HomeResourcesHoneywell Communication Protocols
Device Protocols

What are the Honeywell HC900 &
UDC communication protocols?

Honeywell's HC900 Hybrid Controllers and UDC loop controllers are standalone process control instruments deployed across virtually every process industry. They communicate using Honeywell-specific variants of the Modbus protocol — purpose-adapted for each product line's register map, loop parameter structures, and data types. This guide explains those protocols, what makes them distinct from standard Modbus, and how TOP Server connects to both device families.

Last reviewed: 2026Reading time: ~8 minTopics: HC900 Modbus, UDC Modbus, Modbus TCP, Modbus RTU, HC900, UDC 2500/3000/3200/3300/3500, Experion PKS DCS

Honeywell controllers vs. the Experion PKS DCS — what TOP Server covers

Honeywell makes both standalone process controllers and full Distributed Control Systems. The TOP Server Honeywell Suite connects to the standalone instrument side — the HC900 Hybrid Controller and the UDC series loop controllers. Honeywell's Experion PKS DCS, which is the company's flagship large-scale process control platform, uses a completely different architecture and connectivity path not covered by TOP Server.

This distinction matters because both types of Honeywell hardware appear in the same facilities. An HC900 managing a batch heating skid or a UDC 3500 controlling a single temperature loop may sit alongside — or feed data into — an Experion PKS system managing the broader plant. TOP Server handles the instrument side of that picture.

If your Honeywell hardware is part of an Experion PKS, TDC 3000, or TPS system, the OPC interface is provided by Honeywell's own Experion OPC server built into the DCS platform — not TOP Server. The HC900 and UDC families are independently deployed controllers that communicate over standard network interfaces, which is why a third-party OPC server like TOP Server can connect to them directly.

Honeywell HC900 & UDC — covered by TOP Server
Standalone process controllers: HC900 Hybrid Controller for multi-loop applications; UDC series for single and dual-loop PID control
Communicate via Honeywell-specific Modbus variants over Ethernet TCP/IP or serial RS-232/RS-422/RS-485
Common in batch processing, temperature control, heat treatment, combustion management, and utilities
Deployed independently of DCS infrastructure — their own process controllers with their own communications
Connect with: TOP Server Honeywell Suite (3 drivers)
Honeywell Experion PKS DCS — separate connectivity path
Full DCS platform: C300 controllers, Series C I/O, FTE (Fault-Tolerant Ethernet) control network, Experion servers
Proprietary FTE (Fault-Tolerant Ethernet) control network between controllers and Experion servers
OPC connectivity via Honeywell's own OPC server software built into the Experion server platform
Designed for continuous process units at scale — refineries, chemical plants, power generation
Earlier TDC 3000 / TPS systems use a similar pattern with different hardware
Connect with: Honeywell's built-in Experion OPC server (not TOP Server)

The device families TOP Server connects to

The Honeywell Suite covers two distinct controller families. Each has its own communication protocol variant, its own Modbus register map, and its own driver in TOP Server.

Hybrid ControllerHC900 Hybrid Controller
Multi-loop hybrid process controller with sequencing and batch capabilities
The HC900 is Honeywell's mid-range hybrid process controller, designed for applications requiring multiple control loops, discrete I/O, sequencing, and batch logic in a single rack-based system. "Hybrid" refers to its combination of analog PID control with discrete logic and sequencing. The HC900 is widely deployed in batch chemical processes, heat treatment furnaces, combustion management, and food processing applications. It communicates over Ethernet TCP/IP using the Honeywell HC900 Modbus protocol. Its Automatic Tag Database Generation feature is uniquely powerful: TOP Server can import the HC900's configuration CSV export file and automatically generate hundreds of organized OPC tags covering all loops, variables, signal tags, and SP programmers in the controller.
Supported: HC900 Hybrid Controller (all models and I/O configurations)
Loop ControllerUDC Series Controllers
Universal Digital Controllers — single and dual-loop PID control
The UDC (Universal Digital Controller) series are Honeywell's family of compact, panel-mount single and dual-loop PID controllers — one of the most widely installed families of temperature and process controllers in the world. They are found in virtually every process industry: temperature control in plastics and rubber processing, furnace control in metals and heat treatment, reactor temperature management in chemical plants, and environmental chamber control in pharmaceutical manufacturing. The UDC series spans several generations from the legacy UDC 3000 through to the current UDC 2500, 3200, 3300, and 3500 models. Ethernet-capable models use the Honeywell UDC Modbus Ethernet protocol. Older serial-only models use the Honeywell UDC Modbus serial protocol over RS-232, RS-422, or RS-485.
Supported: Ethernet models: UDC 2500, UDC 3200, UDC 3500 | Serial models: UDC 3000, UDC 3300 (MODB3K mode)

