Why does the device reject my write to the execute register (x)?

The device validates the full payload before accepting the execute trigger. Ensure the sequence number (seq) is strictly greater than the previous request, the timestamp (ts) is current and within the device's accepted time window, and the role register matches a permitted client role. Any mismatch causes the device to refuse the transaction.

The gateway connects but all offset and value registers read as zero. What now?

Offset and value registers are only populated after a write transaction is staged. A freshly powered device or one that has processed no requests will return zeros. Confirm the device's SunSpec model map includes Model 5 at the base address you configured, and use a Modbus scanner to verify the model ID register returns 5.

How do I know which offset/value pairs are actually active in a given request?

Read the n register (address 89). It holds the count of valid pairs in the current request. Pairs beyond index n contain placeholder zeros and should be ignored. Always read n first before interpreting off and val registers to avoid processing stale or uninitialised slots.

Are there risks to writing the offset/value pairs and execute register carelessly?

Yes. Writing incorrect offset values or out-of-range values can overwrite protected device parameters, trip protection limits, or cause the device to fault. Always stage and review all offset/value pairs before triggering execution with x. Confirm the target device documentation supports each intended register address before issuing a live write.

Free Modbus template: SunSpec Model 5 — Secure Write Request

Name: SunSpec Model 5 — Secure Write Request
Brand: SunSpec
SKU: 5d559cdb-fd26-47d4-91d6-00a9ef2ce1fc

SunSpec Model 5 is the Secure Write Request model defined by the SunSpec Alliance for authenticated, tamper-resistant register writes over Modbus TCP. Rather than writing individual registers directly, a client populates up to 40 offset/value pairs (off1 through off40, val1 through val40), sets a UNIX timestamp (ts), millisecond component (ms), sequence number (seq), role (role), algorithm identifier (alg), and active-pair count (n), then triggers execution by writing the execute register (x). The model prevents replay attacks through sequence numbers and timestamps. It is used wherever DER devices require credential-controlled write access under standards such as IEEE 1547-2018.

Registers (89)

