Fronius · Solar inverter
Symo / Primo / Tauro / GEN24 Plus (SunSpec) Modbus register map
Default configuration
- Protocol
- Modbus TCP
- Port
- 502
- Unit ID
- 1
- Addressing
- 0-based
- Byte order
- Big endian
- Word order
- High word first
Register map
| Address | Count | Name | Type | Unit | Scale | Access |
|---|---|---|---|---|---|---|
| 40000 | 2 | SunSpec identifier ("SunS") 0x53756E53. Present on every SunSpec device. | UInt32 | - | 1 | R |
| 40002 | 1 | SunSpec model ID (common) 1 = SunSpec common model. | UInt16 | - | 1 | R |
| 40003 | 1 | SunSpec common model length Number of registers that follow this field (65 on Fronius devices). Use it to check the base address. | UInt16 | - | 1 | R |
| 40004 | 16 | Manufacturer "Fronius". | Ascii | - | 1 | R |
| 40020 | 16 | Model Device model, e.g. "Symo 10.0-3-M" or "Primo GEN24 8.0 Plus". | Ascii | - | 1 | R |
| 40052 | 16 | Serial number | Ascii | - | 1 | R |
| 40069 | 1 | SunSpec model ID (inverter) 111 = single phase, 112 = split phase, 113 = three phase (float encoding). With the inverter's "int+SF" setting the model IDs are 101/102/103 at the same address and the register layout is different. | UInt16 | - | 1 | R |
| 40070 | 1 | SunSpec inverter model length 60 registers follow for the float (111-113) models. | UInt16 | - | 1 | R |
| 40071 | 2 | AC current, total A (sum of active phases). | Float32 | A | 1 | R |
| 40073 | 2 | AC current, phase A | Float32 | A | 1 | R |
| 40075 | 2 | AC current, phase B | Float32 | A | 1 | R |
| 40077 | 2 | AC current, phase C | Float32 | A | 1 | R |
| 40079 | 2 | AC voltage, phase A-B Not available on all models; single-phase devices report 0 or NaN. | Float32 | V | 1 | R |
| 40081 | 2 | AC voltage, phase B-C | Float32 | V | 1 | R |
| 40083 | 2 | AC voltage, phase C-A | Float32 | V | 1 | R |
| 40085 | 2 | AC voltage, phase A-N | Float32 | V | 1 | R |
| 40087 | 2 | AC voltage, phase B-N | Float32 | V | 1 | R |
| 40089 | 2 | AC voltage, phase C-N | Float32 | V | 1 | R |
| 40091 | 2 | AC active power Total AC power; negative when the inverter consumes (e.g. night-time standby of a battery unit). | Float32 | W | 1 | R |
| 40093 | 2 | AC frequency | Float32 | Hz | 1 | R |
| 40095 | 2 | AC apparent power | Float32 | VA | 1 | R |
| 40097 | 2 | AC reactive power | Float32 | var | 1 | R |
| 40099 | 2 | Power factor cos φ; negative = under-excited (inductive), positive = over-excited (capacitive). | Float32 | - | 1 | R |
| 40101 | 2 | AC lifetime energy Total energy fed in. Divide by 1000 for kWh. | Float32 | Wh | 1 | R |
| 40103 | 2 | DC current Reports "not implemented" on inverters with several DC inputs; per-input data is in SunSpec model 160. | Float32 | A | 1 | R |
| 40105 | 2 | DC voltage Reports "not implemented" on inverters with several DC inputs; per-input data is in SunSpec model 160. | Float32 | V | 1 | R |
| 40107 | 2 | DC power, all inputs | Float32 | W | 1 | R |
| 40109 | 2 | Cabinet temperature | Float32 | °C | 1 | R |
| 40111 | 2 | Heat sink temperature | Float32 | °C | 1 | R |
| 40117 | 1 | Inverter operating state 1 = Off, 2 = Sleeping, 3 = Starting, 4 = MPPT (normal), 5 = Throttled, 6 = Shutting down, 7 = Fault, 8 = Standby. | UInt16 | - | 1 | R |
| 40118 | 1 | Vendor operating state Fronius state code; see the state code table in the Modbus manual. | UInt16 | - | 1 | R |
