Modbus and Bacnet integration

Hello everyone, I recently bought a TB Tiny Brother 8 UI Programmable Bacnet & Modbus Controller to test the product. I read the pdf manual.

There are two RS485 networks on each controller, one is labeled ‘main’ and the other ‘sub’ though they are functionally equivalent. Typically the subnet is used for expansion I / O and the main is used for controller-to-controller level connections.

If I had a Modbus RS485 network with some devices, such as some temperature sensors, XY-MD02 Temperature And Humidity Transmitter (RS485 SHT20 Modbus RTU Sensor - see Amazon website), I could directly connect this modbus network to the expansion points subnetwork and reference the registers inside the controller?

If I had BACNET or Modbus devices visible on the same ethernet network to which the controller is connected, could I refer to them inside the controller?

Thank you very much for your support.

Expansion Points: You can add T3E-XXX series controllers and the extra IO will show up as inputs and outputs on the associated controller. In the case of 3rd party Modbus devices, these will need to be ‘integrated’ over Modbus read & write commands. You could in fact use a control basic program to write to the external modbus registers to the on board ‘inputs’ so in fact it would have the same effect as some expansion IO but it needs the small control basic program to drive it. You can read about network programming here:

Ethernet Devices: You can read and write to Bacnet and Modbus devices over Ethernet as well, check the same link above to learn more about that.


Hi Maurice, I have installed the T3-TB-8I controller and prepared a platform for testing. I connected a thermostat probe (Ok, it works perfectly); I then created a PID that drives an analog output (OK, it works perfectly). I have some problems and I would like to ask you what to do. I have an RS485 modbus line consisting of an environmental thermometer (ID 1), an electricity meter (ID 2) and a relay switch (ID 3). I connected the line to the SUB 485 terminals of the controller. I would have expected to see in the left tree of the T3000 program the controller T3-TB-8I with the three modbus components underneath but instead I don’t see anything and also the discovery doesn’t see anything (only the controller). However the components are fully functional because from the T3000 Modbus tool menu I can read and write coils and registers of the three components. How come they are not visible in the tree under the controller in the T3000 program? At this point I wanted to read the value of a register and put it in a variable for use within the controller. I used the syntax 10 VOLT = 2.MB_REG1 (I would like to read the first modbus input register of the component ID = 2) but the VOLT variable is never updated. Even the instruction, in my opinion more correct, 10 VOLT = 2.MB_READ_FLOAT_ABCD1 (the numeric value is a 32-bit floating point number) does not work. I tried to prepend the controller ID (ID 10) but even then it doesn’t work. Could you show me documentation or explain what to do? Thanks so much for the support.

Auto discovery of Modbus devices is not a feature. Yet. Once you know the ID, baud rate and so on of the subnet devices you can poll them It would be a good idea to add them in the tree if there’s communication to them going on, I like it. Fandu will implement it soon. He will also send an updated list of the modbus commands, some like the floating point are new so not documented well I admit. Thanks for your great efforts there to integrate and work with our gear.


Thanks for your answer. In the meantime, I have verified that my modbus devices can also be reached (read/write) by LAN pointing directly to the controller IP, port 502. Ok, I will be waiting for the list of modbus commands. Thank you.

Hi DonatoM:
10 VOLT = 2.MB_READ_FLOAT_ABCD1 , Should be changed to
10 VOLT = 11.2.MB_READ_FLOAT_ABCD1234 ,
11 indicates the primary device (T3-TB-8I), and 2 indicates the sub-device connected to RS485 Sub or Main

Here are some programming examples.That maybe help you.

31 REM The value 1 below represents the panel number of the main device. You can view or change this number in the setting interface
32 REM The value 2 indicates the Modbus ID of the sub-device
40 VAR100 = 1.2.MB_REG_FLOAT_ABCD33
50 VAR101 = 1.2.MB_REG_FLOAT_CDAB44
60 VAR102 = 1.2.MB_REG_FLOAT_BADC55
70 VAR103 = 1.2.MB_REG_FLOAT_DCBA66
90 VAR104 = 1.2.MB_REG7
100 VAR105 = 1.2.MB_REG7 & 1
110 VAR106 = 1.2.MB_REG7 | 1
120 VAR107 = 1.2.MB_COIL7
130 VAR108 = 1.2.MB_DISINPUT7
140 VAR109 = 1.2.MB_INPUTREG7
150 VAR110 = 123456AI2048
160 VAR111 = 123456AV3
170 VAR112 = 123456AO4
180 VAR110 = 123456BO5
190 VAR110 = 123456BI6
200 VAR110 = 123456BV7
210 VAR1 = MB_BLOCKWRITE ( 1 , 2 , 3 , 111 , 5 , 6 )
220 VAR10 = MB_BLOCKREAD ( 1 , 2 , 3 , 2 , VAR1 , VAR2 )
228 REM Line 230 writes the high level of VAR1 to register 3
229 REM Line 240 writes the low level of VAR1 to register 4
230 1.2.MB_REG3 = VAR1 / 65536
240 1.2.MB_REG4 = VAR1 * 1000 % 65536 / 1000

