MODBUS RTU - Function code change

The function code is determined by a combination of MODE and DATA_ADDR and DATA_LEN. The MODE input controls the read / write / type of write function / additional diagnostic function codes.

Reading data from slave:

MODE 0 with DATA_ADDR range 00001 to 9999 and any DATA_LEN value = Function code 1 (Read coils)
MODE 0 with DATA_ADDR range 10001 to 19999 and any DATA_LEN value = Function code 2 (Read discrete inputs)
MODE 0 with DATA_ADDR range 40001 to 49999 or 400001 to 465535 and any DATA_LEN value = Function code 3 (Read holding registers)
MODE 0 with DATA_ADDR range 30001 to 39999 and any DATA_LEN value = Function code 4 (Read input registers)

Writing data to slave (all write function codes):

MODE 1 with DATA_ADDR range 1 to 9999 and DATA_LEN value 1 = Function code 5 (Write single coil)
MODE 1 with DATA_ADDR range 40001 to 49999 or 400001 to 465535 and DATA_LEN value 1 = Function code 6 (Write single holding register)
MODE 1 with DATA_ADDR range 1 to 9999 and DATA_LEN value > 1 = Function code 15 (Write multiple coils)
MODE 1 with DATA_ADDR range 40001 to 49999 or 400001 to 465535 and DATA_LEN value > 1 = Function code 16 (Write multiple holding registers)

Writing data to slave without using function function codes 05 and 06: (This option is useful in cases where some slave devices do not support single data length write function codes 05 / 06)

MODE 2 with DATA_ADDR range 00001 to 9999 and any DATA_LEN value = Function code 15 (Write one or more coils)
MODE 2 with DATA_ADDR range 40001 to 49999 or 400001 to 465535 and any DATA_LEN value = Function code 16 (Write one or more holding registers)

MODE = 11,80 and 81 perform diagnostic actions in the slave device.

 Taking your points in order.

oki4400

1. doesn't support function 01 or 05

2. data register starts at 0001

These statements are contradictory. Modbus addresses starting at 0001 are coils and can only be accessed with function codes 1, 5 & 15. These may be offsets and not addresses (see below)

oki4400

According to client documentation I must send  function 03 or 04 to read data on addresses 1-123. Addresses over 30000 are out of range.

 This is nonsense and does not adhere to the Modbus specification. Are you sure these are addresses and not offsets? Some documentation works in offsets from the data base address rather than an actual address. For example offset 100 for holding registers = holding register base address + the offset = 40001 + 100 = 40101. Can you provide the documentation for us to look at please?

oki4400

On the other hand I cannot arbitrarily set function on MD_MASTER. It is set according to MODE and DATA_ADDR (like you both explained).

 That is because the software is written to comply with the Modbus protocol specification. What you are trying to do is not in accordance with the Modbus protocol specification, hence why it is preventing you from doing so. 

oki4400

My question is, how to read data in address range 1 - 123, with function 03 or 04.

You can't as it is illegal to do so with respect to the Modbus protocol specification.
Function code 3 can only read address ranges from 40001 to 49998 and 400001 to 465535.
Function code 4 can only read address ranges from 30001 to 39998

We really need to see the specification for the slave device. What device is it?.