Understanding Honeywell's Modbus variants

The core of understanding Honeywell connectivity is understanding that "Modbus" in this context does not mean standard Modbus TCP or Modbus RTU. Both the HC900 and UDC families use Honeywell-specific adaptations of the Modbus protocol — they share the Modbus framing, function codes, and transport, but their register maps and data structures are organized according to Honeywell's own specifications for each product line. A generic Modbus driver can reach these devices but will not correctly interpret the data without knowledge of those register structures.

Why Honeywell-specific drivers matter

The difference becomes concrete when you look at how control loop parameters are organized. In a standard Modbus device, a PID loop's setpoint might live at an arbitrary register address chosen by whoever programmed the device. In the HC900 and UDC controllers, Honeywell has defined a structured register map where every loop parameter — process value, setpoint, output, alarm status, auto/manual mode — has a specific, documented Modbus address. The HC900 and UDC drivers know this map natively, which enables features that a generic Modbus driver cannot provide.

Standard Modbus TCP/RTU
Generic register access onlyAddresses mean whatever the device vendor defined
Manual address entry requiredYou must know the vendor's register map
No knowledge of loop structuresPV, SP, Output accessed as separate numeric registers
No automatic tag generationAll tags configured by hand
Honeywell HC900 Modbus Driver
HC900 register map built inDriver understands loops, variables, signal tags, SP programmers
CSV import from HC900 DesignerImport controller config → hundreds of tags generated instantly
Loop-aware tag generationAll loop parameters grouped and named by loop number and function
Configurable block read sizesOptimizes performance for HC900's data structures
Honeywell UDC Modbus Driver
UDC register map built inDriver understands UDC loop configuration memory
PID loop parameter mappingLoop parameters mapped directly to their Modbus addresses
Automatic tag generationTags generated based on UDC parameter structure
Multi-drop serial supportUp to 247 devices on one RS-485 bus

Address range and data types

Both the HC900 and UDC drivers support the full Modbus address range — 0 to 65,535 decimal (0x0000 to 0xFFFF hex) — well beyond the 9,999-register limit that some Modbus tools impose. Both decimal and hexadecimal addressing are supported at the driver level, which is important because Honeywell documentation for these controllers frequently expresses register addresses in hex.

Modbus Function CodeRegister TypeAccessible FromDescription
FC 01Coil (0x)HC900 & UDC SerialDiscrete output bits — coil status read and write
FC 02Discrete Input (1x)HC900 & UDC SerialDiscrete input bits — read only
FC 03Holding Register (4x)HC900, UDC Ethernet & SerialGeneral-purpose read/write registers — primary area for process values, setpoints, control parameters
FC 04Input Register (3x)HC900 & UDC SerialRead-only input registers — analog and digital inputs
FC 05Write Single CoilUDC SerialWrite a single discrete output bit
FC 06Write Single RegisterUDC SerialWrite a single holding register
FC 16Write Multiple RegistersUDC SerialWrite a block of holding registers in one request
FC 20Read File RecordUDC SerialAccess extended memory including Loop Configuration Memory
FC 21Write File RecordUDC SerialWrite to extended memory including Loop Configuration Memory

Word order swapping for 32-bit values: Both HC900 and UDC controllers store 32-bit floating point and long integer values across two consecutive 16-bit Modbus registers. Which register holds the high word and which holds the low word — the "word order" — can vary by controller model and configuration. The HC900 Ethernet and UDC drivers both include a configurable First Word Lo/Hi option that allows the word order to be matched to the specific controller's configuration. Incorrect word order is the most common cause of garbage float values when connecting to these controllers — if process values look nonsensical, check the word order setting first.

