Also what is the reason to read blocks with 0406 command? You ca read a range on devices with 0401.
IF in binary -
0x50, 0x00, # Subheader (2B)
0x00, 0xFF, # Network Number & PLC Number (2B)
0x0C, 0x00, # Request Length (2B)
0x01, 0x04, # Command Code (Read Word Device - 0x0401)
0x00, 0x00, # Subcommand (2B)
0x2E, 0xE1, 0x00, # Start Address (D12001 - 3B)
0xA8, #Device code (D in binary message is A8 - 1B)
0x06, 0x00 # Number of Points to Read (2B)
This message should read 6 words starting from D12001.
Or this will read 10 points from starting D0
0x50, 0x00, // Sub Header
0x00, 0xFF, 0xFF, 0x03, 0x00, // Route
0x0C, 0x00, // Request Length
0x00, 0x00, // Monitoring Timer
0x01, 0x04, 0x00, 0x00, // Command
0x00, 0x00, 0x00, // Device Address
0xA8, // Device Prefix
0x10, 0x00 // Device Length
the only reason for 0406 is you can read bits and words in the same message, or blocks of words/bits that are not consecutive. Personally never tried...