SunSpec Model 7 — Secure Write Response Model (DRAFT 1)
SunSpec Model 7 — Secure Write Response Model (DRAFT 1) is a protocol-layer model defined by the SunSpec Alliance for Modbus TCP. It does not represent a physical energy device but provides the response block a DER device populates after processing an authenticated write command. The template reads the request sequence echo, status code, response timestamp, millisecond sub-timestamp, response sequence number, alarm bitfield, and cryptographic algorithm identifier. The single writable register configures the response entry count. Integrators use this model to verify that secure write operations on SunSpec-compliant inverters, meters, or storage systems completed correctly.
- Protocol
- Modbus TCP
- Connection
- Ethernet, Modbus TCP
- Registers
- 10, read and write
- Brand
- SunSpec
- Last updated
Registers (10)
10 read, 1 write
| Name | Unit | Access | Address (Hidden until you enter your email) | Function (hidden) | Type (hidden) |
|---|---|---|---|---|---|
| id | Read | ||||
| l | Read | ||||
| rqseq | Read | ||||
| sts | Read | ||||
| ts | Read | ||||
| ms | Read | ||||
| seq | Read | ||||
| alm | Read | ||||
| alg | Read | ||||
| n | Read and write |
Loading registers…
Send your device list
If a device is not in the library yet, we build the template for free as soon as we have the register data.
Use cases
- Verify that authenticated write commands issued to SunSpec-compliant DER devices completed without errors.
- Monitor the alarm bitfield after each secure write to detect integrity or security alert conditions promptly.
- Track response sequence numbers over time to confirm no write commands were silently dropped or duplicated.
- Compare request and response sequence numbers to diagnose mismatches caused by communication timeouts.
- Audit cryptographic algorithm identifiers across multiple devices to confirm consistent security configuration on-site.
Installation
Confirm that the target DER device supports SunSpec Model 7 by checking its firmware release notes or SunSpec PICS document under the communication or Modbus section.
Connect the device to the same LAN as the ModbusCloud Gateway via Ethernet and ensure the device's Modbus TCP port (default 502) is reachable from the Gateway's IP address.
In the ModbusCloud portal, add your Gateway, import the SunSpec Model 7 template, and assign the correct Modbus unit ID matching the device configuration.
Perform a test read of register 0 (id) and verify the returned value equals 7, confirming the model block is correctly mapped and the Gateway is polling the right address offset.
Things to watch for
Why does register 'id' return an unexpected value instead of 7?
SunSpec models are discovered by walking the holding register map starting at the SunS marker. If your base address offset is wrong, register 0 will not land on the Model 7 id field. Use a SunSpec discovery scan to locate the exact starting address of Model 7 within the device map, then set the template offset accordingly in the portal.
The gateway connects but all Model 7 registers read as zero or NaN. What now?
Model 7 registers are only populated after a secure write transaction has been initiated. If no authenticated write has occurred recently, the device returns unimplemented or zero values. Trigger a secure write from your control system and re-read within the device's response window to see live data.
Timestamp register 'ts' shows a value that does not match wall-clock time. Why?
The ts register is a uint32 Unix epoch value. Verify the DER device has a synchronized real-time clock, either via NTP or an external time source. A device without time synchronization will report a relative counter rather than an absolute timestamp, causing apparent offsets in the ModbusCloud portal timeline.
Is it safe to write to the 'n' register without restrictions?
Use caution when writing to the n register. It is the only writable point in this model and controls response entry count. Writing unsupported values may cause the device to return malformed response blocks or trigger a Modbus exception. Test with the minimum valid value first and consult the device's SunSpec PICS document before changing this setting in production.
Knowledge base articles for this device
SunSpec Modbus: one register map for many inverters
SunSpec Modbus is the open register map SMA, Fronius, SolarEdge and Kostal share. Learn the layout, int+SF vs float, ports, and reading a mixed fleet.
Fronius Modbus: read a Symo GEN24 over Modbus TCP
Fronius Modbus explained: enable Modbus TCP on the Symo GEN24 on port 502, choose between int+SF and float, read the right SunSpec registers and scale them correctly. Practical guide for solar installers.
SMA Modbus: reading a Sunny Boy over Modbus TCP (installers)
SMA Modbus explained: enable the Modbus TCP server on port 502, choose between the SMA profile (unit ID 3) and SunSpec (unit ID 126), read the right registers, and handle the NaN values at night. Practical guide for installers.
Want to see how it works?
