Hello,

I was wondering if there were any people who could guide me through the steps that would be required to configure a Honeywell UDC2800 to enable Modbus RTU. Any steps would be helpful, I have read through the documentation online but I am really just looking for the minimal steps required to be able to establish the connection.

Also I was wondering if anyone knew if it would be possible to establish a connection using python + a python module to connect to the UDC2800's Modbus server and if it is even possible to set up the connection for a proof of concept by directly plugging the UDC2800 into my laptop's ethernet cord as I don't have any ethernet or networks that I could connect the UDC2800 to as of the initial setup of this POC.

Thanks! (Sorry if this is alot of information to request I am a second year student on an internship)

 

Yes, I can help you from the UDC2800 side, but I don't know one end of snake from the other, so you'd be on your own for Python coding.

But I need to make sure that the magic of Modbus will actually move you toward your goal, because I have encountered numerous situations where invoking the magic of Modbus was supposed to solve problems that were outside the realm of a UDC 2800's PID control functions, in essence a pipe dream, not a reality.

So please write out, in English, your process narrative, that is, what you expect the the process has (what it has for input, what it has for final control element and what drives it) and what the process is and how the UDC2800 is managing the control and then how Modbus is supposed to be involved in the process, as opposed to stand-alone loop control. What value is Modbus adding?

 

For input, the process has it's RTD temperature sensor (iirc), the final control element I am unsure about, but I do know that when wired the UDC2800 has been able to control oven's for us, what drives it should be a program that changes the setpoint depending on the part that we are running.

The process is heat treating bearing parts, the UDC2800 is set to a goal temperature, and regulates output of the oven. After hitting the goal temperature we put in the bearing part's and leave them in there for the required amount of time.

Modbus is supposed to give us access so that the machinists can setup the SP more easily and monitor the PV, OUT, and SP without having to manually set it every time they are running a new part.

Thanks for your help and if you need any more additional information I would be happy to provide it, although, I don't have that much information about the way the current process functions as I was just assigned the task yesterday.

 

Modbus is supposed to give the machinists ability to setup the SP and monitor the PV and OUT*

Also, I was reading online and they said that Modbus RTU protocols are more often used for serial ports where as I wanted to do it over the ethernet or internet, would I be using Modbus TCP?

 

Reading/Changing SP, PV and OUT

This is nitty gritty stuff but it's critical to understanding what all you need to make this work.

Modbus is a just protocol which is a set of rules for communication. The rules cover things like who talks, who listens, how a connection is established, what happens when there errors, how the data packet that carries the data is constituted.

The responsibility of Modbus is to get data bits from the Master to the slave and from the slave to the master. Modbus has no idea, no clue what the data bits in the message mean, because it's not Modbus's responsibility. Modbus merely gets data from A to B or B to A. It's up to the devices using Modbus to interpret the data bits and to deal with or to handle the data (display the data/provide data entry) that is transferred back and forth.

It requires a higher level "application" that uses Modbus to fetch or send the data that the application can display or provide some easy means of entering setpoint changes remotely. This higher level application is typically HMI software running on a PC or a physical HMI panel, either of which have Modbus Master/client functionality. The Modbus master/client asks the UDC for the SP, PV and OP values and when it gets those values, the HMI tags the data internally and HMI programming displays the values on its screen. HMI's can be programmed for data entry, or with a set of recipes where the recipe has the setpoint. Typically recipes are named with friendly names that are associated with the work orders.

So, it is not "Modbus" that provides the means or seeing and changing the setpoint. Seeing or displaying the setpoint remotely is an "application"; Modbus is just the mule carrying the data bits back and forth.

Serial or Ethernet

Modbus RTU infers communications over RS-232 or RS-485. The UDC 2800 uses RS-485 for its Modbus RTU option. But Modbus is an option on the 2800 which option means that it is a card in the controller that can be changed out. If your 2800 has the serial RS-485 card, you can buy an Ethernet card and swap it out and you then have a 2800 with Ethernet.

You could get a Modbus-enabled RS-485-to-Ethernet gateway, but a gateway requires some setup and is another failure point. You're better off with whatever network card is needed in the controller itself.

2800 Setpoint Programming

The 2800 has an option for Setpoint Programming (SPP). When SPP is running the controller generates the setpoint changes over time according to its configured setpoint profile. A simple profile might be: go to SP 400° in 10 minutes and hold for 55 minutes, then go back to SP 80°. The advantage of using SPP is that the timing function is built-in.

The 2800's SPP option can handle 8 profiles. The profiles are numbered, they are not associated with friendly names.

Specview

Specview is an HMI program that runs on a Windows box. Specview has had drivers for Honeywell UDCs for several decades now.
https://www.specview.com/index.html
But there are hundreds of other HMI software packages or physical HMI panels.

Rather than learn Modbus inside and out, it might pay to learn an HMI software program, because the programs typically do more that just display data.

 

If you're going to roll your own HMI, then there are some things to be aware of:

1. You need to download the UDC 2800 vendor manuals:

For the UDC 2800: User manual R200.0 rev 8 51-52-25-157 Sept 2023, not an earlier version. The Modbus maps are for Function Codes 20/21 which are rarely, if ever used and the maps are not valid for typical FC01, 02, 03, 04, 05, 15, 06, 16.

For Honeywell Modbus: Honeywell Modbus RTU Manual 51-52-25-66T 2013 (not updated for the 2800, but the register maps for the UDC 3200 generally apply).

2. 2800 Firmware

As of March 15, 2024, the current firmware for the UDC 2800 is R200.1 and is displayed on the 2800 under the Status group as V1.29.14. But Honeywell has not posted the download link for it yet. The available download link is for V1.29.13.

