Yantai Winmore Trade Co., Ltd.

COD Sensor

MODBUS RTU Manual

1 / 18
 Yantai Winmore Trade Co., Ltd.

Table of Contents
1 MODBUS RTU Overview..................................................................................................... 3
1.1 Scope................................................................................................................................ 3
1.2 MODBUS Command Structure.........................................................................................3
1.3 MODBUS RTU for WINMORE’s Optical COD Sensor........................................................ 5
1.4 MODBUS RTU Function Code for WINMORE’s Optical COD Sensor............................... 5
1.5 Data formats in optical COD sensor.................................................................................7
2 MODBUS RTU Commands for Optical COD Sensor.......................................................... 10
2.1 Overview........................................................................................................................ 10
2.2 Command Description................................................................................................... 10
3 Procedure to get COD value............................................................................................. 17

2 / 18
 Yantai Winmore Trade Co., Ltd.

1 MODBUS RTU Overview

1.1 Scope

This document is about MODBUS of optical COD probes with hardware Rev1.0 and software
Rev1.5 or later. This document is intended for software programmers with detailed information
about MODBUS RTU protocols.

1.2 MODBUS Command Structure

Data format in this document:

----Binary number – shown with suffix B. For example: 10001B
----Decimal number – without nay suffix. For example: 256
----Hexadecimal number—shown with prefix 0x. For example: 0x2A
1.2.1 Command Structure
MODBUS defines a simple protocol data unit (PDU), which is transparent to communication layer.

Figure 1: MODBUS Protocol Data Unit

The mapping of MODBUS protocol on a specific bus or network introduces some additional fields
on the Protocol Data Unit. The client that initiates a MODBUS transaction builds the MODBUS
PDU, and then adds fields in order to build the appropriate communication PDU.

Figure 2: MODBUS Structure for Serial Communication

On a MODBUS serial bus, address field only includes addresses for slave devices.
Note:
 Slave address range for optical COD sensor is: 1…247
 Master device sends a “request frame” with a targeted slave address. When slave device
responses, it has to put its own address in the “response frame”, so that master device
knows where the response comes from.
 Function code indicates type of operations
 CRC is the result of redundancy check.

1.2.2 MODBUS RTU Transmission Mode

3 / 18
 Yantai Winmore Trade Co., Ltd.

When devices communicate on a MODBUS using RTU (remote terminal unit) mode, each 8-bit
byte message contains two 4-bit hexadecimal characters. The main advantage of the RTU mode is
that it has higher character density, which enables better throughput compare to ASCII mode at
same baud rate. Each RTU message must be transmitted in a continuous string of characters.
RTU mode format for each byte (11 bits):
Encoding system 8 bit binary
Each 8-bit packet contains 4-bit hexadecimal characters (0-9, A-F)
Bit per byte: 1 start bit
8 data bits, least significant bit first
No parity check
1 stop bits
Baud rate: 9600bps
Serial transmission of characters:
Every character or byte is sent under this sequence (left to right):
Least Significant Bit (LSB)……Most Significant Bit(MSB)
Start 1 2 3 4 5 6 7 8 Stop
Figure 3: RTU Mode Bit Sequence
CRC Field Structure:
Redundancy check (CRC16)
Frame Structure:
Slave address Function Code Data CRC
2 bytes
1 byte 1 byte 0…252 bytes
CRC Low CRC High
Figure 4: RTU Message Frame Structure
Maximum size of MODBUS frame is 256 bytes.
1.2.3 MODBUS RTU Message Frame
In RTU mode, message frames need to be separated by an idle interval of at least 3.5 character
lengths. In rest of this document, this idle interval is called t3.5.

Figure 5: RTU Message Frame

Entire message frame must be sent as continuous stream of characters.
If idle time between two characters is longer than 1.5 characters, the message frame will be
considered incomplete, and will be discarded by receiving side.

4 / 18
 Yantai Winmore Trade Co., Ltd.

Figure 6: Frame transmission

1.2.4 MODBUS RTU CRC Check
In RTU mode, the error checking field is based on a cyclical redundant checking (CRC) method.
The CRC field checks entire content of MODBUS message, regardless of the existence of parity
check bit. CRC16 checking method is utilized. CRC result is a 16-bit value with two 8-bit bytes, low
order 8-bit byte first followed by high order 8-bit byte.

1.3 MODBUS RTU for WINMORE’s Optical COD Sensor

Based on standard MODBUS definition, message frame starts with t3.5 idle interval, and similarly,
ends with t3.5 idle interval. Device address and Function code are both 8-bit byte. Data character
string has n*8 bits, it contains information about register start/end address and number of
registers for read/write operation. CRC field is 16 bit in length.
Start Device Function Data CRC End
address code
Value Idle for 3.5 1-247 Comply Comply CRC CRC Idle for 3.5
character with with Low High character
length MODBUS MODBUS length
function data
code format format
Length 3.5 1 1 n 1 1 3.5
(byte)
Figure 7: Message frame structure for Winmore’s MODBUS

1.4 MODBUS RTU Function Code for WINMORE’s

Optical COD Sensor

Winmore’s optical COD sensor has two MODBUS function codes:

0x03: Read registers 0x10： Write registers
1.4.1 MODBUS Function Code 0x03: Read Registers
This function code is to read a block of continuous registers from a remote device. Request PDU
defines start address and number of registers for the read operation. Register addressing starts
from 0. Therefore, addresses for register 1-16 are 0-15. Data for each register in Response
message have two bytes. For each register data, first byte is for high bits, and second byte for low
bits.

5 / 18
 Yantai Winmore Trade Co., Ltd.

Request Frame:
Function code 1 Byte 0x03
Start address 2 Bytes 0x0000….0xfffff
Number of registers 2 Bytes 1…125
Figure 8: Request frame for read registers
Response Frame:
Function code 1 byte 0x03
Number of byte 1 byte N×2
Register data N×2 bytes
N = number of registers
Figure 9: Response frame for read registers
Below is an example of Request and Response frames (Read register 108-110. Register 108 is read
only with 2-byte value of 0X022B. Registers 109-110 have values of 0X0000 and 0X0064).
Request Frame Response Frame
Data format Hexadecimal Data Format Hexadecimal
Function code 0x03 Function code 0x03
Start address(high bits) 0x00 Number of bytes 0x06
Start address (low bits) 0x6B Register value (high bits, 108) 0x02
Number of registers (high bits) 0x00 Register value (low bits, 108) 0x2B
Number of registers (low bits) 0x03 Register value (high bits, 109) 0x00
Register value (low bits, 109) 0x00
Register value (high bits, 110) 0x00
Register value (low bits, 110) 0x64
Figure 10: Example of request frame and response frame for read operation
1.4.2 MODBUS Function Code 0x10: Write Registers
This function code is to write a block of continuous registers at a remote device. Request frame
contains register data. Each register data have two character bytes. Response frame contains
function code, start address, and number of registers that completed write operation.
Request Frame:
Function code 1 byte 0x10
Start address 2 bytes 0x0000….0xffff
Number of registers 2 bytes 0x0001….0x0078
Number of bytes 1 byte N×2
Register data N×2 bytes value
N = number of registers
Figure 11: Request frame for write operation
Response Frame:
Function Code 1 byte 0x10
Start address 2 bytes 0x0000….0xffff
Number of registers 2 bytes 1…123(0x7B)
N = number of registers
Figure 12: Response frame for write operation
Below is an example of Request Frame and Response frame (write 0x000A and 0x0102 to two

6 / 18
 Yantai Winmore Trade Co., Ltd.

registers starting from address 2):

Request Frame Response Frame
Data Format Hexadecimal Data Format Hexadecimal
Function code 0x10 Function code 0x10
Start address (high bits) 0x00 Start address (high bits) 0x00
Start address (low bits) 0x01 Start address (low bits) 0x01
Number of registers (high bits) 0x00 Number of registers (high bits) 0x00
Number of registers (low bits) 0x02 Number of registers (low bits) 0x02
Number of bytes 0x04
Register value (high bits) 0x00
Register value (low bits) 0x0A
Register value (high bits) 0x01
Register value (low bits) 0x02
Figure 13: Example of Request frame and response frame for write operation

