SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS) Modbus register map

Updated 16 October 2026

Short answer

These ennexOS battery inverters are read and controlled over Modbus TCP via the device acting as System Manager, using the SMA Modbus profile: unit ID 1 for the communication product, 2 for system values and 3 for each device. Every register is a 32-bit SMA value (U32/S32) with a FIXn decimal format or a tag code. The map covers status, battery state, ratings, active power limits, the external setpoint fallback and the direct battery power window.

This page lists 30 Modbus registers for the SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS) — 21 writable — with the table, 0-based wire address, data type, word order, scale, units and access of each, re-typed from SMA’s own free documentation (linked below) and checked against it.

Manufacturer: SMA
Model: Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS)
Equipment type: Battery inverter
Registers: 30 (21 writable)
Transport: Modbus TCP
Default unit ID: 3
TCP port: 502
Documented addressing: 0-based (the number printed is the address on the wire)
32-bit word order: ABCD high word first (big-endian)
Also known as: STPS30-20, STPS50-20, STPS27-US-20, STPS60-US-20, SI30-20, SI50-20, SI27-US208-20, SI40-US480-20, SI60-US480-20, Sunny Tripower Storage X 50, Sunny Island X 50
Source document: SMA Modbus Interface - Sunny Tripower Storage X / Sunny Island X (Technical Information) · SMAModbus-STPS-X-SI-X-TI-en-11 (Version 1.1) · rev. 2026-04-20

Download CSV all columns JSON Manufacturer PDF ↗

Integration notes: SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS)

Integration in brief

Activate the Modbus TCP server on the System Manager, disable its energy management if a third-party EMS will steer the batteries, then talk to each device on unit ID 3 (port 502). Set 40210 = 1079, 41195 = timeout and 44029 = 303 once, then write 44449 and 44451 together at a regular interval (SMA's example: once per second).

Minimum registers to map

Addresses are 0-based wire addresses. Enough to monitor and run the unit; map more as the job needs.

Register	Name	Type	Why	Access
IR 30845	Current battery state of charge (unit ID 2/3)	UINT32 ABCD	Battery state of charge (%)	Read
IR 30955	Operating status of battery (unit ID 3)	UINT32 ABCD	Battery operating status	Read
HR 40029	General operating status (unit ID 2/3)	UINT32 ABCD	General operating status	Read
HR 40210	Operating mode active power setpoint (unit ID 3)	UINT32 ABCD	Active power setpoint mode - must be 1079 for external battery control	Read/write
HR 41195	Timeout for external setpoint (unit ID 2/3)	UINT32 ABCD	External setpoint timeout (watchdog)	Read/write
HR 44449	Maximum active power battery (unit ID 3)	INT32 ABCD	Battery power upper bound (%)	Write
HR 44451	Minimum active power battery (unit ID 3)	INT32 ABCD	Battery power lower bound (%)	Write

Enable Modbus control & writes

Log in to the user interface of the device configured as System Manager and activate its Modbus server (TCP only; no RTU or UDP). For direct battery control the energy management in the System Manager must be deactivated, after which the third-party EMS is responsible for battery and inverter protection (basic functions such as deep-discharge protection remain). Set CtlComMssMod to 'Apply fallback values' and FlbWMaxNom/FlbWMinNom to 0 in the parameters.

Communication loss & watchdog

41195 'Timeout for external setpoint' (1-1800 s, default 600 s) with 41193 choosing 'keep values' (2506, default) or 'use fallback values' (2507) when setpoints stop. SMA's battery procedure uses a 10 s timeout and resends 44449/44451 about once per second.

Byte order & addressing

All registers are 32-bit, high word first; always read/write both registers of a value in one request.
No minus-one offset: request the ADR number as printed (unlike SMA's SunSpec profile on unit ID 126, which starts at 40001 = address 40000).
44449 and 44451 are write-only S32 with two decimals (-100.00 % to +100.00 %); positive = discharge, negative = charge; write both in one 4-register FC16 request.
Before the first write 44449/44451 read 8000 0000 8000 0000 (NaN); write zeros to return to neutral.
44029 must be set to 303 (ramps off) for the battery procedure; this register is used in the TI's procedure but has no row in its tables, so it is not listed here.

Network setup

Connect over Ethernet to the System Manager's IP address, TCP port 502 by default (pick a free port 49152-65535 if changing).
Unit ID 1 = communication product, 2 = system, 3 = each Sunny Tripower Storage X / Sunny Island X device.
The correct country standard must be selected at commissioning before the Modbus grid-management functions work.
Leave at least 1 s between transfers and transfer no more than five values at once; writes take about 1 s per parameter to be acknowledged.

Watch out for

With energy management disabled the System Manager no longer protects the battery - the external EMS must.
Resetting the product to defaults can disable the Modbus server; check it is still enabled afterwards.
Read-only access needs no password once Modbus is enabled, so keep the Modbus port off the internet.

SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS) Modbus registers

Address = 0-based wire address (the documented number is shown under it when it differs) · Order: ABCD = high word first, CDAB = low word first · Scale: engineering value = raw × scale.

