How to Enable Cellular Connectivity for Industrial Routers, DTU, and RTU in SCADA Deployments?

May 31, 2026 · 8 min read · Technical Whitepapers

Industrial cellular routers convert serial RS-232/RS-485 protocols to cellular networks, enabling SCADA connectivity for PLC, RTU, and data loggers in remote sites. Dual-SIM redundancy ensures 200-500ms failover, preventing production stops in mission-critical industrial deployments.

TL;DR: Industrial cellular routers provide serial-to-cellular networking for PLC, RTU, and data loggers in remote SCADA applications. These devices perform protocol conversion (Modbus RTU to Modbus TCP), enable VPN tunnels (IPsec, PPTP, L2TP) for security, and support dual-SIM failover with 200-500ms switching. Operating temperature range spans -40C to +85C with EMC protection for harsh industrial environments.

Source: USR-G781 Technical Documentation, Pusr. Available at https://www.pusr.com/products/cellular-modem-routers-usr-g781.html

Architecture & Mechanism:

Industrial cellular routers aggregate field devices (PLC, RTU, sensors) via serial interfaces (RS-232/RS-485) and Ethernet ports, then bridge data to cloud platforms over 4G/5G cellular networks. The router performs transparent data transmission, protocol conversion, and security encryption.

Flowchart:

Field Devices (PLC/RTU/Sensor) --(RS-485/232)--> Industrial Router --(Ethernet/Cellular)--> Core Network --(VPN Tunnel)--> SCADA Server / Cloud Platform --(Modbus TCP/MQTT)--> Control Center

Data flow sequence: (1) Field device transmits serial data via RS-485 (Modbus RTU). (2) Router receives data through serial port. (3) Internal processor performs protocol conversion to Modbus TCP or encapsulates in MQTT. (4) Cellular module transmits encrypted packet over 4G network. (5) VPN tunnel terminates at enterprise security gateway. (6) SCADA server receives standardized Modbus TCP queries.

Source: CSDN Blog, "4G Industrial Routers: Core Connector of Industrial IoT", May 2026. Available at https://blog.csdn.net/m0_65946824/article/details/147334406

Technical Comparison: Industrial Communication Protocols

Source: USR-G781 Technical Documentation. Available at https://www.pusr.com/products/cellular-modem-routers-usr-g781.html; CSDN Blog, "4G Industrial Routers: Core Connector of Industrial IoT", May 2026. Available at https://blog.csdn.net/m0_65946824/article/details/147334406

Key Technical Specifications for Industrial Cellular Routers:

1. Serial Interfaces: RS-232 (300bps-460800bps) and RS-485 (300bps-460800bps) for legacy device connectivity.

2. Ethernet Ports: WAN (configurable as LAN) and LAN ports for IP-based device aggregation.

3. Cellular Standards: 4G LTE (Cat-4/Cat-1), 3G/2G fallback for global coverage.

4. VPN Support: IPsec, PPTP, L2TP, OpenVPN, GRE for encrypted site-to-site tunnels.

5. Industrial Hardening: EMC protection, wide input voltage (DC 9-36V), hardware watchdog for 7x24 operation.

6. Operating Temperature: -40C to +85C for extreme industrial environments.

7. Management: AT commands, web GUI, SMS remote configuration, cloud platform integration.

Source: USR-G781 Datasheet. Available at https://www.pusr.com/products/cellular-modem-routers-usr-g781.html; Pusr Technical Documentation.

Dual-SIM Card Redundancy Architecture:

Dual-SIM industrial routers insert two SIM cards from different carriers (e.g., China Mobile + China Unicom) for cross-carrier coverage. Under normal conditions, primary SIM handles data transmission while secondary remains on standby.

Failover trigger conditions: Signal strength falls below preset threshold (e.g., -90 dBm), network disconnection detected, or carrier maintenance window.

Failover timing: Router automatically switches to secondary SIM in 200-500 milliseconds. This latency is imperceptible to PLC communication cycles (typically 100ms+) and SCADA polling (typically 1-10 seconds).

Source: Pusr Blog, "Dual-SIM Card Redundancy Design of IoT Router", November 2025. Available at https://www.pusr.com/blog/Dual-SIM-Card-Redundancy-Design-of-IoT-Router

Step-by-Step Configuration for Modbus RTU to TCP Conversion:

1. Connect PLC RS-485 A/B terminals to router serial port (TX+/TX-).

2. Access router web interface (default: 192.168.1.1). Navigate to Serial Settings -> Mode: Modbus RTU to TCP.

3. Configure serial parameters: Baud rate (9600-115200), Data bits (8), Stop bits (1), Parity (None) to match PLC configuration.

