+31 85 333 4015WhatsAppDocumentationSupportContactLog in
View demoOrder
SunSpec SunSpec Model 6 — Secure Write Sequential Request Modbus TCP template

SunSpec Model 6 — Secure Write Sequential Request

SunSpec Model 6 is a protocol-level security model defined by the SunSpec Alliance for authenticated register writes over Modbus TCP. It implements the Secure Write Sequential Request pattern: a client stages up to 80 data words (val1 through val80) into a buffer, sets the target model index and register offset using the x and off registers, and commits the request with a timestamp (ts, ms), sequence number (seq), client role (role), signature algorithm (alg), and word count (n). The model header registers id and l identify and size the block. This template lets the ModbusCloud Gateway monitor the full write-request state, which is useful for auditing control commands sent to DER devices.

Protocol
Modbus TCP
Connection
Ethernet, Modbus TCP
Registers
90, read and write
Brand
SunSpec
Last updated

Registers (90)

90 read, 88 write

NameUnitAccessAddress (Hidden until you enter your email)Function (hidden)Type (hidden)
idRead
lRead
xRead and write
offRead and write
val1Read and write
val2Read and write
val3Read and write
val4Read and write
val5Read and write
val6Read and write
val7Read and write
val8Read and write
val9Read and write
val10Read and write
val11Read and write
val12Read and write
val13Read and write
val14Read and write
val15Read and write
val16Read and write
val17Read and write
val18Read and write
val19Read and write
val20Read and write
val21Read and write
val22Read and write
val23Read and write
val24Read and write
val25Read and write
val26Read and write
val27Read and write
val28Read and write
val29Read and write
val30Read and write
val31Read and write
val32Read and write
val33Read and write
val34Read and write
val35Read and write
val36Read and write
val37Read and write
val38Read and write
val39Read and write
val40Read and write
val41Read and write
val42Read and write
val43Read and write
val44Read and write
val45Read and write
val46Read and write
val47Read and write
val48Read and write
val49Read and write
val50Read and write
val51Read and write
val52Read and write
val53Read and write
val54Read and write
val55Read and write
val56Read and write
val57Read and write
val58Read and write
val59Read and write
val60Read and write
val61Read and write
val62Read and write
val63Read and write
val64Read and write
val65Read and write
val66Read and write
val67Read and write
val68Read and write
val69Read and write
val70Read and write
val71Read and write
val72Read and write
val73Read and write
val74Read and write
val75Read and write
val76Read and write
val77Read and write
val78Read and write
val79Read and write
val80Read and write
tsRead and write
msRead and write
seqRead and write
roleRead and write
algRead and write
nRead and write

Loading registers…

Send your device list

If a device is not in the library yet, we build the template for free as soon as we have the register data.

Use cases

  • Monitor the sequence register to detect duplicate or replayed write requests to DER setpoints.
  • Verify the role register to confirm which client role last submitted a write request.
  • Track the timestamp registers ts and ms to correlate secure write events with portal alert timelines.
  • Alert on unexpected changes in the alg register that may indicate a configuration change in the signing algorithm.
  • Audit the off and x registers to track which target model instance and register offset received the last staged payload.

Installation

  1. Enable Modbus TCP on the SunSpec-compatible DER device and confirm that Secure Write (Model 6) is present in the device's SunSpec model list, typically discoverable by scanning from the base address 0, 40000, or 50000.

  2. Connect the device to the same LAN segment as the ModbusCloud Gateway, ensuring TCP port 502 (or 802 for mbaps) is reachable from the Gateway and not blocked by a firewall.

  3. In the ModbusCloud portal, add the Gateway, create a new device, import this SunSpec Model 6 template, and set the correct unit ID and base address offset for the device's SunSpec map.

  4. Spot-check the id register: it must read 6 and the l register must match the expected block length before relying on val1 through val80 and the metadata registers.

Things to watch for

The id register does not read 6. What is wrong?

The base address offset may be incorrect. SunSpec device maps can start at address 0, 40000, or 50000. Verify which base address the device uses and adjust the template offset in the portal accordingly. Also confirm the device firmware supports Model 6 as some older firmware versions expose only models 1 and 101.

All val registers read zero even after a write event. Why?

The staged write buffer is only populated during an active write transaction. Between transactions the device may reset all val registers to zero or to the not-implemented value (0xFFFF for uint16). This is expected behaviour. Poll the seq register to detect when a new transaction has occurred, then read the payload in the same scan cycle.

The gateway connects but the seq register never increments. What now?

No secure write client is actively submitting requests to the device. Check that the control application has Model 6 enabled and is sending write requests. Also verify the unit ID assigned in the portal matches the device's configured Modbus unit ID, as a mismatch causes reads to succeed but return stale or zero values.

Is it safe to write to the val, off, or x registers from the portal?

Use extreme caution. Writing to any RW register in Model 6, including val1 through val80, off, x, seq, role, alg, or n, constitutes submitting or modifying a secure write request to the target DER device. An incorrect payload or offset can push an invalid setpoint to a live inverter or battery, which may trip protection limits or affect device warranty. Only write from the portal during a controlled commissioning or test procedure.

More SunSpec templates

All SunSpec templatesBrowse the library

Knowledge base articles for this device

Want to see how it works?

View demoOrder your first gateway
Electrician working in an open distribution board