Fox ESS on-grid inverter
Register map(s) for this device, each at the trust rung it earned. Addresses are 0-based
as on the wire. Word order and scaling are confirmed at the hardware-verified rung and at no rung below it.
interop-verified
Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
| point | address (0-based) | type | scale | unit |
|---|
| master_state | 10500 | U16 | 1 | |
| grid_yield_today | 10503 | U16 | 0.1 | |
| grid_yield_total | 10504 | U32BE | 0.1 | |
| feed_in_power | 10506 | I16 | 1 | |
| output_power | 10507 | I16 | 1 | |
| load_power | 10508 | I16 | 1 | |
| bat_power | 10509 | I16 | 1 | |
| grid_volt_r | 10700 | U16 | 0.1 | |
| grid_current_r | 10701 | I16 | 0.1 | |
| grid_freq_r | 10702 | U16 | 0.01 | |
| grid_power_r | 10703 | I16 | 1 | |
| grid_volt_s | 10704 | U16 | 0.1 | |
| grid_current_s | 10705 | I16 | 0.1 | |
| grid_freq_s | 10706 | U16 | 0.01 | |
| grid_power_s | 10707 | I16 | 1 | |
| grid_volt_t | 10708 | U16 | 0.1 | |
| grid_current_t | 10709 | I16 | 0.1 | |
| grid_freq_t | 10710 | U16 | 0.01 | |
| grid_power_t | 10711 | I16 | 1 | |
| pv1_volt | 10800 | U16 | 0.1 | |
| pv1_current | 10801 | U16 | 0.1 | |
| pv1_power | 10802 | U16 | 1 | |
| pv2_volt | 10803 | U16 | 0.1 | |
| pv2_current | 10804 | U16 | 0.1 | |
| pv2_power | 10805 | U16 | 1 | |
| charger_temp | 11200 | I16 | 1 | |
| inv_temp | 11201 | I16 | 1 | |
| ambient_temp | 11202 | I16 | 1 | |
| bat1_volt | 11500 | U16 | 0.1 | |
| bat1_current | 11501 | I16 | 0.1 | |
| bat1_power | 11502 | I16 | 1 | |
link settings as documented (unverified): RTU; default 9600 8N1; unit ID 1; FC 03,04,06,16,69
bench facts as documented (unverified)
| terminals | RS485 |
| max registers/read | 125 |
| model register | 10020 |
| serial register | 10036 |
| firmware register | 10055 |
| doc revision | V1.02 |
field reports — community-sourced, unverified (checked 2026-06-11)
- For some inverter firmware versions, Fox ESS changed the scale of specific registers (e.g., reading 1600 instead of 1.6), requiring integration adjustments based on the active firmware version. [source]
- Firmware updates (such as Master update to 2.23 on H3 series) can break Modbus communication or cause specific registers to return invalid errors, requiring integration re-configuration or manual file adjustments. [source]
- confirmed: baud_rates [9600], default_baud 9600, default_unit_id 1, framing [RTU], parity N, stop_bits 1 — confirmed by FoxESS Modbus Communication Protocol Guide (V1.02) which specifies RS485 asynchronous mode with 9600 bps, no parity, 8 data bits, and 1 stop bit
- confirmed: identification registers (model_register 10020, serial_register 10036, firmware_register 10055) — confirmed by FoxESS Modbus Protocol Guide where 10020 is ModuleName, 10036 is SeriesNumber, and 10055 is MasterVersion
- confirmed: register map summary (master_state @ 10500, grid_yield_today @ 10503, grid_yield_total @ 10504, feed_in_power @ 10506, grid_volt_r @ 10700, grid_current_r @ 10701, grid_freq_r @ 10702, pv1_volt @ 10800, pv1_current @ 10801, pv1_power @ 10802, charger_temp @ 11200, inv_temp @ 11201, bat1_volt @ 11500, bat1_current @ 11501, bat1_power @ 11502) — confirmed by FoxESS Modbus Protocol Guide register definitions
The trust ladder
Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.
- generated — A prompt produced it. Unproven — anyone can regenerate this.
- structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
- interop-verified — Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
- simulator-verified — Decoded correctly against a protocol emulator seeded with known-true values — catches word-order/scaling errors vs the emulator, not the physical device.
- hardware-verified x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.