I have found what appears to me to be an error on Page 29 of the Modbus/TCP Protocol Guide in the Analog Module Address Table. This pertains to the values used for both the CONFIG POINT and CONFIG FEATURE.
For reference: I am using a SNAP-PAC-EB1 brain with firmware R8.5e on a SNAP-PAC-RCK12 and have been experimenting by moving a SNAP-AIMA 2 channel module around to different positions along with some input and output modules.
According to the table each module position has 128 registers reserved for CONFIG POINT and CONFIG FEATURE and conveniently gives the beginning register number for each module. I used ModScan32 to read the registers and from what I am seeing there are actually only 64 registers for each module.
For example: I placed the SNAP_AIMA module in module position 11. By the table I should be able to read the Hex value of holding registers 12679 through 12682 and see a Hex value of 0040 in 12680 and 12682, which is the default value automatically assigned to the AIMA module by the brain. However, these registers all read FFFF.
Now assuming a 64 register spacing between modules and starting with the beginning register for module 0, which is 11271, add 64 to it 11 times. This gives you a register number of 11975. Now when I read the Hex value of 11975 through 11978, both 11976 and 11978 have a value of 0040.
I have moved the module around to other positions with the same results. Also I have observed the same behavior with the POINT FEATURE being 64 registers per module by configuring a counter through PAC Manager and reading the register locations to see which ones are changed.
Other values in the table seem to be accurate. Though I have only used the READ VALUE, SET LOW SCALE, and SET HIGH SCALE values. Oh, and I also looked at the old register locations while experimenting, which all read correctly.