Yantai Winmore Trade Co., Ltd.

NH4-N Sensor

MODBUS RTU
Programmer Manuel

1 / 21
 Yantai Winmore Trade Co., Ltd.

Table of Contents
1 MODBUS RTU Overview..................................................................................................... 3
1.1 Scope........................................................................................................................ 3
1.2 MODBUS Command Structure.................................................................................3
1.3 MODBUS RTU for NH4-N Sensor............................................................................. 5
1.4 MODBUS RTU Function Code for NH4-N Sensor..................................................... 5
1.5 Data formats in NH4-N Sensor.................................................................................7
2 MODBUS RTU Commands for NH4-N Sensor................................................................... 10
2.1 Overview................................................................................................................ 10
2.2 Command Description........................................................................................... 10
3 Procedure to get NH4-N value..........................................................................................21

2 / 21
 Yantai Winmore Trade Co., Ltd.

1 MODBUS RTU Overview

1.1 Scope

This document is about MODBUS of Self-cleaning NH4-N probes with hardware Rev1.0 and
software Rev1.6 or later. This document is intended for software programmers with detailed
information about MODBUS RTU protocols.

1.2 MODBUS Command Structure

Data format in this document:

----Binary number – shown with suffix B. For example: 10001B
----Decimal number – without nay suffix. For example: 256
----Hexadecimal number—shown with prefix 0x. For example: 0x2A
----ASCII character or string – shown with quotation marks. For example:” YL1014010022”
1.2.1 Command Structure
MODBUS defines a simple protocol data unit (PDU), which is transparent to communication layer.

Figure 1: MODBUS Protocol Data Unit

The mapping of MODBUS protocol on a specific bus or network introduces some additional fields
on the Protocol Data Unit. The client that initiates a MODBUS transaction builds the MODBUS
PDU, and then adds fields in order to build the appropriate communication PDU.

Figure 2: MODBUS Structure for Serial Communication

On a MODBUS serial bus, address field only includes addresses for slave devices.
Note:
 Slave address range for NH4-N sensor is: 1…247
 Master device sends a “request frame” with a targeted slave address. When slave device
responses, it has to put its own address in the “response frame”, so that master device
knows where the response comes from.
 Function code indicates type of operations
 CRC is the result of redundancy check.

3 / 21
 Yantai Winmore Trade Co., Ltd.

1.2.2 MODBUS RTU Transmission Mode

When devices communicate on a MODBUS using RTU (remote terminal unit) mode, each 8-bit
byte message contains two 4-bit hexadecimal characters. The main advantage of the RTU mode is
that it has higher character density, which enables better throughput compare to ASCII mode at
same baud rate. Each RTU message must be transmitted in a continuous string of characters.
RTU mode format for each byte (11 bits):
Encoding system 8 bit binary
Each 8-bit packet contains 4-bit hexadecimal characters (0-9, A-F)
Bit per byte: 1 start bit
8 data bits, least significant bit first
No parity check
1 stop bits
Baud rate: 9600bps
Serial transmission of characters:
Every character or byte is sent under this sequence (left to right):
Least Significant Bit (LSB)……Most Significant Bit(MSB)
Start 1 2 3 4 5 6 7 8 Stop
Figure 3: RTU Mode Bit Sequence
CRC Field Structure:
Redundancy check (CRC16)
Frame Structure:
Slave address Function Code Data CRC
2 bytes
1 byte 1 byte 0…252 bytes
CRC Low CRC High
Figure 4: RTU Message Frame Structure
Maximum size of MODBUS frame is 256 bytes.
1.2.3 MODBUS RTU Message Frame
In RTU mode, message frames need to be separated by an idle interval of at least 3.5 character
lengths. In rest of this document, this idle interval is called t3.5.

Figure 5: RTU Message Frame

Entire message frame must be sent as continuous stream of characters.
If idle time between two characters is longer than 1.5 characters, the message frame will be
considered incomplete, and will be discarded by receiving side.
4 / 21
 Yantai Winmore Trade Co., Ltd.

Figure 6: Frame transmission

1.2.4 MODBUS RTU CRC Check
In RTU mode, the error checking field is based on a cyclical redundant checking (CRC) method.
The CRC field checks entire content of MODBUS message, regardless of the existence of parity
check bit. CRC16 checking method is utilized. CRC result is a 16-bit value with two 8-bit bytes, low
order 8-bit byte first followed by high order 8-bit byte.

