AEG SolarCube Pro Modbus registers (AS-BBL08 / HYXi HALO): what works and what only stores

The AEG SolarCube Pro, model number AS-BBL08, has an RS485 port on the back that speaks Modbus. We found no register document from AEG or HYXi that matches this unit. HYXi builds it, and it is an AEG-badged HYXi HALO: the register layout is shared, the meaning of the registers is not. own measurementModbus reads over RS485, set against HYXi's register document · 12 September 2026 This page lists the Modbus registers we mapped ourselves, each one checked against the app, the metering socket or the behaviour of the unit. What the battery itself delivers is in the AEG SolarCube Pro review. This page is only about reading and control.

The whole map is also in one file: aeg-solarcube-as-bbl08-modbus-registers.csv, 46 rows. What the columns mean is at the bottom, with the download.

Connecting to the RS485 port of the AEG SolarCube

The port is D, on the main unit. The manual describes it as a standard network-cable port for a third-party energy manager to control your system. manufacturerAS-BBL08 user manual V1.0-26, page 9, port legend The specification table of the datasheet does not list it. It says "WiFi / Bluetooth / CAN", and footnote 5 makes CAN the line to the battery module. manufacturerdatasheet V2.0, communication row and footnote 5 · 12 September 2026

Our bridge was a USR-W610 in Modbus TCP to RTU translation mode. In that mode, use plain Modbus TCP framing (MBAP); RTU over TCP timed out for us. At 9600 baud the bus stays dead. If two programs share the same bridge, check the transaction id on every reply. Without that check one program receives the other's answers, and on 25 September that gave us a scan in which whole blocks sat 150 to 200 registers out of place. own measurementModbus TCP through a USR-W610 to RS485

Other function codes time out: 43/14 (device identification), 20 (file record), 17 and 8. Coils and discrete inputs (function codes 1 and 2) do not exist anywhere between 0 and 9999. So there is no way to update the firmware over Modbus. own measurementModbus scan over RS485

Control over this port needs no internet. It is also the only local path: the communication module has every port closed on the home network and talks only to the cloud. own measurementModbus TCP through an RS485 bridge, and a port scan of the communication module · 25 September 2026

Holding and input are two separate spaces

On this unit, holding (function code 3) and input (function code 4) are different registers, also where the address is the same. Input 4048 and 4049 are the rated frequency and voltage; holding 4048 and 4049 is a dispatch pair that does nothing. HYXi's register document does not make that distinction. own measurementModbus reads and a write test · 12 September 2026

Above 9999 it gives well-formed replies with no content on function codes 3 and 4. A scanner that counts every reply without an exception as a hit finds about thirty false islands there. own measurementModbus scan over RS485, 10000 to 65535

Where HYXi uses a name of its own for a register, in its register document or in the firmware, that name is in the tables and in the CSV. Such a name is a lead, not proof. The HYXi document we found, Micro Storage RS485 MODBUS V1.0, does not hold for this unit, also where the addresses match. So do not use it to correct this map. If you build a driver, key it on the model string AS-BBL08-3K and never on "HALO". Then a HYXi-badged unit does not silently inherit the behaviour of this AEG. own measurementModbus reads, register by register next to HYXi's document · 12 September 2026

Identity: model string, firmware and rated power

Every text we read in the registers had the two bytes of each register swapped. Swap them back before you compare the string.

Live values: state of charge, power and cells

Control on the lower of 3030 and 3130. 4982 looks like a state of charge and cost us most of a session before we saw that it is not one. own measurementModbus reads next to the app · 12 September 2026

5021 and 5023 report what the unit can do at that moment, not the setting in the app. Off the grid and just after reconnecting they fall away. A script that reads a ceiling from them before it starts then aborts for no reason or commands too little. Read them only once 4979 is at 4. own measurementModbus reads while disconnecting and reconnecting, 800 W grid setting · 12 September 2026 No register writes the grid setting itself, 800 or 3000 W. It lives only in the app. own measurementModbus reads and app, 800 W and 3000 W grid settings · 12 September 2026

Work mode, on and off

The thirdpartyEMS mode reports itself as such and accepts a power value by no path we tried. Custom, with the schedule table below, is the mode in which you set a discharge power over Modbus. own measurementModbus writes, mode by mode · 12 September 2026

Standby is not off. With 4021 at 3 it draws about 9.5 W, and with the power button off 9.3 W; Modbus keeps answering in both cases. Off the grid, that draw comes from the battery. own measurementmetering socket and Modbus reads, after the recovery · 30 September 2026 That is how our unit drained until the battery management locked it out. What the error code then means and how it came back is on the page about error code 170305110.