1.5 Data formats in optical COD sensor

1.5.1 Floating-point number

Definition: floating point number, comply with IEEE754 (single precision)
Note Sign Exponent Fraction Total
bit 31 30…23 22…0 32
Exponent deviation 127
Figure 14: Single floating point number definition (4 bytes, 2 MODBUS registers)
Example: Convert decimal number 17.625 to binary number
Step 1: Convert decimal number 17.625 to a floating point number with binary format
First, convert integer to binary
17decimal = 16 + 1 = 1×24 + 0×23 + 0×22 + 0×21 + 1×20
Thus, integer 17 in binary format is 10001B
Then convert decimal part to binary
0.625decimal = 0.5 + 0.125 = 1×2-1 + 0×2-2 + 1×2-3
Thus, 0.625 in binary format is 0.101B
Combine above together, 17.625 in binary format is 10001.010B
Step 2: Calculate exponent
Left shift the binary number 10001.010B until only bit left before the decimal point ---
10001.101B = 1.0001101 B× 24, so exponent value is 4. By adding 127, we have 131, which
is 10000011B in binary format
Step 3: Get fraction
Fraction is simply the number after decimal point. Thus from 1.0001101B, fraction
number is 0001101B. IMPORTANT NOTE about the 23 bit fraction number: the first bit
which on the left side of decimal point is hidden bit and does not need to be compiled.
Step 4: Sign definition
Sign bit is 0 if the number is positive. Sign is 1 if the number is negative. For 17.625,
sign 17.625, sign bit is 0.
7 / 18
 Yantai Winmore Trade Co., Ltd.

Step 5: Convert to floating point number

1 Sign bit + 8-bit exponent + 23-bit fraction
0 10000011 00011010000000000000000B
(Corresponding hexadecimal number is 0x418D0000)

Sample code:
1. If your compiler has similar library functions, it can be called directly. For example if C
language is used, we can directly call memcpy() function in C library to convert floating point
number. Sample code:
float floatdata;//floating point data to be converted
void* outdata;
memcpy(outdata,&floatdata,4);

If floatdata=17.625,
In little-endian storage mode after the function is called:
Value at address of outdata is 0x00
Value at address of (outdata+1) is 0x00
Value at address of (outdata+2) is 0x8D
Value at address of (outdata+3) is 0x41
In big-endian storage mode after the function is called:
Value at address of outdata is 0x41
Value at address of (outdata+1) is 0x8D
Value at address of (outdata+2) is 0x00
Value at address of (outdata+3) is 0x00

2. If your complier doesn’t have the conversion function, then the following function can be
used:
void memcpy(void *dest,void *src,int n)
{
char *pd = (char *)dest;
char *ps = (char *)src;
for(int i=0;i<n;i++) *pd++ = *ps++;
}
Then you can get same result by calling this function memcpy(outdata,&floatdata,4);

Example: Convert binary floating point number 0100 0010 0111 1011 0110 0110 0110 0110B to a
decimal number
Step 1: Separate this binary number 0100 0010 0111 1011 0110 0110 0110 0110B and get values
of Sign , exponent and fraction.
0 10000100 11110110110011001100110B
1 Sign bit 8-bit exponent 23-bit fraction

Sign bit(s): 0
Exponent(E):10000100B=1×27+0×26+0×25+0×24+0×23+1×22+0×21+0×20
=128+0+0+0+0+4+0+0=132
8 / 18
 Yantai Winmore Trade Co., Ltd.

Fraction(M)：11110110110011001100110B =8087142
Step 2: Calculate decimal value
D = (-1)S×(1.0+M/223)×2E-127
= (-1)0×(1.0+8087142/223)×2132-127
= 1×1.964062452316284×32
= 62.85

Reference code:
float floatTOdecimal(long int byte0, long int byte1, long int byte2, long int byte3)
{
long int realbyte0,realbyte1,realbyte2,realbyte3;
char S;
long int E,M;
float D;
realbyte0 = byte3;
realbyte1 = byte2;
realbyte2 = byte1;
realbyte3 = byte0;

if((realbyte0&0x80)==0)
{
S = 0; //Positive
}
else
{
S = 1; //Negative
}
E = ((realbyte0<<1)|(realbyte1&0x80)>>7)-127;
M = ((realbyte1&0x7f) << 16) | (realbyte2<< 8)| realbyte3;
D = pow(-1,S)*(1.0 + M/pow(2,23))* pow(2,E);
return D;
}
Note:
 Function parameters byte0, byte1, byte2 and byte3 represent the 4 sections of a binary
floating number.
 Return value is value of decimal number after conversion

For example when a command is sent to a sensor to get temperature value, response frame from
the sensor will have measured temperature. If the values are 4 byte floating point number
0x00,0x00,0x8d,0x41, then the following function can be used to get temperature in decimal
value:
float temperature = floatTOdecimal( 0x00, 0x00, 0x8d, 0x41);
and temperature = 17.625.

9 / 18
 Yantai Winmore Trade Co., Ltd.

2 MODBUS RTU Commands for Optical

COD Sensor

2.1 Overview

In order to communicate with optical COD probe via MODBUS RTU, master terminal software will
be needed. MODBUS RTU is an open standard. There are free commercial software tools
available. For applications described in this document, MODBUS register address starts from 1.
However, slave address in MODBUS protocol starts from 0, and usually master software compiles
addresses. For example, register address 2090 will be compiled by master software as address
2089.

2.2 Command Description

2.2.1 Set Slave Device ID

Purpose: Set MODBUS slave address to a sensor probe. Range of address is 1~247.
Sensor probe slave address can be set via MODBUS register 0x3000:
Start address Number of registers Register 1 MODBUS Function code
0x3000 0x01 New Slave address 0x10
Figure 15: Register definition of Set Slave ID Command
Below is an example of request and response frames for setting slave device ID command. Old
slave address is 0x01, new address is 0x14.
Definition Address Function Start Number of Number Register CRC
code address registers of byte value
Byte 0 1 2 3 4 5 6 7 8 9 10
Value 0x01 0x10 0x30 0x00 0x00 0x01 0x02 0x14 0x00 0x99 0x53
Figure 16: Request frame to Set Slave ID
*Note: byte 8 is reserved
Definition Address Function code Start address Number of registers CRC
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x30 0x00 0x00 0x01 0x0E 0xC9
Figure 17: Response frame for Set Slave ID Command

2.2.2 Start Measurement

Purpose ： Set probe in continuous light emitting mode and start measuring COD. MODBUS
register 0x2500 is used. The Probe starts in auto-measure mode by default.
Starting address Number of registers MODBUS Function code
0x2500 0x01 0x03
Figure 18: Register definition of Start Measurement Command

10 / 18
 Yantai Winmore Trade Co., Ltd.

Below is an example of request and response frames for sending a Start Measurement command
to a device with slave address 0x01.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x25 0x00 0x00 0x01 0x8F 0x06
Figure 19: Request frame to Start Measurement Comment
Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3~4 5 6
Value 0x01 0x03 0x00 meaningless
Figure 20: Response frame for Start Measurement Command
2.2.3 Get Temperature and COD values
Purpose ： Get temperature and COD/TOC measurement results. Temperature unit is Celsius
degree (  C), COD/TOC unit is mg/L. User calibration process is automatically applied to
COD/TOC value.
Get Temperature :
SEND：
Definition Device Function Start address Number of registers CRC
address code
Byte 0 1 2 3 4 5 6 7
Value 0X01 0X03 0X26 0X00 0X00 0X02 0XC7 0X43
RECIEVE：
Definition Device Function Number TEMPERATURE○
1 CRC
address code of bytes
Byte 0 1 2 3~4 5~6 7 8
Value 0X01 0X03 0X04 0X00 0X00 0X00 0X00 0XFA 0X5F