Protocol and driver comparison

DriverDeviceProtocolTransportMax devicesAuto tag gen
HC900 EthernetHC900 Hybrid ControllerHoneywell HC900 Modbus TCPTCP/IP Ethernet8,192 / channelYes — CSV import or manual config
UDC EthernetUDC 2500, 3200, 3500Honeywell UDC Modbus TCPTCP/IP Ethernet256 / channelYes
UDC SerialUDC 3000, UDC 3300Honeywell UDC Modbus RTURS-232 / RS-422 / RS-485247 / channelManual tag entry

How TOP Server connects to Honeywell controllers

The TOP Server Honeywell Suite bundles all three drivers in a single license. Here is a detailed breakdown of each driver, what it does, and the key configuration points.

HC900 Ethernet
Honeywell HC900 Ethernet Driver
Connects to HC900 Hybrid Controllers over Ethernet TCP/IP using the Honeywell HC900 Modbus TCP protocol. Supports the full address range (0–65,535 decimal; 0–FFFF hex). Two Automatic Tag Database Generation modes: a simplified mode where you specify the number of loops, variables, signal tags, and SP programmers; and a CSV import mode from HC Designer software generating organized tag groups covering all loops, variables, and principal function blocks. Configurable block read sizes optimize communication throughput. Word order (First Word Lo/Hi) is configurable per device. Up to 100 channels with 8,192 devices per channel.
Covers: HC900 Hybrid Controller (all models, all I/O configurations)
UDC Ethernet
Honeywell UDC Ethernet Driver
Connects to Ethernet-equipped UDC loop controllers over TCP/IP using the Honeywell UDC Modbus TCP protocol. Includes PID Loop Parameter Value Mapping — the driver understands the UDC's loop parameter register structure and maps parameters (process value, setpoint, output, alarm states, mode) to named items rather than requiring manual register address lookup. Full address range support (0–65,535 decimal; 0–FFFF hex). Configurable block read sizes. Word order swapping for 32-bit values. Automatic Tag Database Generation. Up to 100 channels with 256 devices per channel.
Covers: UDC 2500, UDC 3200, UDC 3500
UDC Serial
Honeywell UDC Serial Driver
Connects to older UDC serial controllers over RS-232, RS-422, or RS-485 using the Honeywell UDC Modbus RTU protocol. Supports Modbus function codes 01, 02, 03, 04, 05, 06, 16, 20, and 21 — including FC 20 and 21 (Read/Write File Record) for access to Loop Configuration Memory. Multi-drop RS-485 configurations support up to 247 devices per RS-485 bus. Adjustable address base (0 or 1). Configurable block read sizes. Word order swapping. Ethernet Encapsulation via serial-to-Ethernet converter hardware. Modem support with automatic dial and multiple phone number management for remote UDC access.
Covers: UDC 3000; UDC 3300 (in MODB3K serial mode)

Ethernet Encapsulation for UDC Serial: The UDC Serial driver supports Ethernet Encapsulation, allowing a serial-to-Ethernet converter (Moxa NPort, Digi, or equivalent) to bridge the Modbus RTU serial protocol over TCP/IP. TOP Server connects to the converter's IP address and port; the converter handles the physical RS-232/422/485 communication to the UDC controllers. This is the recommended approach for modernizing serial UDC installations — no long cable runs, the TOP Server machine can sit anywhere on the network.

Frequently asked questions

Can I use the standard Modbus TCP driver instead of the HC900 or UDC Ethernet driver?+

Technically, a standard Modbus TCP driver can connect to HC900 and UDC Ethernet controllers and read raw register values. But doing so means working directly with Honeywell's proprietary register maps — looking up each parameter address in the HC900 or UDC hardware documentation, manually entering each tag one at a time, and correctly handling the word order for floating point values yourself.

The HC900 and UDC Ethernet drivers eliminate this work by building in knowledge of those register maps. Automatic Tag Database Generation — especially the HC900's CSV import mode — can turn a hundreds-tag configuration effort into a few minutes of work. For production deployments, the Honeywell-specific drivers are strongly recommended over a generic Modbus driver.

