FoxESS Commercial inverter series (Modbus definition V1.05.04.00) Modbus register map
FoxESS inverters with battery storage, Modbus RTU over RS485 and Modbus TCP: status, PV, grid, battery, BMS, energy counters, remote control and time-period scheduling
- Official
- 1,462 registers
- Modbus TCP and RTU
- Revision 1 · 2026-10-18
- Identity: firmware, serial number
Official: Written from the manufacturer's documentation, but not tested on a device yet. Check the map against the manufacturer's documentation before you write to a live device. Tested it? Report a test.
Communication
- Protocol
- Modbus TCP and RTU
- Unit ID
- 1default
- TCP port
- 502default
- Serial
- 9600 8N1 · 9600 baud, 8 data bits, none parity, 1 stop bit
- Byte / word order
- ABCD · bytes big-endian, words high first
- Addresses
- 0-based
- Max read
- 125 registers per request
Connection values are defaults: the device may be configured differently.
Map
- Registers
- 1462 holding registers
- Groups
- 23
- Revision
- 1 · 2026-10-18
- Added
- ()
- File
- maps/fox-ess/commercial-inverter.mbmap.json · 282 KB · history
- SHA-256
- 82e7e031feb551db54a622c41b8268c6400f95ec743f706d666dad84172c856a
- Manufacturer
- fox-ess.com
Device identity
What a tool can read to check that this map fits the connected device (SPEC.md section 4.7). Registers with a role are read like any other register.
| Role | Register | Address | Type | Values |
|---|---|---|---|---|
| Firmware | Master version | holding 36001 | uint16 | |
| Serial number | Serial number | holding 39018 | string[16] |
Sources and notes
- FOX commercial inverter Modbus interface definition description · version V1.05.04.00, 2025-12-15 tables 3-1 to 3-13 and sections 4.1 and 4.2
Source: FoxESS, FOX commercial inverter Modbus definition V1.05.04.00 (2025-12-15)
- Gains in the document are divisors: a gain of 10 on a voltage means the register holds the voltage ×10, so the map uses a scale of 0.1.
- The document does not state the byte order, the word order or the serial settings. 32-bit values are assumed to have the high register first, and 9600 baud, 8N1 is what integrators report for the H3 series; neither comes from the document.
- The model list of the public document (table 1-1) is empty, so which models and firmware versions apply is not stated here. Registers and ranges marked in the document with an asterisk, or named for a model (H3 Smart, H3 Pro, KH, 812), only exist on those models.
- Per-string registers are given for 24 strings and 24 MPPTs, and per-battery registers for 32 slaves of each of the two BMS; the document says that the host reads only the number of channels reported in 'Number of strings' and 'Number of slaves'.
- Registers 45002, 45003 and 45005 are write-only in the document.
- Bit meanings of the BMS fault registers are not described in the document.
| Area | Address | Name | Type | Access | Unit | Scale | Description |
|---|---|---|---|---|---|---|---|
| HR | 30016 | string[16] | R | ||||
| HR | 30032 | string[16] | R | ||||
| HR | 36001 | uint16 | R | ||||
| HR | 36002 | uint16 | R | ||||
| HR | 36003 | uint16 | R | ||||
| HR | 36100 | string[16] | R | ||||
| HR | 36116 | string[16] | R | ||||
| HR | 36132 | string[16] | R | ||||
| HR | 36148 | string[1] | R | ||||
| HR | 36200 | string[16] | R | ||||
| HR | 36216 | string[16] | R | ||||
| HR | 36232 | string[16] | R | ||||
| HR | 36248 | string[1] | R | ||||
| HR | 39000 | uint32 ABCD | R | For example 0x01020304 is V1.02.03.04; the first version is V1.01.00.00 | |||
| HR | 39002 | string[16] | R | ||||
| HR | 39018 | string[16] | R | ||||
| HR | 39034 | string[16] | R | ||||
| HR | 39050 | uint16 | R | ||||
| HR | 39051 | uint16 | R | ||||