Firmware is updated via Bluetooth, which is standard on every 2800, and which requires an Android or iOS (Apple) mobile phone with Bluetooth. The Honeywell mobile application used for firmware updates is called EasySet and is available as a free download from the appropriate app store.

3. Does the UDC 2800 have the Modbus option?

Does the UDC 2800 have the Modbus option? and if so, which network, Ethernet or RS-485?

Modbus is NOT standard on a UDC 2800, it is optional. There are different hardware cards/firmware for Modbus RTU over RS-485 and Modbus over Ethernet.

If the UDC 2800 has an RJ-45 Ethernet jack on the back wiring panel, then you know it has the Modbus over Ethernet function, which can be confirmed by the model number with a number 3 in the 2nd digit of Table II.

To determine whether the 2800 has Modbus RTU with the RS-485 network, decode the model number printed on the side of case using the table on page 44 of the User manual, where the number 2 in the 2nd digit of Table II is for the RS-485 network and Modbus RTU slave option.

If the UDC 2800 does not have the Modbus option, order the appropriate card which can be installed in the field without too much effort.

Modbus over Ethernet board and RJ-45 jack kit part number: 51308448-528

Modbus RTU/RS-485 board part number: 51308448-527

4. UDC 2800 Modbus Slave/Server Register Address Maps

96% of the information in the UDC 2800 User manual, section 12, Modbus, is worthless for 99.99% of all Modbus usage, specifically: the register address tables. The tables in the User manual are used only for Modbus Function Codes 20/21, for which there are few commercial Modbus master/clients that support FC 20/21.

The correct Modbus register address tables are found in the Honeywell Modbus RTU Manual 51-52-25-66T 2013

Reference to the UDC 3200 are valid for the UDC 2800, with some questions about Setpoint Programming registers because the 2800's functionality has changed from previous models.

5. Use a generic Windows Modbus Master/Client to check the UDC2800

Open Modscan is a freeware application that's convenient to check Modbus functions on a 2800:
https://github.com/sanny32/OpenModScan/releases/tag/1.6.1

 

Thank you very much I do have an ethernet port on the back, I just saw what you typed about section 12 being useless right now but was trying to use it earlier.

I have been able to establish a connection with the modbus server from the UDC 2800 but I have been unsuccessful in reading so far so I will try the Open Modscan application to see if it can help me.

 

I have an issue on ModScan where it say's there is no response from slave device, I was wondering if that was due to an error on my part regarding the setup procedure and what I could check.

I am using the ethernet connection to maintain a connection between the UDC2800 and my computer and I was wondering if that could be the issue.

 

I stand corrected. The initial draft and versions of the User Manual had to 20/21 register addresses, but only just now did I realize that the latest version 2800 User manual that I linked to above has the standard register addresses for integers, but the user manual still lacks the floating point register addresses. You'd think they'd never written a manual before . . . .

For Open Modscan:
under "Connection"
Connect Using: Remote TCP/IP server
IP address: needs to be on the same subnet
Service Port: defaults to 502, why would you change it?

On the 2800:
Communication group:
Communication Type = Ethernet
Modbus Address is the slave node ID that you still need to define in Modscan, even though it's TCP
I can't remember the default but it has to match the value in Modscan's "Device ID"
Response Delay = 1 works OK
Word Order for Float = FP B 0123, corresponds to Modscan's "Swapped FP" format
Ethernet Address has to be whatever, but it has to match what Modscan is using
Subnet mask address = 255.255.255.0
Default gateway is 0.0.0.0, needs to be something other if you are crossing subnets.
Shed function = disable, unless you write a value every cycle (doesn't matter for reads)
Computer SP units/SP Ratio/SP Bias only apply when Shed is enabled

In the Open Modscan work area:
Device ID = whatever the 2800's Modbus address is configured for.
Modbus Point type = 03 Holding Register

To read integer values:
Address = 0001 (other entry defines the memory area as Holding Registers)
Length = 4
On the 3rd menu bar down (all cryptic image buttons), select 3rd button from the left: integer

when you 'connect', the work area will display four rows of data

40001 = SP
40002 = remote SP
40003 = working SP (there can be multiple local SPs)
40004 = Output in percent

page 455 paper/pdf shows all four register addresses with the description that each is a value prescaled by 10.
Proper interpretation means you have to divide the value shown by 10.
On my 2800 the SP of 1999 is 199.9 Deg F (units are not included as properties in Modbus, they have to hand coded at the master/client)

To read 32 bit floating point values

You need the other manual because the 2800 manual misprinted the integer loop values twice (also starting on 468) instead of the floating point loop values. The floating point value registers start on page 44

Open Modscan work area:
Address = 0067 (other entry defines the memory area as Holding Registers)
Length = 8
On the 3rd menu bar down (all cryptic buttons), select 4th from the left: Swapped FP

when you 'connect', the work area will display eight rows of data

40065 = SP as an FP value
40066 = blank because its 16 bits are part of the FP displayed in 40065
40067 = Remote SP (probably 0)
40068 = blank because its 16 bits are part of the FP displayed in 40067
40069 = Working SP as an FP value (there can be multiple local SPs)
40070 = blank because its 16 bits are part of the FP displayed in 40069
40071 = Output in percent as an FP value
40072 = blank because its 16 bits are part of the FP displayed in 40071

page 44 in the Honeywell Modbus RTU manual has the Loop floating point registers

 

Thank you very much for your help, I was able to get Modscan working pretty quickly and finish the python script's with your information.