1.3 MODBUS RTU for NH4-N Sensor

Based on standard MODBUS definition, message frame starts with t3.5 idle interval, and similarly,
ends with t3.5 idle interval. Device address and Function code are both 8-bit byte. Data character
string has n*8 bits, it contains information about register start/end address and number of
registers for read/write operation. CRC field is 16 bit in length.
Start Device Function Data CRC End
address code
Value Idle for 3.5 1-247 Comply Comply CRC CRC Idle for 3.5
character with with Low High character
length MODBUS MODBUS length
function data
code format format
Length 3.5 1 1 n 1 1 3.5
(byte)
Figure 7: Message frame structure for MODBUS

1.4 MODBUS RTU Function Code for NH4-N Sensor

The NH4-N sensor has two MODBUS function codes:

0x03: Read registers 0x10： Write registers
1.4.1 MODBUS Function Code 0x03: Read Registers
This function code is to read a block of continuous registers from a remote device. Request PDU
defines start address and number of registers for the read operation. Register addressing starts
from 0. Therefore, addresses for register 1-16 are 0-15. Data for each register in Response
message have two bytes. For each register data, first byte is for high bits, and second byte for low
bits.
Request Frame:
Function code 1 Byte 0x03
Start address 2 Bytes 0x0000….0xfffff
Number of registers 2 Bytes 1…125
5 / 21
 Yantai Winmore Trade Co., Ltd.

Figure 8: Request frame for read registers

Response Frame:
Function code 1 byte 0x03
Number of byte 1 byte N×2
Register data N×2 bytes
N = number of registers
Figure 9: Response frame for read registers
Below is an example of Request and Response frames (Read register 108-110. Register 108 is read
only with 2-byte value of 0X022B. Registers 109-110 have values of 0X0000 and 0X0064).
Request Frame Response Frame
Data format Hexadecimal Data Format Hexadecimal
Function code 0x03 Function code 0x03
Start address(high bits) 0x00 Number of bytes 0x06
Start address (low bits) 0x6B Register value (high bits, 108) 0x02
Number of registers (high bits) 0x00 Register value (low bits, 108) 0x2B
Number of registers (low bits) 0x03 Register value (high bits, 109) 0x00
Register value (low bits, 109) 0x00
Register value (high bits, 110) 0x00
Register value (low bits, 110) 0x64
Figure 10: Example of request frame and response frame for read operation
1.4.2 MODBUS Function Code 0x10: Write Registers
This function code is to write a block of continuous registers at a remote device. Request frame
contains register data. Each register data have two character bytes. Response frame contains
function code, start address, and number of registers that completed write operation.
Request Frame:
Function code 1 byte 0x10
Start address 2 bytes 0x0000….0xffff
Number of registers 2 bytes 0x0001….0x0078
Number of bytes 1 byte N×2
Register data N×2 bytes value
N = number of registers
Figure 11: Request frame for write operation
Response Frame:
Function Code 1 byte 0x10
Start address 2 bytes 0x0000….0xffff
Number of registers 2 bytes 1…123(0x7B)
N = number of registers
Figure 12: Response frame for write operation
Below is an example of Request Frame and Response frame (write 0x000A and 0x0102 to two
registers starting from address 2):
Request Frame Response Frame
Data Format Hexadecimal Data Format Hexadecimal
Function code 0x10 Function code 0x10

6 / 21
 Yantai Winmore Trade Co., Ltd.

Start address (high bits) 0x00 Start address (high bits) 0x00
Start address (low bits) 0x01 Start address (low bits) 0x01
Number of registers (high bits) 0x00 Number of registers (high bits) 0x00
Number of registers (low bits) 0x02 Number of registers (low bits) 0x02
Number of bytes 0x04
Register value (high bits) 0x00
Register value (low bits) 0x0A
Register value (high bits) 0x01
Register value (low bits) 0x02
Figure 13: Example of Request frame and response frame for write operation

1.5 Data formats in NH4-N sensor

1.5.1 Floating-point number

Definition: floating point number, comply with IEEE754 (single precision)
Note Sign Exponent Fraction Total
bit 31 30…23 22…0 32
Exponent deviation 127
Figure 14: Single floating point number definition (4 bytes, 2 MODBUS registers)
Example: Convert decimal number 17.625 to binary number
Step 1: Convert decimal number 17.625 to a floating point number with binary format
First, convert integer to binary
17decimal = 16 + 1 = 1×24 + 0×23 + 0×22 + 0×21 + 1×20
Thus, integer 17 in binary format is 10001B
Then convert decimal part to binary
0.625decimal = 0.5 + 0.125 = 1×2-1 + 0×2-2 + 1×2-3
Thus, 0.625 in binary format is 0.101B
Combine above together, 17.625 in binary format is 10001.010B
Step 2: Calculate exponent
Left shift the binary number 10001.010B until only bit left before the decimal point ---
10001.101B = 1.0001101 B× 24, so exponent value is 4. By adding 127, we have 131, which
is 10000011B in binary format
Step 3: Get fraction
Fraction is simply the number after decimal point. Thus from 1.0001101B, fraction
number is 0001101B. IMPORTANT NOTE about the 23 bit fraction number: the first bit
which on the left side of decimal point is hidden bit and does not need to be compiled.
Step 4: Sign definition
Sign bit is 0 if the number is positive. Sign is 1 if the number is negative. For 17.625,
sign 17.625, sign bit is 0.
Step 5: Convert to floating point number
1 Sign bit + 8-bit exponent + 23-bit fraction
0 10000011 00011010000000000000000B
(Corresponding hexadecimal number is 0x418D0000)
7 / 21
 Yantai Winmore Trade Co., Ltd.