| HR | 39052 | uint16 | R | ||||
| HR | 39053 | int32 ABCD | R | kW | ×0.001 | ||
| HR | 39055 | int32 ABCD | R | kW | ×0.001 | ||
| HR | 39057 | int32 ABCD | R | kVA | ×0.001 | ||
| HR | 39059 | int32 ABCD | R | kvar | ×0.001 | ||
| HR | 39061 | int32 ABCD | R | kvar | ×0.001 | ||
| HR | 39063 | bool bit 0 | R | ||||
| HR | 39063 | bool bit 2 | R | ||||
| HR | 39063 | bool bit 6 | R | ||||
| HR | 39066 | bool bit 0 | R | ||||
| HR | 39067 | bool bit 0 | R | ||||
| HR | 39067 | bool bit 1 | R | ||||
| HR | 39067 | bool bit 2 | R | ||||
| HR | 39067 | bool bit 7 | R | ||||
| HR | 39067 | bool bit 8 | R | ||||
| HR | 39067 | bool bit 11 | R | ||||
| HR | 39067 | bool bit 14 | R | ||||
| HR | 39067 | bool bit 15 | R | ||||
| HR | 39068 | bool bit 0 | R | ||||
| HR | 39068 | bool bit 1 | R | ||||
| HR | 39068 | bool bit 2 | R | ||||
| HR | 39068 | bool bit 3 | R | ||||
| HR | 39068 | bool bit 9 | R | ||||
| HR | 39068 | bool bit 10 | R | ||||
| HR | 39068 | bool bit 14 | R | ||||
| HR | 39069 | bool bit 3 | R | ||||
| HR | 39069 | bool bit 4 | R | ||||
| HR | 39069 | bool bit 9 | R | ||||
| HR | 39069 | bool bit 10 | R | ||||
| HR | 39070 | int16 | R | V | ×0.1 | ||
| HR | 39071 | int16 | R | A | ×0.01 | ||
| HR | 39072 | int16 | R | V | ×0.1 | ||
| HR | 39073 | int16 | R | A | ×0.01 | ||
| HR | 39074 | int16 | R | V | ×0.1 | ||
| HR | 39075 | int16 | R | A | ×0.01 | ||
| HR | 39076 | int16 | R | V | ×0.1 | ||
| HR | 39077 | int16 | R | A | ×0.01 | ||
| HR | 39078 | int16 | R | V | ×0.1 | ||
| HR | 39079 | int16 | R | A | ×0.01 | ||
| HR | 39080 | int16 | R | V | ×0.1 | ||
| HR | 39081 | int16 | R | A | ×0.01 | ||
| HR | 39082 | int16 | R | V | ×0.1 | ||
| HR | 39083 | int16 | R | A | ×0.01 | ||
| HR | 39084 | int16 | R | V | ×0.1 | ||
| HR | 39085 | int16 | R | A | ×0.01 | ||
| HR | 39086 | int16 | R | V | ×0.1 | ||
| HR | 39087 | int16 | R | A | ×0.01 | ||
| HR | 39088 | int16 | R | V | ×0.1 | ||
| HR | 39089 | int16 | R | A | ×0.01 | ||
| HR | 39090 | int16 | R | V | ×0.1 | ||
| HR | 39091 | int16 | R | A | ×0.01 | ||
| HR | 39092 | int16 | R | V | ×0.1 | ||
| HR | 39093 | int16 | R | A | ×0.01 | ||
| HR | 39094 | int16 | R | V | ×0.1 | ||
| HR | 39095 | int16 | R | A | ×0.01 | ||
| HR | 39096 | int16 | R | V | ×0.1 | ||
| HR | 39097 | int16 | R | A | ×0.01 | ||
| HR | 39098 | int16 | R | V | ×0.1 | ||
| HR | 39099 | int16 | R | A | ×0.01 | ||
| HR | 39100 | int16 | R | V | ×0.1 | ||
| HR | 39101 | int16 | R | A | ×0.01 | ||
| HR | 39102 | int16 | R | V | ×0.1 | ||
| HR | 39103 | int16 | R | A | ×0.01 | ||
| HR | 39104 | int16 | R | V | ×0.1 | ||
| HR | 39105 | int16 | R | A | ×0.01 | ||
| HR | 39106 | int16 | R | V | ×0.1 | ||
| HR | 39107 | int16 | R | A | ×0.01 | ||
| HR | 39108 | int16 | R | V | ×0.1 | ||
| HR | 39109 | int16 | R | A | ×0.01 | ||
| HR | 39110 | int16 | R | V | ×0.1 | ||
| HR | 39111 | int16 | R | A | ×0.01 | ||
| HR | 39112 | int16 | R | V | ×0.1 | ||
| HR | 39113 | int16 | R | A | ×0.01 | ||
| HR | 39114 | int16 | R | V | ×0.1 | ||
| HR | 39115 | int16 | R | A | ×0.01 | ||
| HR | 39116 | int16 | R | V | ×0.1 | ||
| HR | 39117 | int16 | R | A | ×0.01 | ||
| HR | 39118 | int32 ABCD | R | kW | ×0.001 | ||
| HR | 39123 | int16 | R | V | ×0.1 | ||
| HR | 39124 | int16 | R | V | ×0.1 | ||
| HR | 39125 | int16 | R | V | ×0.1 |
No registers match
Try part of the name, an address (decimal or 0x hex) or clear the filters.
Help improve this map
- I tested it on a deviceReport whether it worked, even if you did not write the map.
- Suggest a correctionEdit the file on GitHub; it opens a pull request.
- Report a problemA wrong address, type, scale or byte order.
- Read the formatWhat each key of the file means (SPEC.md).