Smart Breakers on Modbus: Retrofit Energy Metering

A smart breaker with RS485 gives you per-circuit voltage, current, power, energy and remote trip over Modbus RTU, through a DIN-rail retrofit whose wiring and auxiliary-power needs must be checked. What it does not give you is a billing-grade meter, a complete register map in every manual revision, or a protocol safe to put on a shared network. Plan for all three before you quote the job.

Retrofit energy monitoring is one of the few IoT projects where the hardware is genuinely the easy part. A qualified electrician must assess the panel, protection requirements, wiring, and auxiliary supply before estimating installation time. The work that actually consumes the project sits on the other side of those two wires.

What does a smart breaker actually measure?

The Acrel ASCB1 series is representative of the class: a DIN-rail miniature circuit breaker with an RS485 port, sold 1P through 4P, with and without residual-current protection. Nothing exotic. The same shape of device now ships from a dozen Chinese manufacturers, and the integration story is close to identical across all of them.

Over Modbus RTU, read function 0x03, one breaker exposes a real-time register block. Many measurements are IEEE-754 floats occupying two registers; state and control fields use their documented integer formats:

That covers everything an energy audit asks for and several things it does not. Leakage current and per-pole temperature are protection telemetry, not metering, and they turn out to be the most useful channels in the whole map for anyone maintaining an old panel. A rising terminal temperature on one pole can indicate a loose connection or another fault requiring electrical inspection.

Then the trap. The floats are IEEE-754, but you must check byte and word order rather than assume the library default. The manual's own worked example makes it obvious once you see it: 219.9 V arrives on the wire as 66 E6 5B 43, and only becomes 219.9 after the four bytes are reversed to 43 5B E6 66. For this frame that is DCBA-to-ABCD ordering, not merely a swap of two 16-bit words. Miss that and every voltage reads as some absurd number near zero or near 10^30. Every vendor in this category picks its own word order, and roughly none of them put it in the datasheet.

Which manual revision contains the register map?

The older English ASCB1 manual (document 591 V1.0) omits the protocol chapter. The newer English 591 V1.1 includes it, as do the Chinese 591 V1.1 and 680 manuals checked for this integration. Ask for the exact revision before assuming the map is unavailable.

Documentation differs by revision and distributor. Collect the technical manual rather than relying on a product brochure.

The working method for this situation is boring and reliable:

1. Collect every manual revision you can find, including the ones in Chinese, including the ones for adjacent model variants. Vendor download pages are versioned by document number, not by model, so a "different" product often carries the same protocol chapter.
2. Diff the register maps across revisions before you trust one. For the ASCB1 the self-powered variant (document 680) and the split-type variant (document 591 V1.1) turn out to carry byte-identical maps: same 190 address tokens, same order, same worked frame example. That agreement across two independently published documents is worth more than either document alone.
3. Verify on the bench against a known load before you verify on site. A 100 W lamp and a clamp meter can help settle the word-order question, the scaling question and the register-offset question in twenty minutes.
4. Write the map down in your own repo, in your own format, with the document number and revision you took it from. The vendor's download link will rot. Your integration will outlive it.

Step 2 is the one people skip, and it is the one that catches transcription errors. A register map you read once from one PDF is a hypothesis. Agreement between documents strengthens the evidence; the target model and firmware still need a bench check.

Is breaker metering accurate enough to bill on?

Breaker readings can support internal allocation if their measured accuracy fits the intended use. Before invoicing tenants, check the device certification, local metering requirements, and contract.

IEC 61557-12 edition 2.1 covers power metering and monitoring devices. Schneider's guide describes embedded measurement functions in breakers and distinguishes uncertainty under reference and operating conditions. Check the claimed class, measurement range, and installation against the actual load; a class label alone does not clear billing use.

Keep a suitable approved meter at the billing boundary where required, and reconcile circuit readings against it. Neither a generic smart breaker nor this architecture guarantees audit acceptance.

What does the retrofit actually cost in wiring?

Here is the detail that kills schedules: these breakers do not power their own RS485 from the line they protect. The ASCB1 exposes a four-pin connector carrying 12V+, 12V-, A and B. Energise the 230 V line and the breaker trips and closes normally, and the RS485 port stays dead. You need a DC 12 V auxiliary supply in the panel. Assess its capacity and failure path separately from the poller; a lost auxiliary supply can take communication for the string offline.

You then choose between two topologies, and the choice is mostly about who owns the data path.

Vendor gateway. The ASCB1-M gateway supplies the 12 V, daisy-chains up to 16 breakers on the four-pin cable, assigns slave addresses automatically from its local settings menu, and uplinks over Ethernet, WiFi or 4G. It is the fast path. It is also a second vendor cloud in your architecture unless you point its uplink at your own broker, and the address assignment happens in a menu behind a factory-default password that nobody ever changes.

Straight RS485 into your own poller. Officially supported, and the honest choice for anyone who already runs an ingestion service. You supply the 12 V, you supply the RS485 master, and you inherit one real problem: without the gateway's auto-addressing, every breaker ships on the same default slave address, and you must set addresses one at a time before they share a bus. Register 0x1105 holds the slave address and 0x1106 the baud rate, so the procedure is: connect exactly one breaker, write its address, label it physically, disconnect, repeat. Budget ten minutes per device and do it on a bench, not in a live panel.