Sample code:
1. If your compiler has similar library functions, it can be called directly. For example if C
language is used, we can directly call memcpy() function in C library to convert floating point
number. Sample code:
float floatdata;//floating point data to be converted
void* outdata;
memcpy(outdata,&floatdata,4);

If floatdata=17.625,
In little-endian storage mode after the function is called:
Value at address of outdata is 0x00
Value at address of (outdata+1) is 0x00
Value at address of (outdata+2) is 0x8D
Value at address of (outdata+3) is 0x41
In big-endian storage mode after the function is called:
Value at address of outdata is 0x41
Value at address of (outdata+1) is 0x8D
Value at address of (outdata+2) is 0x00
Value at address of (outdata+3) is 0x00

2. If your complier doesn’t have the conversion function, then the following function can be
used:
void memcpy(void *dest,void *src,int n)
{
char *pd = (char *)dest;
char *ps = (char *)src;
for(int i=0;i<n;i++) *pd++ = *ps++;
}
Then you can get same result by calling this function memcpy(outdata,&floatdata,4);

Example: Convert binary floating point number 0100 0010 0111 1011 0110 0110 0110 0110B to a
decimal number
Step 1: Separate this binary number 0100 0010 0111 1011 0110 0110 0110 0110B and get values
of Sign , exponent and fraction.
0 10000100 11110110110011001100110B
1 Sign bit 8-bit exponent 23-bit fraction

Sign bit(s): 0
Exponent(E):10000100B=1×27+0×26+0×25+0×24+0×23+1×22+0×21+0×20
=128+0+0+0+0+4+0+0=132
Fraction(M)：11110110110011001100110B =8087142
Step 2: Calculate decimal value
D = (-1)S×(1.0+M/223)×2E-127
= (-1)0×(1.0+8087142/223)×2132-127
8 / 21
 Yantai Winmore Trade Co., Ltd.

= 1×1.964062452316284×32
= 62.85

Reference code:
float floatTOdecimal(long int byte0, long int byte1, long int byte2, long int byte3)
{
long int realbyte0,realbyte1,realbyte2,realbyte3;
char S;
long int E,M;
float D;
realbyte0 = byte3;
realbyte1 = byte2;
realbyte2 = byte1;
realbyte3 = byte0;

if((realbyte0&0x80)==0)
{
S = 0; //Positive
}
else
{
S = 1; //Negative
}
E = ((realbyte0<<1)|(realbyte1&0x80)>>7)-127;
M = ((realbyte1&0x7f) << 16) | (realbyte2<< 8)| realbyte3;
D = pow(-1,S)*(1.0 + M/pow(2,23))* pow(2,E);
return D;
}
Note:
 Function parameters byte0, byte1, byte2 and byte3 represent the 4 sections of a binary
floating number.
 Return value is value of decimal number after conversion

For example when a command is sent to a sensor to get temperature value, response frame from
the sensor will have measured temperature. If the values are 4 byte floating point number
0x00,0x00,0x8d,0x41, then the following function can be used to get temperature in decimal
value:
float temperature = floatTOdecimal( 0x00, 0x00, 0x8d, 0x41);
and temperature = 17.625.

1.5.2 Characters
Definition: Character is shown by ASCII code.
Example: String “YL”could be shown by corresponding ASCII codes (refer to ASCII character chart)
“Y” is 0x59

9 / 21
 Yantai Winmore Trade Co., Ltd.

“L” is 0x4C

2 MODBUS RTU Commands for NH4-N Sensor

2.1 Overview

In order to communicate with NH4-N sensor via MODBUS RTU, master terminal software will be
needed. MODBUS RTU is an open standard. There are free commercial software tools available.
For applications described in this document, MODBUS register address starts from 1. However,
slave address in MODBUS protocol starts from 0, and usually master software compiles addresses.
For example, register address 2090 will be compiled by master software as address 2089.

