Fox ESS · EV charger
EV Charger (EVC, A/C series) Modbus register map
Default configuration
- Protocol
- Modbus TCP
- Port
- 502
- Unit ID
- 1
- Addressing
- 0-based
- Byte order
- Big endian
- Word order
- High word first
Register map
| Address | Count | Name | Type | Unit | Scale | Access |
|---|---|---|---|---|---|---|
| 4096 | 1 | Device address Modbus device address of the charger (factory default 1). | UInt16 | - | 1 | R |
| 4097 | 1 | Software version Example: 0x0110 = version 1.16. | UInt16 | - | 1 | R |
| 4098 | 1 | Stop reason 0 = none, 1 = stopped on command, 2 = timed charging completed, 3 = S2 timeout, 4 = charging pause timeout, 5 = emergency stop button pressed, 6 = abnormal CP voltage, 7 = abnormal connector removal, 8 = abnormal AC contactor, 9 = abnormal electronic lock, 10 = abnormal card reader, 11 = overcurrent, 12 = overvoltage, 13 = undervoltage, 14 = charging port overtemperature, 15 = leakage current, 16 = N line reversed, 17 = abnormal frequency, 18 = charging stop button pressed, 19 = abnormal circuit breaker, 20 = phase loss, 21 = abnormal PE, 22 = abnormal external meter, 23 = environment overtemperature, 24 = metering chip failure, 25 = access control failure, 26 = phase-switch box fault, 27 = predetermined energy reached. | UInt16 | - | 1 | R |
| 4099 | 1 | Connector status 0 = idle, 1 = connect, 2 = start, 3 = charging, 4 = pause, 5 = finish, 6 = fault, 7 = reserve, 8 = locked. | UInt16 | - | 1 | R |
| 4100 | 1 | CP status 0 = CP fault, 1 = CP 12 V (not connected), 2 = CP 9 V (connected), 3 = CP 6 V (car ready). | UInt16 | - | 1 | R |
| 4101 | 1 | CC connection status 0 = plug unconnected, 1 = plug connected. | UInt16 | - | 1 | R |
| 4102 | 1 | Charging port temperature Raw * 0.1 - 50. Not fitted on the plug version; fixed 0xFFFF from certain firmware versions. | UInt16 | °C | 0.1 (offset -50) | R |
| 4103 | 1 | EVC environment temperature Raw * 0.1 - 50. | UInt16 | °C | 0.1 (offset -50) | R |
| 4104 | 1 | Voltage phase A | UInt16 | V | 0.1 | R |
| 4105 | 1 | Voltage phase B | UInt16 | V | 0.1 | R |
| 4106 | 1 | Voltage phase C | UInt16 | V | 0.1 | R |
| 4107 | 1 | Current phase A | UInt16 | A | 0.1 | R |
| 4108 | 1 | Current phase B | UInt16 | A | 0.1 | R |
| 4109 | 1 | Current phase C | UInt16 | A | 0.1 | R |
| 4110 | 1 | Active power | UInt16 | kW | 0.1 | R |
| 4111 | 1 | Electronic lock status 0 = unlocked, 1 = locked. | UInt16 | - | 1 | R |
| 4112 | 1 | Current phase sequence 0 = three-phase, 1 = L2, 2 = L3, 3 = reserve. Only meaningful with the external phase-switch box. | UInt16 | - | 1 | R |
| 4113 | 1 | Max supported power Model rating. | UInt16 | kW | 0.1 | R |
| 4114 | 1 | Min supported power | UInt16 | kW | 0.1 | R |
| 4115 | 1 | Max supported current Per phase; model rating. | UInt16 | A | 0.1 | R |
| 4116 | 1 | Min supported current | UInt16 | A | 0.1 | R |
| 4117 | 1 | System alarm information Alarm bitfield, see the alarm code appendix of the protocol. | UInt16 | - | 1 | R |
| 4118 | 2 | Current energy Internal meter reading. | UInt32 | kWh | 0.1 | R |
| 4120 | 2 | Total charging energy | UInt32 | kWh | 0.1 | R |
| 4122 | 2 | System fault information Fault bitfield, see the fault code appendix of the protocol. | UInt32 | - | 1 | R |
| 4124 | 2 | RFID card UID of the card that started the current session. | UInt32 | - | 1 | R |
| 4126 | 4 | Id model code 8 bytes, e.g. A022KP1. | Ascii | - | 1 | R |
| 4130 | 16 | Id serial number 32 bytes, zero padded. | Ascii | - | 1 | R |
| 4146 | 10 | Extended RFID card 20 bytes, zero padded; only on some models. | Ascii | - | 1 | R |
| 4156 | 1 | Connector number 1 = single connector, 2 = dual connector. | UInt16 | - | 1 | R |
| 4157 | 1 | Single/three-phase switching status 0 = idle, 1 = switching 3-phase to single-phase, 2 = switching single-phase to 3-phase. | UInt16 | - | 1 | R |
