Renogy Rover 20A/40A MPPT charge controller
Register map(s) for this device, each at the trust rung it earned. Addresses are 0-based
as on the wire. Word order and scaling are confirmed at the hardware-verified rung and at no rung below it.
interop-verified
Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
| point | address (0-based) | type | scale | unit |
|---|
| system_voltage_and_charging_current_limit | 10 | U16 | 1 | |
| discharging_current_limit_and_product_type | 11 | U16 | 1 | |
| controller_device_address | 26 | U16 | 1 | |
| battery_capacity_soc | 256 | U16 | 1 | % |
| battery_voltage | 257 | U16 | 0.1 | V |
| charging_current | 258 | U16 | 0.01 | A |
| controller_and_battery_temperature | 259 | U16 | 1 | °C |
| street_light_voltage | 260 | U16 | 0.1 | V |
| street_light_current | 261 | U16 | 0.01 | A |
| street_light_power | 262 | U16 | 1 | W |
| solar_panel_voltage | 263 | U16 | 0.1 | V |
| solar_panel_current | 264 | U16 | 0.01 | A |
| charging_power | 265 | U16 | 1 | W |
| battery_min_voltage_current_day | 267 | U16 | 0.1 | V |
| battery_max_voltage_current_day | 268 | U16 | 0.1 | V |
| max_charging_current_current_day | 269 | U16 | 0.01 | A |
| max_discharging_current_current_day | 270 | U16 | 0.01 | A |
| max_charging_power_current_day | 271 | U16 | 1 | W |
| max_discharging_power_current_day | 272 | U16 | 1 | W |
| charging_amp_hours_current_day | 273 | U16 | 1 | AH |
| discharging_amp_hours_current_day | 274 | U16 | 1 | AH |
| power_generation_current_day | 275 | U16 | 0.0001 | kWh |
| power_consumption_current_day | 276 | U16 | 0.0001 | kWh |
| total_operating_days | 277 | U16 | 1 | days |
| total_battery_over_discharges | 278 | U16 | 1 | |
| total_battery_full_charges | 279 | U16 | 1 | |
| total_charging_amp_hours | 280 | U32BE | 1 | AH |
| total_discharging_amp_hours | 282 | U32BE | 1 | AH |
| cumulative_power_generation | 284 | U32BE | 0.0001 | kWh |
| cumulative_power_consumption | 286 | U32BE | 0.0001 | kWh |
| street_light_status_and_charging_state | 288 | U16 | 1 | % |
| controller_fault_and_warning_info | 289 | U32BE | 1 | |
link settings as documented (unverified): RTU; FC 03,06,16,120,121; Start character: >10ms, End character: >10ms. 00H is a broadcast address to which all slaves respond but do not return commands.
bench facts as documented (unverified)
| max registers/read | 125 |
| inter-frame delay | 10 ms |
| broadcast | supported |
| model register | 0x000C |
| serial register | 0x0018 |
| firmware register | 0x0014 |
| FC 43 device ID | not supported |
field reports — community-sourced, unverified (checked 2026-06-11)
- The official MODBUS Protocol document contains a typo in its temperature parsing example, stating that a register value of 800AH (0x800A) indicates a battery temperature of -10 °C. In reality, the battery temperature is stored in the low byte of register 0x0103, where the highest bit (bit 7) is the sign bit. A battery temperature of -10 °C is represented by 0x8A in the low byte (e.g., 0x008A), whereas 0x800A represents a controller temperature of -0 °C and a battery temperature of +10 °C. [source]
- Writing 0 to the load control register 0x010A to turn off the load does not work on some firmware versions. Once the load is turned on by writing 1 to 0x010A, writing 0 back to it does nothing. To turn the load off, users must work around this by changing the load working mode (register 0xE01D) to 14 and then back to 15. [source]
- The default Modbus slave address for some Renogy controllers (especially when communicating via the BT-1 Bluetooth module) is undocumented as 255 (0xFF) instead of the standard Modbus default of 1. [source]
- confirmed: RTU framing and function codes 3, 6, 16, 120, 121 — confirmed by official Renogy Rover MODBUS Protocol document [1.1.2]
- confirmed: Start/End character delay >10ms — confirmed by official Renogy Rover MODBUS Protocol document
- confirmed: 00H broadcast address behavior — confirmed by official Renogy Rover MODBUS Protocol document
- confirmed: Identification registers (firmware @ 0x0014, model @ 0x000C, serial @ 0x0018) — confirmed by floreno/renogy-rover-modbus GitHub repository
- confirmed: Register map addresses (battery SOC @ 0x0100, battery voltage @ 0x0101, charging current @ 0x0102, temperatures @ 0x0103) — confirmed by sophienyaa/NodeRenogy GitHub repository
- confirmed: Max read/write registers limit of 125 (0x007D) — confirmed by official Renogy Rover MODBUS Protocol document
The trust ladder
Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.
- generated — A prompt produced it. Unproven — anyone can regenerate this.
- structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
- interop-verified — Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
- simulator-verified — Decoded correctly against a protocol emulator seeded with known-true values — catches word-order/scaling errors vs the emulator, not the physical device.
- hardware-verified x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.