1 Like

Hi Fance, thank you so much for your support. Unfortunately it still doesn’t work. So I attached some picture for your better information.
T3000_config (panel ID is 10)
SDM230_modbus_protocol (the SDM230 register to query. Modbus ID is 2)
SDM230_modbus_polling (by using modbus T3000 Tools I can read the correct floating point value
T3000_vars (the values of vars)
Please could you help me? Thank you.

In the program I used alternatively line 30 or line 35 (I tried both) but with no success.


of the register (219.22 volt)
T3000_list (program source code). I tried both (line 30 and 35) but it still doesn’t work.


Good morning Fance, I’m sorry if I insist but I still can’t solve my problem and my project at momenti is stopped. I sent you a series of T3000 setup screenshots for more knowledge. I absolutely need to be able to read registers from modbus devices connected to the T3000 SUB 485 network. Could you please give me some other suggestions on how to proceed? Thank you very much.

Hi DonatoM:
I did find some issues with MB_REG_FLOAT_ABCD and have found and fixed the bugs, I will release the latest T3000 later. (Jul 8 2022)
The following is the test interface I fixed, almost the same as your test environment, can normally read 7020 floating point data.

122 is panel number of my T3-BB-Fandu-ip122
199 is the modbus ID of my board T3-NB (like your board SDM230)

I also found you make a mistak ,the key words is “MB_REG_FLOAT_ABCD” , not MB_READ_FLOAT_ABCD

1 Like

Good morning Fance,
“I also found you make a mistak ,the key words is “MB_REG_FLOAT_ABCD” , not MB_READ_FLOAT_ABCD”
Yes, I wrote wrong in the answer but I had written the instruction correctly. Despite all my efforts I am still unable to read the values of my modbus devices connected to the SUB485 port and assign them to a variable. They are an XY-MD02 (ID 1) ambient thermometer and an Eastron SDM 230 (ID 2) electrical meter that I bought a couple of months ago on Amazon. I checked the values of modbus ID (10) and panel ID (10) of the controller. I also checked the speed (9600 baud) and control (parity none, 1 bit stop) settings. The controller is configured as modbus master of the 485 Sub line. I updated the T3000 software, then I updated the controller firmware but it was useless. Some time ago I made a software written in PHP language that I use to read the values of the registers of my devices and they work well. Even now that I have connected them to the SUB 485 port of my T3-TB-8i, I can correctly read their values with my PHP client by pointing to the IP address (port 502) of my T3-TB-8i. I have checked again and I don’t seem to have made any mistakes in writing the Basic code. I do not know what to think. Using the T3000 modbus tool I get correct data even if the readings are not very stable and I often get timeouts.The documentation I have does not specify how to debug the modbus channel and I don’t even know if it is possible.
Thank you very much for your support.

I can use Anydesk to assist remotely to see what’s going on and not be able to read the third-party device you’re using.Please send your Anydesk ID to Fandu@

Thank you very much for your precious support and availability. Please send me your time zone (I live in Italy and it is now 07:44 am) to take into account the differences due to the time zone and at what time you prefer to be contacted. At moment I am at work and cannot connect.


I am now in Shanghai and I can assist you, your morning will be early afternoon here. You can send me the remote assistance ID of Anydesk by email, and I will connect with you.

Are there any other syntax examples for the MODBUS register points to transfer to local variables i.e. I’ve seen “MB_READ_FLOAT_XXX” and “MB_REGxxx” Are there anymore, as its not well documented.

There’s a few lengthy posts here with the modbus commands which are available. Search for around for keyword ‘ABCD’ as this will include the floating point commands which were added most recently.

Opening any programming interface and clicking the Help button will give you enough sample code.

Also you can check here, there’s examples for all network commands over both baacnet and modbus protocols. Over both the main Ethernet connection and the RS485 subnet connections:

1 Like