The id register does not read 6. What is wrong?

The base address offset may be incorrect. SunSpec device maps can start at address 0, 40000, or 50000. Verify which base address the device uses and adjust the template offset in the portal accordingly. Also confirm the device firmware supports Model 6 as some older firmware versions expose only models 1 and 101.

All val registers read zero even after a write event. Why?

The staged write buffer is only populated during an active write transaction. Between transactions the device may reset all val registers to zero or to the not-implemented value (0xFFFF for uint16). This is expected behaviour. Poll the seq register to detect when a new transaction has occurred, then read the payload in the same scan cycle.

The gateway connects but the seq register never increments. What now?

No secure write client is actively submitting requests to the device. Check that the control application has Model 6 enabled and is sending write requests. Also verify the unit ID assigned in the portal matches the device's configured Modbus unit ID, as a mismatch causes reads to succeed but return stale or zero values.

Is it safe to write to the val, off, or x registers from the portal?

Use extreme caution. Writing to any RW register in Model 6, including val1 through val80, off, x, seq, role, alg, or n, constitutes submitting or modifying a secure write request to the target DER device. An incorrect payload or offset can push an invalid setpoint to a live inverter or battery, which may trip protection limits or affect device warranty. Only write from the portal during a controlled commissioning or test procedure.

Free Modbus template: SunSpec Model 6 — Secure Write Sequential Request

Name: SunSpec Model 6 — Secure Write Sequential Request
Brand: SunSpec
SKU: 2543bb26-82a3-41ff-a082-2cb7f301c652

SunSpec Model 6 is a protocol-level security model defined by the SunSpec Alliance for authenticated register writes over Modbus TCP. It implements the Secure Write Sequential Request pattern: a client stages up to 80 data words (val1 through val80) into a buffer, sets the target model index and register offset using the x and off registers, and commits the request with a timestamp (ts, ms), sequence number (seq), client role (role), signature algorithm (alg), and word count (n). The model header registers id and l identify and size the block. This template lets the ModbusCloud Gateway monitor the full write-request state, which is useful for auditing control commands sent to DER devices.

Registers (90)

