So I spent much of yesterday using Claude to help me figure out the AT903's modbus setup. I found and used OpenModScan from here:
github.com/sanny32/OpenModScan
along with a waveshare USB-RS485 adapter to communicate with the mystery VFD. I'd recommend OMS, it installed straightforwardly on my linuxcnc PC and proved easy enough for me to use as a newcomer to modbus.
I found several versions of a manual that relates to the 'AT900 series' VFDs, (i.e. AT901 and AT903) some with odd unicode, have attached one of the more readable ones.
I scanned about 16000 addresses in the modbus holding register range and found that there are around 16 blocks of used addresses, each starting at the beginning of 256-bit blocks, which correspond quite closely (identical in many cases) with the manual's function groups as coded e.g. P01.01 is at 0x0001, P17.00 at 0x1000. I've confirmed that I can write to some of those addresses as well as read them; I have not yet managed to find the address that accepts actual run and frequency setpoint commands - the freq. setpoint address shown in the manual is read-only.
Spreadsheet is attached - copies of the function groups per the manual, next to their modbus addresses, in case this is useful to anyone else.
Anyone with time to have a quick look, who has a deeper familiarity with modbus standards, I'd be grateful to get some idea of the most likely command register addresses.