SRNE PV inverter (RS485)
Register map(s) for this device, each at the trust rung it earned. Addresses are 0-based
as on the wire. Word order and scaling are confirmed at the hardware-verified rung and at no rung below it.
interop-verified
Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
| point | address (0-based) | type | scale | unit |
|---|
| user_password | 4869 | U16 | 1 | |
link settings as documented (unverified): RTU; default 9600 8N1; FC 03,16; Supports a universal address of 0xF7 (247) for one-to-one communication without knowing the device address. Broadcast address is 0.
bench facts as documented (unverified)
| wiring notes | Star connection. Physical layer limits the maximum number of slaves to 32. |
| max registers/read | 12 |
| broadcast | supported |
| protocol notes | CRC transmission order is low byte first, then high byte, which is different from standard Modbus. Although the protocol description mentions a limit of 20 registers, error code 0AH explicitly states that a length error is triggered if the number of registers exceeds 12. |
| doc revision | V1.00 |
field reports — community-sourced, unverified (checked 2026-06-11)
- To prevent Modbus communication errors resulting from automatic client optimization (which groups registers and requests non-existent ones), users must force new ranges for each register block (e.g., force_new_range: true in ESPHome). [source]
- The USB port and the RS485 port are tied to the same internal controller; polling both simultaneously creates communication conflicts and timeouts. [source]
- To change settings via Modbus, a password must be entered (default is 111111). This password must be entered once every time the inverter is rebooted, otherwise parameter writes will fail. [source]
- When connecting via RS485, the RJ45 pinout is non-standard: Pin 1 and Pin 2 are used for power (do not connect to standard RS485 adapters to avoid damage), while Pin 7 is RS485-A and Pin 8 is RS485-B. [source]
- confirmed: Baud rate 9600, framing RTU, parity N, stop bits 1 — confirmed by SRNE PV Inverter RS485 MODBUS Communication Protocol V1.00 document which states 'The underlying format is fixed at 9600,n,8,1, i.e. baud rate 9600, 8 data bits, no checksum.' [1.4.1]
- confirmed: Universal address of 0xF7 (247) — confirmed by SRNE PV Inverter RS485 MODBUS Communication Protocol V1.00 document which states '0~F7H, 0 is the broadcast address, F7H is the universal address...'
- confirmed: Function codes 3 and 16 (0x03 and 0x10) — confirmed by SRNE PV Inverter RS485 MODBUS Communication Protocol V1.00 document which states '03H: Read data. 10H: Write data.'
- confirmed: Physical star connection with max 32 slaves — confirmed by SRNE PV Inverter RS485 MODBUS Communication Protocol V1.00 document which states 'Connection method: One master, multiple slaves, star connection... physical layer limits the maximum number of slaves to 32.'
- confirmed: CRC transmission order is low byte first, then high byte — confirmed by SRNE PV Inverter RS485 MODBUS Communication Protocol V1.00 document which states 'Special note: The result calculated by CRC is 16-bit data. In the actual transmission, the low bytes should be transmitted first and then the high bytes.'
- confirmed: Error code 0AH triggers if registers exceed 12 — confirmed by SRNE PV Inverter RS485 MODBUS Communication Protocol V1.00 document which states '0AH Length error. The number of registers required to read during the read process exceeds 12.'
- confirmed: User password register at 4869 (0x1305) — confirmed by SRNE PV Inverter RS485 MODBUS Communication Protocol V1.00 document which mentions 'password set by the user of register 0x1305.'
The trust ladder
Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.
- generated — A prompt produced it. Unproven — anyone can regenerate this.
- structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
- interop-verified — Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
- simulator-verified — Decoded correctly against a protocol emulator seeded with known-true values — catches word-order/scaling errors vs the emulator, not the physical device.
- hardware-verified x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.