30 of 30 shown

SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS) Modbus register map
Table	Address	Name	Description	Type	Order	Scale	Units	Access	Values / bits
IR	30005	Serial number (unit ID 1)	Serial number of the device.	UINT32	ABCD			Read
IR	30051	Device category (unit ID 1)	Device category tag, e.g. 8009 = hybrid inverter.	UINT32	ABCD			Read	8009 = Hybrid inverter
IR	30201	Current state of health (unit ID 2/3)	Health status tag (5-minute value).	UINT32	ABCD			Read	307 = OK
IR	30845	Current battery state of charge (unit ID 2/3)	User SoC: SoC within the configured charge/discharge limits.	UINT32	ABCD		%	Read
IR	30955	Operating status of battery (unit ID 3)	Battery state tag.	UINT32	ABCD			Read	303 = Off; 2291 = Battery standby; 2292 = Battery charging (default); 2293 = Battery discharging
IR	33017	Nominal active power WMaxOutRtg (unit ID 2)	Rated feed-in active power of the system.	INT32	ABCD		W	Read
IR	33019	Nominal active power WMaxInRtg (unit ID 2/3)	Rated intake (charging) power, negative, e.g. -50000 W.	INT32	ABCD		W	Read
HR	40018	Quick shut-down of the inverters (unit ID 2/3)	Fast stop/start of the system (UID 2) or one device (UID 3).	UINT32	ABCD			Read/write	381 = Standby; 1467 = Start; 1749 = Full stop (AC and DC side)
HR	40029	General operating status (unit ID 2/3)	Overall operating state tag.	UINT32	ABCD			Read	303 = Off; 309 = Operation; 569 = Switched on (default); 1295 = Standby; 1795 = Blocked; 16777213 = Information not available
HR	40187	Nominal battery capacity (unit ID 2/3)	Rated battery capacity.	UINT32	ABCD		Wh	Read
HR	40210	Operating mode active power setpoint (unit ID 3)	Source of the active power setpoint; 1079 needed for battery control.	UINT32	ABCD			Read/write	303 = Off; 1077 = Manual setpoint in W; 1078 = Manual setpoint in %; 1079 = External active power setpoint (default)
HR	40212	Active power limitation, in W (unit ID 3)	Absolute active power limit, 0-60000 W.	UINT32	ABCD		W	Read/write
HR	40214	Active power limitation in % (unit ID 3)	Relative active power limit, 0-100 %.	UINT32	ABCD		%	Read/write
HR	40236	Operating mode of the BMS (unit ID 3)	Battery management operating mode.	UINT32	ABCD			Read/write	303 = Off; 308 = On; 2289 = Battery charging (default); 2290 = Battery discharging; 2424 = Default setting
HR	40472	Nominal grid voltage (unit ID 2/3)	Nominal grid voltage, e.g. 230 or 400 V.	UINT32	ABCD		V	Read/write
HR	40721	Minimum width of deep discharge protection range (unit ID 3)	Default 1 %, recommended above 0 %.	UINT32	ABCD		%	Read/write
HR	41193	Behavior during failure of external setpoint (unit ID 2/3)	What happens when external setpoints stop arriving.	UINT32	ABCD			Read/write	2506 = Keep values (default); 2507 = Use fallback values
HR	41195	Timeout for external setpoint (unit ID 2/3)	Setpoint timeout, 1-1800 s, default 600 s.	UINT32	ABCD		s	Read/write
HR	41315	Operating mode active power controller (unit ID 2)	Selects open-loop or closed-loop active power control.	UINT32	ABCD			Read/write	3352 = Open-loop control (default); 3353 = Closed-loop control
HR	41369	Activation threshold, grid feed-in (unit ID 2/3)	Default 5 %.	INT32	ABCD	× 0.001	%	Read/write
HR	41371	Deactivation threshold grid feed-in (unit ID 2/3)	Default 5 %.	INT32	ABCD	× 0.001	%	Read/write
HR	41373	Activation threshold power consumption (unit ID 2/3)	Default 5 %.	INT32	ABCD	× 0.001	%	Read/write
HR	41375	Deactivation threshold power consumption (unit ID 2/3)	Default 5 %.	INT32	ABCD	× 0.001	%	Read/write
HR	44001	Soft start rate P (unit ID 2/3)	Active power soft-start ramp, 1-10000 %/min, default 1200.	UINT32	ABCD		%/min	Read/write
HR	44013	Soft start P after a grid fault (unit ID 2/3)	Enables the soft start after a grid fault.	UINT32	ABCD			Read/write	303 = Off; 308 = On
HR	44381	Nominal active power WMaxOut (unit ID 2/3)	Feed-in active power setting, e.g. 12000 W.	INT32	ABCD		W	Read/write
HR	44383	Nominal active power WMaxIn (unit ID 2/3)	Intake active power setting, -60000 to 0 W.	INT32	ABCD		W	Read/write
HR	44449	Maximum active power battery (unit ID 3)	Upper battery power bound, % of nominal; write together with 44451.	INT32	ABCD	× 0.01	%	Write
HR	44451	Minimum active power battery (unit ID 3)	Lower battery power bound, % of nominal; write together with 44449.	INT32	ABCD	× 0.01	%	Write
HR	44505	Limitation of active power in % (unit ID 2)	System active power limit; 0-100.00 %, default 100 %.	UINT32	ABCD	× 0.01	%	Read/write

