I've just realised that M registers can't be controlled via MODBUS and %M00200 is the toggle bit between MODBUS and SNP in the logic. The problem is that I can read and write MODBUS perfectly but you can't program or attach via MODBUS... Is there any way to clear/stop the PLC or change the protocol back to SNP? I know there is a pin 4 on the PLC programming lead which is used by a GE programming unit to set the port back to SNP but I have no idea what the PLC requires on this port (I have tried grounding it and pulling it up to +5v with no result).

 

Well, looks like I'll have to answer my own question...

DISCLAIMER: DO NOT ATTEMPT THIS AT ANY COST - I WILL NOT BE RESPONSIBLE FOR ANY DAMAGE TO YOURSELF, OTHERS OR THE PLC IF YOU FOLLOW THESE INSTRUCTIONS!

For the GE series 90 PLC:
i) remove power to the PLC
ii) remove the top plastic cover
iii) pull out the I/O board
iv) pull out the CPU board
v) on the CPU board short out pins 14 (gnd) and 28 (vcc) on the SRAM chip 'PD43256' for about 5-10 seconds (the rechargable battery onboard should be ok as it has diode protection)

After powering it back up it should go into stop mode with the logic and hardware config still intact.