Siemens SINAMICS G110M Function Manual page 131

Structure of a read request via Modbus function code 03 (FC 03)
Any valid register address is permitted as the start address.
Via FC 03, the control can address more than one register with one request. The number of
addressed registers is contained in bytes 4 and 5 of the read request.
Table 5- 12
Example
11 h
03 h
00 h
6D h
00 h
02 h
xx h
xx h
The response returns the corresponding data set:
Table 5- 13
Example
11 h
03 h
04 h
11 h
22 h
33 h
44 h
xx h
xx h
Table 5- 14
Read request
Invalid register address
Read a write-only register
Read a reserved register
Controller addresses more than 125 registers
The start address and the number of registers of an
address are located outside of a defined register
block
Fieldbuses
Function Manual, 01/2016, FW V4.7 SP6, A5E34229197B AC
Structure of a read request via slave number 17
Byte Description
0 Slave address
1 Function code
2 Register start address "High" (register 40110)
3 Register start address "Low"
4 Number of registers "High" (2 registers: 40110; 40111)
5 number of registers "Low"
6 CRC "Low"
7 CRC "High"
Slave response to this read request
Byte Description
0 Slave address
1 Function code
2 Number of bytes (4 bytes are returned)
3 Data first register "High"
4 Data first register "Low"
5 Data second register "High"
6 Data second register "Low"
7 CRC "Low"
8 CRC "High"
Invalid read request
Communication via RS485
5.4 Communication using Modbus RTU
Inverter response
Exception code 02 (invalid data address)
Telegram in which all values are set to 0.
Exception code 03 (invalid data value)
Exception code 02 (invalid data address)
131