The device im trying to hack is the "Digital Gateway" used to attach sensors to a "Hach SC200". On the main PCB of the SC200 I found 2 RS485 chips ADM3483ARZ which confirms my initial thoughts on the physical layer.
I have no futher info on the actual gateway as its a solid epoxy block and these devices are NOT CHEAP so destructive hacking is not an option.
The through the gateway we get temperature and PH/ORP readings among other setup config testing infos. There is a complete modbus map available for the gateway/sensor which a normal user would use while talking to it THROUGH the SC200 which has an additional Optional modbus card (which i have).
The manual is on the link above and it includes the modbus register map.
Now to be clear: the gateway does not speak in modbus to the sc200.
Im trying to AVOID using the SC200 and talk to the gateway directly.