Pylontech US2000/US3000 battery (RS485)

Register map(s) for this device, with a note of how far each has been checked. Addresses are 0-based, as on the wire. Scale and byte order are confirmed only at the hardware-verified rung.

coherence-checked

Round-trips through a real Modbus stack with no overlapping addresses and a word-order-sensitive codec — the map is internally coherent and wire-decodable. Does NOT prove byte-order or scaling match a real device: the emulator is seeded from the map's own types, so a uniformly wrong byte-order still round-trips. Only hardware-verified confirms byte-order/scale on the wire.

point	address (0-based)	type	scale
cell_1_voltage	0	I16	0.001
cell_2_voltage	1	I16	0.001
cell_3_voltage	2	I16	0.001
cell_4_voltage	3	I16	0.001
cell_5_voltage	4	I16	0.001
cell_6_voltage	5	I16	0.001
cell_7_voltage	6	I16	0.001
cell_8_voltage	7	I16	0.001
cell_9_voltage	8	I16	0.001
cell_10_voltage	9	I16	0.001
cell_11_voltage	10	I16	0.001
cell_12_voltage	11	I16	0.001
cell_13_voltage	12	I16	0.001
cell_14_voltage	13	I16	0.001
cell_15_voltage	14	I16	0.001
cell_16_voltage	15	I16	0.001
bms_temperature	16	I16	0.1
cell_temperature_1	17	I16	0.1
cell_temperature_2	18	I16	0.1
cell_temperature_3	19	I16	0.1
cell_temperature_4	20	I16	0.1
current	21	I16	0.1
module_voltage	22	U16	0.001
remain_capacity	23	U16	0.001
module_total_capacity	24	U16	0.001
cycle_number	25	U16	1
cell_high_voltage_limit	100	I16	0.001
cell_low_voltage_limit	101	I16	0.001
cell_under_voltage_limit	102	I16	0.001
charge_high_temperature_limit	103	I16	0.1
charge_low_temperature_limit	104	I16	0.1
charge_current_limit	105	I16	0.1
module_high_voltage_limit	106	I16	0.001
module_low_voltage_limit	107	I16	0.001
module_under_voltage_limit	108	I16	0.001
discharge_high_temperature_limit	109	I16	0.1
discharge_low_temperature_limit	110	I16	0.1
discharge_current_limit	111	I16	0.1
charge_voltage_limit	200	U16	0.001
discharge_voltage_limit	201	U16	0.001
max_charge_current	202	I16	0.1
max_discharge_current	203	I16	0.1

link settings as documented (unverified): ASCII; default 115200 8N1; unit ID 2; Uses proprietary Pylontech RS485 protocol (based on B.12 front-end smart devices protocol) with HEX-ASCII transmission, not standard Modbus.

⚠ Please contact PYLONTECH first, before doing any change on these settings. — Starkest reads only; we never write a control register.

bench facts as documented (unverified)

wiring notes	RS485 asynchronous serial communication.
protocol notes	For manual charge/discharge management settings, the command must be sent periodically. If the battery does not receive the command again within 10 seconds, it automatically reverts to the latest automatic values.
identification notes	Device serial number is retrieved via command 93H. Software version is retrieved via command 96H.
FC 43 device ID	not supported
power	48V battery module with BMS
doc revision	V3.3

field reports — community-sourced, unverified (checked 2026-06-11)

Firmware updates (e.g., version 3.2 and newer) on some batteries like US2000B disable the B.12 protocol on the RS232 console port, restricting it to console shell commands only. [source]
Address mapping issues where some setups fail with default address 2 or 0 (returning CID2 = 0x90 address error) and require address 1 to establish communication. [source]
Inverters like the EG4 6000XP may fail to parse extended capacity fields, cell temperatures, cell voltages, or cycle counts from the analog data response (CID2 = 0x42) even though total battery voltage is parsed correctly. [source]
When emulating the Pylontech protocol, if communication is lost, some inverters (like the EG4 6000XP) will remain stuck in a 'Charging: Forbidden' state for exactly 10 minutes before clearing. [source]
confirmed: Baud rates [9600, 115200, 500000] and default baud rate of 115200 — confirmed by Pylontech RS485 protocol document and user manuals
confirmed: Default unit ID of 2 — confirmed by python-pylontech library implementation and protocol specifications
confirmed: Uses proprietary Pylontech RS485 protocol based on B.12 front-end smart devices protocol with HEX-ASCII transmission — confirmed by protocol document
confirmed: Device serial number retrieved via command 93H and software version via command 96H — confirmed by protocol command tables
confirmed: Manual charge/discharge management settings command must be sent periodically, reverting to automatic values if not received within 10 seconds — confirmed by protocol document note under command 94H

The trust ladder

Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.

generated — A prompt produced it. Unproven — anyone can regenerate this.
structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
coherence-checked — Round-trips through a real Modbus stack with no overlapping addresses and a word-order-sensitive codec — the map is internally coherent and wire-decodable. Does NOT prove byte-order or scaling match a real device: the emulator is seeded from the map's own types, so a uniformly wrong byte-order still round-trips. Only hardware-verified confirms byte-order/scale on the wire.
hardware-verified (software-key) x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.

Device not here? Upload its manual and get a checked map back. It's free.

Want it confirmed against your own device? Order hardware verification. If it doesn't check out, you don't pay.

Building on a lot of devices? License the library — machine-readable maps, the firmware matrix, and API access.