Well the device manufacturer really needs to familiarise themselves with the modbus specification as they are in clear violation of it. I know this doesn't help you fix your issue, but unless jklm's suggestion works (which it might) you would have to go back to the device manufacturer and educate them regarding the modbus specification and ask them to fix their implementation or offer some sort of workaround.

Good luck.

Gwawl

The problem is that the function block MB_CLIENT from Siemens does not support the whole data area that Modbus/TCP supports. With the function blocks you can only read/write the adresses from 1-9999 per data type. The blocks do not support the other 55536 data adresses. 

Well that is correct according to the modbus specification. The only registers that can have ranges beyond the 9999 limit are holding regsiters as they are at the top of the memory space and can be expanded without overlapping other address areas. But this was an extention to the modbus specification known as exteneded addressing and not all devices support it. Technically, discrete inputs could occupy 19998 addresses as the 20001 - 29999 range is not actually used. However, I have never seen this done.

Coils 00001 - 09999 (no room to expand as discrete inputs start at 10001).

Discrete inputs 10001 - 19999 (could possibly be expanded to 29999 as input registers start at 30001)

Input registers 30001 - 39999 (no room to expand as holding registes start at 40001).

Holding registers 40001 - 49999 (can be expanded to 105536 (40001 + 65535) with extended addressing).

See here for details:-

Modbus extended addressing