Local tech support guy (out of Virginia) demonstratied the S7-1200 $ Modbus TCP comms to our drives using Modbus Function 23. We exchanged ~20 double words some formated as Integers, others as Reals.
Worked quite well. (But like others have said it was custom code he wipped up. Looked to me like we was manually building the Modbus Header & Data Frame.
Next was getting the code to support Functions 16 & 3 (As our Touchscreens do not support function code 23).
I never went down that path as I found the touchscreen has an S7-300/400 driver and used it instead.
I can put you in contact with him if you like, and (he agrees). He has stated that hs Modbus TCP work has 'turned into a national thing'.