Honeywell UDC2500/3200/3300 controller (Modbus comms option)
Register map(s) for this device, each at the trust rung it earned. Addresses are 0-based
as on the wire. Word order and scaling are confirmed at the hardware-verified rung and at no rung below it.
interop-verified
Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
| point | address (0-based) | type | scale | unit |
|---|
| pv_integer | 0 | I16 | 0.1 | Prescale * 10 |
| remote_set_point_integer | 1 | I16 | 0.1 | |
| working_set_point_integer | 2 | I16 | 0.1 | Prescale * 10 |
| output_integer | 3 | I16 | 0.1 | Prescale * 10 |
| input_1_integer | 4 | I16 | 0.1 | |
| input_2_integer | 5 | I16 | 0.1 | |
| pv_float | 64 | F32BE | 1 | EU |
| remote_set_point_float | 66 | F32BE | 1 | EU |
| working_set_point_float | 68 | F32BE | 1 | EU |
| output_float | 70 | F32BE | 1 | EU |
| input_1_float | 72 | F32BE | 1 | EU |
| input_2_float | 74 | F32BE | 1 | EU |
| analog_input_1 | 6144 | F32BE | 1 | EU |
| analog_input_2 | 6146 | F32BE | 1 | EU |
| analog_input_3 | 6148 | F32BE | 1 | |
| analog_input_4 | 6150 | F32BE | 1 | |
| totalizer_1 | 6912 | F32BE | 1 | EU |
| totalizer_2 | 6914 | F32BE | 1 | |
| alarm_status_1_16 | 7152 | U16 | 1 | |
| alarm_set_point_1 | 7168 | F32BE | 1 | EU |
| alarm_set_point_2 | 7170 | F32BE | 1 | |
link settings as documented (unverified): RTU; baud 300/600/1200/2400/4800/9600/19200/38400; FC 01,02,03,04,05,06,08,16,17,20,21
bench facts as documented (unverified)
| wiring notes | The Modbus RTU allows the instrument to be a citizen on a data link shared with other devices that subscribe to the Modbus RTU RS-485 specification. |
| max registers/read | 22 |
| broadcast | not supported |
| protocol notes | Request delay time is 20 ms (or 3.5 characters for newer versions). |
| identification notes | Uses Function Code 17 (11h) to report Device ID. |
| FC 43 device ID | not supported |
| doc revision | Revision T |
field reports — community-sourced, unverified (checked 2026-06-11)
- The standard UDC2500/3200 product manuals only document registers for Function Codes 20 and 21, which are proprietary and unsupported by most commercial Modbus masters. Users must refer to the separate Modbus RTU Serial Communications User Manual (51-52-25-66) to obtain the standard operational register map (FC03/FC04/FC06/FC16). [source]
- The Ethernet IP address on the UDC2500/3200 Ethernet option card cannot be configured via the front keypad; it can only be configured using Honeywell's proprietary PIE (Process Instrument Explorer) software. The default IP address is 10.0.0.2. [source]
- Writing setpoints or parameters continuously to the UDC controller via Modbus will cause premature EEPROM memory fatigue and eventual hardware failure. Setpoints should only be written on change or at the start of a segment. [source]
- Writing to UDC2500 controllers using Function Code 6 can trigger Modbus Exception Code 3 (Illegal Data Value) due to High Limit FM approval constraints or incorrect register mapping. [source]
- confirmed: comms defaults (baud rates up to 38400, 8-N-1 framing) — confirmed by Honeywell Modbus RTU Serial Communications User Manual (51-52-25-66, Rev T) and field integration notes on Control.com
- confirmed: Function Code 17 (11h) used for Device ID — confirmed by Honeywell Modbus RTU Serial Communications User Manual
- confirmed: pv_integer @ 0 (40001) and pv_float @ 64 (40065) — confirmed by Honeywell Modbus RTU Serial Communications User Manual and Control.com forum threads
- confirmed: analog_input_1 @ 6144 (1800h) — confirmed by Honeywell Modbus RTU Serial Communications User Manual
The trust ladder
Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.
- generated — A prompt produced it. Unproven — anyone can regenerate this.
- structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
- interop-verified — Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
- simulator-verified — Decoded correctly against a protocol emulator seeded with known-true values — catches word-order/scaling errors vs the emulator, not the physical device.
- hardware-verified x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.