The device im trying to hack is the "Digital Gateway" used to attach sensors to a "Hach SC200". On the main PCB of the SC200 I found 2 RS485 chips ADM3483ARZ which confirms my initial thoughts on the physical layer.

I have no futher info on the actual gateway as its a solid epoxy block and these devices are NOT CHEAP so destructive hacking is not an option.

The through the gateway we get temperature and PH/ORP readings among other setup config testing infos. There is a complete modbus map available for the gateway/sensor which a normal user would use while talking to it THROUGH the SC200 which has an additional Optional modbus card (which i have).

https://www.hach.com/digital-3-4-inch-combination-ph-orp-sensor-convertible-style-ryton-body-material-general-purpose-glass-ph-electrode-type-temperature-compensation-none/product-downloads?id=7640010699

The manual is on the link above and it includes the modbus register map.

Now to be clear: the gateway does not speak in modbus to the sc200.

Im trying to AVOID using the SC200 and talk to the gateway directly.