Read Modbus Holding Registers (function code 03) vs Input Registers (function code 04) with correct addressing

Steps

1. Identify which register type the device exposes: Holding Registers (function code 03, read/write, conventionally numbered 4xxxx) vs Input Registers (function code 04, read-only, conventionally numbered 3xxxx)
2. Send the request with the matching function code (0x03 or 0x04), using a 1-byte function code, 2-byte starting address, and 2-byte quantity-of-registers
3. Convert any documented register number to the PDU address by stripping the type-prefix digit and subtracting 1 — e.g. documented holding register 40002 maps to PDU address 0x0001; the wire protocol always uses 0-based addressing
4. Parse the response: byte count field, then 2 bytes per register with the high-order byte first for each 16-bit register
5. If values look shifted by one register or come from the wrong range, check whether the vendor's documentation numbers are already 0-based, and whether you used FC03 against a point that is really only exposed as an input register (or vice versa)