2.2 Command Description

2.2.1 Set Slave Device ID

Purpose: Set MODBUS slave address to a sensor probe. Range of address is 1~247.
Sensor probe slave address can be set via MODBUS register 0x3000:
Start address Number of registers Register 1 MODBUS Function code
0x3000 0x01 New Slave address 0x10
Figure 15: Register definition of Set Slave ID Command
Below is an example of request and response frames for setting slave device ID command. Old
slave address is 0x01, new address is 0x14.
Definition Address Function Start Number of Number Register CRC
code address registers of byte value
Byte 0 1 2 3 4 5 6 7 8 9 10
Value 0x01 0x10 0x30 0x00 0x00 0x01 0x02 0x14 0x00 0x99 0x53
Figure 16: Request frame to Set Slave ID
*Note: byte 8 is reserved
Definition Address Function code Start address Number of registers CRC
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x30 0x00 0x00 0x01 0x0E 0xC9
Figure 17: Response frame for Set Slave ID Command

2.2.2 Get SN
Purpose: Get sensor probe’s serial number (SN). Each sensor probe has a unique SN.
Serial Number can be read from 7 continuous MODBUS registers starting from address 0x0900.
Start Address Number of registers Register 1-7 MODBUS Function code
0x0900 0x07 SN 0x03
Figure 18: Register definition of Get SN Command
Below is an example of request and response frames to get SN “YL1014010022” from a slave
device (address 0x01) .
10 / 21
 Yantai Winmore Trade Co., Ltd.

Definition Address Function Starting address Number of CRC

code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x09 0x00 0x00 0x07 0x07 0x94
Figure 19: Request frame to Get SN Command
Definition Address Function Number of Register value CRC
code byte
Byte 0 1 2 3 4-15 16 17 18
Value 0x01 0x03 0x0E 0x00 “YL1014010022” 0x00 0x4c 0x5f
Figure 20: Response frame for Get SN Command
Note: SN value is in ASCII code as below:
Byte 4 5 6 7 8 9 10 11 12 13 14 15
Value 0x59 0x4C 0x31 0x30 0x31 0x34 0x30 0x31 0x30 0x30 0x32 0x32
Figure 21: Sensor probe’s SN

2.2.3 Get pH and potential Value (ORP)

Purpose: Get current pH and potential value (ORP), the unit is mV.
The pH and potential value can be read from 4 continuous MODBUS registers starting from
address 0x2600.
Start address Number of Register 1-2 Register 3-4 MODBUS function
registers code
0x2600 0x04 potential value pH value 0x03
Figure 25: Request frame to Get pH and potential value(ORP) Command
Below is an example of request and response frames for getting pH and potential value command,
assuming slave device address is 0x01, returned pH value is 7 and potential value (ORP) is
-6.56mV.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x26 0x00 0x00 0x04 0x4F 0x41
Figure 26: Request frame to Get pH and potential value (ORP) Command
Definit Device Function Number Register value CRC
ion address code of bytes
Byte 0 1 2 3~6 7~10 11 12
Value 0x01 0x03 0x08 -6.56 7 0x5C 0xE6
Figure 27: Response frame for Get pH and potential value (ORP) Command
potential value（3-6） pH value（7-10）
0x85 0xEB 0xD1 0xC0 0x00 0x00 0xE0 0x40
Figure 28: Registers definition for pH and potential value (ORP).

2.2.4 Get NH4+ and K+ in mV

Purpose: Get current NH4+ and K+, the unit is mV.
The NH4+ and K+ can be read from 4 continuous MODBUS registers starting from address
0x3700.(For now being, K+ value is ignored)
11 / 21
 Yantai Winmore Trade Co., Ltd.

Start address Number of Register 1-2 Register 3-4 MODBUS function

registers code
0x3700 0x04 NH4+ K+ 0x03
Figure 29: Request frame to Get NH4+ and K+ Command
Below is an example of request and response frames for getting NH4+ and K+ command,
assuming slave device address is 0x01, returned NH4+ value is -20.1 and K+ is -32.2mV.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x37 0x00 0x00 0x04 0x4A 0x7D
Figure 30: Request frame to Get NH4+ and K+ Command
Definit Device Function Number Register value CRC
ion address code of bytes
Byte 0 1 2 3~6 7~10 11 12
Value 0x01 0x03 0x08 -20.1 -32.2 0x5B 0x61
Figure 31: Response frame for Get NH4+ and K+ Command
NH4+ value（3-6） K+value（7-10）
0xCD 0xCC 0xA0 0xC1 0xCD 0xCC 0x00 0xC2
Figure 32: Registers definition for NH4+ and K+.

