SunSpec Model 5 — Secure Write Request
SunSpec Model 5 is the Secure Write Request model defined by the SunSpec Alliance for authenticated, tamper-resistant register writes over Modbus TCP. Rather than writing individual registers directly, a client populates up to 40 offset/value pairs (off1 through off40, val1 through val40), sets a UNIX timestamp (ts), millisecond component (ms), sequence number (seq), role (role), algorithm identifier (alg), and active-pair count (n), then triggers execution by writing the execute register (x). The model prevents replay attacks through sequence numbers and timestamps. It is used wherever DER devices require credential-controlled write access under standards such as IEEE 1547-2018.
- Protocol
- Modbus TCP
- Connection
- Ethernet, Modbus TCP
- Registers
- 89, read and write
- Brand
- SunSpec
- Last updated
Registers (89)
89 read, 87 write
| Name | Unit | Access | Address (Hidden until you enter your email) | Function (hidden) | Type (hidden) |
|---|---|---|---|---|---|
| id | Read | ||||
| l | Read | ||||
| x | Read and write | ||||
| off1 | Read and write | ||||
| val1 | Read and write | ||||
| off2 | Read and write | ||||
| val2 | Read and write | ||||
| off3 | Read and write | ||||
| val3 | Read and write | ||||
| off4 | Read and write | ||||
| val4 | Read and write | ||||
| off5 | Read and write | ||||
| val5 | Read and write | ||||
| off6 | Read and write | ||||
| val6 | Read and write | ||||
| off7 | Read and write | ||||
| val7 | Read and write | ||||
| off8 | Read and write | ||||
| val8 | Read and write | ||||
| off9 | Read and write | ||||
| val9 | Read and write | ||||
| off10 | Read and write | ||||
| val10 | Read and write | ||||
| off11 | Read and write | ||||
| val11 | Read and write | ||||
| off12 | Read and write | ||||
| val12 | Read and write | ||||
| off13 | Read and write | ||||
| val13 | Read and write | ||||
| off14 | Read and write | ||||
| val14 | Read and write | ||||
| off15 | Read and write | ||||
| val15 | Read and write | ||||
| off16 | Read and write | ||||
| val16 | Read and write | ||||
| off17 | Read and write | ||||
| val17 | Read and write | ||||
| off18 | Read and write | ||||
| val18 | Read and write | ||||
| off19 | Read and write | ||||
| val19 | Read and write | ||||
| off20 | Read and write | ||||
| val20 | Read and write | ||||
| off21 | Read and write | ||||
| val21 | Read and write | ||||
| off22 | Read and write | ||||
| val22 | Read and write | ||||
| off23 | Read and write | ||||
| val23 | Read and write | ||||
| off24 | Read and write | ||||
| val24 | Read and write | ||||
| off25 | Read and write | ||||
| val25 | Read and write | ||||
| off26 | Read and write | ||||
| val26 | Read and write | ||||
| off27 | Read and write | ||||
| val27 | Read and write | ||||
| off28 | Read and write | ||||
| val28 | Read and write | ||||
| off29 | Read and write | ||||
| val29 | Read and write | ||||
| off30 | Read and write | ||||
| val30 | Read and write | ||||
| off31 | Read and write | ||||
| val31 | Read and write | ||||
| off32 | Read and write | ||||
| val32 | Read and write | ||||
| off33 | Read and write | ||||
| val33 | Read and write | ||||
| off34 | Read and write | ||||
| val34 | Read and write | ||||
| off35 | Read and write | ||||
| val35 | Read and write | ||||
| off36 | Read and write | ||||
| val36 | Read and write | ||||
| off37 | Read and write | ||||
| val37 | Read and write | ||||
| off38 | Read and write | ||||
| val38 | Read and write | ||||
| off39 | Read and write | ||||
| val39 | Read and write | ||||
| off40 | Read and write | ||||
| val40 | Read and write | ||||
| ts | Read and write | ||||
| ms | Read and write | ||||
| seq | Read and write | ||||
| role | Read and write | ||||
| alg | Read and write | ||||
| n | Read and write |
Loading registers…
Send your device list
If a device is not in the library yet, we build the template for free as soon as we have the register data.
Use cases
- Verify that sequence numbers increment correctly across successive secure write cycles to confirm replay-attack protection is active.
- Monitor the execute register (x) state after each write transaction to confirm the device acknowledged and applied the payload.
- Track the timestamp (ts) and millisecond (ms) fields to audit when configuration changes were committed to a DER device.
- Alert on unexpected role values in the role register to detect unauthorised clients attempting writes to protected parameters.
- Compare the active-pair count (n) against expected values to verify the correct number of register writes was submitted per transaction.
Installation
Enable Modbus TCP on the target SunSpec-compliant DER device and confirm the device supports Model 5 by scanning its SunSpec model map starting at the SunS identifier.
Connect the device to the same TCP/IP network as the ModbusCloud Gateway, ensuring port 502 (or the device-configured Modbus TCP port) is reachable from the Gateway.
In your ModbusCloud portal, add the Gateway, import this SunSpec Model 5 template, and assign the correct unit ID and base Modbus address matching your device's model map location.
Read back the id register (address 0) and confirm it returns 5, then read the l register to verify model length before performing any write operations.
Things to watch for
Why does the device reject my write to the execute register (x)?
The device validates the full payload before accepting the execute trigger. Ensure the sequence number (seq) is strictly greater than the previous request, the timestamp (ts) is current and within the device's accepted time window, and the role register matches a permitted client role. Any mismatch causes the device to refuse the transaction.
The gateway connects but all offset and value registers read as zero. What now?
Offset and value registers are only populated after a write transaction is staged. A freshly powered device or one that has processed no requests will return zeros. Confirm the device's SunSpec model map includes Model 5 at the base address you configured, and use a Modbus scanner to verify the model ID register returns 5.
How do I know which offset/value pairs are actually active in a given request?
Read the n register (address 89). It holds the count of valid pairs in the current request. Pairs beyond index n contain placeholder zeros and should be ignored. Always read n first before interpreting off and val registers to avoid processing stale or uninitialised slots.
Are there risks to writing the offset/value pairs and execute register carelessly?
Yes. Writing incorrect offset values or out-of-range values can overwrite protected device parameters, trip protection limits, or cause the device to fault. Always stage and review all offset/value pairs before triggering execution with x. Confirm the target device documentation supports each intended register address before issuing a live write.
Knowledge base articles for this device
SunSpec Modbus: one register map for many inverters
SunSpec Modbus is the open register map SMA, Fronius, SolarEdge and Kostal share. The layout, int+SF vs float, the TCP port per brand and reading a mixed fleet.
Fronius Modbus: read a Symo GEN24 over Modbus TCP
Fronius Modbus explained: enable Modbus TCP on the Symo GEN24 on port 502, choose between int+SF and float, read the right SunSpec registers and scale them correctly. Practical guide for solar installers.
SMA Modbus: reading a Sunny Boy over Modbus TCP (installers)
SMA Modbus explained: enable the Modbus TCP server on port 502, choose between the SMA profile (unit ID 3) and SunSpec (unit ID 126), read the right registers, and handle the NaN values at night. Practical guide for installers.
Want to see how it works?
