Skip to content

INVERTER_MODEL_CATALOG.generated.md

Latest commit

 

History

History
549 lines (496 loc) · 47.2 KB

INVERTER_MODEL_CATALOG.generated.md

File metadata and controls

549 lines (496 loc) · 47.2 KB
Raw

Inverter Model Catalog

Generated by tools/model_catalog.py. Do not edit by hand.

  • Model catalog version: 2026.09.1
  • Runtime inverter catalog version: 2026.08.8
  • Models: 18 | Variants: 20

How To Read This Catalog

This page describes what has been confirmed for a specific inverter model or model family. It is more precise than a simple compatibility list.

  • Supported Models have a safe built-in runtime path and confirmed telemetry.
  • Limited Or Experimental Models can still work, but a listed limitation, partial telemetry, unconfirmed controls, or a read-only path remains.
  • Research Queue records known hardware that does not yet have a safe built-in runtime path.
  • Telemetry describes confidence in local readings; Controls describes confidence in local writes; Hardware describes the evidence available from a real device.
  • Protocol, Detection, Runtime Tier, descriptors, surfaces, and fingerprints are implementation details useful when comparing variants.
  • Family-level runtime coverage means EyeBond Local has a safe generic protocol path, but has not claimed an exact commercial model identity.

Supported Models

Manufacturer Model Protocol Detection Runtime Tier Telemetry Controls Hardware
Anenji ANJ-11KW-48V-WIFI / WIFI-P — Anenji ANJ-11KW-48V-WIFI-P (0x8000) modbus_smg fingerprint full confirmed confirmed captured
PowMr 4.2KW — PI30 VMII-NXPW5KW raw-model variant pi30 anchors full confirmed confirmed captured
PowMr 4.2KW — SmartESS 0925 local Modbus alternate runtime pi30 anchors full confirmed confirmed captured
Sandisolar SD-HYM-4862HWP modbus_smg fingerprint full confirmed confirmed confirmed

Limited Or Experimental Models

Manufacturer Model Protocol Detection Runtime Tier Telemetry Controls Hardware
Anenji 6200 (single output) modbus_smg fingerprint full confirmed partial captured
Anenji ANJ-11KW-48V-WIFI / WIFI-P — Anenji ANJ-11KW-48V-WIFI (0x8401) modbus_smg fingerprint full confirmed partial captured
Anenji ANJ-4000W-24V modbus_smg fingerprint full confirmed partial captured
Anenji ANJ-6200-48PL modbus_smg fingerprint full confirmed partial captured
Anenji HHS-11kW-WIFI (without parallel) modbus_smg fingerprint full partial partial captured
Aninerel 6200 (dual output) modbus_smg fingerprint full confirmed partial captured
Aninerel ANL-4200T-24L-W-PRO modbus_smg fingerprint full partial partial captured
EyeBond Short-ASCII family eybond_short_ascii anchors partial partial none captured
Gootu GT-H2436M14P5 eybond_g_ascii anchors full confirmed partial captured
Kevolt PD0080G-TPM-EU modbus_catalog anchors full partial partial confirmed
LVYUAN TY-SIC-3.6KBE-W1 eybond_g_ascii anchors full confirmed partial captured
MUST PV18-3024 must_pv_ph18 anchors full partial partial captured
Sandisolar SD 11KP48V WIFI modbus_smg fingerprint full partial partial captured
SRNE-compatible Modbus family srne_modbus anchors partial partial none none
Yingfa YF6.2K-2K-LEL-IF pi30 anchors full confirmed partial captured
Yingfa YF6.2K-LEL-1B pi30 anchors full confirmed partial captured

Research Queue

No known commercial models without a safe built-in runtime path.

Family-Level Runtime Coverage

Runtime descriptors with no specific commercial model record. These are generic protocol families and family fallbacks, reported as runtime coverage rather than gaps.

Descriptor Protocol Surface Tier Read-only
anenji_anj_5kw_48v_wifi modbus_smg anenji_anj_5kw_48v_wifi_full full no
aohai_fsa_family modbus_catalog aohai_fsa_read_only partial yes
deye_lv_family modbus_catalog deye_lv_untested full no
eybond_g_ascii_family eybond_g_ascii eybond_g_ascii_read_only partial yes
growatt_spf_family modbus_catalog growatt_spf_untested full no
modbus_smg.protocol_11_family_fallback modbus_smg smg_protocol_11_family_fallback full no
modbus_smg.protocol_1_family_fallback modbus_smg smg_protocol_1_family_fallback full no
modbus_smg.protocol_2_family_fallback modbus_smg smg_protocol_2_family_fallback full no
modbus_smg.protocol_3_family_fallback modbus_smg smg_protocol_3_family_fallback full no
modbus_smg.protocol_4_family_fallback modbus_smg smg_protocol_4_family_fallback full no
modbus_smg.protocol_5_family_fallback modbus_smg smg_protocol_5_family_fallback full no
modbus_smg.protocol_6_family_fallback modbus_smg smg_protocol_6_family_fallback full no
pi18_family pi18 pi18_read_only partial yes
pi30_family pi30 pi30_default_full full no
pi30_max_qflag pi30 pi30_max_full full no
pi30_pip_gk pi30 pi30_pip_gk_full full no
pi30_smartess_0925_compatible pi30 pi30_default_full full no
pi30_smartess_query_0925_compatible pi30 pi30_default_full full no
pi41_family pi30 pi41_full full no
smg_variant_4200 modbus_smg smg_variant_4200_full full no
solis_esinv_family modbus_catalog solis_esinv_read_only partial yes

Model Details

Anenji — 6200 (single output) (anenji_6200_single_output)