What is the difference between the UDC 3300 MODB3K mode and standard UDC 3300 Ethernet operation?+

The UDC 3300 is a transitional model in the UDC series — it can operate in different communication modes depending on how it is configured. In MODB3K mode, it uses the older UDC 3000-compatible Modbus RTU protocol over its serial port, which is why the UDC Serial driver covers the UDC 3300 in this mode alongside the UDC 3000. In its standard Ethernet mode, the UDC 3300 would use a different communication path.

If you have a UDC 3300 and are connecting via serial, verify whether it is configured in MODB3K mode — if it is, use the UDC Serial driver. The driver documentation specifies the configuration requirements.

How does the HC900 CSV import for Automatic Tag Database Generation work?+

The HC900 Hybrid Controller's engineering software, HC Designer, can export the controller's configuration as a CSV file that contains the full list of loops, variables, signal tags, and SP programmers along with their names, addresses, and descriptors. The HC900 Ethernet driver in TOP Server can directly import this CSV file to generate a complete OPC tag database.

The import process produces organized tag groups for all the loops, variables, and principal function blocks in the controller. For a large HC900 configuration with dozens of loops and hundreds of variables, this can generate several hundred organized OPC tags in seconds, compared to hours of manual address-by-address tag entry.

If you do not have access to HC Designer or a current configuration export, the driver also supports a simplified manual generation mode where you specify the number of loops, variables, signal tags, and SP programmers.

My UDC controller shows garbage values for floating point process variables. What is wrong?+

The most common cause of nonsensical floating point values from Modbus-based controllers is incorrect word order configuration. Honeywell UDC controllers store 32-bit floating point values (like process values and setpoints) as two consecutive 16-bit Modbus registers. The question is which 16-bit register contains the high word and which contains the low word — and this can differ between controller models and firmware versions.

Both the UDC Ethernet and UDC Serial drivers include a "First Word Lo/Hi" (word order) configuration option. Try toggling this setting — if the values immediately start reading correctly, word order was the issue.

Does the Honeywell Suite connect to the Experion PKS or TDC 3000 DCS?+

No. The TOP Server Honeywell Suite covers the HC900 Hybrid Controller and the UDC series loop controllers only. It does not have drivers for the Experion PKS, Experion Process Knowledge System, or older Honeywell DCS platforms including TDC 3000, TPS (Total Plant Solution), or Plantscape.

The Experion PKS uses Honeywell's proprietary FTE (Fault-Tolerant Ethernet) control network. OPC access to Experion is provided by the Honeywell OPC server included with Experion — this is a Honeywell-supplied component, not a third-party driver.

If you need to move data from an Experion PKS OPC server into a broader data infrastructure, TOP Server's OPC UA Client or Cogent DataHub can act as an OPC client to the Experion OPC server and republish that data. Contact Software Toolbox to discuss this architecture.

Does the Honeywell Suite include all three drivers in one license?+

Yes. The TOP Server Honeywell Communications Suite is a single perpetual license that includes all three drivers: Honeywell HC900 Ethernet, Honeywell UDC Ethernet, and Honeywell UDC Serial. All three can be active simultaneously on the licensed machine — a single TOP Server instance can connect to an HC900 over Ethernet, a bank of UDC 3500 controllers over Ethernet, and a multi-drop RS-485 network of UDC 3000 controllers, all served to OPC clients under one license with no tag count or device count restrictions.

Individual drivers are also available as standalone licenses if you only need connectivity to one protocol variant. Contact Software Toolbox to confirm the right option for your specific controller mix.

Ready to connect your Honeywell HC900 or UDC controllers?

TOP Server's Honeywell Suite covers every HC900 and UDC model — with Honeywell-specific Modbus drivers that make tag generation and loop parameter access far simpler than generic Modbus. Try it free or talk to an engineer.

Ready to connect your Honeywell HC900 or UDC controllers?

TOP Server's Honeywell Suite covers every HC900 and UDC model — with Honeywell-specific Modbus drivers that make tag generation and loop parameter access far simpler than generic Modbus. Try it free or talk to an engineer.

Talk to an engineer