Why do all flag registers return zero even after writing?

Model 64412 flag registers are only active when the underlying simulation platform or test harness is running and has accepted the write. Confirm the simulator is started and the Modbus unit ID in the portal matches the simulator's slave address. A stale TCP connection may also cache the previous value: cycle the Gateway connection.

The gateway connects but no model block is found. What now?

SunSpec devices present their model map starting at holding register 40001 (offset 0). If the simulator places Model 64412 later in the map, discovery must walk all preceding model blocks first. Check that the simulator's SunSpec map is complete and ends with the standard end model (ID 65535). Restarting the discovery scan in the portal usually resolves this.

Why does writing a flag register produce a Modbus exception code?

Some simulation platforms restrict writes to flag registers while an active test sequence is running. Pause the running test scenario before writing individual flags. Also confirm you are using function code 16 (Write Multiple Registers): function code 6 (Write Single Register) can be rejected by stricter SunSpec implementations.

Is it safe to write attack-mode flags on a live production DER device?

No. Model 64412 is a test and research model. Writing its flags on a real DER device could falsify measurement data reported to the utility, trigger protection relays, or violate grid codes. Only use this template on isolated lab or simulation environments. Never apply it to a production installation.

Free Modbus template: SunSpec Model 64412 — DER Cyber Exploitation

Name: SunSpec Model 64412 — DER Cyber Exploitation
Brand: SunSpec
SKU: ee6c8543-1595-4456-947f-1e5ad756fab6

SunSpec Model 64412 is a cybersecurity test model defined by the SunSpec Alliance and Sandia National Laboratories for use in DER security research and conformance testing. It does not represent a physical inverter or energy device. Over Modbus TCP, the model exposes a set of writable flag registers that simulate specific cyber-exploitation attack modes against DER equipment: measurement falsification (voltage, frequency, current, reactive power, power factor, apparent power), nameplate data spoofing, settings manipulation, and common-model identity falsification. It is used by test labs and security engineers to verify that DER management systems detect and respond correctly to manipulated Modbus data.

Registers (45)

45 read / 43 write

Name	Address	Function	Type	Access
id SunSpec model identifier, fixed value 64412 for this model.	0	FC03	uint16	R
l Length of this model block in registers.	1	FC03	uint16	R
damanipulation Flag enabling generic data-manipulation attack simulation mode.	2	FC03	uint16	R/W
falsifydeviceidentity Flag to simulate falsification of device identity data.	3	FC03	uint16	R/W
measpalwaysnameplate Flag forcing active power measurement to report nameplate value.	4	FC03	uint16	R/W
measqalwaysminimum Flag forcing reactive power measurement to report minimum value.	5	FC03	uint16	R/W
measqalwaysmaximum Flag forcing reactive power measurement to report maximum value.	6	FC03	uint16	R/W
measqalwayszero Flag forcing reactive power measurement to report zero.	7	FC03	uint16	R/W
measzerop Flag forcing active power measurement to report zero.	8	FC03	uint16	R/W
measinvertq Flag inverting the sign of reactive power measurements.	9	FC03	uint16	R/W
measlowv Flag forcing voltage measurement to report an artificially low value.	10	FC03	uint16	R/W
meashighv Flag forcing voltage measurement to report an artificially high value.	11	FC03	uint16	R/W
measlowl1v Flag forcing phase L1 voltage measurement to report a low value.	12	FC03	uint16	R/W
meashighl1v Flag forcing phase L1 voltage measurement to report a high value.	13	FC03	uint16	R/W
measlowf Flag forcing frequency measurement to report an artificially low value.	14	FC03	uint16	R/W
meashighf Flag forcing frequency measurement to report an artificially high value.	15	FC03	uint16	R/W
measlowamps Flag forcing current measurement to report an artificially low value.	16	FC03	uint16	R/W
meashighamps Flag forcing current measurement to report an artificially high value.	17	FC03	uint16	R/W
meashighs Flag forcing apparent power measurement to report a high value.	18	FC03	uint16	R/W
measlows Flag forcing apparent power measurement to report a low value.	19	FC03	uint16	R/W
meashighq Flag forcing reactive power measurement to report a high value.	20	FC03	uint16	R/W
measlowq Flag forcing reactive power measurement to report a low value.	21	FC03	uint16	R/W
measlowpf Flag forcing power factor measurement to report a low value.	22	FC03	uint16	R/W
measlowreversedpf Flag forcing reversed power factor measurement to report a low value.	23	FC03	uint16	R/W
nameplatehighp Flag spoofing nameplate active power rating to a high value.	24	FC03	uint16	R/W
nameplatelowp Flag spoofing nameplate active power rating to a low value.	25	FC03	uint16	R/W
nameplatehighs Flag spoofing nameplate apparent power rating to a high value.	26	FC03	uint16	R/W
nameplatelows Flag spoofing nameplate apparent power rating to a low value.	27	FC03	uint16	R/W
nameplatehighq Flag spoofing nameplate reactive power rating to a high value.	28	FC03	uint16	R/W
nameplatelowq Flag spoofing nameplate reactive power rating to a low value.	29	FC03	uint16	R/W
nameplatehighnomv Flag spoofing nameplate nominal voltage to a high value.	30	FC03	uint16	R/W
nameplatelownomv Flag spoofing nameplate nominal voltage to a low value.	31	FC03	uint16	R/W
nameplatelowamps Flag spoofing nameplate current rating to a low value.	32	FC03	uint16	R/W
nameplatelowvarmaxinj Flag spoofing nameplate maximum VAR injection rating to a low value.	33	FC03	uint16	R/W
nameplatelowvarmaxabs Flag spoofing nameplate maximum VAR absorption rating to a low value.	34	FC03	uint16	R/W
nameplatelowpf Flag spoofing nameplate power factor rating to a low value.	35	FC03	uint16	R/W
settingshighnomv Flag spoofing configured nominal voltage setting to a high value.	36	FC03	uint16	R/W
settingslowamps Flag spoofing configured current limit setting to a low value.	37	FC03	uint16	R/W
settingshighp Flag spoofing configured active power setting to a high value.	38	FC03	uint16	R/W
settingslowp Flag spoofing configured active power setting to a low value.	39	FC03	uint16	R/W
settingshighvamax Flag spoofing configured maximum apparent power setting to a high value.	40	FC03	uint16	R/W
settingshighvarmaxinj Flag spoofing configured maximum VAR injection setting to a high value.	41	FC03	uint16	R/W
settingshighvarmaxabs Flag spoofing configured maximum VAR absorption setting to a high value.	42	FC03	uint16	R/W
changecommonmodelid Flag simulating falsification of the SunSpec common model identifier.	43	FC03	uint16	R/W
changecommonmodellength Flag simulating falsification of the SunSpec common model block length.	44	FC03	uint16	R/W