The checked 591 V1.1 register map lists 4800, 9600, 19200, and 38400 baud. Confirm the default and framing on the installed model; do not assume a product-page range applies to every revision. At 9600 with sixteen devices you are reading roughly 30 registers each; a full sweep lands comfortably inside a few seconds, which is fine for energy but useless for anything you want to call real-time. If you need sub-second reaction to a trip, do not poll for it — the breaker's own protection already acted, and your job is to record it, not to detect it. That distinction is the whole argument in Modbus polling vs event-driven ingestion.

Which register is the dangerous one?

Register 0x0019. Write 1 and the breaker closes. Write 0 and it opens.

The measurement block is mostly telemetry, while address and baud-rate configuration registers are writable, and then there is one 16-bit write that can drop power to a floor. Treat it as a different class of object from the rest of the integration:

• Separate code path. Control writes do not belong in the polling loop or in the same service. If your poller cannot write, a bug in the poller cannot trip a panel.
• Explicit allow-list. Name the breakers that are allowed to be controlled remotely, in configuration, and reject the rest at the API boundary. Most breakers in a retrofit are metering-only, forever.
• Read back and log. After a write, read 0x0018 and record the observed state with the operator identity that requested it. Modbus RTU gives you a protocol write response, not confirmation that the physical contacts moved, and no operator identity.
• Know what the load is. Remote disconnect on a tenant sub-circuit is a commercial action. Remote disconnect on a circuit feeding a lift, a fire pump, a server room or medical equipment is a safety incident. The device cannot tell the difference. Your configuration has to.

The enforcement side of this — when a remote cut is a legitimate business workflow and when it is not — is covered in room-level energy control with smart breakers.

Modbus has no authentication, so where do you put the security?

Modbus was specified in 1979 for a serial link inside a cabinet. It has no authentication, no encryption and no integrity protection beyond a CRC that catches noise, not malice. Anyone who can reach the bus can read every register, and anyone who can reach the bus can write 0x0019.

This is not a theoretical concern once the bus gets an IP address. On 17 March 2026 CISA published advisory ICSA-26-076-02 for Schneider Electric SCADAPack and RemoteConnect: CVE-2026-0667, CVSS 9.8, improper exception handling over Modbus TCP allowing remote code execution without authentication (CISA). That is a serious industrial vendor with a security programme. Check whether the selected RS485-to-Ethernet converter has a published security policy and supported firmware.

So the security lives in the transport, not the protocol:

1. Never expose Modbus TCP to the internet. Not behind a port forward, not on a "temporary" rule. Internet-exposed Modbus endpoints are scanned continuously and indexed by search engines built for the purpose.
2. Put the poller on the panel side. A small edge device that speaks RS485 locally and pushes outbound MQTT or HTTPS avoids exposing an inbound Modbus service. Secure the gateway and validate commands received through its outbound session. The bus stays in the cabinet, which is where the protocol was designed to live.
3. VLAN the serial converters. If you must use Modbus TCP, put the converters on a management VLAN reachable only by the poller, and firewall port 502 to that one source.
4. Patch the converter, not just the breaker. The RS485-to-Ethernet box is a networked computer. Inventory its firmware, check the vendor support policy, and plan replacement if security updates are unavailable.

Where does the money actually come from?

The business case rarely holds up if you write it as "monitoring". It holds up when you connect the readings to a tariff line and a regulatory deadline.

On the tariff side, PLN's non-subsidised rates for September 2026 hold at Rp 1,444.70/kWh for B-2/TR customers, 6,600 VA to 200 kVA, and Rp 1,114.74/kWh for B-3/TM above 200 kVA — unchanged through the July–September quarter (Antara, 1 September 2026). At that B-2 rate, a single 3 kW load left running 12 hours a night that nobody knew about costs about Rp 1.6 million a month. This is an illustrative avoidable-load calculation, not guaranteed savings or payback. Compare measured usage with the installation and support quote.

On the regulatory side, PP 33/2023 on Energy Conservation, Article 34, requires energy management for building-sector energy users consuming 500 tonnes of oil equivalent per year or more. This measures energy consumption, not tonnes of CO₂e emissions. The 4,000-tonne threshold concerns industry and transport, not buildings. Energy management includes an energy manager, a programme, periodic audits, and action on audit findings under the applicable provisions.

Katadata's report on government-building audits supplies implementation context; it should not replace the threshold in the regulation. Permen ESDM No. 1/2026 concerns energy-conservation services. Check the applicable service and audit requirements with the energy auditor. Breaker readings can support an audit; they do not replace it or satisfy every requirement on their own.

Circuit history can help an auditor build a consumption baseline. A building with only an incoming meter may need additional measurements to separate loads. If circuit logging has run for twelve months, that history supplies an audit starting point; the auditor still needs to judge whether it is sufficient.

The takeaway

Installation time depends on the panel and electrical work required. Everything that makes the project succeed or fail is documentation, addressing, accuracy class and network design.

Get the register map from more than one source and diff it. Verify the word order on a bench before you argue with a client about their voltage. Bring your own 12 V. Keep the control register out of the polling service. Keep Modbus off the internet, always. And decide early whether these numbers will ever appear on an invoice, because that single question decides whether a class 1 breaker is sufficient or whether you need an approved meter standing behind it.

Meter what you can switch. Switch only what you meant to. Document what you measured.