Hello,

hope I'm not wrong, in case you ask for status word and your DB for data is with word data type defined then you can easy ask as LEN->1 your address looks to me ok in case it is Holding Register, also I see that it is area from documentation to read and write so I expected that.

I recommend to do one logical step. You have your DB28 defined with 4 words but your pointer at CLIENT block reserves only 2 words. It is not problem actually because you can read 2 parameters at once but they must be existed logically each after previous, also with register addresses. Theoretically if they aren't each next after previous, you can better set LEN->1 what means only one register word read. Another thing is if that register is 2 word long, then you need set that LEN->2 so your actual set is therefore wrong probably. Then also some register can be not  correctly saved inside your DB because it is defined only with WORD data type, hope you understand this. Simple my idea is to have pure DB with f.ex. your word elements but without any clear description as Frequency and other. After read specific register (also with 2 words long) you'll have that data inside this DB and then I recommend move data to final DB with expecetd data types and data field names. You need only after read one stop execution of block, REQ->false, move data from source to final DB and change parameters to diferent expected, then again REQ->true will start requests again. This can be correct functionality as I expect. Definitelly I recommend check documentation about data type of each required registers and then you can easy set correct LEN due your defined WORD type.

Hello,

in your documentation is part with Modbus TCP and also specific Port usage for specific HW or control option. To me, you do one mistake which prolongs your success, you do changes of DB where data are saved, I see this no good because your previous typical DB with maybe 4 Words as Array is enough for tests. You need only pay attention to have this Db as not set with optimized access. You can also use not DB but Pointer to some merker memory area reserved like P#M100.0 WORD 10 what reserves 10 Words from MW100 to MW109 similar as to your DB with 4 elements. Again, don't change things during tests as memory for data because you can be not sure about functionality in some steps, it can be chaos for you. I recommend use for first PC MB TCP Client application from web to do tests to your Altivar device and check functionality, simply this tests is better and comfortable compared to PLC, for sure. After tests (save screenshots from tests to see that) you can better prepare PLC cfg. Really I don't know where you decide to use 40001 HR for test because I don't see this inside your documentation shared, maybe I've overlooked this.

Hello,

eeeeehm this looks like run on long distance. Pls understand me, how can I know what connection settings you've set as IPs, Port, Unit ID? Experience is mandatory in this problematic sry. If you look at this good SW (I don't use it also), there is clear that all is set via specific FC MB code function and register but in this case it is set from first register address as 0000 probably, not with offset. On Simatic you're use is all different, you don't have there FC code so MODE and addrees defines what type of register and action is expected. Really very sry now, is really very hard to spend pages with still many corrections and knowledge description because this problematic is huge. I recommend my favorite www.simplymodbus.ca for study and also carefully read TIA help about block used. If you see at CLIENT block there you have not REQ as conenction parameter, this is start of comm task, connection is initiated differently and I also expect some internal TAG about conenction established. Try sum all my recommendations and try connect correctly with PC SW test and try receive correct data with std register addressing again, save also conenction screen to see parameetrs you've set there and your screenshot with correct data. ZIP can be your friend here with more screenshots included.