Get COD：
SEND:
Definition Device Function Start address Number of registers CRC
address code
Byte 0 1 2 3 4 5 6 7
Value 0X01 0X03 0X26 0X02 0X00 0X02 0X 6E 0X83
RECIEVE:
Definition Device Function Number COD○
1 CRC
address code of bytes
Byte 0 1 2 3~4 5~6 7 8
Value 0X01 0X03 0X04 0X00 0X00 0X00 0X00 0XFA 0X5F

Get TOC：
SEND:
Definition Device Function Start address Number of registers CRC

11 / 18
 Yantai Winmore Trade Co., Ltd.

address code
Byte 0 1 2 3 4 5 6 7
Value 0X01 0X03 0X26 0X06 0X00 0X02 0X C7 0XE8
RECEIVE:
Definition Device Function Number TOC○
1 CRC
address code of bytes
Byte 0 1 2 3~4 5~6 7 8
Value 0X01 0X03 0X04 0X00 0X00 0X00 0X00 0XFA 0X5F
1 :
○ Floating point numbers are stored in little endian mode

2.2.4 Get Software and Hardware Rev

Purpose: Get current hardware and software Release Version
Hardware and software release version numbers of a sensor probe can be read from 2
continuous registers starting from address 0x0700.
Start address Number Register 1 Register 2 MODBUS function
registers code
0x0700 0x02 HW Rev SW Rev 0x03
Figure 21: Register definition for Get Software and Hardware Rev Command
Below is an example of request and response frames for getting hardware and software release
version, assuming device slave address is 0x01, returned value for hardware Rev is 1.0 and
software rev is 1.0.
Definition Device Function Start address Number of registers CRC
address code
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x07 0x00 0x00 0x02 0xc5 0x7f
Figure 22: Request frame to Get Hardware and Software Rev Command
Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3-4 5-6 7 8
Value 0x01 0x03 0x04 0x01 0x00 0x01 0x00 0xfa 0x5f
Figure 23: Response frame for Get Hardware and Software Rev Command
2.2.5 Stop Measurement
Purpose：After stable test results is obtained, stop measurement activities. If measurement need
to start again , use command Start Measurement.
MODBUS register 0x2E00 is used for this command.
Start address Number of registers MODBUS function code
0x2E00 0x01 0x03
Figure 24: Register definition of Stop Measurement Command
Below is an example of request and response frames for a device with slave address 0x01 to stop
measurement activities.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7

12 / 18
 Yantai Winmore Trade Co., Ltd.

Value 0x01 0x03 0x2E 0x00 0x00 0x01 0x8D 0x22

Figure 25: Request frame to Stop Measurement Command
Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3~4 5 6
Value 0x01 0x03 0x00 meaningless
Figure 26: Response frame for Stop Measurement Command

2.2.6 Get User Calibration Coefficients

Purpose: Get two calibration coefficients K and B. (This is to eliminate measurement errors
caused by aging or other reasons. User calibration equation is: Turfinal=K*Tur +B; default values
are: K=1; B=0)
User calibration coefficients (K and B) can be read from 4 continuous MODBUS registers starting
from address 0x1100.
Start address Number of Register 1-2 Register 3-4 MODBUS function
registers code
0x1100 0x04 K B 0x03
Figure 27: Register definition of Get User Calibration Coefficients Command
Below is an example of request and response frames for getting customer calibration coefficients
from a device with slave address 0x01, assuming returned values are: K=1.0; B=0.0.
Definition Device Function Start address Number of registers CRC
address code
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x11 0x00 0x00 0x04 0x41 0x35
Figure 28: Request frame to Get Customer Calibration Coefficient Command
Definition Device Function Number Register value CRC
address code of bytes
Byte 0 1 2 3-6 7-10 11 12
Value 0x01 0x03 0x08 1.0 0.0 0x9E 0x12
Figure 29: Response frame for Get Customer Calibration Coefficient Command
Note: K and B are floating point numbers in little-endian storage mode

K(3-6) B(7-10)
0x00 0x00 0x80 0x3F 0x00 0x00 0x00 0x00
Figure 30: Registers for two coefficients K and B.
2.2.7 Set Customer Calibration Coefficients
Purpose: Set two calibration coefficients K and B.
Customer coefficients (K and B) can be set at 4 continuous MODBUS registers starting from
address 0x1100.
Start address Number of Register 1-2 Register 3-4 MODBUS function
registers code
0x1100 0x04 K B 0x10
Figure 31: Register definition of Set Customer Calibration Command
Below is an example of request and response frames for setting customer calibration coefficients,
13 / 18
 Yantai Winmore Trade Co., Ltd.

assuming slave address is 0x01, coefficients are K=1.0 and B=0.0.

Definition Device Function Start Number of Number Register value CRC
address code address registers of bytes
Byte 0 1 2 3 4 5 6 7-10 11-14 15 16
Value 0x01 0x10 0x11 0x00 0x00 0x04 0x08 1.0 0.0 0x81 0xAE
Figure 32: Request frame to Set Customer Calibration Coefficient Command
Note: Coefficients K and B, floating point numbers in little-endian storage mode
K(7-10) B(11-14)
0x00 0x00 0x80 0x3F 0x00 0x00 0x00 0x00
Figure 33: Registers for two coefficients K and B
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x11 0x00 0x00 0x04 0Xc4 0xf6
Figure 34: Response frame for Set Customer Calibration Coefficient Command
2.2.8 Active Brush
Purpose：Make brush rotate.
MODBUS register 0x3100 is used.
Start address Number of registers MODBUS function code
0x3100 0x00 0x10
Figure 35: Register definition of active brush Command
Below is an example of request and response frames for a device with slave address 0x01 to
active brush.

Definition Device Function Start Number of Number CRC

address code address registers of bytes
Byte 0 1 2 3 4 5 6 7 8
Value 0x01 0x10 0x31 0x00 0x00 0x00 0x00 0x74 0x94
Figure 36: Request frame to Active brush Command
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x31 0x00 0x00 0x00 0Xce 0xf5
Figure 37: Response frame to Active brush Command
2.2.9 Set Brush Interval of time
Purpose：Set the interval of time for brush between each rotation, the unit is minute.
The interval of time can be set at 1 MODBUS registers starting from address 0x3200.
Start address Number of registers Register 1 MODBUS function code
0x3200 0x01 Interval of time(min) 0x10
Figure 38: Register definition of Set Brush Interval of time Command
Below is an example of request and response frames for setting brush interval of time,
assuming slave address is 0x01, time is 10min.
Definition Device Function Start Number of Number Register value CRC

14 / 18
 Yantai Winmore Trade Co., Ltd.

address code address registers of bytes

Byte 0 1 2 3 4 5 6 7 8 15 16
Value 0x01 0x10 0x32 0x00 0x00 0x01 0x02 0x0a 0x00 0xb3 0x33
Figure 39: Request frame to Set Brush Interval of time Command
Note: Time in little-endian storage mode
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x10 0x32 0x00 0x00 0x01 0x0f 0x71
Figure 40: Response frame to Set Brush Interval of time Command
2.2.10 Get Brush Interval of time
Purpose：Get the interval of time for brush between each rotation, default time is 30 min.
The interval of time can be read from 1 MODBUS registers starting from address 0x3200.
Start address Number of registers Register 1 MODBUS function code
0x3200 0x01 Interval of time(min) 0x03
Figure 41: Register definition of Get Brush Interval of time Command
Below is an example of request and response frames for getting brush interval of time from a
device with slave address 0x01, assuming returned time is 30min.
Definition Device Function Start address Number of registers CRC
address code
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x32 0x00 0x00 0x01 0x8a 0xb2
Figure 42: Request frame to Get Brush Interval of time Command

Definition Device Function Number Register value CRC

address code of bytes
Byte 0 1 2 3 4 5 6
Value 0x01 0x03 0x02 0x1E 0x00 0xb1 0xe4
Figure 43: Response frame to Get Brush Interval of time Command

2.2.11 Get Slave Device ID

Purpose: Get current MODBUS slave address to a sensor probe. Use 0xFF as fixed Device address.
Sensor probe slave address can be read from MODBUS registers 0x3000.
Start address Number of registers Register 1 MODBUS Function code
0x3000 0x01 Current Slave address 0x10
Figure 44: Get slave ID command
Below is an example of request and response frames for getting slave device id, assuming
returned address is 0x03.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0xFF 0x03 0x30 0x00 0x00 0x01 0x9E 0xD4

15 / 18
 Yantai Winmore Trade Co., Ltd.

Figure 45: Request frame of get slave device ID comment

Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3 4 5 6
Value 0xFF 0x03 0x02 0x03 0x00(reserve) 0x91 0x60
Figure 46: Response frame of get slave device ID comment

2.2.12 Get Turbidity values

Purpose ： Get Turbidity measurement results. Turbidity unit is NTU. User calibration process is
automatically applied to Turbidity value.
Turbidity data can be read from 2 continuous MODBUS registers starting from address 0x1200.
Start address Number of Register 1-2 MODBUS
registers function code
0x1200 0x02 Turbidity value 0x03
Figure 47: Register definition of Get Turbidity Command
Below is an example of request and response frames for getting Turbidity command, assuming
slave device address is 0x01, returned Turbidity value is 17.625NTU.
Definition Device Function Start address Number of CRC
address code registers
Byte 0 1 2 3 4 5 6 7
Value 0x01 0x03 0x12 0x00 0x00 0x02
Figure 48: Request frame to Get Turbidity Command
Definition Device Function Number of Register value CRC
address code bytes
Byte 0 1 2 3-6 7 8
Value 0x01 0x03 0x04 17.625
Figure 49: Response frame for Get Turbidity Command

2.2.13 Set Brush work mode

Purpose：Set brush work mode: Auto Run or NON-Auto Run when power on. The default mode is
Auto Run.
The mode can be set at 1 MODBUS registers starting from address 0x1b00.
Start address Number of registers Register 1 MODBUS function code
0x1b00 0x01 brush work mode 0x10
Figure 50: Register definition of Set brush work mode Command
Below is an example of request and response frames for setting brush Auto Run when power on,
assuming slave address is 0x01.
Definition Device Function Start Number of Number Register value CRC
address code address registers of bytes
Byte 0 1 2 3 4 5 6 7 8 15 16
Value 0x01 0x10 0x1b 0x00 0x00 0x01 0x02 0x01 0x00
Figure 51: Request frame to Set brush work mode Command
Wiper Auto Run Wiper NON-Auto Run（Need command2.2.9 Active Brush）

16 / 18
 Yantai Winmore Trade Co., Ltd.

01 00
Figure52: The definition of brush work mode
2.2.14 Get Brush work mode
Purpose：Get brush work mode.
The mode can be read from 1 MODBUS registers starting from address 0x1b00.
Start address Number of registers Register 1 MODBUS function code
0x1b00 0x01 brush work mode 0x03
Figure53: Register definition of Get brush work mode Command

3 Procedure to get COD value

Procedures Command

Power On

Delay>=2s

Get Temperature and COD Get Temperature and

COD values

More than 10 N
Delay 2S
times?

Display and other Process

Figure 43：Flow chart to get COD measurement

 Start Measurement – sensor probe start emitting LED light, and perform COD
measurement with automatic calibration.
 Get temperature and COD values – Get measurement results including temperature (  C)
and COD (mg/L) after 2 seconds of measurements.
Note: Please pay attention to highlighted portion (red) in the flow chart above. It’s highly
17 / 18
 Yantai Winmore Trade Co., Ltd.

recommended that customers get an average COD results after 10 consecutive

measurements, then perform display or other process.

18 / 18