2.2.5 Get NH3-N NH4+ and K+ in mg/L

Purpose: Get NH3-N NH4+ and K+ value after temperature compensation, the unit is mg/L.
The NH3-N ,NH4+ and K+ can be read from 6 continuous MODBUS registers starting from address
0x2800.
Start Number of Register 1-2 Register 3-4 Register 5-6 MODBUS
address registers function code
0x2800 0x06 NH3-N K+ NH4+ 0x03
Figure 33: Request frame to Get NH3-N ,NH4+ and K+ Command
Below is an example of request and response frames for getting NH3-N ,NH4+ and K+ command,
assuming slave device address is 0x01, returned NH3-N value is 7.6,NH4+ value is 5.2 and K+ is
1.0 mg/L.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x28 0x00 0x00 0x06 0xCC 0x68
Figure 34: Request frame to Get NH3-N ,NH4+ and K+ Command
Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3~6 7~10 11~14 15 16
Value 0x01 0x03 0x0C 7.6 1.0 5.2 0x6C 0x7D
Figure 35: Response frame for Get NH3-N ,NH4+ and K+ Command
NH4-N value（3~6） K+ value（7~10） NH4+ value(11~14)
0x33 0x33 0xF3 0x40 0x00 0x00 0x80 0x3F 0x66 0x66 0xA6 0x40

12 / 21
 Yantai Winmore Trade Co., Ltd.

Figure 36: Registers definition for NH3-N ,NH4+ and K+.

2.2.6 Get temperature value
Purpose：Get current temperature value , the unit is C.
Temperature can be read from 2 continuous MODBUS registers starting from address 0x2400.
Start address Number of Register 1-2 MODBUS
registers function code
0x2400 0x02 temperature value 0x03
Figure 37: Request frame to Get temperature Command
Below is an example of request and response frames for getting temperature command,
assuming slave device address is 0x01, returned temperature value is 15.8.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x24 0x00 0x00 0x02 0xCE 0xFB
Figure38: Request frame to Get temperature Command
Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3-6 11 12
Value 0x01 0x03 0x04 15.8 0xE4 0x50
Figure 39: Response frame for Get temperature Command
Temperature value（3~6）
0xCD 0xCC 0x7C 0x41
Figure 40: Registers definition for temperature.

2.2.7 Get Software and Hardware Rev

Purpose: Get current hardware and software Release Version
Hardware and software release version numbers of a sensor probe can be read from 2
continuous registers starting from address 0x0700.
Start address Number Register 1 Register 2 MODBUS function
registers code
0x0700 0x02 HW Rev SW Rev 0x03
Figure 41: Register definition for Get Software and Hardware Rev Command
Below is an example of request and response frames for getting hardware and software release
version, assuming device slave address is 0x01, returned value for hardware Rev is 1.0 and
software rev is 1.0.
Definition Device Function Start address Number of registers CRC
address code
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x07 0x00 0x00 0x02 0xc5 0x7f
Figure 42: Request frame to Get Hardware and Software Rev Command
Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3-4 5-6 7 8

13 / 21
 Yantai Winmore Trade Co., Ltd.

Value 0x01 0x03 0x04 0x01 0x00 0x01 0x00 0xfa 0x5f
Figure 43: Response frame for Get Hardware and Software Rev Command

2.2.8 Stop Measurement

Purpose：After stable test results is obtained, stop measurement activities.
MODBUS register 0x2E00 is used for this command.
Start address Number of registers MODBUS function code
0x2E00 0x01 0x03
Figure 44: Register definition of Stop Measurement Command
Below is an example of request and response frames for a device with slave address 0x01 to stop
measurement activities.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x2E 0x00 0x00 0x01 0x8D 0x22
Figure 45: Request frame to Stop Measurement Command
Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3~4 5 6
Value 0x01 0x03 0x00 meaningless
Figure 46: Response frame for Stop Measurement Command

2.2.9 Set pH Electrode Coefficients

Purpose: Recover pH factory calibration coefficients K1~K6.K1=6.86, K2=-6.72, K3=0.04, K4=6.86,
K5=-6.56, K6=-1.04 by default.
Customer coefficients can be set at 12 continuous MODBUS registers starting from address
0x2900.
Start address Number of Register 1-12 MODBUS function
registers code
0x2900 0x0C K1~K6 0x10
Figure 47: Register definition of Set pH Customer Calibration Coefficients Command
Below is an example of request and response frames for setting customer calibration coefficients,
assuming slave address is 0x01.
Definition Device Function Start Number of Number Register CRC
address code address registers of bytes value
Byte 0 1 2 3 4 5 6 7-30 15 16
Value 0x01 0x10 0x29 0x00 0x00 0x0C 0x18 K1~K6 0x94 0x59
Figure 48: Request frame to Set pH Customer Calibration Coefficients Command
Note: Coefficients K1~K6, floating point numbers in little-endian storage mode
K1(7~10) K2(11~14) K3(15~18) K4(19~22)
0x1f 0x85 0xdb 0x40 0x3d 0x0a 0xd7 0xc0 0x0a 0xd7 0x23 0x3d 0x1f 0x85 0xdb 0x40
K5(23~26) K6(27~30)
0x85 0xeb 0xd1 0xc0 0xb8 0x1e 0x85 0xbf
Figure 49: Registers for coefficients K1~K6
14 / 21
 Yantai Winmore Trade Co., Ltd.