  • Lifecycle: supported
  • Aliases: —
  • Validation: hardware captured, telemetry confirmed, controls partial
  • Coverage: runtime available, cloud unknown, vendor map documented
    • Coverage notes:
      • Runtime writes inherit the documented classic SMG RS232 V1 surface; not every write is independently validated on this commercial unit.
  • Summary: Anenji single-output 6200 (layout 1) bound to the shared SMG base surface; same control set as the verified SMG 6200.
  • Variants:
    • layout1_model14080 — Anenji single-output variant
      • Descriptors: anenji_6200
      • Known firmware: 3700_A6250424v1
      • anenji_6200 → surface smg_base_full (driver modbus_smg, variant default)
        • Protocol: modbus_smg | Detection: fingerprint (layout 1, model 14080, rated 6200)
        • Tier: full | Read-only: no | Profile: modbus_smg/default.json | Schema: modbus_smg/base.json
        • Capabilities: 33 (tested 25, untested 8); support tiers: blocked 2, conditional 24, standard 7 | Telemetry: 100 measurements, 18 binary sensors
  • Known limitations:
    • Controls inherit the SMG 6200 control set; not every writable setting is independently confirmed on this unit.
  • Evidence: 2 source(s)

Anenji — ANJ-11KW-48V-WIFI / WIFI-P (anenji_anj_11kw_48v_wifi_p)

  • Lifecycle: supported
  • Aliases: —
  • Validation: hardware captured, telemetry confirmed, controls confirmed
  • Coverage: runtime hardware_confirmed, cloud unknown, vendor map documented
    • Coverage notes:
      • Device-specific runtime profile is user-confirmed.
      • Communication Protocol No. 3-10 documentation defines the protocol-4 telemetry projection used by this model.
      • The captured 0x8401 hardware fingerprint uses the documented Protocol 4 telemetry and control surface.
      • The 0x8401 owner confirmed local writes and resulting device behavior for OP2 enable plus start-hour and end-hour timer controls, including controls absent from the vendor apps.
      • The documented Protocol 4 control surface is treated as tested for this exact fingerprint; irreversible generation-data clear and user-parameter reset actions remain blocked by the independent safety policy.
  • Summary: Anenji 11kW unit with a model-specific control profile over the shared protocol-4 register projection, backed by donor captures, user-confirmed controls, and the Protocol No. 3-10 documentation.
  • Variants:
    • layout4_model32768 — Anenji ANJ-11KW-48V-WIFI-P (0x8000)
      • Descriptors: anenji_anj_11kw
      • Known firmware: —
      • anenji_anj_11kw → surface anenji_anj_11kw_full (driver modbus_smg, variant anenji_anj_11kw_48v_wifi_p)
        • Protocol: modbus_smg | Detection: fingerprint (layout 4, model 32768, rated —)
        • Tier: full | Read-only: no | Profile: modbus_smg/models/anenji_anj_11kw_48v_wifi_p.json | Schema: modbus_smg/models/anenji_anj_11kw_48v_wifi_p.json
        • Capabilities: 63 (tested 50, untested 13); support tiers: blocked 2, conditional 52, standard 9 | Telemetry: 117 measurements, 18 binary sensors
    • layout4_model33793 — Anenji ANJ-11KW-48V-WIFI (0x8401)
      • Validation override: hardware captured, telemetry confirmed, controls partial
      • Descriptors: anenji_anj_11kw_8401
      • Known firmware: —
      • anenji_anj_11kw_8401 → surface smg_anenji_11kw_8401_full (driver modbus_smg, variant anenji_anj_11kw_48v_wifi_p_8401)
        • Protocol: modbus_smg | Detection: fingerprint (layout 4, model 33793, rated —)
        • Tier: full | Read-only: no | Profile: modbus_smg/models/anenji_anj_11kw_48v_wifi_p_8401.json | Schema: modbus_smg/protocols/communication_protocol_4.json
        • Capabilities: 60 (tested 60); support tiers: blocked 2, conditional 55, standard 3 | Telemetry: 117 measurements, 18 binary sensors
  • Known limitations:
    • The issue #38 owner reports a non-parallel ANJ-11KW-48V-WIFI for 0x8401. Its runtime name omits the unproven -P suffix; the fingerprint alone is not a parallel-capability test. Stable profile and catalog keys are retained.
    • Irreversible generation-data clear and user-parameter reset actions remain blocked even though the ordinary Protocol 4 control surface is enabled.
  • Evidence: 7 source(s)

Anenji — ANJ-4000W-24V (anenji_4200_protocol_1)

  • Lifecycle: experimental
  • Aliases: 4200 (Protocol 1), Anenji 4200 Protocol 1
  • Validation: hardware captured, telemetry confirmed, controls partial
  • Coverage: runtime device_scoped_overlay, cloud device_scoped_overlay, vendor map documented
    • Coverage notes:
      • The common runtime surface comes from the documented classic SMG RS232 V1 map; the observed register-184 value 1 is separate runtime identity evidence.
      • Full cloud shadow-learning correlated 77 cloud write attempts and activated eight device-scoped learned controls; writes were captured but intentionally not applied.
  • Summary: Anenji 4200 Protocol 1 variant has user support captures from an ANJ-4000W-24V device. Runtime detection resolves exactly to the SMG Protocol 1 surface, read telemetry is confirmed, and a full shadow-learning run mapped the SmartESS 0925 write surface without leaking writes to the real inverter. Treat controls as partial until specific Home Assistant writes are user-validated.
  • Variants:
    • layout1_model13569 — Anenji 4200 Protocol 1 variant
      • Descriptors: anenji_4200
      • Known firmware: 3501_A6251128v1
      • anenji_4200 → surface anenji_4200_protocol_1_full (driver modbus_smg, variant anenji_4200_protocol_1)
        • Protocol: modbus_smg | Detection: fingerprint (layout 1, model 13569, rated 4200)
        • Tier: full | Read-only: no | Profile: modbus_smg/models/anenji_4200_protocol_1.json | Schema: modbus_smg/models/anenji_4200_protocol_1.json
        • Capabilities: 30 (untested 30); support tiers: conditional 21, standard 9 | Telemetry: 100 measurements, 18 binary sensors
  • Known limitations:
    • Runtime telemetry is confirmed by user support archives.
    • Full shadow-learning completed and activated eight device-scoped learned controls; the learning proxy intentionally captured but did not apply cloud writes, so direct Home Assistant write/readback validation is still pending.
  • Evidence: 6 source(s)

Anenji — ANJ-6200-48PL (anenji_anj_6200_48pl)