| 40119 | 2 | Inverter events Bit field, SunSpec model 111-113 Evt1. Bit 0 = ground fault, 2 = DC disconnect, 4 = grid disconnect, 5 = cabinet open, 6 = manual shutdown, 7 = over temperature, 8 = blown fuse, 9 = under temperature, 10 = memory loss, 11 = arc detection, 13 = input under voltage, 14 = input over current. | UInt32 | - | 1 | R |
| 40131 | 1 | SunSpec model ID (nameplate) 120 = nameplate model. | UInt16 | - | 1 | R |
| 40132 | 1 | SunSpec nameplate model length | UInt16 | - | 1 | R |
| 40133 | 1 | Device type (DERType) 4 = PV inverter. | UInt16 | - | 1 | R |
| 40134 | 1 | Rated active power (WRtg) Fronius reports WRtg_SF = 1, so the raw value is in 10 W steps. | UInt16 | W | 10 | R |
| 40136 | 1 | Rated apparent power (VARtg) Fronius reports VARtg_SF = 1. | UInt16 | VA | 10 | R |
| 40237 | 1 | SunSpec model ID (immediate controls) 123 = immediate controls model. | UInt16 | - | 1 | R |
| 40238 | 1 | SunSpec immediate controls model length | UInt16 | - | 1 | R |
| 40241 | 1 | Grid connect / disconnect (Conn) 1 = connect, 0 = disconnect. Only honoured when remote control via Modbus is enabled on the inverter's web interface. | UInt16 | - | 1 | RW |
| 40242 | 1 | Active power limit (WMaxLimPct) Percentage of WMax; Fronius reports WMaxLimPct_SF = -2, so 5000 = 50 %. Enable the limit with WMaxLim_Ena. Write the value first, then enable. | UInt16 | % | 0.01 | RW |
| 40243 | 1 | Active power limit start time (WMaxLimPct_WinTms) Ramp-in time; 0 = immediate. | UInt16 | s | 1 | RW |
| 40244 | 1 | Active power limit return time (WMaxLimPct_RvrtTms) 0 = no automatic return to the previous limit. | UInt16 | s | 1 | RW |
| 40245 | 1 | Active power limit ramp time (WMaxLimPct_RmpTms) | UInt16 | s | 1 | RW |
| 40246 | 1 | Active power limit enable (WMaxLim_Ena) 0 = limit inactive, 1 = limit active. | UInt16 | - | 1 | RW |
| 40247 | 1 | Power factor setpoint (OutPFSet) Fronius reports OutPFSet_SF = -3, so 950 = 0.95. Enable with OutPFSet_Ena; negative values are under-excited. | Int16 | - | 0.001 | RW |
| 40251 | 1 | Power factor setpoint enable (OutPFSet_Ena) 0 = inactive, 1 = active. | UInt16 | - | 1 | RW |
| 40263 | 1 | SunSpec model ID (multiple MPPT) 160 = multiple MPPT inverter extension model. Holds the per-DC-input values that the inverter model leaves unimplemented on multi-input devices; on battery units modules 3 and 4 carry the battery charge and discharge DC values. | UInt16 | - | 1 | R |
| 40264 | 1 | SunSpec MPPT model length 48 registers for two DC inputs (88 on GEN24 Plus units with a battery, which add modules 3 and 4). | UInt16 | - | 1 | R |
| 40267 | 1 | MPPT DC power scale factor (DCW_SF) SunSpec scale factor for the module DC power (and 40268 for DC energy); auto-scaled by the inverter, 10^SF. | Int16 | - | 1 | R |
| 40268 | 1 | MPPT DC energy scale factor (DCWH_SF) SunSpec scale factor for the module lifetime energy, 10^SF. | Int16 | - | 1 | R |
| 40284 | 1 | MPPT 1 DC power DC power of input 1; engineering value = raw x 10^DCW_SF (40267). | UInt16 | W | 1 | R |
| 40285 | 2 | MPPT 1 lifetime energy Engineering value = raw x 10^DCWH_SF (40268). | UInt32 | Wh | 1 | R |
| 40304 | 1 | MPPT 2 DC power DC power of input 2; engineering value = raw x 10^DCW_SF (40267). | UInt16 | W | 1 | R |
| 40305 | 2 | MPPT 2 lifetime energy Engineering value = raw x 10^DCWH_SF (40268). | UInt32 | Wh | 1 | R |
| 40353 | 1 | SunSpec model ID (basic storage control) 124 = basic storage control model. Only present on GEN24 Plus (hybrid) units with a battery. | UInt16 | - | 1 | R |
