Connect to the Modbus TCP or RTU device and prepare to read holding registers at three possible base addresses: 0, 40000, and 50000.
At each base address, read two consecutive 16-bit holding registers (the first two registers starting at that address) and check whether their combined value equals the ASCII string 'SunS' (hex: 0x5375, 0x6E53).
If the SunS marker is found at a base address, read the following registers to discover the model chain: each model block starts with a model ID (uint16) and a length field (uint16), continuing until you encounter the end model ID 0xFFFF.
Decode each model block according to the SunSpec information model specification; common models include 1 (Common), 101-103 (Inverters), and 160 (MPPT modules).
If no SunS marker is found at any of the three addresses, the device is either not SunSpec-compliant or requires a vendor-specific unit ID — consult the device manual for the correct Modbus unit/slave ID before re-scanning.
Use the pySunSpec library or a similar reference implementation to automate discovery; it handles all three base address attempts and model parsing automatically.
Known gotchas
SunSpec devices may place their map at register 0, 40000, or 50000; scanning only 40001 (the traditional Modbus coil offset) will miss devices at the other two base addresses.
Some devices require a specific Modbus unit ID (slave address) to respond; a no-response at all three base registers may indicate the wrong unit ID rather than a non-SunSpec device.
Register 0 in some Modbus implementations is ambiguous (0-indexed vs 1-indexed convention); verify whether your library uses 0-based or 1-based addressing to avoid an off-by-one miss.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp