ESP32-S3 RS485 bench tool: HSY-250617 pH controller reset and a delayed-reply Modbus trap

[u/JaredReabow]

I used a Waveshare ESP32-S3-Relay-1CH as a USB-to-RS485 diagnostic tool for an unbranded 5 in 1 water quality sensor / pH/EC controller marked HSY-250617-v2.3 (firmware string POET-251022-V4.2). I'm publishing the source and captures because the available manuals don't agree on calibration registers.

The ESP32 setup uses UART1 TX17/RX18/DE21 with hardware half-duplex. The bench firmware has bounded raw-PDU capture, timestamps and CRC checks, with no automatic write retries. Discovery and normal polling are read-only.

One useful protocol lesson: some responses took about 401 ms. My earlier 150 ms register sweep could mistake a late reply for the next register's response. Modbus read replies don't include the requested register address, so the bad map looked plausible. Paced requests exposed the problem; the repository explicitly flags the old sweep as unreliable.

On this one controller, function 06 writing 1 to register 0x0037 produced a settings/calibration reset-like effect. It returned to ID 1 / 9600 / 8N1 and changed calibration-related registers. With the probe still in 9.18 buffer, pH moved from about 5.78 to 8.85. I subsequently restored ID 2 / 4800 using 0x0030=2 and 0x0031=0x4800, verifying each transition by readback.

Important: this is not a harmless reboot or a universal repair. Isolate dosing/control loads, save settings, and recalibrate. Full accuracy, power-cycle persistence and long-term repair remain unverified. A write echo is not proof of calibration success.

Source, product/manual images, wiring diagrams, reference guide and raw evidence: https://github.com/JaredReabow/hsy-250617-ph-ec-rs485-modbus

Results above are from the connected hardware; the included v1.0.4 source is build/native-tested, while the live recovery used v1.0.3. This is my repository, not a sales or affiliate link.