I could send the value of holding_register in PLC to ThingWorx with modbus function code NO.3.
And, i try to send set-point value for control system from ThingWorx to PLC with modbus function code NO.6.
In wireshark, the packet(NO.141) sent from EMS to PLC with modbus function code NO.6 exists as query packet.
But, PLC send response packet to EMS with modbus function code NO.3.
I can't understand why query and response packets use different function codes...
I use modbus package and siemens PLC.
If I were you, I will try to write modbus register using the other Modbus Master tool to confirm the setup of PLC and IP network connection.
Also I will use Modbus slave simulator tool in place of PLC and will see if it responds the correct response to the write register command from ThingWorx modbus package.
This will help you to separate the issue whether the issue is coming from the ThingWorx side or PLC side.
If you do not have favorite Modbus master tool, here is my favorite one.
This tool is free of charge and easy to use and powerful for debugging modbus issue.
free Modbus simulator