| 4158 | 1 | Single/three-phase work status 0 = idle, 1 = three-phase charging, 2 = single-phase charging. | UInt16 | - | 1 | R |
| 4159 | 1 | Real-time power phase A | UInt16 | kW | 0.1 | R |
| 4160 | 1 | Real-time power phase B | UInt16 | kW | 0.1 | R |
| 4161 | 1 | Real-time power phase C | UInt16 | kW | 0.1 | R |
| 12288 | 1 | Work mode 0 = controlled mode, 1 = plug and charge, 2 = lock mode. Takes effect only while no connector is connected. | UInt16 | - | 1 | RW |
| 12289 | 1 | Max charging current Applies for one minute, then reverts to the rated maximum; 0 stops charging. | UInt16 | A | 0.1 | RW |
| 12290 | 1 | Max charging power Applies for one minute, then reverts to the rated maximum; 0 stops charging. | UInt16 | kW | 0.1 | RW |
| 12291 | 1 | Allowable charge time 0xFFFF = no limit. | UInt16 | min | 1 | RW |
| 12292 | 1 | Allowable charge energy 0xFFFF = no limit. | UInt16 | kWh | 1 | RW |
| 12293 | 1 | Time validity How long the last command value is valid; default 180 s, range 10-255 s. | UInt16 | s | 1 | RW |
| 12294 | 1 | Default current Current used when the link to the EMS is lost. | UInt16 | A | 0.1 | RW |
| 12298 | 1 | Single/three-phase automatic switching 0 = disabled, 1 = enabled; switches at 4.2 kW. Not supported on single-phase models. | UInt16 | - | 1 | RW |
| 12299 | 1 | EVC suspend switching minimum interval 0-30 min, default 12 min. | UInt16 | min | 1 | RW |
| 12300 | 1 | Current charging connector number 1 = connector 1 (default), 0 = the EVC itself; only multi-connector models. | UInt16 | - | 1 | RW |
| 12301 | 1 | Minimum interval for EVC suspended status change 0-1800 s, default 720 s; finer-grained form of register 12299. | UInt16 | s | 1 | RW |
| 16384 | 1 | Electronic lock control 0 = no action, 1 = unlock, 2 = lock. | UInt16 | - | 1 | W |
| 16385 | 1 | Charging control 0 = no action, 1 = start charging, 2 = stop charging. | UInt16 | - | 1 | W |
| 16386 | 1 | Phase sequence switching 0 = three-phase, 1 = L2, 2 = L3; only with the external phase-switch box. | UInt16 | - | 1 | W |
| 16387 | 1 | Restart Write 0xA5A5 to restart the charger. | UInt16 | - | 1 | W |
Read this device live with Modbus Connect, free for Windows, macOS and Linux
Related guides
Notes
MIRROR-SOURCED (vendor-authored, hosting unconfirmed). Source: Fox ESS "EV Charger - Modbus TCP & RTU Protocol V1.06" (file number MTWH-2024-0001, dated 2025-07-02), chapter 2 "Register List" and sections 2.1-2.50 for types, scaling and enums; the vendor's EV charger protocol document, read from the copy of the protocol document in Fox ESS's own website asset storage (the vendor download pages serve the user manuals, not this protocol) at https://cdn.prod.website-files.com/6a7ae62372cb780ff5be747e/6abaad94818d6bac9bad9d21_Fox-ESS-EV-Charger-Modbus-TCP---RTU-Protocol-1.06-(1).pdf. Section 1.4 item (5) documents the Modbus TCP default port 502, and the MBAP unit-identification field (§1.6.1.1) and §2.1 both give the device address range with default 1; the table prints hex register addresses (0x1000 = 4096) which are stored here unchanged as zero-based wire addresses. All rows are holding registers on function codes 3/6/16. Temperatures scale as raw * 0.1 - 50 C. The document's RTU baud rate is not stated anywhere, so only the TCP transport is declared; the RTU path would need the site's own gateway settings. Alarm and fault bit fields are referenced by register, not transcribed row by row. This is the wallbox itself, a different device family from the library's Fox ESS inverter seeds (fox-ess-h3, fox-ess-h3-pro-smart, fox-ess-avocado), whose register map it does not share. File identity: SHA-256 5a47f709341d34d53b04e12fc466d84fc6ea78db3379dc933f4ea41d98df1e68 (PDF, downloaded 2026-11-07).