4. Set TCP server endpoint: SCADA server IP and port (typically 502 for Modbus).

5. Enable heartbeat packet: Configure registration package (device ID) and heartbeat interval (30-60 seconds) to maintain connection.

6. Configure APN: Set cellular APN provided by IoT SIM operator (e.g., CMMTM for China Mobile M2M).

7. Enable VPN (optional): Configure IPsec tunnel to enterprise gateway for encrypted SCADA traffic.

8. Test connectivity: Use AT+CSQ to verify cellular signal, AT+ICMP for network ping test.

Example Configuration via AT Commands:

AT+CSQ # Check signal quality (0-31, 99=not detected)

AT+CGATT? # Check GPRS attachment status (1=attached)

AT+SAPBR=3,1,"APN","cmnet" # Set APN for China Mobile

AT+HTTPACTION=1 # Test HTTP POST to cloud platform

Source: USR-G781 AT Command Set Documentation. Available at https://www.pusr.com/products/cellular-modem-routers-usr-g781.html

When the router connects but SCADA gets nothing — field debugging patterns

Scenario 1: Industrial router loses PPP connection after 24-48 hours of operation.

Root Cause: Carrier NAT timeout or ISP-level PPP session expiry. Some cellular operators terminate idle PPP connections after 2-4 hours.

Resolution: (1) Enable keepalive packets with 30-second interval using AT+CACHAT command. (2) Configure router to send registration package every 5 minutes to maintain session. (3) Set SCADA polling interval <60 seconds to maintain active traffic. (4) Consider using MQTT with QoS 1 instead of raw TCP socket.

CLI Command: AT+CACHAT=1,30 # Enable data channel with 30-second keepalive

Scenario 2: Modbus RTU polling returns correct data but SCADA shows intermittent timeout errors.

Root Cause: Modbus RTU response timeout shorter than actual device response time. PLC processing delay exceeds SCADA timeout threshold.

Resolution: (1) Increase SCADA Modbus timeout from default 3 seconds to 10 seconds. (2) Reduce polling register count from 125 to 10 registers per request. (3) Enable router response caching feature. (4) Check router serial buffer overflow using AT+SHOWRB command.

Configuration: In SCADA software, set "Response Timeout" parameter to 10000ms and "Inter-frame delay" to 50ms.

Source: Industrial router deployment experience; CSDN Blog, "4G Industrial Routers: Core Connector of Industrial IoT", May 2026. Available at https://blog.csdn.net/m0_65946824/article/details/147334406

Industrial IoT Module Ecosystem:

Compatible cellular modules for industrial routers include Quectel EC21 (Cat-4), EG25-G (Cat-4), BG96 (Cat-M/NB-IoT); Telit Cinterion LE910, ME910; Fibocom L710, L610. These modules support global frequency bands (B1-B84) for worldwide deployment.

M2M modem routers with dual-SIM architecture support automatic operator switching based on signal strength, latency, and cost optimization. Common brands include USR (G781, G805s), Cisco (IR1101), Sierra Wireless (GX450), and Alibaba Cloud IoT (AS-600).

Source: Alibaba Cellular Modems for SCADA Marketplace. Available at https://www.alibaba.com/showroom/cellular-modems-for-scada.html

FAQ (Long-tail Queries):

Q: What is the maximum serial baud rate supported by industrial routers for Modbus RTU?

A: Most industrial cellular routers support serial baud rates from 300 bps to 460800 bps. Standard Modbus RTU deployments use 9600 bps or 115200 bps. Higher baud rates (230400, 460800) are used for firmware uploads or batch data retrieval but require shielded RS-485 cable with proper termination (120 ohm resistor at bus ends).

Q: How does dual-SIM failover affect SCADA polling response time?

A: Dual-SIM failover completes in 200-500ms. Standard Modbus TCP polling intervals are 1-10 seconds, and PLC scan cycles typically run at 50-500ms. This failover latency remains below SCADA timeout thresholds, causing no observable interruption. For safety-critical systems (protective relays), verify SCADA timeout setting exceeds 500ms.

Q: Can industrial routers tunnel SCADA traffic over VPN without introducing latency that violates PLC timing requirements?

A: IPsec VPN overhead adds 5-15ms latency per hop due to encryption/decryption. For PLCs with cycle times >100ms (most process automation), this overhead remains acceptable. Safety systems with <20ms real-time requirements should verify VPN tunnel latency using path latency tools (ping, traceroute) before deployment.

Source: Pusr Technical Documentation. Available at https://www.pusr.com/products/cellular-modem-routers-usr-g781.html; CSDN Blog, "4G Industrial Routers: Core Connector of Industrial IoT", May 2026. Available at https://blog.csdn.net/m0_65946824/article/details/147334406

References