AC180P BLE Modbus: ReadHoldingRegisters cause modbus addr rang error and BLE disconnect

Product Discussion BLUETTI Apex & AC Series
1

Hi,
First of all, Happy New Year to all members of the Forum!

I’m trying to integrate an AC180P via BLE Modbus using the open-source project bluetti-mqtt-asyncio (Python, Bleak).

The BLE cryptographic link (ECDH) completes successfully every time:

crypt module link ecdh result success
encrypt link completed, client ready

However, any ReadHoldingRegisters request I send causes:

[cryptModule]:modbus addr rang error
→ immediate BLE disconnect

In all cases, the Modbus frame is sent correctly, but the device reports an address range error and forcibly disconnects BLE instead of returning a Modbus exception.

Example log:

send message: 0103008c000485e2
[cryptModule]:modbus addr rang error
BLE disconnected

I also tested the default register definitions from ac180.py in bluetti-mqtt-asyncio, but all read attempts still result in modbus addr rang error and a BLE disconnect.

This suggests that the AC180P firmware only allows a very specific internal register map or predefined blocks, and rejects any other Modbus read at firmware level.

My questions:

  1. Does the AC180P expose any supported Modbus register ranges over BLE?
  2. Are registers different from other Bluetti models (AC200, EB series, etc.)?
  3. Is there official documentation for the BLE Modbus register map of AC180P?

Any guidance from the technical team would be greatly appreciated (@BLUETTI, @BLUETTI_CARE: If you could share this with the Bluetti technical team, it would be greatly appreciated).

I’m happy to provide full logs or test specific addresses if recommended.

Thanks in advance.

1 Like
2

@DrKnuth Hello, thank you very much for your detailed testing, logs, and technical analysis. We really appreciate your interest in BLUETTI devices and low-level communication.

Regarding your questions, we have checked with our technical team and would like to share the following information:

  1. About the availability of Modbus register addresses
    Due to current company policy, the BLE Modbus register address mapping is not officially open to the public yet.
    However, we can share that our development team has recently started systematically organizing and reviewing the register mappings across multiple device models. After internal verification and approval, some supported register addresses will be gradually published for external reference.
    Since this work involves many devices and firmware versions, it will take some time. Once the information is ready, we will announce it through official channels or the community as soon as possible. Please stay tuned.

  2. Reference suggestion for AC180P
    At the moment, there is no officially published register map specifically for the AC180P.
    You may want to check whether any electronics enthusiasts or developers in the community have shared AC60 register mappings, which can be used as a temporary reference for comparison and testing purposes.
    Please note that compatibility is not guaranteed, as the actual implementation depends on the device model and firmware.

  3. About the BLE disconnection after register read attempts
    Regarding the behavior where a “modbus addr range error” is followed by an immediate BLE disconnection, our technical team’s initial analysis suggests that this issue may not be directly related to the register address itself.

From an architectural perspective, if an unsupported register address is accessed, the Bluetooth encryption/communication module would typically return an error response only, and does not directly manage or terminate the BLE connection.

We therefore recommend checking whether:
①The application logic triggers an exception after receiving the error response
②The BLE session is being closed by the client due to unhandled errors or abnormal return values.