Hi Mark,
All is clear now. Your making the same mistake that the engineers at Huanyang have.
Yes the spec says the modbus serial pdu contains
Address
Function Code
Data
CRC
BUT, you need to see what the definition of the Data field contains for each function code. For that you need to look at the document
http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdfFor instance Function code 03 (Read holding registers) on page 15 shows the Data field contains 2 sub-fields as shown below.
Data.starting address 2 bytes = 0x0000 - 0xFFFF
Data.quantity of Registers 2 bytes = 0x0000 - 0x7D
And, the Data field in the response to this contains;
Data.bute count 1 byte = 2 x N
Data.register valuess N x 2 bytes = 0x0000 - 0xFFFF
where N is the quantity of registers.
Cheers,
Peter.