Own-protocol command reference (401 · YP461)

For the models that use the manufacturer’s own protocol, not Modbus — AMR-THS401 and AMR-YP461.

Note

AMR-THS501 and AMR-YP561 speak Modbus. See the Modbus reference instead.

Port settings

Address    0–254  (255 broadcasts to every unit)
Baud rate  115200 (factory default)
Format     8 data bits · no parity · 1 stop bit

Frame layout

What you send

02 │ address │ length │ command │ data… │ XOR │ 03

What the reader sends back

AA │ address │ length │ command │ data… │ XOR │ BB

Field	Meaning
First byte	02 from you · AA from the reader
Length	Bytes of command + data (excluding header, XOR and end byte)
XOR	XOR of every byte from address up to the byte before the XOR field
Last byte	03 from you · BB from the reader

Important

Integrity is a single XOR byte, not a CRC16.

Completely different from Modbus — code written for one model cannot be reused for the other.

Commands you will actually use

System

Code	Purpose
0x3B	Reset the reader
0x80	Set address
0x81	Set baud rate
0x83	Read the unit serial number
0x41	Automatic read and upload settings

Lights and buzzer

Code	Purpose
0x34 / 0x38	Red light on / off
0x36 / 0x3A	Yellow light on / off
0x90	Green light flash
0x87 / 0x88	Red / yellow flash
0x37 / 0x30	Buzzer on / off
0x89	Intermittent buzzer

Warning

🔴 There is no steady-on command for the green light — only flash.

Red and yellow have both on and off. If your design uses a steady green light to mean “ready”, that is not possible on these models.

ISO15693 tags (the type used on AGVs)

Code	Purpose
0x10	Read the tag UID
0x11	Read block contents
0x12	Write block contents
0x13	Lock a block against further writes
0x1B	Read tag information

Warning

🔴 A block is always 4 bytes, and the frame carries a block count.

Writing 8 bytes means writing two consecutive blocks, not one 8-byte block. Get the count wrong and the reader rejects the frame.

Example frames

Read the tag UID (address 0 = broadcast)

02 00 05 10 06 00 00 00 13 03
│  │  │  │  └──┬──┘  │  │  └ end byte
│  │  │  │     │     │  └──── XOR
│  │  │  │     │     └─────── data (fixed values per the manual)
│  │  │  └───────────────── command 0x10
│  │  └──────────────────── length = 5 (1 command + 4 data)
│  └─────────────────────── address
└────────────────────────── header

Reset the reader

send   02 00 01 3B 3A 03
reply  AA 00 02 3B 00 39 BB

Write 8 bytes to block 5 (two blocks)

02 01 0C 12 02 05 02 11 22 33 44 55 66 77 88 92 03
         │  │  │  │  └────── 8 bytes ──────┘
         │  │  │  └ block count = 2
         │  │  └─── start block = 5
         │  └────── flag 0x02 (ordinary block)
         └───────── command 0x12, write

Check your code before touching hardware

Feed the example frames above into your XOR routine. Matching values mean the routine is correct and only wiring and settings remain.

02 00 01 3B 3A 03    ->  XOR of 00 ^ 01 ^ 3B = 3A  ✅
AA 00 02 3B 00 39 BB ->  XOR of 00 ^ 02 ^ 3B ^ 00 = 39  ✅

Or use the test tool, which appends the XOR for you when sending a raw frame.