Is there any way with the IAP to have a Rockwell PLC read beyond modbus address 1x00600 or 3x00600?

I have a modbus slave with some modbus inputs starting at 12001 (function code 2) and some input registers starting at 31001 (function code 4). Reading through the literature it states that reads of B250 to B255 are interpreted as function code 2 space and N250 to N255 as function code 4 space. The xcel bridging calculator further indicates that the only valid range for elements in this space is 0 to 99. Example: N250:0 to N250:99. This would mean that the highest modbus address that can be accessed for function code 2 and 4 is 600. There must be a way to change this default mapping??

Sadly, no. You’ll need to buy a fancier product elsewhere. This was a trade-off between limiting 4x to less range, or 3x to less range.

Few main-stream products use 1x or 3x anymore. For example, all SE/Modicon PLC will ‘hide’ the raw 3x input via scaling/conversion blocks - so a temperature input will end up in a 4x location.