resource (DER) devices such as inverters and energy storage systems. The template reads the full response structure: a request sequence echo (rqseq), a status code (sts), up to 50 payload value registers (val1 through val50), a 32-bit Unix timestamp (ts) with millisecond resolution (ms), an outgoing sequence counter (seq), an alarm bitmap (alm), and the authentication algorithm identifier (alg) with its code length (n). For integrators verifying DER data integrity over Modbus TCP, this template provides the complete register map in one import.
- Protocol
- Modbus TCP
- Connection
- Ethernet, Modbus TCP
- Registers
- 61, read only
- Brand
- SunSpec
- Last updated
Registers (61)
61 read, 0 write
| Name | Unit | Access | Address (Hidden until you enter your email) | Function (hidden) | Type (hidden) |
|---|---|---|---|---|---|
| id | Read | ||||
| l | Read | ||||
| rqseq | Read | ||||
| sts | Read | ||||
| x | Read | ||||
| val1 | Read | ||||
| val2 | Read | ||||
| val3 | Read | ||||
| val4 | Read | ||||
| val5 | Read | ||||
| val6 | Read | ||||
| val7 | Read | ||||
| val8 | Read | ||||
| val9 | Read | ||||
| val10 | Read | ||||
| val11 | Read | ||||
| val12 | Read | ||||
| val13 | Read | ||||
| val14 | Read | ||||
| val15 | Read | ||||
| val16 | Read | ||||
| val17 | Read | ||||
| val18 | Read | ||||
| val19 | Read | ||||
| val20 | Read | ||||
| val21 | Read | ||||
| val22 | Read | ||||
| val23 | Read | ||||
| val24 | Read | ||||
| val25 | Read | ||||
| val26 | Read | ||||
| val27 | Read | ||||
| val28 | Read | ||||
| val29 | Read | ||||
| val30 | Read | ||||
| val31 | Read | ||||
| val32 | Read | ||||
| val33 | Read | ||||
| val34 | Read | ||||
| val35 | Read | ||||
| val36 | Read | ||||
| val37 | Read | ||||
| val38 | Read | ||||
| val39 | Read | ||||
| val40 | Read | ||||
| val41 | Read | ||||
| val42 | Read | ||||
| val43 | Read | ||||
| val44 | Read | ||||
| val45 | Read | ||||
| val46 | Read | ||||
| val47 | Read | ||||
| val48 | Read | ||||
| val49 | Read | ||||
| val50 | Read | ||||
| ts | Read | ||||
| ms | Read | ||||
| seq | Read | ||||
| alm | Read | ||||
| alg | Read | ||||
| n | Read |
Loading registers…
Send your device list
If a device is not in the library yet, we build the template for free as soon as we have the register data.
Use cases
- Verify that dataset responses from a DER device arrive with matching request sequence numbers to detect dropped or replayed messages.
- Track the Unix timestamp and millisecond fields to confirm the DER device clock is synchronized before logging energy data.
- Monitor the alarm bitmap register to detect active device alarms present at the moment a dataset was captured.
- Inspect the authentication algorithm identifier to confirm the device is using the expected signing algorithm across a fleet.
- Compare outgoing sequence counters across polling cycles to identify communication gaps or counter roll-over events.
Installation
Confirm the target DER device supports Secure SunSpec Modbus and has Model 4 listed in its model map. Enable the Modbus TCP interface under the device's communication or network settings.
Connect the DER device and the ModbusCloud Gateway to the same IP network. Note the device's IP address and Modbus unit ID, typically 1 for SunSpec TCP devices.
In your ModbusCloud portal, add a new gateway, then import the SunSpec Model 4 template. Assign the device IP address and unit ID, and set the polling interval to match your data-integrity monitoring requirements.
Trigger a read and spot-check the id register (address 0): it must return 4. Verify rqseq increments correctly and that ts reflects the current Unix time to confirm the model is active.
Things to watch for
The id register returns a value other than 4. Why?
The SunSpec model map on the device may place Model 4 at a different base offset than address 0 in your portal configuration. Scan the device's full SunSpec map to locate the actual base address of Model 4 and adjust the template offset accordingly.
All val registers read as 0xFFFF. What does this mean?
A value of 0xFFFF (65535) for a uint16 is the SunSpec 'Not Implemented' sentinel. This indicates the device has not populated those payload slots for the current request. Check the sts register first: a non-zero status code means the device returned an error rather than valid data.
The gateway connects but the ts register shows an implausible timestamp. What now?
The ts register is a 32-bit Unix epoch value spanning two consecutive 16-bit registers. Confirm the ModbusCloud template is reading it as uint32 across addresses 55 and 56. If the device clock is not synchronized to NTP, the timestamp will be arbitrary until time sync is restored.
Why does the seq counter not increment between polls?
Model 4 is a response model, not a polled data model. The seq counter increments only when the DER device issues a new secured dataset. If your polling interval is shorter than the device's dataset publication interval, you will read the same response multiple times. Align your poll rate with the device's update rate.
Knowledge base articles for this device
SunSpec Modbus: one register map for many inverters
SunSpec Modbus is the open register map SMA, Fronius, SolarEdge and Kostal share. The layout, int+SF vs float, the TCP port per brand and reading a mixed fleet.
Fronius Modbus: read a Symo GEN24 over Modbus TCP
Fronius Modbus explained: enable Modbus TCP on the Symo GEN24 on port 502, choose between int+SF and float, read the right SunSpec registers and scale them correctly. Practical guide for solar installers.
SMA Modbus: reading a Sunny Boy over Modbus TCP (installers)
SMA Modbus explained: enable the Modbus TCP server on port 502, choose between the SMA profile (unit ID 3) and SunSpec (unit ID 126), read the right registers, and handle the NaN values at night. Practical guide for installers.
Want to see how it works?
