I have a Modicion M340 Schneider PLC which is connected via an Ethernet cable to a local PC with monitor. On this PC I have TIA Portal V17 with a project consisting of only one SIMATIC WinCC Unified device. 

In this project I have connected it with the communication driver "Standard Modbus TCP/IP" and filled in the addresses of the PC and PLC.

When I make a tag, I can connect it with the PLC. If I use address 4x400201 for example and use a tag on my PLC with the address %MW200 it works. But only one way...

I can only write a value on the PLC-tag and that changes the value of my HMI-tag, but not the other way around. For some reason it also does not matter if I use the input or output register on the HMI tag (3x3 or 4x4). It remains an input.

I think it has something to do with the function code which Modbus uses. I know that function code 23 is not possible (read/write register), but function code 3(Read consecutive integer values) and 6(Write single integer value) should be possible. So, I believe that it is somehow locked in function code 3 (input) when it communicates with the PLC.

Does anyone have any idea how to change this? Do I have to tinker with the CSP of the Modbus for Unified? Maybe I'm completely wrong and if so please tell me.

for the PLC, I'm using a BMX CPS 2010 with an Ethernet connection. And the project only uses 1 tag for now to test. Without any READ_VAR or other extra things, it still can access the tag of the HMI.

the pictures are there for some clarification of the function codes I mentioned.