Code 03 - Read Output Registers; Figure 2-10 Read Output Register Example - Request; Figure 2-11 Read Output Register Example - Response - Siemens SIMATIC TI505 User Manual

Modbus Function Descriptions (continued)
Code 03 — Read
Output Registers
2-12 Modbus Commands
Code 03 allows you to read the contents of holding registers in the attached
secondary device. The data field of this command includes the start address
of the registers and the number of registers to be read.
Addressing is sequential up to the maximum memory size for a particular
PLC. The maximum number of registers that can be addressed with one
command is 125. If more are requested, the whole command will be rejected
with an Exception code 03.
[This command is equivalent to issuing a TIWAY I Primitive 20 request with
a TT-type 01 (Variable Memory)].
Example:
Request: 07 03 0064 0003 XXXX
Figure 2-10 Read Output Register Example — Request
This request is for secondary address 7 to read the contents of registers
0064, 0065, and 0066 (100, 101, and 102 decimal).
Response: 07 03 06 032C 0001 0030 XXXX
Figure 2-11 Read Output Register Example — Response
The response has returned the number of bytes of data (06) and the values
for the requested registers; these are 032C, 0001, and 0030 respectively
(812, 1, and 48 decimal).
Checksum (XXXX)
Number of registers (0003)
Address of first register (0064)
Function code (03)
Slave address (07)
Checksum (XXXX)
3rd register value (0030)
2nd register value (0001)
1st register value (032C)
Number of bytes (06)
Function code (03)
Slave address (07)
SIMATIC TI505/TI500 MODNIM User Manual