Smart Breakers on Modbus: Retrofit Energy Metering

Smart Breakers on Modbus: Retrofit Energy Metering

A smart breaker with RS485 gives you per-circuit voltage, current, power, energy and remote trip over Modbus RTU, for the price of a DIN-rail swap and no rewiring. What it does not give you is a billing-grade meter, a register map you can find in English, or a protocol safe to put on a shared network. Plan for all three before you quote the job.

Retrofit energy monitoring is one of the few IoT projects where the hardware is genuinely the easy part. An electrician pulls the old MCB, clips in the new one, lands two extra wires. Half a day for a panel. The work that actually consumes the project sits on the other side of those two wires.

What does a smart breaker actually measure?

The Acrel ASCB1 series is representative of the class: a DIN-rail miniature circuit breaker with an RS485 port, sold 1P through 4P, with and without residual-current protection. Nothing exotic. The same shape of device now ships from a dozen Chinese manufacturers, and the integration story is close to identical across all of them.

Over Modbus RTU, read function 0x03, one breaker exposes a real-time block of IEEE-754 floats, two registers each:

That covers everything an energy audit asks for and several things it does not. Leakage current and per-pole temperature are protection telemetry, not metering, and they turn out to be the most useful channels in the whole map for anyone maintaining an old panel. A rising terminal temperature on one pole is a loose lug, months before it is a fire.

Then the trap. The floats are IEEE-754, but the word order is CDAB, not the big-endian ABCD your Modbus library assumes by default. The manual's own worked example makes it obvious once you see it: 219.9 V arrives on the wire as 66 E6 5B 43, and only becomes 219.9 after you swap the 16-bit words to 43 5B E6 66. Miss that and every voltage reads as some absurd number near zero or near 10^30. Every vendor in this category picks its own word order, and roughly none of them put it in the datasheet.

Why is the register map only in the Chinese manual?

Search the web for the ASCB1 register map and you get product pages, a distributor PDF or two, and no addresses. The information exists, but it lives in chapter 6 of the Chinese-language manual, and the English manual that distributors hand out is an older revision with the protocol chapter removed entirely.

This is the normal condition for the low-cost end of industrial hardware, not an exception. The device is fine. The documentation supply chain is what is broken: the factory writes one manual in Chinese, the export arm translates a shorter marketing version, and the protocol chapter is the first thing cut because the export arm assumes you will buy the vendor's own gateway.

The working method for this situation is boring and reliable:

1. Collect every manual revision you can find, including the ones in Chinese, including the ones for adjacent model variants. Vendor download pages are versioned by document number, not by model, so a "different" product often carries the same protocol chapter.
2. Diff the register maps across revisions before you trust one. For the ASCB1 the self-powered variant (document 680) and the split-type variant (document 591 V1.1) turn out to carry byte-identical maps: same 190 address tokens, same order, same worked frame example. That agreement across two independently published documents is worth more than either document alone.
3. Verify on the bench against a known load before you verify on site. A 100 W lamp and a clamp meter settles the word-order question, the scaling question and the register-offset question in twenty minutes.
4. Write the map down in your own repo, in your own format, with the document number and revision you took it from. The vendor's download link will rot. Your integration will outlive it.

Step 2 is the one people skip, and it is the one that catches transcription errors. A register map you read once from one PDF is a hypothesis. A register map that two documents agree on is a fact.

Is breaker metering accurate enough to bill on?

For internal cost allocation, yes. For an invoice a tenant can dispute, be careful, and understand exactly what standard your device claims.

Breaker-embedded metering is governed by IEC 61557-12, whose current consolidated edition 2.1 was published on 21 May 2021 (IEC webstore). The standard classifies a circuit breaker with built-in sensors as a PMD-D — a power metering and monitoring device with embedded sensors, as opposed to a PMD-S that reads through external CTs. Schneider's MasterPact MTZ with a MicroLogic X control unit, to take a documented high-end example, is declared PMD-DD with class 1 accuracy for power and energy (Schneider Electric).

