AC180P BLE Modbus: ReadHoldingRegisters cause modbus addr rang error and BLE disconnect

Product Discussion BLUETTI Apex & AC Series
1

Hi,
First of all, Happy New Year to all members of the Forum!

I’m trying to integrate an AC180P via BLE Modbus using the open-source project bluetti-mqtt-asyncio (Python, Bleak).

The BLE cryptographic link (ECDH) completes successfully every time:

crypt module link ecdh result success
encrypt link completed, client ready

However, any ReadHoldingRegisters request I send causes:

[cryptModule]:modbus addr rang error
→ immediate BLE disconnect

In all cases, the Modbus frame is sent correctly, but the device reports an address range error and forcibly disconnects BLE instead of returning a Modbus exception.

Example log:

send message: 0103008c000485e2
[cryptModule]:modbus addr rang error
BLE disconnected

I also tested the default register definitions from ac180.py in bluetti-mqtt-asyncio, but all read attempts still result in modbus addr rang error and a BLE disconnect.

This suggests that the AC180P firmware only allows a very specific internal register map or predefined blocks, and rejects any other Modbus read at firmware level.

My questions:

  1. Does the AC180P expose any supported Modbus register ranges over BLE?
  2. Are registers different from other Bluetti models (AC200, EB series, etc.)?
  3. Is there official documentation for the BLE Modbus register map of AC180P?

Any guidance from the technical team would be greatly appreciated (@BLUETTI, @BLUETTI_CARE: If you could share this with the Bluetti technical team, it would be greatly appreciated).

I’m happy to provide full logs or test specific addresses if recommended.

Thanks in advance.