BYD Battery-Box Premium Modbus register map
Also covers Battery-Box Premium HVS, Battery-Box Premium HVM, Battery-Box Premium HVL, Battery-Box Premium LVS, Battery-Box Premium LVL
Battery-Box Premium battery management unit, read-only status over its Ethernet port
- Unofficial
- 32 registers
- Modbus TCP
- Revision 1 · 2026-10-18
- Identity: serial number
Unofficial: Copied from an unofficial source and not tested. Read it as a draft and check a value on the real device before you rely on the rest. Check the map against the manufacturer's documentation before you write to a live device. Tested it? Report a test.
Communication
- Protocol
- Modbus TCP
- Unit ID
- 1
- TCP port
- 8080
- Byte / word order
- ABCD · bytes big-endian, words high first
- Addresses
- 0-based
Connection values are defaults: the device may be configured differently.
Map
- Registers
- 32 holding registers
- Groups
- 2
- Translation tables
- 3
- Revision
- 1 · 2026-10-18
- Added
- ()
- File
- maps/byd/battery-box-premium.mbmap.json · 8 KB · history
- SHA-256
- 20e86c9867742b697d94315fba0da6f22e15ca40b876a345b71952535cf8357e
- Manufacturer
- byd.com
Device identity
What a tool can read to check that this map fits the connected device (SPEC.md section 4.7). Registers with a role are read like any other register.
| Role | Register | Address | Type | Values |
|---|---|---|---|---|
| Serial number | Serial number | holding 0 | string[9] |
Sources and notes
- sarnau/BYD-Battery-Box-Infos, Read_Modbus.py and README Unofficial; register meanings come from the reference script, not from a BYD document
Source: Community reverse engineering of the BE Connect Plus protocol (sarnau/BYD-Battery-Box-Infos); BYD publishes no register map
- Unofficial: BYD does not publish this protocol and the registers were worked out from the installer software. Treat every value as unchecked and keep to reading.
- The battery management unit answers on its fixed Ethernet address 192.168.16.254, port 8080, unit id 1. It speaks Modbus RTU framing (with CRC) carried over a TCP connection, not Modbus TCP with the MBAP header; a client must be set to RTU-over-TCP.
- Only one client can be connected at a time: the BE Connect Plus app and a monitoring script cannot run together. Wi-Fi access of the unit is switched off after a while, so the wired Ethernet port is the practical route; the unit needs a route to 192.168.16.0/24.
- Readable blocks found by the community: 0x0000 to 0x0066 (hardware information and configuration), 0x0500 to 0x0518 (current status), 0x0550 to 0x0557 (BMS information) and 0x05A0 to 0x05A7 (history). The last two are request-and-response areas and are not mapped; registers 0x0010 to 0x0012 hold the hardware configuration and must never be written.
- The bit meanings of the error bitmask at 0x050D are not mapped; the reference script prints it as a hexadecimal number.
| Area | Address | Name | Type | Access | Unit | Scale | Description |
|---|---|---|---|---|---|---|---|
| HR | 0 | string[9] | R | 18 ASCII characters; the prefix tells the type: P03 or E0P3 for high-voltage packs (HVL, HVM, HVS), P02 or P011 for low-voltage ones (LVL, LVFlex, LVS) | |||
| HR | 12 | uint16 bits 8–15 | R | Firmware area A of the battery management unit, shown as V<major>.<minor> | |||
| HR | 12 | uint16 bits 0–7 | R | ||||
| HR | 13 | uint16 bits 8–15 | R | Firmware area B of the battery management unit | |||
| HR | 13 | uint16 bits 0–7 | R | ||||
| HR | 14 | uint16 bits 8–15 | R | Battery management system firmware | |||
| HR | 14 | uint16 bits 0–7 | R | ||||
| HR | 15 | uint16 bits 8–15 | R | ||||
| HR | 15 | uint16 bits 0–7 | R | ||||
| HR | 16 | uint16 bits 0–3 | R | ||||
| HR | 16 | uint16 bits 4–7 | R | ||||
| HR | 16 | uint16 bits 8–11 | R | Index into the list of inverters the pack was configured for; the list in the reference script has more entries than four bits can address. Do not change it: it is the hardware configuration | |||
| HR | 17 | uint16 bits 8–15 | R | ||||
| HR | 17 | uint16 bits 0–7 | R | Index into the battery type list of the serial prefix: HVL, HVM, HVS for P03 and E0P3, or LVL, LVFlex (Lite), LVS / LVS Lite for P02 and P011 | |||
| HR | 18 | uint16 bits 8–15 | R | ||||
| HR | 1280 | uint16 | R | % | |||
| HR | 1281 | uint16 | R | V | ×0.01 | ||
| HR | 1282 | uint16 | R | V | ×0.01 | ||
| HR | 1283 | uint16 | R | % | |||
| HR | 1284 | int16 | R | A | ×0.1 | ||
| HR | 1285 | uint16 | R | V | ×0.01 | ||
| HR | 1286 | uint16 | R | °C | |||
| HR | 1287 | uint16 | R | °C | |||
| HR | 1288 | uint16 | R | °C | |||
| HR | 1290 | uint16 bits 8–15 | R | ||||
| HR | 1290 | uint16 bits 0–7 | R | ||||
| HR | 1293 | uint16 | R | Bit set for each error; the bit meanings of the pack are not documented here | |||
| HR | 1294 | uint16 bits 8–15 | R | Parameter table version | |||
| HR | 1294 | uint16 bits 0–7 | R | ||||
| HR | 1296 | uint16 | R | V | ×0.01 | ||
| HR | 1297 | uint16 | R | Read as one register by the reference script; the neighbouring register may hold the high word | |||
| HR | 1299 | uint16 | R | Read as one register by the reference script |
No registers match
Try part of the name, an address (decimal or 0x hex) or clear the filters.
Help improve this map
- I tested it on a deviceReport whether it worked, even if you did not write the map.
- Suggest a correctionEdit the file on GitHub; it opens a pull request.
- Report a problemA wrong address, type, scale or byte order.
- Read the formatWhat each key of the file means (SPEC.md).