  • Lifecycle: supported
  • Aliases: —
  • Validation: hardware captured, telemetry confirmed, controls partial
  • Coverage: runtime available, cloud unknown, vendor map documented
    • Coverage notes:
      • Runtime writes use the documented classic SMG RS232 V1 surface plus the SMG 6200 model overlay; write behavior is not independently confirmed on this commercial unit.
  • Summary: SMG layout 2 model that reuses the SMG 6200 runtime surface; reported via a GitHub issue and a support capture.
  • Variants:
    • layout2_model8960 — Known SMG layout 2 variant
      • Descriptors: anenji_anj_6200_48pl
      • Known firmware: —
      • anenji_anj_6200_48pl → surface smg_6200_full (driver modbus_smg, variant default)
        • Protocol: modbus_smg | Detection: fingerprint (layout 2, model 8960, rated 6200)
        • Tier: full | Read-only: no | Profile: modbus_smg/models/smg_6200.json | Schema: modbus_smg/models/smg_6200.json
        • Capabilities: 38 (tested 30, untested 8); support tiers: blocked 2, conditional 27, standard 9 | Telemetry: 107 measurements, 18 binary sensors
  • Known limitations:
    • Shares the SMG 6200 runtime surface; writes are not independently hardware-confirmed on this unit.
  • Evidence: 3 source(s)

Anenji — HHS-11kW-WIFI (without parallel) (anenji_hhs_11kw_wifi_no_parallel)

  • Lifecycle: experimental
  • Aliases: —
  • Validation: hardware captured, telemetry partial, controls partial
  • Coverage: runtime available, cloud unknown, vendor map documented
    • Coverage notes:
      • The exact layout/model fingerprint is captured from a beta.3 support archive.
      • The exact fingerprint uses the documented Protocol 3 telemetry and write matrices.
      • A later proxy capture and matching DESSMonitor export confirmed the documented L1 Grid Power at holding register 340 for this exact fingerprint.
      • Documented Protocol 3 controls are available only after the user explicitly selects Full Control; none is marked hardware-tested on this model.
      • Registers whose protocol-number column is empty, and Protocol 4/6-only OP2 controls, are not inherited.
  • Summary: An Anenji HHS 11kW non-parallel inverter with an exact captured Protocol 3 fingerprint. The integration exposes the shared telemetry projection, including hardware-correlated Grid Power, and offers only the controls explicitly valid for Protocol 3 as untested Full-Control candidates.
  • Variants:
    • layout3_model29440 — Anenji HHS 11kW non-parallel variant
      • Descriptors: anenji_hhs_11kw
      • Known firmware: —
      • anenji_hhs_11kw → surface anenji_hhs_11kw_protocol_3 (driver modbus_smg, variant anenji_hhs_11kw_wifi_no_parallel)
        • Protocol: modbus_smg | Detection: fingerprint (layout 3, model 29440, rated —)
        • Tier: full | Read-only: no | Profile: modbus_smg/models/anenji_hhs_11kw_wifi_no_parallel.json | Schema: modbus_smg/models/anenji_hhs_11kw_wifi_no_parallel.json
        • Capabilities: 53 (untested 53); support tiers: blocked 2, conditional 51 | Telemetry: 117 measurements, 18 binary sensors
  • Known limitations:
    • No local write has been hardware-validated on this exact model; Auto mode remains read-only and the documented controls are experimental Full-Control candidates.
  • Evidence: 3 source(s)

Aninerel — 6200 (dual output) (aninerel_6200_dual_output)

  • Lifecycle: supported
  • Aliases: SMG OP2 6200, Aninerel 6.2KW
  • Validation: hardware captured, telemetry confirmed, controls partial
  • Coverage: runtime device_scoped_overlay, cloud device_scoped_overlay, vendor map extended
    • Coverage notes:
      • The aninerel.zip donor capture and the issue #7 Aninerel 6.2KW device currently share the same immutable local fingerprint: layout 11, model code 30979, rated power 6200, firmware 7903_A6260126v1.
      • A fresh issue #7 support archive includes a device-scoped shadow-learning overlay with 71 matched cloud write attempts and zero unmatched attempts or writes.
      • cloud evidence and shadow-learning trace confirm charge_source_priority/register 331 values 1-3; owner ESPHome YAML also lists value 4, so the built-in UI exposes 1-4 for this shared OP2 profile. The generic SMG value 0 remains excluded after a user-reported illegal_data_value rejection.
      • Owner-supplied ESPHome YAML extends the known register map beyond the OP2-only register list, but it is not official manufacturer documentation.
      • Only the OP2 enable write and the selected shadow-learning controls have device-specific evidence; the rest of the base SMG control surface is inherited.
  • Summary: Aninerel dual-output 6200 / Aninerel 6.2KW resolves to the OP2 6200 runtime surface (layout 11, model code 30979, rated 6200, firmware 7903_A6260126v1). The aninerel.zip donor capture and the issue #7 support package are treated as the same shared OP2 model family unless a future stable runtime anchor proves otherwise. Owner ESPHome YAML and shadow-learning evidence extend the known Modbus register map for this family.
  • Variants:
    • layout11_model30979 — OP2 dual-output variant
      • Descriptors: anenji_op2_6200
      • Known firmware: 7903_A6260126v1
      • anenji_op2_6200 → surface anenji_op2_6200_full (driver modbus_smg, variant default)
        • Protocol: modbus_smg | Detection: fingerprint (layout 11, model 30979, rated 6200)
        • Tier: full | Read-only: no | Profile: modbus_smg/models/anenji_op2_6200.json | Schema: modbus_smg/models/anenji_op2_6200.json
        • Capabilities: 37 (tested 25, untested 12); support tiers: blocked 2, conditional 24, standard 11 | Telemetry: 106 measurements, 18 binary sensors
  • Known limitations:
    • No official manufacturer register document is available for this exact commercial model family.
    • Charge Source Priority value 4 is exposed from owner-supplied YAML evidence; if a particular unit rejects it, Home Assistant will surface the inverter rejection.
    • Shadow-learning proves cloud-to-local register correlation for selected controls, but does not by itself confirm every Home Assistant write/readback path as user-tested.
  • Evidence: 6 source(s)

Aninerel — ANL-4200T-24L-W-PRO (aninerel_anl_4200t_24l_w_pro)

  • Lifecycle: experimental
  • Aliases: —
  • Validation: hardware captured, telemetry partial, controls partial
  • Coverage: runtime available, cloud cloud_catalog, vendor map documented
    • Coverage notes:
      • Binds a model-specific full-control surface over the documented classic SMG RS232 V1 map (no longer the read-only family fallback). Hardware-tested controls are visible in the default control mode; unverified controls stay full-control only.
      • A tester confirmed writes on hardware (2026-07-05); battery-voltage setpoint windows are left wide because this is a 24 V unit and the family templates carry 48 V-class windows, so the inverter's own write validation is the authority.
  • Summary: Aninerel ANL-4200T-24L-W-PRO reported via GitHub issue #3 and donor captures. It resolves exactly (SMG layout code 11) and binds a model-specific full-control surface: the family-proven SMG settings (output/charge source priority, battery voltage windows, charge-current limits, buzzer/LCD/input mode, boot mode) ship tested and a tester confirmed writes on hardware; the family's unverified extras (exit-fault action, output-rating/mode, power-saving, overload-bypass, remote turn-on/shutdown) stay untested and appear only in full control.
  • Variants:
    • layout11_model30723 — Aninerel ANL-4200T 24 V runtime
      • Descriptors: aninerel_anl_4200t_24l_w_pro
      • Known firmware: —
      • aninerel_anl_4200t_24l_w_pro → surface aninerel_anl_4200t_24l_w_pro_full (driver modbus_smg, variant aninerel_anl_4200t_24l_w_pro)
        • Protocol: modbus_smg | Detection: fingerprint (layout 11, model 30723, rated 4200)
        • Tier: full | Read-only: no | Profile: modbus_smg/models/aninerel_anl_4200t_24l_w_pro.json | Schema: modbus_smg/models/aninerel_anl_4200t_24l_w_pro.json
        • Capabilities: 30 (tested 22, untested 8); support tiers: conditional 21, standard 9 | Telemetry: 100 measurements, 18 binary sensors
  • Known limitations:
    • Battery-voltage setpoint limits for this model are undocumented, so the setpoint windows are deliberately wide and rely on the inverter's own write validation.
    • The full control surface is not yet reflected as a hardware-write-validated catalog assertion (validation.controls stays partial pending a backing write-validation source).
  • Evidence: 3 source(s)

EyeBond — Short-ASCII family (eybond_short_ascii_family)

  • Lifecycle: experimental
  • Aliases: EyeBond Short-ASCII family
  • Validation: hardware captured, telemetry partial, controls none
  • Coverage: runtime read_only, cloud not_applicable, vendor map partial
    • Coverage notes:
      • Runtime support is family-only and read-only. Compatible devices appear as EyeBond Short-ASCII family; retail model and serial are not inferred.
      • Optional RB/F/RH and aux-0200 MPPT/PV entities are disabled by default and expire on TTL or invalid replies.
  • Summary: EyeBond Short-ASCII is a capture-qualified read-only family for the fixed MP/Q1/MD dialect shared by some Anern and Maxinn sites. Optional F/RH/RB add rated values and BMS telemetry with TTL expiry, hard-reject/link-loss hold, and an RH+F gate for currents. Optional live PV/MPPT uses aux 0200 with opt-in entities and TTL; offline MPPT decode stays maintainer-only. Labelled AC-load estimate is separate from measured battery DC power. Retail-model identity remains out of scope; site live-qualification for the PV path is still pending.
  • Variants:
    • urtu1920_checksum — EyeBond Short-ASCII read-only family (URTU1920 checksum dialect)
      • Descriptors: eybond_short_ascii_family
      • Known firmware: —
      • eybond_short_ascii_family → surface eybond_short_ascii_read_only (driver eybond_short_ascii, variant urtu1920_checksum)
        • Protocol: eybond_short_ascii | Detection: anchors (protocol.protocol_id=EYBOND_SHORT_ASCII; protocol.wire_dialect=urtu1920_checksum; shape.q1_length=51; shape.mp_length=38; shape.md_length=24)
        • Tier: partial | Read-only: yes | Profile: — | Schema: eybond_short_ascii/base.json
        • Capabilities: no model-specific profile | Telemetry: 43 measurements, 8 binary sensors
  • Known limitations:
    • Family identity only: no retail commercial model (including no Anern SPI-12000W claim) and no inverter serial from MP/Q1/MD.
    • Read-only: no inverter controls; Full Control does not invent settings.
    • Optional live PV/MPPT uses the documented auxiliary 0200 runtime read only (not tip AABB harvest, not settings 0202). Matching schema sensors stay disabled by default; mppt_error_code is diagnostic and quiet. Samples use 30 s solicit / 60 s TTL; at most one optional read per Q1 cycle, with FC4 RB/F/RH preferred when both are due.
    • Offline decode_short_ascii_mppt is a maintainer capture inspector only; it is not the live optional admission path and does not create entities by itself.
    • Live PV/MPPT admission is code-complete but not yet live-qualified on site HA (family cutover / Support Archive RECEIPT still pending).
    • Quiet fault/diagnostic sensors beyond Q1 flags and the quiet mppt_error_code (Q2 extras) remain deferred.
    • estimated_ac_load_power is load% × rated VA from F — an estimate, not measured active power; load_percent stays separate. Output frequency is not grid frequency.
    • Optional BMS currents and battery_power publish only when RH reports BMS current display accuracy=1 (decimals) and F ratings are available for I/P hard-reject bounds; RH=0, unread, expired or failed RH omits those keys. RH=1 is the discriminator (no retail-model gate).
    • Impossible RB V/SoC/I/P values are hard-rejected. Link-loss (V=0 ∧ SoC=0) may hold last-good BMS for up to 180 s without refreshing sample age; normal RB TTL remains 60 s.
    • Diagnostic counters: bms_link_loss_count and rb_hard_reject_count are runtime-scoped; reading_hold_pending_count stays 0 (physics confirmation-hold deferred).
    • BMS current / battery_power path is SmartValue-correlated on one live family member; other members (e.g. Maxinn) are not separately live-proven and only light up if RH=1.
  • Evidence: 2 source(s)

Gootu — GT-H2436M14P5 (gootu_gt_h2436m14p5)

  • Lifecycle: experimental
  • Aliases: Gootu Hybrid 24V 3.6kW
  • Validation: hardware captured, telemetry confirmed, controls partial
  • Coverage: runtime available, cloud correlated, vendor map documented
    • Coverage notes:
      • Runtime identification uses the exact local G-ASCII F/SVFW fingerprint, not the commercial model name.
      • Captured GPDAT0 and GPV responses match the existing EyeBond G-ASCII telemetry decoder.
      • Charging-priority CPR03 and CPR00 writes received ACK responses in a SmartValue proxy capture.
      • The family protocol document describes additional commands, but unverified model-specific writes are not promoted to tested support.
  • Summary: Gootu GT-H2436M14P5 is a 24V 3.6kW hybrid inverter observed behind an EyeBond Wi-Fi collector. A support archive and SmartValue proxy capture establish the EyeBond G-ASCII telemetry family, the exact 230V/15A/24V/50Hz plus SVFW 4.007 offline fingerprint, and acknowledged CPR00/CPR03 charging-priority writes. The exact runtime profile therefore reuses the established telemetry decoder and exposes only the evidence-backed charging-priority control.
  • Variants:
    • eybond_g_ascii_gootu_fingerprint — EyeBond G-ASCII 230V/15A/24V/50Hz, software 4.007
      • Descriptors: gootu_gt_h2436m14p5
      • Known firmware: collector AT R001, inverter F 230V 15A 24V 50Hz, inverter SVFW 4.007
      • gootu_gt_h2436m14p5 → surface eybond_g_ascii_gootu_gt_h2436m14p5 (driver eybond_g_ascii, variant gootu_gt_h2436m14p5)
        • Protocol: eybond_g_ascii | Detection: anchors (protocol.protocol_id=EYBOND_G_ASCII; rating.output_voltage=230; rating.output_current=15; rating.battery_voltage=24; rating.frequency=50; firmware.software_version=4.007)
        • Tier: full | Read-only: no | Profile: eybond_g_ascii/models/gootu_gt_h2436m14p5.json | Schema: eybond_g_ascii/base.json
        • Capabilities: 23 (tested 1, untested 22); support tiers: conditional 22, standard 1 | Telemetry: 104 measurements, 3 binary sensors
  • Known limitations:
    • Only charging priority is exposed as a model-verified control.
    • CPR01 and CPR02 are document-backed members of the verified CPR command family, but the supplied trace directly captured ACK only for CPR00 and CPR03.
    • Output-priority OPR is intentionally omitted until an ACK and resulting behavior are verified on this exact model.
    • The original Cloud + HA probe timeout was reported on 0.3.0-beta.1; release retesting is still required against the current connection lifecycle.
  • Evidence: 4 source(s)

Kevolt — PD0080G-TPM-EU (kevolt_pd0080g_tpm_eu)

  • Lifecycle: experimental
  • Aliases: Kevolt 8 kW Three-Phase Hybrid
  • Validation: hardware confirmed, telemetry partial, controls partial
  • Coverage: runtime available, cloud unknown, vendor map documented
    • Coverage notes:
      • The supplied SmartValue proxy capture contains repeated, CRC-valid Modbus FC03 request/response pairs for the Deye-compatible three-phase runtime map at registers 500-683.
      • Runtime identification uses four local raw anchors: device type 5, protocol version 0x0104, and low-first rated-power words 0x3880/0x0001 (80000 raw; documented 0.1 W scale = 8000 W).
      • Direct hardware feedback confirms this is the 8 kW model, so the runtime now follows the protocol document's 0.1 W rated-power scale. The raw words remain the stable fingerprint anchors.
      • Hardware feedback confirms the exposed battery values already use the expected negative-on-charge sign; the integration preserves that wire sign.
      • Runtime reads use small register blocks of at most 15 words rather than the unsupported 500-599 bulk read reported in the issue.
      • A bounded document-backed operational subset with unambiguous register encoding is available as 118 untested controls only in Full control mode. It covers battery, charging, generator, smart-load, export, metering, TOU, topology, and selected advanced functions.
      • Settings read-back is rotated one compact block per poll so the expanded control surface does not delay live telemetry. Every write uses FC 0x10, preserves unrelated shared-register bits, and requires an immediate wire read-back before it is accepted.
  • Summary: Kevolt PD0080G-TPM-EU is a hardware-confirmed 8 kW three-phase hybrid inverter behind an EyeBond Wi-Fi collector. The latest SmartValue proxy capture proves a Modbus RTU FC03 layout with device type 5, protocol version 0x0104, rated-power words 80000 raw at the documented 0.1 W scale (8000 W), and live telemetry in the Deye-compatible 500-683 register range. Deye Modbus RTU V1.04 corroborates the telemetry and documents a broader FC 0x10 settings range. The exact wire fingerprint therefore exposes the current document-backed telemetry surface plus 118 opt-in, untested controls whose encodings are unambiguous, with shared-field-safe writes and mandatory immediate read-back confirmation.
  • Variants:
    • deye_3ph_high_80kw — Deye-compatible FC03 high-power map, protocol 0x0104, 8 kW
      • Descriptors: deye_3ph_high_80kw
      • Known firmware: collector AT R001, inverter protocol 0x0104
      • deye_3ph_high_80kw → surface deye_3ph_high_80kw_untested (driver modbus_catalog, variant deye_3ph_high_80kw)
        • Protocol: modbus_catalog | Detection: anchors (identity.deye_device_type_raw=5; identity.deye_3ph_protocol_version_raw=260; identity.deye_3ph_rated_power_low_raw=14464; identity.deye_3ph_rated_power_high_raw=1)
        • Tier: full | Read-only: no | Profile: modbus_catalog/deye_3ph_high_80kw.json | Schema: deye_3ph_high_80kw/base.json
        • Capabilities: 118 (untested 118); support tiers: conditional 18, standard 100 | Telemetry: 70 measurements, 0 binary sensors
  • Known limitations:
    • All 118 document-backed controls are untested and disabled by default. Users must explicitly select Full control and then enable only the individual entities they intend to test.
    • Factory reset, production-test, EEPROM initialization, calibration, BMS-owned live words, parallel-cluster addressing, and grid-code/certification curves are intentionally not exposed as user controls even though they occupy writable registers in the protocol document.
    • Battery output power/current retain the hardware-confirmed wire sign; no additional canonical sign projection is inferred.
    • Heat-sink temperature is diagnostic because the observed raw value requires the offset-1000 convention used by adjacent Deye storage maps, while the translated table omits that offset for register 541.
    • The commercial Kevolt identity comes from the public issue report; the local fingerprint identifies the compatible 8 kW Deye-family wire layout and may be shared by OEM siblings.
    • A current-release hardware retest is still required before telemetry support can be marked confirmed.
  • Evidence: 5 source(s)

LVYUAN — TY-SIC-3.6KBE-W1 (lvyuan_ty_sic_3_6kbe_w1)

  • Lifecycle: experimental
  • Aliases: —
  • Validation: hardware captured, telemetry confirmed, controls partial
  • Coverage: runtime available, cloud correlated, vendor map documented
    • Coverage notes:
      • Runtime support is based on captured SmartValue/EyeBond G-ASCII command polling and a matching JsdSolar G-command ASCII protocol document.
      • The model is identified offline by the local G-ASCII rated-info/software fingerprint: F=220V/16A/24V/50Hz plus SVFW 4.003.
      • Support archives now include a schema-driven extended EyeBond G-ASCII read-only protocol probe so future user packages can report command support and unknown fields without changing runtime behavior.
      • A fingerprint-bound control profile is exposed from SmartValue shadow-learning evidence. The captured cloud write attempts were correlated to local G-ASCII setting commands without applying the writes during learning.
  • Summary: LVYUAN TY-SIC-3.6KBE-W1 was reported behind an EyeBond/SmartValue Wi-Fi logger using iot.eybond.com-style cloud connectivity and 9600 8N1 serial settings. Proxy/support captures show a plain G-command ASCII polling family with GPDAT0, GPV, GBAT, GMOD, and related commands; a matching JsdSolar protocol document defines the telemetry layout. The current runtime binding uses the local offline fingerprint F=220V/16A/24V/50Hz plus SVFW 4.003 and exposes a partial, fingerprint-bound control profile derived from SmartValue shadow-learning evidence.
  • Variants:
    • eybond_g_ascii_lvyuan_fingerprint — SmartValue EyeBond G-ASCII fingerprint-bound control profile
      • Descriptors: lvyuan_ty_sic_3_6kbe_w1
      • Known firmware: collector FW 8-50-12-3, collector AT 1-11, inverter F 220V 16A 24V 50Hz, inverter SVFW 4.003 (20250217)
      • lvyuan_ty_sic_3_6kbe_w1 → surface eybond_g_ascii_lvyuan_ty_sic_3_6kbe_w1 (driver eybond_g_ascii, variant lvyuan_ty_sic_3_6kbe_w1)
        • Protocol: eybond_g_ascii | Detection: anchors (protocol.protocol_id=EYBOND_G_ASCII; rating.output_voltage=220; rating.output_current=16; rating.battery_voltage=24; rating.frequency=50; firmware.software_version=4.003)
        • Tier: full | Read-only: no | Profile: eybond_g_ascii/models/lvyuan_ty_sic_3_6kbe_w1.json | Schema: eybond_g_ascii/base.json
        • Capabilities: 34 (tested 34); support tiers: conditional 34 | Telemetry: 104 measurements, 3 binary sensors
  • Known limitations:
    • Control support is partial: the exposed write surface is the cloud-known user settings set, not the full manufacturer/MCU register map.
    • Commercial model name is still user-reported, while runtime binding uses the offline F/SVFW fingerprint.
    • The documented G-ASCII command family is distinct from PI30 ASCII despite superficial line-oriented ASCII similarities.
    • Extended protocol-probe evidence is maintainer input only; runtime entities are added only after the command schema/driver decoder is explicitly updated.
    • SmartValue public XML catalog checks found adjacent OEM/SMK Modbus or mixed profiles, but no direct LVYUAN TY-SIC-3.6KBE-W1 manufacturer register map.
  • Evidence: 6 source(s)

MUST — PV18-3024 (must_pv18_3024)

  • Lifecycle: experimental
  • Aliases: MUST PV18-3024, MUST PV1800, MUST PV/PH18
  • Validation: hardware captured, telemetry partial, controls partial
  • Coverage: runtime available, cloud cloud_catalog, vendor map partial
    • Coverage notes:
      • Runtime support uses the MUST PH RS485 map (v1.4.3 and v1.4.15 xlsx, cross-checked against the third-party implementation), with per-control read-back over gap-free register blocks.
      • The control surface is cross-referenced from the SmartESS cloud device_settings field catalog and the vendor 1.4.15 register map: the 20 fields the cloud exposes ship tested (visible in the default control mode); datasheet-only settings absent from the cloud catalog (grid charging and the battery-equalization block) ship untested (full-control only).
      • The register map is documentary; hardware write confirmation is still pending a tester report. The inverter validates its own writes, so a register that is absent or locked self-disables via the write-failure block.
  • Summary: MUST PV18-3024 support is based on issue #5 support archives and a MUST PV/PH18 Modbus register map (v1.4.3 and v1.4.15). The user archives showed Auto/PI30 probe timeouts, SmartESS protocol asset "02FF,0,0," and collector serial baudrate 19200-8-1-0. The runtime accepts both the PV18 marker and a numeric PV1800 marker at Modbus register 20001, and binds a full MUST PV/PH18 Modbus surface using slave address 4. It exposes a writable control surface cross-referenced from the SmartESS cloud device_settings catalog and the 1.4.15 register map (output voltage/frequency, energy use mode, grid protection standard, charge-source priority, battery type, charge/discharge current limits, and battery voltage windows) with per-control read-back; hardware write confirmation is pending.
  • Variants:
    • must_pv18 — MUST PV18 Modbus runtime with cloud/datasheet control surface
      • Descriptors: must_pv18_3024
      • Known firmware: —
      • must_pv18_3024 → surface must_pv_ph18_full (driver must_pv_ph18, variant pv_ph18)
        • Protocol: must_pv_ph18 | Detection: anchors (protocol.protocol_id=MUST_PV_PH18; identity.model_number=['PV18', 'PV1800'])
        • Tier: full | Read-only: no | Profile: must_pv_ph18/base.json | Schema: must_pv_ph18/base.json
        • Capabilities: 27 (tested 20, untested 7); support tiers: standard 27 | Telemetry: 37 measurements, 0 binary sensors
  • Known limitations:
    • Requires collector serial settings compatible with Modbus RTU 19200 8N1 and inverter slave address 4.
    • Control writes are derived from the SmartESS cloud settings catalog and the vendor register map, not yet independently confirmed on hardware; setpoint windows are left wide because the documented ranges are battery-voltage-grade dependent and the inverter validates its own writes.
    • Telemetry map is based on a MUST PV/PH18 Modbus register map and still needs owner confirmation through a fresh support archive after integration update.
  • Evidence: 3 source(s)

PowMr — 4.2KW (powmr_4_2kw)

  • Lifecycle: supported
  • Aliases: VMII-NXPW5KW
  • Validation: hardware captured, telemetry confirmed, controls confirmed
  • Coverage: runtime hardware_confirmed, cloud hardware_confirmed, vendor map unknown
    • Coverage notes:
      • PI30 ASCII runtime control surface is validated from the VMII-NXPW5KW live-capture fixture.
      • The same inverter also responds to the local SmartESS 0925 Modbus map through the legacy EyeBond binary tunnel; the commercial model is PowMr 4.2kW, while the raw inverter model reports VMII-NXPW5KW.
  • Summary: PowMr 4.2KW with raw model number VMII-NXPW5KW. The inverter supports PI30 ASCII and the local SmartESS 0925 Modbus runtime through the legacy EyeBond binary tunnel.
  • Variants:
    • pi30_vmii_nxpw5kw — PI30 VMII-NXPW5KW raw-model variant
      • Descriptors: pi30_vmii_nxpw5kw
      • Known firmware: —
      • pi30_vmii_nxpw5kw → surface pi30_vmii_full (driver pi30, variant vmii_nxpw5kw)
        • Protocol: pi30 | Detection: anchors (protocol.protocol_id=PI30; identity.model_number=VMII-NXPW5KW)
        • Tier: full | Read-only: no | Profile: pi30_ascii/models/vmii_nxpw5kw.json | Schema: pi30_ascii/models/vmii_nxpw5kw.json
        • Capabilities: 20 (tested 20); support tiers: standard 20 | Telemetry: 77 measurements, 16 binary sensors
    • smartess_0925_modbus — SmartESS 0925 local Modbus alternate runtime
      • Descriptors: pi30_vmii_nxpw5kw
      • Known firmware: —
      • pi30_vmii_nxpw5kw → surface pi30_vmii_full (driver pi30, variant vmii_nxpw5kw)
        • Protocol: pi30 | Detection: anchors (protocol.protocol_id=PI30; identity.model_number=VMII-NXPW5KW)
        • Tier: full | Read-only: no | Profile: pi30_ascii/models/vmii_nxpw5kw.json | Schema: pi30_ascii/models/vmii_nxpw5kw.json
        • Capabilities: 20 (tested 20); support tiers: standard 20 | Telemetry: 77 measurements, 16 binary sensors
  • Known limitations: —
  • Evidence: 1 source(s)

Sandisolar — SD 11KP48V WIFI (sandisolar_sd_11kp48v_wifi)

  • Lifecycle: experimental
  • Aliases: —
  • Validation: hardware captured, telemetry partial, controls partial
  • Coverage: runtime available, cloud unknown, vendor map documented
    • Coverage notes:
      • The exact layout/model fingerprint is captured from the issue #13 beta.4 support archive.
      • Telemetry uses the documented protocol-4 projection; this prevents generic SMG interpretation of register 227 as temperature.
      • Canonical Grid and inverter power values use the protocol-4 L1 points. Legacy total fields remain available in support captures instead of acting as value-based fallbacks.
      • Secondary Charging Priority and Secondary Output Priority are hardware-confirmed on this exact fingerprint.
      • The remaining compatible ANJ write surface is inherited only as untested Full-Control candidates.
  • Summary: Sandisolar SD 11KP48V WIFI with exact layout-4/model-0x8003 identity. Captured telemetry and protocol documentation select the shared protocol-4 projection, while compatible write candidates remain explicitly untested.
  • Variants:
    • layout4_model32771 — Protocol-4 fingerprint 171=0x8003, 184=4
      • Descriptors: sandisolar_sd_11kp48v
      • Known firmware: —
      • sandisolar_sd_11kp48v → surface sandisolar_sd_11kp48v_full (driver modbus_smg, variant sandisolar_sd_11kp48v_wifi)
        • Protocol: modbus_smg | Detection: fingerprint (layout 4, model 32771, rated —)
        • Tier: full | Read-only: no | Profile: modbus_smg/models/sandisolar_sd_11kp48v_wifi.json | Schema: modbus_smg/models/sandisolar_sd_11kp48v_wifi.json
        • Capabilities: 63 (tested 2, untested 61); support tiers: blocked 2, conditional 50, standard 11 | Telemetry: 117 measurements, 18 binary sensors
  • Known limitations:
    • Only Secondary Charging Priority and Secondary Output Priority have been hardware-validated; every other inherited control remains Full-Control-only until hardware retesting.
  • Evidence: 5 source(s)

Sandisolar — SD-HYM-4862HWP (sandisolar_sd_hym_4862hwp)

  • Lifecycle: supported
  • Aliases: —
  • Validation: hardware confirmed, telemetry confirmed, controls confirmed
  • Coverage: runtime hardware_confirmed, cloud hardware_confirmed, vendor map extended
    • Coverage notes:
      • Maintainer hardware validates the runtime SMG control surface.
      • Cloud shadow-learning contributed five non-destructive controls and excluded destructive actions.
      • Maintainer local evidence covers an extended register map beyond the cloud user-facing surface.
  • Summary: Maintainer's Sandisolar SD-HYM-4862HWP resolves to runtime descriptor smg_6200 via local SMG identity anchors: register 171 device_type/model_code=0x1E00 (7680), register 184 protocol/layout=1, and register 643 rated_power=6200. The local SMG register set does not expose the commercial model name, so the Sandisolar mapping is hardware/source-backed rather than register-name-backed. Full telemetry, the original SMG control set, and five cloud shadow-learning controls (304, 322, 330, 338, 425) are validated on this hardware; destructive actions 460 and 461 remain excluded.
  • Variants:
    • layout1_model7680 — SMG fingerprint 171=0x1E00, 184=1, 643=6200
      • Descriptors: smg_6200
      • Known firmware: —
      • smg_6200 → surface smg_6200_full (driver modbus_smg, variant default)
        • Protocol: modbus_smg | Detection: fingerprint (layout 1, model 7680, rated 6200)
        • Tier: full | Read-only: no | Profile: modbus_smg/models/smg_6200.json | Schema: modbus_smg/models/smg_6200.json
        • Capabilities: 38 (tested 30, untested 8); support tiers: blocked 2, conditional 27, standard 9 | Telemetry: 107 measurements, 18 binary sensors
  • Known limitations: —
  • Evidence: 3 source(s)

