[Huawei ESM-48100U2] Modbus RTU reverse engineering (slave 214 / 9600 8E1 / RS485)

I am trying to integrate Huawei ESM-48100U2 batteries with Home Assistant using ESPHome/Modbus RTU and would appreciate any technical insight regarding protocol details and register maps.

What I have discovered/tested so far:

Battery:

  • Huawei ESM-48100U2
  • Possible slave ID: 214
  • Communication settings:
    • 9600 baud
    • 8E1 (8 data bits, EVEN parity, 1 stop bit)

Hardware used:

  • ESP32
  • MAX485
  • MAX490
  • ESPHome

Tests performed:

  1. MAX485 RS485 2-wire
  • Partial communication achieved
  • Received:
    • CRC errors
    • truncated responses
    • UART echo

At some moments I received valid Modbus exceptions:

  • 0x83 exception 2
  • 0x84 exception 1

This indicates:

  • slave 214 is responding
  • protocol is likely Modbus RTU
  • but register/function selection may be wrong

  1. MAX490 RS422 4-wire
  • Tried separating:
    • T+/T-
    • R+/R-

Received strange/partial UART responses:

  • 94 0A 2F FF ...

No stable valid Modbus frames.


  1. Important discovery from forum
    Found this thread:
    https://powerforum.co.za/topic/16372-huawei-esm-48100b1-changing-slave-id/

Important information found:

  • Default slave ID = 214
  • Communication = 9600 8E1
  • Huawei implementation is described as “slightly outside standard Modbus”
  • Requires repeated polling attempts
  • Another user succeeded using FTDI RS485 adapter

Most important finding:
RJ45 pinout:

  • pins 1 and 4 = A
  • pins 2 and 3 = B

This strongly suggests:

  • duplicated 2-wire RS485
  • NOT classic RS422 full duplex

  1. Registers found in forum
    Supposed register map:
  • 0x0000 = busbar voltage
  • 0x0001 = battery voltage
  • 0x0002 = current
  • 0x0003 = SOC
  • 0x000E = mode

  1. Registers I already tested
    Tested:
  • 74
  • 802
  • 1000
  • 1329

Results:

  • some returned Modbus exceptions
  • some returned partial responses
  • still no confirmed valid readings

  1. Current ESPHome setup
    Using:
  • modbus_controller
  • slave 214
  • 9600 EVEN
  • tested function 03 and 04

Examples:

  • function 03 -> exception 2
  • function 04 -> exception 1

Next step:
I will test using a USB RS485 adapter directly on PC with:

  • QModMaster
  • Modbus Poll

Planned wiring:

  • Huawei pins 1 + 4 -> A
  • Huawei pins 2 + 3 -> B

Questions:

  1. Has anyone successfully integrated ESM-48100U2?
  2. Is the register map above correct?
  3. Is there any byte swap/endian requirement?
  4. Is this really standard Modbus RTU?
  5. Which function code should be used?

Does this help at all? GitHub - modbus2mqtt/modbus2mqtt: server for modbus2mqtt for REST API of configuration and publishing modbus values to mqtt · GitHub

Otherwise search here in the community, there is literally a thousand modbus posts. Tips on Searching for Answers & Duplicate Topics in the Forum