[0]FA — start
[1]27 — total=39
[2–3]Device address
[4]C9 cmd echo
[5–6]LD uint16 BE
[7–8]PD uint16 BE
[9–10]Reserved (2B)
[11–12]AD4+AD7
[13–14]AD8
[15–16]0x00+AD5
[17–18]0x00+AD6
[19–20]EnvTemp uint16 BE ★
[21–24]Reserved (4B) configurable
[25–28]Soot float32 BE ★
[29–32]Flow float32 BE
[33–34]Loop×100 uint16 BE ★
[35–36]Reserved (2B)
[37]CHK = Σ[1..36]&FF ★
[38]F5 — end
How it works:
On RS232 full-duplex, every TX byte echoes back on RX.
Without cancel:
RX sees: FA 00 0F C9 FF 00 D1 FA 27 00 0F…
Parser gets confused by own echo.
With cancel:
TX echo stripped from RX buffer.
Vendor SW receives clean response.
0xC9 Return test results (39B)
0x98 Read system params (63B)
0xCE 0x97 0x8C 0x9E
0xA5 0x9D 0x9A 0xCF 0xD0
↑ All return 11B stub ACK