Connect to the device with a Modbus TCP or RTU client and target unit ID 1 (or the device-specific unit ID).
Read 2 holding registers starting at data address 40000 (protocol address, 0-based). The two registers must decode to ASCII `SunS` (0x5375 0x6E53); if not, the device does not expose a SunSpec map at this base.
The Common Model block begins at data address 40002. Read the model ID (register 40002) and length (register 40003), then read the full block.
Walk the model chain: after each model block, advance by `length + 2` registers to find the next model ID. Stop when you read model ID 0xFFFF (end marker).
Parse each model block according to the SunSpec model definition for that ID (e.g., model 101/102/103 for single/split/three-phase inverters).
Known gotchas
There is a documented 40000-vs-40001 addressing ambiguity: some tools display registers using 1-based PLC numbering (register 40001 = data address 40000). Always confirm whether a given tool or datasheet uses 0-based protocol addresses or 1-based PLC addresses.
The SunS identifier occupies registers at data addresses 40000–40001; the first SunSpec model (Common Model) starts at 40002 — not 40000 and not 40001.
Modbus register reads are capped at 125 registers per request; split large model reads into multiple requests.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp