. Timer and Counters share memory. Can't just search for a timer to know if the address if free since it could be used by a counter.
This is true of the older PLCs only. The CS1, CJ1 and CP1 have dedicated timer and counter areas. I believe there are 4096 timers and 4096 counters available in all PLCs. If you run out you can always roll your own with the @INC function as well.
These latest PLCs also have a 'W' area - similar to 'M' in most PLCXs - work area.
If you ever come across the APR function just be really careful - it can be used for many things. I use it regularly for performing a linear approximation on a table - most useful with fuel tanks etc but it also has other functions. Have not seen it in any other PLCs.
Modbus RTU is also very easy. All the latest serial comms cards for the CJ and CS have Modbus slave built in - just go online and define where you want to put the words, the slave number, baud rate etc and write to that memory area in your progam.
Modbus RTU master is done with a standard, freely available protocol macro or via serial link which you also set up directly in the serial card. Bit different from a few years ago I can tell you, basic processor card, write your own in basic, wonderful.