SunSpec Modbus: How to Read Solar Inverter Data
SunSpec is a common Modbus register layout that many solar inverter brands implement, so one reader can pull power, energy and status from different brands the same way. Instead of a fixed address list, a SunSpec device exposes a chain of self-describing “models”. Once you can walk that chain, you don’t need a brand-specific register table for the basics.
Step 1: Find the SunSpec base address
A SunSpec map starts with two registers containing the ASCII text SunS (0x5375 0x6E53). Read 2 holding registers (FC03) at the usual base addresses in this order:
| Base address (wire) | Datasheet style | Notes |
|---|---|---|
| 40000 | 40001 | By far the most common |
| 0 | 00001 | Some devices |
| 50000 | 50001 | Some devices |
If you get 0x5375 0x6E53, you’ve found the map. If you get exception 02, try the next base. See Modbus exception codes if something else comes back.
Step 2: Walk the model chain
Right after SunS come the models, one after another. Every model starts with two registers:
- ID: which model this is (1, 103, 160…)
- L: how many registers of data follow
To reach the next model, skip L registers. The chain ends with ID 0xFFFF and length 0. Walking the chain once and caching the start address of each model is more robust than hardcoding offsets. Firmware updates sometimes insert models.
Step 3: Read the models that matter
| Model | Name | Why you want it |
|---|---|---|
| 1 | Common | Manufacturer, model, serial number, firmware version, device address |
| 101 / 102 / 103 | Inverter (single / split / three phase) | Power, energy, voltage, current, frequency, temperature, state. Integer values with scale factors |
| 111 / 112 / 113 | Inverter, float variants | Same data as 32-bit floats, no scale factors |
| 120 | Nameplate | Rated power and capabilities |
| 123 | Immediate controls | Power limit (WMaxLimPct), connect/disconnect |
| 160 | Multiple MPPT extension | Per-MPPT DC voltage, current and power |
Newer devices may also expose the IEEE 1547 “DER” model family (700 series). The monitoring basics are still usually available in 1 and 101–103.
Scale factors: the part everyone gets wrong once
Integer models store most values as a raw integer plus a separate scale factor register (a signed 16-bit exponent). The real value is:
value = raw × 10^SF
For example, W = 5423 with W_SF = -1 means 542.3 W. WH with WH_SF = 3 is in kWh rather than Wh. Read the scale factor together with the value in the same request. If you read them separately, the device can change the scale between the two reads.
Values the device doesn’t implement come back as sentinel values: 0x8000 for signed 16-bit and 0xFFFF for unsigned 16-bit. Treat these as “not available”, not as numbers.
Key registers in model 103 (three-phase inverter)
| Point | Meaning | Unit |
|---|---|---|
A, AphA/B/C | AC current, total and per phase | A (× A_SF) |
PPVphAB…, PhVphA… | Line and phase voltages | V (× V_SF) |
W | AC active power | W (× W_SF) |
Hz | Grid frequency | Hz (× Hz_SF) |
WH | Lifetime energy (32-bit accumulator) | Wh (× WH_SF) |
DCA, DCV, DCW | DC current, voltage, power | (× their SFs) |
TmpCab | Cabinet temperature | °C (× Tmp_SF) |
St | Operating state | enum |
Evt1 | Event/alarm bitfield | bits |
Operating state (St)
| Value | State |
|---|---|
| 1 | Off |
| 2 | Sleeping (night) |
| 3 | Starting |
| 4 | MPPT (producing normally) |
| 5 | Throttled (power limited) |
| 6 | Shutting down |
| 7 | Fault |
| 8 | Standby |
A plant that shows St = 5 at noon on a clear day is being curtailed. That could be an export limit or a PTF-based stop. St = 7 together with a non-zero Evt1 is a real fault.
Common pitfalls
- Off-by-one on the base address.
40001in a datasheet is40000on the wire. - 32-bit values split across reads.
WHspans two registers. Read both in one request, otherwise the low word can roll over between reads. - Reading too many registers at once. Some inverters limit a single read to far fewer than 125 registers. Read a model in chunks if needed.
- Assuming every brand is complete. Some implementations leave points unimplemented (sentinel values) or put the SunSpec map behind a different unit ID than the brand map.
- Dataloggers in the middle. If a datalogger or gateway sits between you and the inverter, you’re often reading the gateway’s own map, not the inverter’s SunSpec map.
Try it on your inverter
- Open Ranaliz iOT Tester, a free desktop Modbus tester for Windows and macOS.
- Connect over Modbus TCP (port 502) or RTU.
- Read 2 holding registers at 40000 and switch the display to ASCII. You should see
SunS. - Read the next two registers to get the first model’s ID and length, then continue down the chain.
- Switch the display between int16 and uint16 to decode scale factors and values.
Once the map is confirmed, continuous collection, alarms and performance ratio tracking belong in a monitoring platform rather than a test tool. See what solar monitoring software does.
FAQ
Do all inverters support SunSpec?
No. Many major brands do, sometimes only after enabling it in settings or with a specific firmware. Others use only their own register map. Checking for the SunS marker is the quickest test.
What is the difference between model 103 and 113?
Both describe a three-phase inverter. Model 103 uses integers with scale factors, and model 113 uses 32-bit floats. A device usually implements one of them.
How do I limit inverter power over SunSpec?
Through the immediate controls model (123): set WMaxLimPct and enable it with WMaxLim_Ena. Many inverters also require remote control to be enabled locally first. Otherwise the write returns exception 03 or 04.
Sources
- SunSpec Alliance — SunSpec Information Model Specification and model definitions (models 1, 101–103, 111–113, 120, 123, 160)
- Modbus Organization — MODBUS Application Protocol Specification V1.1b3
