In-Situ Aqua TROLL 400 Modbus and SDI-12 Reference Guide - Manual (Page 60)

8.10.1 Read Holding Registers
This command reads one or more registers from a device.
Where Byte Count is the #bytes in the Data Payload (does not include CRC bytes).
Byte Count = 2 * Register Count.
8.10.2 Write Holding Register
This command sets a single register in a device.
8.10.3 Write Holding Registers
This command sets one or more registers in a device.
Message (8 bytes): Response (5 + N bytes):
Address 1 Byte 1-247 Address 1 Byte 1-247
Function Code 1 Byte 0x03 Function Code 1 Byte 0x03
Data Address 2 Bytes 0 to 0xFFFF Byte Count 1 Byte 0 to 0xFA
Register Count 2 Bytes 0 to 0x7D Data Payload N Bytes
CRC 2 Bytes CRC 2 Bytes
Message (8 bytes): Response (8 bytes – message echo):
Address 1 Byte 1-247 Address 1 Byte 1-247
Function Code 1 Byte 0x06 Function Code 1 Byte 0x06
Data Address 2 Bytes 0 to 0xFFFF Data Address 2 Bytes 0 to 0xFFFF
Data Payload 2 Bytes 0 to 0xFFFF Data Payload 2 Bytes 0 to 0xFFFF
CRC 2 Bytes CRC 2 Bytes
Message (9 + N bytes): Response (8 bytes):
Address 1 Byte 1-247 Address 1 Byte 1-247
Function Code 1 Byte 0x10 Function Code 1 Byte 0x10
Data Address 2 Bytes 0 to 0xFFFF Data Address 2 Bytes 0 to 0xFFFF
Register Count 2 Bytes 1 to 0x7B Register Count 2 Bytes 0 to 0x78
Byte Count 1 Byte 2 to 0xF0 CRC 2 Bytes
Data Payload N Bytes
CRC 2 Bytes
60