Definition Device Function Start address Number of CRC

address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x29 0x00 0x00 0x0C 0xC8 0x50
Figure 50: Response frame for Set pH Customer Calibration Coefficients Command
2.2.10 Get pH Electrode Coefficients
Purpose: Get pH Customer Calibration Coefficients .
The Customer Calibration Coefficients can be read from 12 continuous MODBUS registers starting
from address 0x2900.
Start address Number of Register 1-12 MODBUS
registers function code
0x2900 0x0C k1~k6 0x03
Figure 51: Request frame to Get Customer Calibration Coefficients Command
Below is an example of request and response frames for getting Customer Calibration
Coefficients command, assuming slave device address is 0x01, returned Customer Calibration
Coefficients are K1=6.86,K2=-6.72,K3=0.04, K4=6.86,K5=-6.56,K6=-1.04 .
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x29 0x00 0x00 0x0C 0x4D 0x93
Figure 52: Request frame to Get Customer Calibration Coefficients Command
Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3-14 15-26 27 28
Value 0x01 0x03 0x0C k1~k3 k4~k6 0xAB 0xF5
Figure 53: Response frame for Get Customer Calibration Coefficients Command
K1(3~6) K2(7~10) K3(11~14) K4(15~18)
0x1f 0x85 0xdb 0x40 0x3d 0x0a 0xd7 0xc0 0x0a 0xd7 0x23 0x3d 0x1f 0x85 0xdb 0x40
K5(19~22) K6(23~26)
0x85 0xeb 0xd1 0xc0 0xb8 0x1e 0x85 0xbf
Figure 54: Registers definition for Customer Calibration Coefficients.

2.2.11 Get pH User Calibration Coefficients

Purpose: Get pH calibration coefficients K and B.
User calibration coefficients (K and B) can be read from 4 continuous MODBUS registers starting
from address 0x1100.

Start address Number of Register 1-2 Register 3-4 MODBUS function

registers code
0x1100 0x04 K B 0x03
Figure 55: Register definition of Get pH User Calibration Coefficients Command
Below is an example of request and response frames for getting customer calibration coefficients
from a device with slave address 0x01, assuming returned values are: K=1.0; B=0.0.

15 / 21
 Yantai Winmore Trade Co., Ltd.

Definition Device Function Start address Number of registers CRC

address code
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x11 0x00 0x00 0x04 0x41 0x35
Figure 56: Request frame to Get pH User Calibration Coefficient Command
Definition Device Function Number Register value CRC
address code of bytes
Byte 0 1 2 3-6 7-10 11 12
Value 0x01 0x03 0x08 1.0 0.0 0x9E 0x12
Figure 57: Response frame for Get pH User Calibration Coefficient Command
Note: K and B are floating point numbers in little-endian storage mode
K(3-6) B(7-10)
0x00 0x00 0x80 0x3F 0x00 0x00 0x00 0x00
Figure 58: Registers for two coefficients K and B.

2.2.12 Set pH User Calibration Coefficients

Purpose: Set pH calibration coefficients K and B.
Customer coefficients (K and B) can be set at 4 continuous MODBUS registers starting from
address 0x1100.
Start address Number of Register 1-2 Register 3-4 MODBUS function
registers code
0x1100 0x04 K B 0x10
Figure 59: Register definition of Set pH User Calibration Command
Below is an example of request and response frames for setting customer calibration coefficients,
assuming slave address is 0x01, coefficients are K=1.0 and B=0.0.
Definition Device Function Start Number of Number Register value CRC
address code address registers of bytes
Byte 0 1 2 3 4 5 6 7-10 11-14 15 16
Value 0x01 0x10 0x11 0x00 0x00 0x04 0x08 1.0 0.0 0x81 0xAE
Figure 60: Request frame to Set pH User Calibration Coefficient Command
Note: Coefficients K and B, floating point numbers in little-endian storage mode
K(7-10) B(11-14)
0x00 0x00 0x80 0x3F 0x00 0x00 0x00 0x00
Figure 61: Registers for two coefficients K and B
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x11 0x00 0x00 0x04 0Xc4 0xf6
Figure 62: Response frame for Set Customer Calibration Coefficient Command

2.2.13 Get NH4+ User Calibration Coefficients

Purpose: Get NH4+ calibration coefficients K and B.
User calibration coefficients (K and B) can be read from 4 continuous MODBUS registers starting

16 / 21
 Yantai Winmore Trade Co., Ltd.

from address 0x3600.