| 40354 | 1 | SunSpec storage model length | UInt16 | - | 1 | R |
| 40355 | 1 | Maximum charge power (WChaMax) Reference value for the charge and discharge limits. 0 when no battery is connected. Fronius reports WChaMax_SF = 0. | UInt16 | W | 1 | R |
| 40358 | 1 | Storage control mode (StorCtl_Mod) Bit field: 1 = charge limit active, 2 = discharge limit active, 3 = both. | UInt16 | - | 1 | RW |
| 40360 | 1 | Minimum reserve state of charge (MinRsvPct) Fronius reports MinRsvPct_SF = -2 (5000 = 50 %). | UInt16 | % | 0.01 | RW |
| 40361 | 1 | Battery state of charge (ChaState) Usable energy as a percentage of the capacity rating; Fronius reports ChaState_SF = -2. | UInt16 | % | 0.01 | R |
| 40364 | 1 | Battery operating state (ChaSt) 1 = Off, 2 = Empty, 3 = Discharging, 4 = Charging, 5 = Full, 6 = Holding, 7 = Testing. | UInt16 | - | 1 | R |
| 40365 | 1 | Discharge limit (OutWRte) Limit as % of WChaMax; Fronius reports InOutWRte_SF = -2, so 5000 = 50 %. Negative values force charging. | Int16 | % | 0.01 | RW |
| 40366 | 1 | Charge limit (InWRte) Limit as % of WChaMax (InOutWRte_SF = -2). Negative values force discharging. | Int16 | % | 0.01 | RW |
| 40370 | 1 | Allow grid charging (ChaGriSet) 0 = no charging from the grid, 1 = charging from the grid allowed. AND-ed with the setting on the inverter's web interface. | UInt16 | - | 1 | RW |
Notes
Fronius inverters speak SunSpec Modbus TCP on the Datamanager's IP, unit ID 1, port 502. Modbus TCP must be enabled in the inverter's web interface (Communication -> Modbus -> TCP, slave = 1). This map is the "float" variant of Fronius' official register-map spreadsheet for GEN24/Primo/Symo (linked from the Modbus TCP manual): common model at 40000, inverter model 111/112/113 at 40069, nameplate model 120 at 40131, immediate controls model 123 at 40237, multiple MPPT model 160 at 40263 (module 1 DC power at 40284, module 2 at 40304; on GEN24 Plus units modules 3 and 4 report the battery charge and discharge DC values) and, with a battery installed, basic storage control model 124 at 40353. If the inverter is set to "int+SF" instead of "float", models 101/102/103 are used at 40069 and every following model moves down by 10 registers (nameplate 40121, controls 40227, multiple MPPT 40253, storage control 40343). Fronius documents its scale factors as fixed values (WMaxLimPct_SF = -2, OutPFSet_SF = -3, MinRsvPct_SF = -2, ChaState_SF = -2, InOutWRte_SF = -2), so they are applied here as plain factors; only the MPPT DC power and energy scale factors are auto-scaled by the inverter, which is why those two scale-factor registers are listed. The SunSpec end block (0xFFFF) sits at 40313 without a battery and at 40379 with one, which is a quick check that the chain matches this map. Symo, Primo, Tauro and Verto share this layout and base address; Verto models add further MPPT blocks before the end block. A connected energy meter has its own unit ID (200 by default) and its own SunSpec chain. Fronius warns that cyclical writes wear the device, so write setpoints only when they change. Addresses here are wire (0-based) addresses; the vendor spreadsheet numbers from 1, so its 40070 is 40069 here. Batteries: Fronius Reserva/Reserva Pro, BYD Battery-Box HVS/HVM and LG RESU FLEX - https://www.fronius.com/en/solar-energy/solar-solutions/solar-energy-storage/compatible-batteries.