Modbus command reference (501 · YP561)

For the models that speak Modbus RTU / TCP — AMR-THS501 and AMR-YP561.

Note

AMR-THS401 and AMR-YP461 use a completely different command set. See their reference instead.

Port settings

Protocol   Modbus RTU
Address    1–127  (0 broadcasts to every unit on the bus)
Baud rate  115200 (factory default)
Format     8 data bits · no parity · 1 stop bit

Function codes

Code	Purpose
`0x03`	Read
`0x06`	Write one register (16-bit)
`0x10`	Write several consecutive registers

Every frame ends with a CRC16 — polynomial 0xA001, seed 0xFFFF.

Warning

🔴 The CRC goes low byte first, the opposite of every other value in the frame.

Get it backwards and the reader silently discards the frame — no reply at all, which looks exactly like a broken cable.

On a bad write the reader replies with the function code plus 0x80 — send 0x06, get 0x86 back, and the address does not exist, is out of range, or is read-only.

Registers you will actually use

Address	4xxxx	Purpose	Value
`0x0001`	40002	Device address	0–255
`0x0002`	40003	Baud rate	see table below
`0x0008`	40009	Red light on/off	low byte `00` off · `01` on
`0x0009`	40010	Green light on/off	same
`0x000A`	40011	Yellow light on/off	same
`0x000B`	40012	Reset
`0x000C`	40013	Buzzer on/off	`00` off · `01` on
`0x000D`	40014	Automatic upload on tag detect
`0x0054`–`0x0057`	40085–40088	Tag UID	read-only · 8 bytes
`0x0010`–`0x004F`	40017–40080	Tag data, blocks 0–31	2 registers per block
`0x0051`–`0x0053`	40082–40084	Automatic read and upload settings

Flashing uses different registers from steady on/off — 0x0004 buzzer, 0x0005 red, 0x0006 green, 0x0007 yellow, where the high byte is the period and the low byte the count.

🔴 Baud rate table — the two models differ

Code written to `0x0002`	THS501	YP561
0	115200 (default)	115200 (default)
1	57600	19200
2	38400	38400
3	19200	57600
4	9600	9600

Danger

Codes 1 and 3 are swapped between the models.

Want 57600 on a YP561 but use the THS501 table → you send code 1 → you get 19200, and the reader stops answering immediately. You then try each speed until you find it.

Always read the model code off the label before writing this register.

Example frames

Read the tag UID (address 1, 4 registers from 0x0054)

01 03 00 54 00 04 05 D9
│  │  └─┬─┘ └─┬─┘ └─┬─┘
│  │    │     │    └── CRC16, low byte first
│  │    │     └─────── register count = 4 (8 bytes)
│  │    └───────────── address 0x0054
│  └────────────────── function 03, read
└───────────────────── device address

Red light on

01 06 00 08 00 01 C9 C8
      └─┬─┘ └─┬─┘
        │     └── value = 1 (on)
        └──────── address 0x0008

Tip

Test your CRC routine before touching hardware. Feed a manual example frame into your code; if the last two bytes match, the routine is correct and only wiring and settings remain — one suspect eliminated without plugging anything in.

🔴 The manual gives two conflicting address sets

The manufacturer’s manual contains both a register table and example frames, and the two disagree.

Function	In the table	In the examples
Red light on/off	`0x0008`	`0x0017`
Reset	`0x000B`	`0x0039`
Buzzer on/off	`0x000C`	`0x003A`

The offsets are inconsistent, and the green and yellow examples duplicate the “flashing” ones exactly — the signature of a copy-paste error.

This page uses the table, because it is self-consistent with its own 4xxxx numbering (40001 = register 0). If a command gets no reply, try sending a raw frame with the tool using the address from the manual’s examples.