Two things in that standard matter commercially, and neither is on the product page.

First, the standard defines three separate uncertainty levels: intrinsic uncertainty, operating uncertainty and overall system uncertainty. A vendor quoting "class 1" is usually quoting intrinsic uncertainty, measured under reference conditions. Operating uncertainty, which includes the effect of temperature, harmonics, unbalance and running near the bottom of the current range, is the number your tenant's dispute will actually turn on. A breaker rated 63 A metering a 2 A standby load is not operating anywhere near its reference conditions.

Second, IEC 61557-12 excludes billing meters from its scope. A PMD is classified by function: PMD-I is intended for energy efficiency and cost allocation, and the standard permits its use for bill checking or sub-billing only where the device carries a third-party certificate. PMD-II and PMD-III cover basic and advanced power monitoring. None of these is the same thing as a meter type-approved for revenue metering.

The practical rule I give clients: use breaker metering for allocation, trending and anomaly detection freely; if the number lands on an invoice that a tenant signs, put a type-approved meter at the boundary and reconcile the breaker readings against it. The breaker tells you which circuit, the approved meter tells you how much. That split also survives an audit, which the breaker readings alone will not.

What does the retrofit actually cost in wiring?

Here is the detail that kills schedules: these breakers do not power their own RS485 from the line they protect. The ASCB1 exposes a four-pin connector carrying 12V+, 12V-, A and B. Energise the 230 V line and the breaker trips and closes normally, and the RS485 port stays dead. You need a DC 12 V auxiliary supply in the panel, and it needs to be on the same rail as the poller or the whole string goes dark together.

You then choose between two topologies, and the choice is mostly about who owns the data path.

Vendor gateway. The ASCB1-M gateway supplies the 12 V, daisy-chains up to 16 breakers on the four-pin cable, assigns slave addresses automatically from its local settings menu, and uplinks over Ethernet, WiFi or 4G. It is the fast path. It is also a second vendor cloud in your architecture unless you point its uplink at your own broker, and the address assignment happens in a menu behind a factory-default password that nobody ever changes.

Straight RS485 into your own poller. Officially supported, and the honest choice for anyone who already runs an ingestion service. You supply the 12 V, you supply the RS485 master, and you inherit one real problem: without the gateway's auto-addressing, every breaker ships on the same default slave address, and you must set addresses one at a time before they share a bus. Register 0x1105 holds the slave address and 0x1106 the baud rate, so the procedure is: connect exactly one breaker, write its address, label it physically, disconnect, repeat. Budget ten minutes per device and do it on a bench, not in a live panel.

Default baud is 9600, 8N1, adjustable up to 115200. At 9600 with sixteen devices you are reading roughly 30 registers each; a full sweep lands comfortably inside a few seconds, which is fine for energy but useless for anything you want to call real-time. If you need sub-second reaction to a trip, do not poll for it — the breaker's own protection already acted, and your job is to record it, not to detect it. That distinction is the whole argument in Modbus polling vs event-driven ingestion.

Which register is the dangerous one?

Register 0x0019. Write 1 and the breaker closes. Write 0 and it opens.

Every other address in the map is read-only telemetry, and then there is one 16-bit write that can drop power to a floor. Treat it as a different class of object from the rest of the integration:

• Separate code path. Control writes do not belong in the polling loop or in the same service. If your poller cannot write, a bug in the poller cannot trip a panel.
• Explicit allow-list. Name the breakers that are allowed to be controlled remotely, in configuration, and reject the rest at the API boundary. Most breakers in a retrofit are metering-only, forever.
• Read back and log. After a write, read 0x0018 and record the observed state with the operator identity that requested it. Modbus RTU gives you no acknowledgement worth the name and no identity at all.
• Know what the load is. Remote disconnect on a tenant sub-circuit is a commercial action. Remote disconnect on a circuit feeding a lift, a fire pump, a server room or medical equipment is a safety incident. The device cannot tell the difference. Your configuration has to.

