ECOM100 & DL06 Is there a serial number or MAC address that can be read?

[harncw]

I'm looking for a way to identify and confirm which PLC is being communicated to via ModBusTCP.

Are the PLC's serial number and\or ECOM100's serial number printed on the device and available at a 'V' address?

[harncw]

http://forum.automationdirect.com/showthread.php?t=3010&highlight=serial+number

This so far seems to say that I'm out of luck.
Furthermore there seems to be no serial number printed on my DL06.
There is what appears to be a mac address printed on the ECOM-100,

Would adding the Mac Address to H0/H2/H4–ECOM100 System Memory (modbus address 317501-419250) make sense?

How are other people confirming the PLC they are communicating with beyond IP address?

[WRT]

If you have a lot of networked DL PLCs, then I guarantee that eventually you will program the wrong PLC if you don't use passwords.  Every PLC should have a simple unique password for verification, even if you don't think you need it for security.  This won't tell you which PLC you are trying to talk to if you don't know, but it will verify that you have the right one.

On the other hand, reading data is simple, since you insert the program and installation identification yourself into memory as you find necessary.

If the ECOM100s are using DHCP, then looking at your router DHCP tables will tell you what addresses are in play for ECOM100s, since ECOM MAC ranges are identifiable.

You can also access the ECOM100 using HTTP to determine it's MAC address.

Note that ALL Ethernet connected hardware has a instance unique MAC address, it's part of the requirement.

[franji1]

There are IBox instructions that can read the following pieces of information out of an ECOM100 at runtime and stick it in V memory, then accessible via an HMI:
ECRDIP (IB-722) ECOM100 Read IP Address
ECRDMID (IB-720) ECOM100 Read Module ID
ECRDNAM (IB-724) ECOM100 Read Module Name
ECRDDES (IB-726) ECOM100 Read Module Description
ECRDSNM (IB-732) ECOM100 Read Subnet Mask
ECRDGWA (IB-730) ECOM100 Read Gateway Address

[franji1]

There are IBox instructions that can read the following pieces of information out of an ECOM100 at runtime and stick it in V memory, then accessible via an HMI:
ECRDIP (IB-722) ECOM100 Read IP Address
ECRDMID (IB-720) ECOM100 Read Module ID
ECRDNAM (IB-724) ECOM100 Read Module Name
ECRDDES (IB-726) ECOM100 Read Module Description
ECRDSNM (IB-732) ECOM100 Read Subnet Mask
ECRDGWA (IB-730) ECOM100 Read Gateway Address

I should have also mentioned that with DirectSOFT Communication Links, you can choose TCP/IP as the Protocol, but then use Module ID or Module Name as the "address".  You then must ensure that the Module ID or Module Name is UNIQUE across all PLCs.  Note that the Module ID is settable via a "soft" setting (NetEdit) or "hard" setting, via dipswitches on the ECOM100 module.  If the lower 6? 7? dipswitches are all "0", then it uses the "soft" ID.  If any of those lower 6/7? dipswitches are "1", then it uses that set of dipswitch values as its "hard" ID.  So if switch 0 and 1 are ON, then it has a hard ID of 3.

[harncw]

The production environment is a PC communicating with a DL06 via the ECOM100 using ModbusTCP exclusively as the protocol.  The ModbusTCP protocol doesn't appear to support passwords (which is scary, alot of these old protocols just entirely ignored security, but this is another topic).

I was looking for a "sanity" check beyond just the IP address.  I plan for the user to configure not just the IP address but also the MAC address as a double check.  When the software "initializes" it will request the MAC address of the ECOM100 and confirm it against the config to ensure that it communicating to the correct device.  We will either print the MAC address on a label so that it is visible on the PLC or possibly have our ladder logic read the MAC (although I don't see an IBOX for reading the MAC address) and display that on the LCD screen, when the PLC is first powered on.

I found the ECom100 MAC address at Modbus addresses 17516-17517, it was sitting under my nose in a print out, the table is titled: "ECOM100 as a MODBUS TCP Server" http://www.hosteng.com/faqfiles/ECOM100%20Server%20Client%20Mapping.pdf

MAC: 00 E0 62 20 E9 DB
17515 E0 00
17516 20 62
17517 DB E9

MAC: 00.E0.62.21.14.C6
17515 E0 00
17516 21 62
17517 C6 14

Thanks for your input!