I know nothing about Siemens specifics as a Modbus master (like where you put the data after you read it), but I can comment on Modbus slaves in general.
1) Function codes
The function code used depends on the slave.
Function code 04 reads input registers
Function code 03 reads holding registers.
In some slaves, those are identical. Some slaves only implement holding registers. The difference might be a input register is the raw counts of an analog value, whereas the holding register is the scaled value conversion, for instance, to temperature in degrees C.
Slave documentation almost always states which function codes are supported.
2) (4)xxxx
The leading numeral in the address is not part of the Modbus message, it's there to identify the type of memory.
3xxxx is data in input registers
4xxxx is data in holding registers
Why the 04 function code addresses 3xxxx and the 03 function code addresses the 4xxxx memory is a mystery.
I put the leading numeral in parentheses, for example (4)0108, to set it apart from the indexed offset that is the functional addressing component.
3) The dreaded one offset
Modbus is plagued by the dreaded one offset issue.
Addresses typically start at 0000
registers typically start at 0001
But the terminology is often confused, sometimes the documentation author doesn't understand it, whatever.
The point is, the data's there and sometimes it takes experimentation to determine exactly where it resides. But once you've cracked the code for a given slave, then all the other register addressing follows suit.
It's imperative to read a known data value (other than zero) from a register to confirm that one is reading the correct register. Many times unused registers are initialized with zero, so it's a bad idea to test a location if the data is a zero.
4) You get what you ask for
Some slaves are smart enough to flag a read of a single register that amounts to a half of a 2 register 32 bit floating point value, but most are not.
Most slaves will return whatever register values are requested and let the master sort out (interpret) what the data means. That's because Modbus does NOT define data formats, that task is left up to the slave implementer and finally to the guy who reads the data with a master and has to make sense of it.
Modbus is just a mule that carries data. The Modbus mule generally doesn't know whether its load is pickaxes, water canteens, beans or salt pork and doesn't care, it just carries its load (data) back and forth.
5) Bulk reads
Whether one performs multiple transactions for small amounts of data (single values) or bulk reads of multiple data values depends on the timing requirements and the tools available in the master.
Most implementers I've talked with prefer to read a large quantity data, multiple values, then pick out what is useful, rather than making multiple read transactions to get small amounts of targeted data. But it depends on what you're working with.
Multiple transactions will take longer because of the overhead in request time and turn around times. Sometimes that's critical, other times it doesn't matter. Some slaves cannot process more than one read request per second, so 8 reads could take 8 seconds to complete, whereas the 8 needed values spread amongst 52 registers could easily be read in one transaction in one second.
Be aware that some slaves limit the number of registers that can be returned in one transaction.
I know of a couple that can only handle one single value as a write value per transaction (function codes 06 or 16 decimal).
6) My question - bit count
Is the Siemens truly asking for a bit count of the returned values? Where 48 bits would be 3 contiguous (adjacent) Modbus input/holding registers of 16 bits each?