The enforcement side of this — when a remote cut is a legitimate business workflow and when it is not — is covered in room-level energy control with smart breakers.

Modbus has no authentication, so where do you put the security?

Modbus was specified in 1979 for a serial link inside a cabinet. It has no authentication, no encryption and no integrity protection beyond a CRC that catches noise, not malice. Anyone who can reach the bus can read every register, and anyone who can reach the bus can write 0x0019.

This is not a theoretical concern once the bus gets an IP address. On 17 March 2026 CISA published advisory ICSA-26-076-02 for Schneider Electric SCADAPack and RemoteConnect: CVE-2026-0667, CVSS 9.8, improper exception handling over Modbus TCP allowing remote code execution without authentication (CISA). That is a serious industrial vendor with a security programme. The generic RS485-to-Ethernet converter in a Rp 400.000 panel retrofit has neither.

So the security lives in the transport, not the protocol:

1. Never expose Modbus TCP to the internet. Not behind a port forward, not on a "temporary" rule. Internet-exposed Modbus endpoints are scanned continuously and indexed by search engines built for the purpose.
2. Put the poller on the panel side. A small edge device that speaks RS485 locally and pushes outbound MQTT or HTTPS means there is no inbound path at all. The bus stays in the cabinet, which is where the protocol was designed to live.
3. VLAN the serial converters. If you must use Modbus TCP, put the converters on a management VLAN reachable only by the poller, and firewall port 502 to that one source.
4. Patch the converter, not just the breaker. The RS485-to-Ethernet box is a networked computer running an unmaintained firmware. Inventory it, and assume it will never receive a security update.

Where does the money actually come from?

The business case rarely holds up if you write it as "monitoring". It holds up when you connect the readings to a tariff line and a regulatory deadline.

On the tariff side, PLN's non-subsidised rates for September 2026 hold at Rp 1.444,70/kWh for B-2/TR customers, 6.600 VA to 200 kVA, and Rp 1.114,74/kWh for B-3/TM above 200 kVA — unchanged through the July–September quarter (Antara, 1 September 2026). At that B-2 rate, a single 3 kW load left running 12 hours a night that nobody knew about costs about Rp 1,6 juta a month. One discovery of that size pays for an eight-breaker retrofit. In practice the first month of per-circuit data on an unmonitored building finds two or three.

On the regulatory side, PP 33/2023 already requires energy management from users above 500 tonnes CO2e, and the revision in progress lowers the mandatory energy-audit threshold for buildings from 6.000 to 4.000 tonnes of oil equivalent per year, with roughly 4.700 government buildings falling under the audit obligation (Katadata). Permen ESDM No. 1/2026, issued 5 January 2026, then sets out what an investment-grade energy audit has to contain: a baseline, measurement, cost analysis and investment feasibility (peraturan.go.id).

Read those two together and the sales conversation changes. An audit needs a measured baseline. A building with one incoming meter has no baseline it can break down, and its consultant will spend the first month of the engagement installing temporary loggers. A building with per-circuit metering already running has twelve months of history on the day the auditor walks in. The breakers stop being a monitoring toy and start being the evidence layer.

The takeaway

The hardware in a Modbus breaker retrofit is a half-day job. Everything that makes the project succeed or fail is documentation, addressing, accuracy class and network design.

Get the register map from more than one source and diff it. Verify the word order on a bench before you argue with a client about their voltage. Bring your own 12 V. Keep the control register out of the polling service. Keep Modbus off the internet, always. And decide early whether these numbers will ever appear on an invoice, because that single question decides whether a class 1 breaker is sufficient or whether you need an approved meter standing behind it.

Meter what you can switch. Switch only what you meant to. Document what you measured.