Controlling discharge: the schedule table from 4178

It has no power setpoint register. You control discharge through the schedule table the app itself uses in Custom mode. The proof that it is the same table: when the app held three time slots of 15, 30 and 45 W, exactly those values with exactly those boundaries sat in 4181 to 4200, in a change we had not written over the bus. own measurementModbus reads next to the app · 12 September 2026

4024 = 21                       work mode Custom
4178 = 1                        PeriodNum: 1 or higher, or the schedule reads as empty
4179 = 127                      days as a bitmask, 127 = every day
4180 = 1                        the number of slots
4181, 4182, 4183, 4184          slot 0: start, end, mode, power
  = 0, 1440, 21, <watts>        start and end in minutes of the day

Slot n starts at 4181 + 8n and takes eight registers. The first four are start, end, mode and power; what the other four do is not settled. The mode in the slot takes the same values as 4024. own measurementModbus writes, confirmed on 4985 · 1 October 2026

We never wrote 4178 at first. On our unit it sat at 0 after a full reset, the whole schedule read as empty and the unit delivered the 200 W default, so every slot write looked ignored. So always set it. own measurementModbus writes after a full reset · 1 October 2026

The power in a slot is an unsigned discharge power. A slot does not charge. If you write a negative number, it reads it as a large positive one and discharges at its maximum. own measurementModbus writes, confirmed on 4985, 800 W grid setting · 1 October 2026

An empty schedule is not zero. With no valid slot it discharges 200 W; the app itself warns about it. To make it stand still, set one all-day slot to 0 W: 4180 = 1 and slot 0 = [0, 1440, 21, 0]. own measurementModbus reads and the notice in the app · 16 September 2026

What you write into the slots over the bus is lost on a full reset. The schedule set in the app survives that reset. Give every script a restore on exit, and set the slot power to 0 there instead of commanding a previously captured power again. own measurementModbus reads before and after a full reset · 16 September 2026

Controlling charge: forced charge with 4132, 4140 and 4113

You cannot pick the charge power in the app, and not in a slot either. Over Modbus you can, with a forced charge:

1. Set 4021 to 1. From standby a forced charge does nothing, and the grid has to be connected.
2. Set 4132, the start state of charge, above the current state of charge. It then charges at the grid setting.
3. Set 4140, the stop state of charge, to your target. The unit enforces that limit itself, also when the script that controls it stops halfway.
4. Set 4113 to the limit you want.

4113 limits the charge power only while a forced charge runs, and the relation is linear: about 19 W per step, from about 190 W up to the ceiling of the grid setting. During discharge 4113 does nothing. HYXi calls the register MaxChargeCurrent. Which unit the device reads into it is not settled, so work with what was measured.

It worked on the unit itself and it is reversible: one write took it from discharging to charging. Values below 10 are not in our measurement, and on the 3000 W setting, between 760 and 2850 W, we did not measure 4113. own measurementour techbench, metering socket, Modbus writes to 4113 during a forced charge, 800 W grid setting · 1 October 2026

None of these limits is a voltage limit. They are states of charge. own measurementModbus reads of the settings, holding 4121 to 4141 · 27 September 2026

Registers that store a value and do nothing

The unit does not check a write when it receives it, only when it executes it. A successful read-back proves storage, not obedience: 4148 accepted 65000. After every write, look at the DC power in 4985, and never only at the read-back straight after it. own measurementModbus writes and reads, register by register · 12 September 2026

Holding 140 to 179: never write

On 26 September the block stayed the same for twelve hours while the cells rose by about 90 mV, so these are stored settings and not measured values. Reading is not always reliable here either: the unit drops a function code 3 read in this block now and then. Retry it. own measurementModbus reads, read only, with transaction id check · 26 September 2026

Behaviour a script has to handle

There is no watchdog and no command timeout. A written value stays until something overwrites it, also long after your script has stopped. So restore on exit and on a SIGTERM. The only limit the unit enforces itself is 4140. own measurementModbus writes · 12 September 2026

A change in the app takes minutes to reach the unit. If a register still shows the old value after a change in the app, read again later before you conclude it is the wrong register. own measurementModbus reads next to the app · 16 September 2026

In the undervoltage lockout, with 4979 at 7, it accepts commands and does not carry them out: writes are acknowledged and read back unchanged. The app then shows the mode that is requested and not what the battery management allows; the alarm list is the place to look. own measurementAEG StoragePRO 1.0.0 app and Modbus reads · 26 September 2026

The register map as CSV

Download aeg-solarcube-as-bbl08-modbus-registers.csv. One row per register, 46 rows, with the columns address, type (holding or input), name, unit_scale, access, what_it_does, status and source. Where HYXi uses a name of its own, it is in name. The status has five values:

The file is under CC BY 4.0: you may use, adapt and share it, also commercially, as long as you credit Jay's Desk and link to this page.

Every row comes from the same register map as the tables above.

What is still open

• 4113 on the 3000 W setting, between 760 and 2850 W: not measured. And below 10: not measured.
• 3956: reliable on 12 September, not on 1 October. Where the difference comes from is not settled.
• 4112 is called MaxDischargeCurrent by HYXi. What it does on this unit is not settled.
• 4024 = 1 and 2: which of the two self-consumption modes is which is not settled.
• The four registers after start, end, mode and power in every slot.
• What each bit in 5000 means, and what exactly 4109, 4110 and 4111 measure.
• Firmware other than 331 / 259 / 286 / 259. The update the app offers did not install on this unit, so I do not know what changes after it.

How other brands handle reading and writing is in Controlling a home battery: what each brand lets you read, and what it lets you write. The specifications of this model are on the product card of the AEG SolarCube AS-BBL08 (in Dutch).

Frequently asked questions

Sources