89 read / 87 write

Name	Address	Function	Type	Access
id SunSpec model identifier, fixed value 5 for this model.	•••	•••	•••	R
l Model block length in Modbus registers.	•••	•••	•••	R
x Execute flag, write to trigger the pending secure write payload.	•••	•••	•••	R/W
off1 Register offset for write pair 1, relative to model base.	•••	•••	•••	R/W
val1 Register value to write for write pair 1.	•••	•••	•••	R/W
off2 Register offset for write pair 2, relative to model base.	•••	•••	•••	R/W
val2 Register value to write for write pair 2.	•••	•••	•••	R/W
off3 Register offset for write pair 3, relative to model base.	•••	•••	•••	R/W
val3 Register value to write for write pair 3.	•••	•••	•••	R/W
off4 Register offset for write pair 4, relative to model base.	•••	•••	•••	R/W
val4 Register value to write for write pair 4.	•••	•••	•••	R/W
off5 Register offset for write pair 5, relative to model base.	•••	•••	•••	R/W
val5 Register value to write for write pair 5.	•••	•••	•••	R/W
off6 Register offset for write pair 6, relative to model base.	•••	•••	•••	R/W
val6 Register value to write for write pair 6.	•••	•••	•••	R/W
off7 Register offset for write pair 7, relative to model base.	•••	•••	•••	R/W
val7 Register value to write for write pair 7.	•••	•••	•••	R/W
off8 Register offset for write pair 8, relative to model base.	•••	•••	•••	R/W
val8 Register value to write for write pair 8.	•••	•••	•••	R/W
off9 Register offset for write pair 9, relative to model base.	•••	•••	•••	R/W
val9 Register value to write for write pair 9.	•••	•••	•••	R/W
off10 Register offset for write pair 10, relative to model base.	•••	•••	•••	R/W
val10 Register value to write for write pair 10.	•••	•••	•••	R/W
off11 Register offset for write pair 11, relative to model base.	•••	•••	•••	R/W
val11 Register value to write for write pair 11.	•••	•••	•••	R/W
off12 Register offset for write pair 12, relative to model base.	•••	•••	•••	R/W
val12 Register value to write for write pair 12.	•••	•••	•••	R/W
off13 Register offset for write pair 13, relative to model base.	•••	•••	•••	R/W
val13 Register value to write for write pair 13.	•••	•••	•••	R/W
off14 Register offset for write pair 14, relative to model base.	•••	•••	•••	R/W
val14 Register value to write for write pair 14.	•••	•••	•••	R/W
off15 Register offset for write pair 15, relative to model base.	•••	•••	•••	R/W
val15 Register value to write for write pair 15.	•••	•••	•••	R/W
off16 Register offset for write pair 16, relative to model base.	•••	•••	•••	R/W
val16 Register value to write for write pair 16.	•••	•••	•••	R/W
off17 Register offset for write pair 17, relative to model base.	•••	•••	•••	R/W
val17 Register value to write for write pair 17.	•••	•••	•••	R/W
off18 Register offset for write pair 18, relative to model base.	•••	•••	•••	R/W
val18 Register value to write for write pair 18.	•••	•••	•••	R/W
off19 Register offset for write pair 19, relative to model base.	•••	•••	•••	R/W
val19 Register value to write for write pair 19.	•••	•••	•••	R/W
off20 Register offset for write pair 20, relative to model base.	•••	•••	•••	R/W
val20 Register value to write for write pair 20.	•••	•••	•••	R/W
off21 Register offset for write pair 21, relative to model base.	•••	•••	•••	R/W
val21 Register value to write for write pair 21.	•••	•••	•••	R/W
off22 Register offset for write pair 22, relative to model base.	•••	•••	•••	R/W
val22 Register value to write for write pair 22.	•••	•••	•••	R/W
off23 Register offset for write pair 23, relative to model base.	•••	•••	•••	R/W
val23 Register value to write for write pair 23.	•••	•••	•••	R/W
off24 Register offset for write pair 24, relative to model base.	•••	•••	•••	R/W
val24 Register value to write for write pair 24.	•••	•••	•••	R/W
off25 Register offset for write pair 25, relative to model base.	•••	•••	•••	R/W
val25 Register value to write for write pair 25.	•••	•••	•••	R/W
off26 Register offset for write pair 26, relative to model base.	•••	•••	•••	R/W
val26 Register value to write for write pair 26.	•••	•••	•••	R/W
off27 Register offset for write pair 27, relative to model base.	•••	•••	•••	R/W
val27 Register value to write for write pair 27.	•••	•••	•••	R/W
off28 Register offset for write pair 28, relative to model base.	•••	•••	•••	R/W
val28 Register value to write for write pair 28.	•••	•••	•••	R/W
off29 Register offset for write pair 29, relative to model base.	•••	•••	•••	R/W
val29 Register value to write for write pair 29.	•••	•••	•••	R/W
off30 Register offset for write pair 30, relative to model base.	•••	•••	•••	R/W
val30 Register value to write for write pair 30.	•••	•••	•••	R/W
off31 Register offset for write pair 31, relative to model base.	•••	•••	•••	R/W
val31 Register value to write for write pair 31.	•••	•••	•••	R/W
off32 Register offset for write pair 32, relative to model base.	•••	•••	•••	R/W
val32 Register value to write for write pair 32.	•••	•••	•••	R/W
off33 Register offset for write pair 33, relative to model base.	•••	•••	•••	R/W
val33 Register value to write for write pair 33.	•••	•••	•••	R/W
off34 Register offset for write pair 34, relative to model base.	•••	•••	•••	R/W
val34 Register value to write for write pair 34.	•••	•••	•••	R/W
off35 Register offset for write pair 35, relative to model base.	•••	•••	•••	R/W
val35 Register value to write for write pair 35.	•••	•••	•••	R/W
off36 Register offset for write pair 36, relative to model base.	•••	•••	•••	R/W
val36 Register value to write for write pair 36.	•••	•••	•••	R/W
off37 Register offset for write pair 37, relative to model base.	•••	•••	•••	R/W
val37 Register value to write for write pair 37.	•••	•••	•••	R/W
off38 Register offset for write pair 38, relative to model base.	•••	•••	•••	R/W
val38 Register value to write for write pair 38.	•••	•••	•••	R/W
off39 Register offset for write pair 39, relative to model base.	•••	•••	•••	R/W
val39 Register value to write for write pair 39.	•••	•••	•••	R/W
off40 Register offset for write pair 40, relative to model base.	•••	•••	•••	R/W
val40 Register value to write for write pair 40.	•••	•••	•••	R/W
ts UNIX timestamp of the request, seconds since epoch, uint32.	•••	•••	•••	R/W
ms Millisecond sub-second component of the request timestamp.	•••	•••	•••	R/W
seq Sequence number, increments with each request to prevent replay.	•••	•••	•••	R/W
role Numeric role identifier of the requesting client.	•••	•••	•••	R/W
alg Cryptographic algorithm identifier used to authenticate the request.	•••	•••	•••	R/W
n Number of valid offset/value pairs active in this request.	•••	•••	•••	R/W

Loading registers…

SunSpec Model 5 — Secure Write Request

Overview

Use cases

Installation

Things to watch for

Registers (89)

Working with Modbus in your projects?

Question about your setup?

More SunSpec templates

SunSpec Model 709 — DER Trip LF

SunSpec Model 139 — LVRTX

SunSpec Model 19 — PPP Link

SunSpec Model 601 — Tracker Controller DRAFT 2

SunSpec Model 64412 — DER Cyber Exploitation

SunSpec Model 135 — LFRT

More TCP templates

Algodue Energy meter UEM80-2D E

Sigenergy SigenStore EC (grid)

Fronius GEN24

HUAWEI SUN2000 Inverter & LUNA2000 battery

NIBE Nibe S-Series (SG Ready)

Fronius - Modbus TCP