Start address Number of Register 1-2 Register 3-4 MODBUS function

registers code
0x3600 0x04 K B 0x03
Figure 63: Register definition of Get NH4+ User Calibration Coefficients Command
Below is an example of request and response frames for getting customer calibration coefficients
from a device with slave address 0x01, assuming returned values are: K=1.0; B=0.0.
Definition Device Function Start address Number of registers CRC
address code
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x36 0x00 0x00 0x04 0x4B 0x81
Figure 64: Request frame to Get NH4+ User Calibration Coefficient Command
Definition Device Function Number Register value CRC
address code of bytes
Byte 0 1 2 3-6 7-10 11 12
Value 0x01 0x03 0x08 1.0 0.0 0x9E 0x12
Figure 65: Response frame for Get NH4+ User Calibration Coefficient Command
Note: K and B are floating point numbers in little-endian storage mode
K(3-6) B(7-10)
0x00 0x00 0x80 0x3F 0x00 0x00 0x00 0x00
Figure 66: Registers for two coefficients K and B.

2.2.14 Set NH4+ User Calibration Coefficients

Purpose: Set NH4+ calibration coefficients K and B.
Customer coefficients (K and B) can be set at 4 continuous MODBUS registers starting from
address 0x3600.
Start address Number of Register 1-2 Register 3-4 MODBUS function
registers code
0x3600 0x04 K B 0x10
Figure 67: Register definition of Set NH4+ User Calibration Command
Below is an example of request and response frames for setting NH4+ customer calibration
coefficients, assuming slave address is 0x01, coefficients are K=1.0 and B=0.0.
Definition Device Function Start Number of Number Register value CRC
address code address registers of bytes
Byte 0 1 2 3 4 5 6 7-10 11-14 15 16
Value 0x01 0x10 0x36 0x00 0x00 0x04 0x08 1.0 0.0 0x81 0xAE
Figure 68: Request frame to Set NH4+ User Calibration Coefficient Command
Note: Coefficients K and B, floating point numbers in little-endian storage mode
K(7-10) B(11-14)
0x00 0x00 0x80 0x3F 0x00 0x00 0x00 0x00
Figure 69: Registers for two coefficients K and B

17 / 21
 Yantai Winmore Trade Co., Ltd.

Definition Device Function Start address Number of CRC

address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x36 0x00 0x00 0x04 0Xc4 0xf6
Figure 70: Response frame for Set Customer Calibration Coefficient Command

2.2.15 Get NH3-N User Calibration Coefficients

Purpose: Get NH3-N calibration coefficients K and B.
User calibration coefficients (K and B) can be read from 4 continuous MODBUS registers starting
from address 0x3400.
Start address Number of Register 1-2 Register 3-4 MODBUS function
registers code
0x3400 0x04 K B 0x03
Figure 71: Register definition of Get NH3-N User Calibration Coefficients Command
Below is an example of request and response frames for getting customer calibration coefficients
from a device with slave address 0x01, assuming returned values are: K=1.0; B=0.0.
Definition Device Function Start address Number of registers CRC
address code
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x34 0x00 0x00 0x04 0x4B 0x81
Figure 72: Request frame to Get NH3-N User Calibration Coefficient Command
Definition Device Function Number Register value CRC
address code of bytes
Byte 0 1 2 3-6 7-10 11 12
Value 0x01 0x03 0x08 1.0 0.0 0x9E 0x12
Figure 73: Response frame for Get NH3-N User Calibration Coefficient Command
Note: K and B are floating point numbers in little-endian storage mode
K(3-6) B(7-10)
0x00 0x00 0x80 0x3F 0x00 0x00 0x00 0x00
Figure 74: Registers for two coefficients K and B.

2.2.16 Set NH3-N User Calibration Coefficients

Purpose: Set NH3-N calibration coefficients K and B.
Customer coefficients (K and B) can be set at 4 continuous MODBUS registers starting from
address 0x3400.
Start address Number of Register 1-2 Register 3-4 MODBUS function
registers code
0x3400 0x04 K B 0x10
Figure 75: Register definition of Set NH3-N User Calibration Command
Below is an example of request and response frames for setting NH3-N customer calibration
coefficients, assuming slave address is 0x01, coefficients are K=1.0 and B=0.0.
Definition Device Function Start Number of Number Register value CRC
address code address registers of bytes

18 / 21
 Yantai Winmore Trade Co., Ltd.

