Leuze MSI430 Safety PLC help??

Hi all,
My Task: To control write to registers to my MSI430 safety PLC from Leuze Electronic using a HMI as a master.
Protocol: Modbus TCP

MSI430 (Modbus TCP - server/slave)

Generic HMI (Modbus TCP - client/master)


I'm reading Okay from the Register address 401101-40110
But I'm not able to write to the MSI PLC to address 402101-402109

Please see the attached images for gateway description for the device.

Please advice/guide on how this could be done.

I have tried using MBPoll and it says Illegal Data Address.
Kind Regards
NarkO