Notes on this map

Word order: the SMA Modbus ennexOS TI (SMAModbus-ennexOS-TI-en-14, https://files.sma.de/downloads/SMAModbus-ennexOS-TI-en-14.pdf, section 3.4.3) says the big-endian transmission rule also applies to 32/64-bit values ('Big-Big'); its validity list names STPS 30-20/50-20, SI30-20/SI50-20 and Sunny Island X-US. For all variants, including STPS27-US-20/STPS60-US-20, this TI's own battery example writes 10 % to 44449/44451 as 0000 03E8 and shows NaN as 8000 0000, i.e. high word first.
Format to scale: FIX0 = integer (x1), FIX2 = two decimals (x0.01), FIX3 = three decimals (x0.001), DURATION = seconds, per the SMA data formats in the ennexOS TI. TAGLIST/ENUM values are tag codes.
NaN values: U32 0xFFFFFFFF, S32 0x80000000, and status tags (TAGLIST) 16777213 (0xFFFFFD) for 'information not available'.
The unit ID in each name tells where to read the register: 1 = communication product, 2 = system (System Manager view), 3 = individual device; '2/3' registers exist under both and may differ because one is the system view.
Table: 3xxxx registers are listed here as input registers and 4xxxx as holding registers. The TI's procedure reads with function 0x04 and writes with 0x10; the ennexOS TI lists 0x03, 0x04, 0x06 and 0x10 as supported.
Left out: 30233 ('Accumulated connected power of the PV inverter') - its row text describes setting an active power limit while the access is read-only, so the source contradicts itself on what the register is.
Left out: 31391 - named 'Battery state of charge' but documented as returning a status tag (error/off/OK/warning); name and format disagree. Use 30845 for the state of charge in percent.
This TI is deliberately limited to control-related registers; the full device list is in SMA's per-device 'Parameters and Measured Values' document, which was not available as a free download and is not covered here.
Writable RW parameters are meant for long-term settings; SMA marks some that must not be changed more than once a day and marks the grid-management parameters that may be written cyclically. The markings are in SMA's 'Parameters and Measured Values' document, not in this TI.

Check it against the live device. A register map tells you what the controller can expose; the unit in front of you may differ by firmware or options. Read a few registers and compare them with the unit’s own display; for a 32-bit value the float and byte-order decoder shows all four word orders at once, so a wrong word order or scale is obvious. New to this? Read what a register map is and why addresses are off by one.

Questions about the SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS)

What Modbus registers does the SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS) have?

This map lists 30 registers: 7 input registers, 23 holding registers. 21 of them can be written. Registers vary with firmware, options and configuration, so confirm against the device.

Are the SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS) Modbus addresses 0-based or 1-based?

The manufacturer's document numbers registers 0-based (the number printed is the address on the wire). Every address on this page is the 0-based wire address you put in the request; the documented number is shown under it where it differs. The SMA tables list 'ADR' as the decimal Modbus register and the TI's own procedure enters ADR directly as the start address in the Modbus master, so the printed number is the wire address (30845 is requested as 30845). Only the SunSpec profile (unit ID 126, from 40001) uses a minus-one offset - that profile is not part of this map.

What byte order does the SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS) use for 32-bit values?

Multi-register values in this map use ABCD (high word first (big-endian)). Set your client to this order for every 32/64-bit value in the table.

What are the minimum Modbus registers to integrate the SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS)?

Start with IR 30845 Current battery state of charge (unit ID 2/3) (Battery state of charge (%)); IR 30955 Operating status of battery (unit ID 3) (Battery operating status); HR 40029 General operating status (unit ID 2/3) (General operating status); HR 40210 Operating mode active power setpoint (unit ID 3) (Active power setpoint mode - must be 1079 for external battery control); HR 41195 Timeout for external setpoint (unit ID 2/3) (External setpoint timeout (watchdog)); HR 44449 Maximum active power battery (unit ID 3) (Battery power upper bound (%)); HR 44451 Minimum active power battery (unit ID 3) (Battery power lower bound (%)).

How do I enable Modbus control of the SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS)?

What happens when the SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS) loses Modbus communication?

Where is the official SMA Sunny Tripower Storage X / Sunny Island X (SMA Modbus, ennexOS) Modbus documentation?

The source is SMA Modbus Interface - Sunny Tripower Storage X / Sunny Island X (Technical Information) (SMAModbus-STPS-X-SI-X-TI-en-11 (Version 1.1)), revision 2026-04-20, published free by SMA at https://files.sma.de/downloads/SMAModbus-STPS-X-SI-X-TI-en-11.pdf.

Source: SMA Modbus Interface - Sunny Tripower Storage X / Sunny Island X (Technical Information) · SMAModbus-STPS-X-SI-X-TI-en-11 (Version 1.1) · rev. 2026-04-20. Register numbers, types, scaling and units are reproduced as published; descriptions are our own.