Byte 0 1 2 3 4 5 6 7-10 11-14 15 16

Value 0x01 0x10 0x34 0x00 0x00 0x04 0x08 1.0 0.0 0x81 0xAE
Figure 76: Request frame to Set NH3-N User Calibration Coefficient Command
Note: Coefficients K and B, floating point numbers in little-endian storage mode
K(7-10) B(11-14)
0x00 0x00 0x80 0x3F 0x00 0x00 0x00 0x00
Figure 77: Registers for two coefficients K and B
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x34 0x00 0x00 0x04 0Xc4 0xf6
Figure 78: Response frame for Set Customer Calibration Coefficient Command

2.2.17 Active Brush

Purpose：Make brush rotate. It is strongly recommend that brush should be active once power
on.
MODBUS register 0x3100 is used.
Start address Number of registers MODBUS function code
0x3100 0x00 0x10
Figure 79: Register definition of active brush Command
Below is an example of request and response frames for a device with slave address 0x01 to
active brush.

Definition Device Function Start Number of Number CRC

address code address registers of bytes
Byte 0 1 2 3 4 5 6 7 8
Value 0x01 0x10 0x31 0x00 0x00 0x00 0x00 0x74 0x94
Figure 80: Request frame to Active brush Command
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x31 0x00 0x00 0x00 0Xce 0xf5
Figure 81: Response frame to Active brush Command
2.2.18 Set Brush Interval of time
Purpose：Set the interval of time for brush between each rotation, the unit is minute.
The interval of time can be set at 1 MODBUS registers starting from address 0x3200.
Start address Number of registers Register 1 MODBUS function code
0x3200 0x01 Interval of time(min) 0x10
Figure 82: Register definition of Set Brush Interval of time Command
Below is an example of request and response frames for setting brush interval of time,
assuming slave address is 0x01, time is 10min.
Definition Device Function Start Number of Number Register value CRC
address code address registers of bytes

19 / 21
 Yantai Winmore Trade Co., Ltd.

Byte 0 1 2 3 4 5 6 7 8 15 16
Value 0x01 0x10 0x32 0x00 0x00 0x01 0x02 0x0a 0x00 0xb3 0x33
Figure 83: Request frame to Set Brush Interval of time Command
Note: Time in little-endian storage mode
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x32 0x00 0x00 0x01 0x0f 0x71
Figure 84: Response frame to Set Brush Interval of time Command
2.2.19 Get Brush Interval of time
Purpose：Get the interval of time for brush between each rotation, default time is 30 min.
The interval of time can be read from 1 MODBUS registers starting from address 0x3200.
Start address Number of registers Register 1 MODBUS function code
0x3200 0x01 Interval of time(min) 0x03
Figure 85: Register definition of Get Brush Interval of time Command
Below is an example of request and response frames for getting brush interval of time from a
device with slave address 0x01, assuming returned time is 30min.
Definition Device Function Start address Number of registers CRC
address code
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x32 0x00 0x00 0x01 0x8a 0xb2
Figure 86: Request frame to Get Brush Interval of time Command

Definition Device Function Number Register value CRC

address code of bytes
Byte 0 1 2 3 4 5 6
Value 0x01 0x03 0x02 0x1E 0x00 0xb1 0xe4
Figure 87: Response frame to Get Brush Interval of time Command
2.2.20 Get Slave Device ID
Purpose: Get current MODBUS slave address to a sensor probe. Use 0xFF as fixed Device address.
Sensor probe slave address can be read from MODBUS registers 0x3000.
Start address Number of registers Register 1 MODBUS Function code
0x3000 0x01 Current Slave address 0x10
Figure 88: Get slave ID command
Below is an example of request and response frames for getting slave device id, assuming
returned address is 0x03.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0xFF 0x03 0x30 0x00 0x00 0x01 0x9E 0xD4
Figure 89: Request frame of get slave device ID comment
Definition Device Function Number of Register value CRC
address code bytes

20 / 21
 Yantai Winmore Trade Co., Ltd.

Byte 0 1 2 3 4 5 6
Value 0xFF 0x03 0x02 0x03 0x00(reserve) 0x91 0x60
Figure 90: Response frame of get slave device ID comment

3 Procedure to get NH3-N value

Procedures Command

Start brush active Start brush

Delay>=20s

Get Temperature and NH3-N Get Temperature and

NH3-N values

More than 10 N
Delay 2S
times?

Display and other Process

Figure 91：Flow chart to get NH3-N measurement

 Start brush active – make the brush active once power on , then the brush will work at the
set interval time.
 Get temperature and NH3-N values – Get measurement results including temperature (C)
and NH3-N (mg/L) after 20 seconds of brush active.
Note: Please pay attention to highlighted portion (red) in the flow chart above. It’s highly
recommended that customers get an average NH3-N results after 10 consecutive
measurements, then perform display or other process.

21 / 21