SRNE-compatible — Modbus family (srne_modbus_family)

  • Lifecycle: experimental
  • Aliases: Anenji SRNE, SRNE Modbus
  • Validation: hardware none, telemetry partial, controls none
  • Coverage: runtime read_only, cloud not_applicable, vendor map partial
    • Coverage notes:
      • Runtime support is read-only and based on a private third-party SRNE-compatible Modbus map.
  • Summary: SRNE-compatible Modbus support is based on a private third-party register map. The runtime adds a read-only surface using slave address 1, product-info detection at registers 53-72, and telemetry ranges for controller, fault, inverter, and optional phase data.
  • Variants:
    • srne_family — SRNE-compatible Modbus read-only family
      • Descriptors: srne_modbus_family
      • Known firmware: —
      • srne_modbus_family → surface srne_modbus_read_only (driver srne_modbus, variant srne_family)
        • Protocol: srne_modbus | Detection: anchors (protocol.protocol_id=SRNE_MODBUS; identity.product_info=)
        • Tier: partial | Read-only: yes | Profile: — | Schema: srne_modbus/base.json
        • Capabilities: no model-specific profile | Telemetry: 37 measurements, 0 binary sensors
  • Known limitations:
    • Read-only first implementation; no write controls are exposed.
    • Requires collector serial settings compatible with Modbus RTU 9600 8N1 and inverter slave address 1.
    • Telemetry map is based on a third-party SRNE-compatible Modbus register map and still needs owner confirmation through a fresh support archive after integration update.
    • Detection relies on the product-info register block containing an SRNE-like marker; commercial model names may need follow-up catalog entries.
  • Evidence: 1 source(s)

Yingfa — YF6.2K-2K-LEL-IF (yingfa_yf6_2k_2k_lel_if)

  • Lifecycle: supported
  • Aliases: YF6.2K, PI30 6200
  • Validation: hardware captured, telemetry confirmed, controls partial
  • Coverage: runtime available, cloud cloud_catalog, vendor map unknown
    • Coverage notes:
      • The proxy capture proves PI30 ASCII telemetry and cloud-visible PI30 controls, but Home Assistant write behavior is not yet independently user-confirmed.
      • This collector family uses raw PI30 ASCII payloads directly over the SmartESS DTU AT callback stream rather than the legacy EyeBond binary FC=4 forwarding tunnel.
  • Summary: Yingfa YF6.2K-2K-LEL-IF support is based on issue #6 and a private proxy capture. The inverter speaks PI30 ASCII through a SmartESS DTU AT collector; QPI reports PI30, QPIRI reports a 28-field 6200W/48V MAX-style rating, and QPIGS returns live telemetry. The integration should use the PI30 MAX runtime surface over raw AT-text payload transport for this collector family.
  • Variants:
    • pi30_max_qpiri — PI30 MAX 6200W raw-ASCII runtime over SmartESS DTU AT collector
      • Descriptors: pi30_max_qpiri
      • Known firmware: VERFW:00074.11, VERFW2:00000.00
      • pi30_max_qpiri → surface pi30_max_full (driver pi30, variant pi30_max)
        • Protocol: pi30 | Detection: anchors (protocol.protocol_id=PI30; shape.qpiri_field_count=)
        • Tier: full | Read-only: no | Profile: pi30_ascii/models/pi30_max.json | Schema: pi30_ascii/models/pi30_max.json
        • Capabilities: 20 (tested 20); support tiers: standard 20 | Telemetry: 77 measurements, 16 binary sensors
  • Known limitations:
    • The commercial model name is known from the user report, not from a local inverter identity command in the captured traffic.
    • QMN/model-number evidence was not present in the cloud proxy capture, so runtime resolution is currently by PI30 protocol plus QPIRI 28-field MAX-family shape.
  • Evidence: 2 source(s)

Yingfa — YF6.2K-LEL-1B (yingfa_yf6_2k_lel_1b)

  • Lifecycle: supported
  • Aliases: Yingfa 6.2K
  • Validation: hardware captured, telemetry confirmed, controls partial
  • Coverage: runtime available, cloud unknown, vendor map unknown
    • Coverage notes:
      • Issue #27 support evidence detects the inverter at high confidence through the built-in PI30 MAX runtime.
      • QPI reports PI30, QMN reports the generic raw model VMII-NXPW5KW, and QPIRI reports a 6200 W / 48 V 28-field rating.
  • Summary: Yingfa YF6.2K-LEL-1B support is confirmed by the issue #27 support archive. The inverter uses the existing PI30 MAX profile over an EyeBond AT-text collector and provides valid rating, live telemetry, warning, mode, and firmware responses.
  • Variants:
    • pi30_max_qpiri — PI30 MAX 6200W raw-ASCII runtime over EyeBond AT collector
      • Descriptors: pi30_max_qpiri
      • Known firmware: VERFW:00074.09, VERFW2:00000.00
      • pi30_max_qpiri → surface pi30_max_full (driver pi30, variant pi30_max)
        • Protocol: pi30 | Detection: anchors (protocol.protocol_id=PI30; shape.qpiri_field_count=)
        • Tier: full | Read-only: no | Profile: pi30_ascii/models/pi30_max.json | Schema: pi30_ascii/models/pi30_max.json
        • Capabilities: 20 (tested 20); support tiers: standard 20 | Telemetry: 77 measurements, 16 binary sensors
  • Known limitations:
    • The inverter identity command reports the generic raw model VMII-NXPW5KW rather than the commercial Yingfa model name.
    • Writable controls were exposed by the runtime but were not independently exercised in the attached support archive.
  • Evidence: 1 source(s)

Integrity Findings

No integrity findings.