Thanks for the tips, I got the read working with some fairly simple changes.
In case it may be useful to anyone else -
Added this function to AllenBradleyPCCC.vb
'* Word range read
'* Reference : Page 7-34
'* Supported by PLC-3 and PLC-5 only.
Public Function WordRangeRead(ByVal byteSize As Byte, ByVal address As MfgControl.AdvancedHMI.Drivers.PCCCAddress, ByVal TNS As Integer) As Integer
Dim pck As New MfgControl.AdvancedHMI.Drivers.PCCCCommandPacket()
pck.Command = &HF
pck.FunctionCode = &H1
pck.TransactionNumber = TNS
'This is basically what happened in version 397e, except the command, function and TNS were manually packed.
For Each val As Byte In address.ByteStream
pck.EncapsulatedData.Add(val)
Next
SendPacket(pck, TNS)
Return TNS
End Function
And replaced code between lines 1772 - 1783 in AllenBradleySLCMicro.vb with this
'* A PLC specifies the number of bytes at the end of the stream
If MfgControl.AdvancedHMI.Drivers.PCCCAddress.IsPLC5(ProcessorType) Then
PAddress.ByteStream(PAddress.ByteStream.Length - 1) = CByte(NumberOfBytesToRead)
WordRangeRead(Convert.ToByte(NumberOfBytesToRead), PAddress, TNS)
Else
PAddress.ByteStream(0) = CByte(NumberOfBytesToRead)
ProtectedTypeLogicalRead(Convert.ToByte(NumberOfBytesToRead), Convert.ToByte(PAddress.FileNumber), Convert.ToByte(PAddress.FileType), _
Convert.ToByte(PAddress.Element), Convert.ToByte(PAddress.SubElement), TNS)
End If