Inverters and meters over Modbus TCP and SunSpec: reading without the vendor cloud

Why local and not the cloud

The vendor cloud delivers data minutes late, has API limits, every vendor has a different one, and when the internet goes down the data is gone. Local Modbus TCP gives you a reading every few seconds, no accounts or keys, and the same mechanism for the inverter, the meter and the battery.

Modbus in five sentences

• A device exposes 16-bit registers: holding (function 03) and input (04).
• A request is: unit id, first register address, number of registers.
• A 32-bit value takes two registers, and the word order depends on the vendor.
• The scale is either a separate register or a constant from the documentation.
• Modbus RTU is the same over RS485, with CRC plus baud rate and parity to set.

SunSpec: one map for many vendors

The SunSpec Alliance standardises the register layout. Address 40000 holds the SunS marker, followed by a chain of blocks (models): 1 – device info, 101/103 – single- and three-phase inverter, 201–204 – meters, 124 – storage control. Each block carries its ID and length, so walking the chain tells you what the device can do. One driver then covers inverters from many brands.

# model 103 (3-phase inverter) – active power W and its scale W_SF
regs = client.read_holding_registers(address=40083, count=2, slave=1).registers
power_w = int16(regs[0]) * 10 ** int16(regs[1])     # W × 10^W_SF
if regs[0] == 0x8000:                                 # SunSpec "not implemented"
    power_w = None

Traps from the field

• 0- or 1-based addresses. "Register 40084" in the manual is often address 40083 in the request.
• "Not available" values: 0x8000 (int16), 0xFFFF (uint16). Don't store them as measurements.
• Power sign. Grid: plus is import, minus is export. For batteries the convention differs between vendors, which is why every source in the panel can be inverted.
• One client at a time. Some inverters accept a single Modbus TCP connection, so a second system (e.g. the installer's EMS) can kick the gateway out.
• Read in blocks. One request for 60 registers is faster and more stable than 60 requests for one.

How we do it in Polbyte IoT

The gateway scans the local network, finds devices on port 502 and suggests a driver. It sends variable definitions (name, unit) to the server along with the readings, so a new device type needs no database changes. We test the whole chain on a house simulator: six Modbus TCP / SunSpec devices, no roof full of panels required.