90 read / 88 write

Name	Address	Function	Type	Access
id SunSpec model identifier, fixed value 6 for this model.	•••	•••	•••	R
l Model block length in 16-bit registers.	•••	•••	•••	R
x Index of the target model instance to write to.	•••	•••	•••	R/W
off Register offset within the target model for the write payload.	•••	•••	•••	R/W
val1 Payload word 1, first staged value for the secure write.	•••	•••	•••	R/W
val2 Payload word 2, second staged value for the secure write.	•••	•••	•••	R/W
val3 Payload word 3, third staged value for the secure write.	•••	•••	•••	R/W
val4 Payload word 4, fourth staged value for the secure write.	•••	•••	•••	R/W
val5 Payload word 5, fifth staged value for the secure write.	•••	•••	•••	R/W
val6 Payload word 6, sixth staged value for the secure write.	•••	•••	•••	R/W
val7 Payload word 7, seventh staged value for the secure write.	•••	•••	•••	R/W
val8 Payload word 8, eighth staged value for the secure write.	•••	•••	•••	R/W
val9 Payload word 9, ninth staged value for the secure write.	•••	•••	•••	R/W
val10 Payload word 10, tenth staged value for the secure write.	•••	•••	•••	R/W
val11 Payload word 11, eleventh staged value for the secure write.	•••	•••	•••	R/W
val12 Payload word 12, twelfth staged value for the secure write.	•••	•••	•••	R/W
val13 Payload word 13, thirteenth staged value for the secure write.	•••	•••	•••	R/W
val14 Payload word 14, fourteenth staged value for the secure write.	•••	•••	•••	R/W
val15 Payload word 15, fifteenth staged value for the secure write.	•••	•••	•••	R/W
val16 Payload word 16, sixteenth staged value for the secure write.	•••	•••	•••	R/W
val17 Payload word 17, seventeenth staged value for the secure write.	•••	•••	•••	R/W
val18 Payload word 18, eighteenth staged value for the secure write.	•••	•••	•••	R/W
val19 Payload word 19, nineteenth staged value for the secure write.	•••	•••	•••	R/W
val20 Payload word 20, twentieth staged value for the secure write.	•••	•••	•••	R/W
val21 Payload word 21 of the staged write buffer.	•••	•••	•••	R/W
val22 Payload word 22 of the staged write buffer.	•••	•••	•••	R/W
val23 Payload word 23 of the staged write buffer.	•••	•••	•••	R/W
val24 Payload word 24 of the staged write buffer.	•••	•••	•••	R/W
val25 Payload word 25 of the staged write buffer.	•••	•••	•••	R/W
val26 Payload word 26 of the staged write buffer.	•••	•••	•••	R/W
val27 Payload word 27 of the staged write buffer.	•••	•••	•••	R/W
val28 Payload word 28 of the staged write buffer.	•••	•••	•••	R/W
val29 Payload word 29 of the staged write buffer.	•••	•••	•••	R/W
val30 Payload word 30 of the staged write buffer.	•••	•••	•••	R/W
val31 Payload word 31 of the staged write buffer.	•••	•••	•••	R/W
val32 Payload word 32 of the staged write buffer.	•••	•••	•••	R/W
val33 Payload word 33 of the staged write buffer.	•••	•••	•••	R/W
val34 Payload word 34 of the staged write buffer.	•••	•••	•••	R/W
val35 Payload word 35 of the staged write buffer.	•••	•••	•••	R/W
val36 Payload word 36 of the staged write buffer.	•••	•••	•••	R/W
val37 Payload word 37 of the staged write buffer.	•••	•••	•••	R/W
val38 Payload word 38 of the staged write buffer.	•••	•••	•••	R/W
val39 Payload word 39 of the staged write buffer.	•••	•••	•••	R/W
val40 Payload word 40 of the staged write buffer.	•••	•••	•••	R/W
val41 Payload word 41 of the staged write buffer.	•••	•••	•••	R/W
val42 Payload word 42 of the staged write buffer.	•••	•••	•••	R/W
val43 Payload word 43 of the staged write buffer.	•••	•••	•••	R/W
val44 Payload word 44 of the staged write buffer.	•••	•••	•••	R/W
val45 Payload word 45 of the staged write buffer.	•••	•••	•••	R/W
val46 Payload word 46 of the staged write buffer.	•••	•••	•••	R/W
val47 Payload word 47 of the staged write buffer.	•••	•••	•••	R/W
val48 Payload word 48 of the staged write buffer.	•••	•••	•••	R/W
val49 Payload word 49 of the staged write buffer.	•••	•••	•••	R/W
val50 Payload word 50 of the staged write buffer.	•••	•••	•••	R/W
val51 Payload word 51 of the staged write buffer.	•••	•••	•••	R/W
val52 Payload word 52 of the staged write buffer.	•••	•••	•••	R/W
val53 Payload word 53 of the staged write buffer.	•••	•••	•••	R/W
val54 Payload word 54 of the staged write buffer.	•••	•••	•••	R/W
val55 Payload word 55 of the staged write buffer.	•••	•••	•••	R/W
val56 Payload word 56 of the staged write buffer.	•••	•••	•••	R/W
val57 Payload word 57 of the staged write buffer.	•••	•••	•••	R/W
val58 Payload word 58 of the staged write buffer.	•••	•••	•••	R/W
val59 Payload word 59 of the staged write buffer.	•••	•••	•••	R/W
val60 Payload word 60 of the staged write buffer.	•••	•••	•••	R/W
val61 Payload word 61 of the staged write buffer.	•••	•••	•••	R/W
val62 Payload word 62 of the staged write buffer.	•••	•••	•••	R/W
val63 Payload word 63 of the staged write buffer.	•••	•••	•••	R/W
val64 Payload word 64 of the staged write buffer.	•••	•••	•••	R/W
val65 Payload word 65 of the staged write buffer.	•••	•••	•••	R/W
val66 Payload word 66 of the staged write buffer.	•••	•••	•••	R/W
val67 Payload word 67 of the staged write buffer.	•••	•••	•••	R/W
val68 Payload word 68 of the staged write buffer.	•••	•••	•••	R/W
val69 Payload word 69 of the staged write buffer.	•••	•••	•••	R/W
val70 Payload word 70 of the staged write buffer.	•••	•••	•••	R/W
val71 Payload word 71 of the staged write buffer.	•••	•••	•••	R/W
val72 Payload word 72 of the staged write buffer.	•••	•••	•••	R/W
val73 Payload word 73 of the staged write buffer.	•••	•••	•••	R/W
val74 Payload word 74 of the staged write buffer.	•••	•••	•••	R/W
val75 Payload word 75 of the staged write buffer.	•••	•••	•••	R/W
val76 Payload word 76 of the staged write buffer.	•••	•••	•••	R/W
val77 Payload word 77 of the staged write buffer.	•••	•••	•••	R/W
val78 Payload word 78 of the staged write buffer.	•••	•••	•••	R/W
val79 Payload word 79 of the staged write buffer.	•••	•••	•••	R/W
val80 Payload word 80, last word of the staged write buffer.	•••	•••	•••	R/W
ts Unix timestamp (32-bit) of the write request, seconds since epoch.	•••	•••	•••	R/W
ms Millisecond component of the write request timestamp.	•••	•••	•••	R/W
seq Sequence counter incremented with each new secure write request.	•••	•••	•••	R/W
role Role identifier of the client submitting this write request.	•••	•••	•••	R/W
alg Algorithm identifier used to compute the write request signature.	•••	•••	•••	R/W
n Number of valid payload words present in this write request.	•••	•••	•••	R/W

Loading registers…

SunSpec Model 6 — Secure Write Sequential Request

Overview

Use cases

Installation

Things to watch for

Registers (90)

Working with Modbus in your projects?

Question about your setup?

More SunSpec templates

SunSpec Model 709 — DER Trip LF

SunSpec Model 139 — LVRTX

SunSpec Model 19 — PPP Link

SunSpec Model 601 — Tracker Controller DRAFT 2

SunSpec Model 64412 — DER Cyber Exploitation

SunSpec Model 135 — LFRT

More TCP templates

Algodue Energy meter UEM80-2D E

Sigenergy SigenStore EC (grid)

Fronius GEN24

HUAWEI SUN2000 Inverter & LUNA2000 battery

NIBE Nibe S-Series (SG Ready)

Fronius - Modbus TCP