The Flowscope probe sensors and inlines have a not very complete implementation of the modbus protocol. This is due to hardware limitations, and is also one of the reasons they are superseded by the flowscopeM line.
What is supported
Function code 3 : read holding register.
This will always give you 4 bytes back. If you request more than one register, it will ignore your request.
In terms of modpoll, this can be done in two ways:
#request for one 4byte integer or float (replace int with float)
modpoll -0 -1 COMn -b38400 -pnone -a9 -t4:int -r 16 -c1
#request for 2 2byte registers:
modpoll -0 -1 COMn -b38400 -pnone -a9 -t4:hex -r 16 -c2
The following does not work:
modpoll -0 -1 COMn -b38400 -pnone -a9 -t4:hex -r 16 -c1
This will make modpoll expect 2 bytes in return, and when it gets 4 bytes, it will read the second pair of bytes as if they were a checksum, and thus report a "bad checksum" error. So there will be a response, but it is not what modpoll expects. Other modbus masters might still interpret it as correct.
This behaviour could be regarded as a bug in modpoll, or at least an unclear error message.
Address space
Besides this there is the address space. Each 4byte value is addressed by an address, and each value is 4bytes long. This is no problem when requesting 1 value, since you would request a value, and get 4 bytes back.
It gets tricky however when you, or your PLC tries to request one 32bit value, by making two requests, say to address 30, and then to 31. Which - under the assumption
that registers are 2bytes - makes sense, however, since 31 is already occupied by the next register, will result in wrong values.