4G/5G Industrial Cellular Router

LTE Cat-4 vs Cat-12 vs 5G NR Sub-6: What Your Application Actually Needs

The throughput and latency specifications of each cellular tier look impressive on a datasheet. The engineering question is whether the gap matters for your specific traffic.

Modbus SCADA polling. Modbus RTU at 9600 baud over RS485 generates under 10kbps of TCP-encapsulated traffic to a cloud historian. LTE Cat-1 (10Mbps downlink, 5Mbps uplink) is over-specified for this use case. Cat-4 (150Mbps downlink, 50Mbps uplink) is certainly sufficient, but the throughput headroom is not the reason to choose it — the reason is Cat-4 module availability, pricing ($8–15 module cost vs Cat-1’s $5–8), and compatibility with carrier bands across EU (Band 1/3/7/8/20), US (Band 2/4/12/17/66), and Japan (Band 1/3/19/21).

Video surveillance and OTA firmware updates. A single H.264 720p stream at medium quality runs 1–2Mbps sustained. A firmware image for an edge device is typically 50–200MB. Neither exceeds Cat-4 uplink capacity at signal levels above -100dBm RSRP. Cat-12 (600Mbps downlink, 100Mbps uplink, 3× carrier aggregation) is relevant only if you are streaming multiple high-definition video feeds simultaneously or running a local LTE router serving a cluster of devices. For OTA updates, the cost difference between Cat-4 and Cat-12 modules (roughly $10–25 per unit) is not recovered by faster update windows.

5G NR Sub-6GHz and real-time control. 5G NR theoretical latency is 1–5ms vs LTE’s 20–50ms, but public 5G network latency in practice is 10–30ms for Sub-6GHz deployments and depends heavily on the operator’s core network configuration. For Modbus polling and MQTT telemetry, 50ms round-trip latency to a cloud broker is indistinguishable from 10ms — SCADA systems tolerate scan cycle jitter measured in seconds, not milliseconds. The 5G latency advantage is real for time-critical closed-loop control (motion control, protection relay coordination), but those applications require private 5G networks with dedicated slicing, not public carrier 5G. Do not pay for 5G NR unless you have a private 5G deployment or a specific carrier agreement with a sliced network. Current 5G NR module pricing adds $40–80 per unit over Cat-12 and $60–100 over Cat-4.

Roaming SIMs and carrier lock-in. Routers deployed across multiple countries or on mobile assets (rail, vehicles, vessels) commonly use multi-IMSI roaming SIMs. Confirm the router’s APN configuration supports multiple APN profiles — some budget-tier devices allow only one saved APN per SIM slot. For US deployments, PTCRB pre-certification is required for devices sold on AT&T, T-Mobile, and Verizon networks. A router with CE RED but without PTCRB cannot be legally activated on a US carrier-locked SIM. This is a common sourcing gap when purchasing from Chinese OEMs targeting primarily European markets.

Modbus RTU/TCP to MQTT Gateway: What the Embedded Firmware Actually Does

Most Chinese industrial routers in the $120–300 price range include an embedded Modbus-to-MQTT gateway function — a software component running in the router’s Linux userspace that polls Modbus RTU/TCP slaves and publishes register values as MQTT messages. This eliminates the need for a separate edge computing node in simple telemetry deployments.

How it works mechanically. The gateway daemon is configured with a list of Modbus slave devices (device ID, register address, data type, polling interval). On each polling cycle, it issues Modbus read requests over the RS485 serial port or via Modbus TCP to IP-addressed PLCs. The read register values are packed into a JSON or binary payload and published to an MQTT broker topic. A typical configuration polls 20 slave devices at 5-second intervals, generating 240 MQTT messages per minute — well within broker and cellular bandwidth limits.

Configuration tool quality. This is where Chinese OEM routers diverge significantly. Higher-quality suppliers (Robustel, InHand Networks) provide web UI configuration with register address validation, a built-in Modbus device template library (common PLC and meter types), and YAML/JSON export for bulk provisioning. Budget-tier routers may require direct editing of a configuration file via SSH with no validation — a single incorrect register type causes the daemon to silently skip that device with no error log. Request a demo of the configuration workflow before committing to a supplier.

MQTT topic mapping and QoS behavior. Confirm the factory default topic structure matches your broker’s expectation. A common pattern is {gateway-id}/modbus/{slave-id}/{register-address}, but some firmware uses flat topics or requires custom topic templates. QoS level selection matters for SCADA reconnection: QoS 0 (at-most-once) drops messages during cellular failover; QoS 1 (at-least-once) delivers buffered messages after reconnection but may deliver duplicates that your historian must handle; QoS 2 (exactly-once) is rarely needed for sensor telemetry and adds latency. Retained message support — where the broker stores the last published value so a newly connected subscriber receives current state immediately — is essential for SCADA applications where a historian reconnection should not see a data gap.

Factory firmware vs OpenWrt. Some Chinese industrial routers ship on an OpenWrt base with the vendor’s Modbus-MQTT application added as a package. This is auditable — you can inspect the source, replace the Modbus daemon, and add custom routing rules. Closed proprietary firmware (more common in the $85–150 price tier) trades flexibility for a polished web UI but prevents any modification of gateway behavior. For OEM deployments where you need to rebrand the management interface or integrate with a custom MQTT payload format, OpenWrt-based firmware is significantly easier to work with.

Dual SIM Failover: Implementation Details That Affect Industrial Session Reliability

Dual SIM is a standard marketing claim. The implementation detail that matters for SCADA deployments is how long the failover takes and what happens to active TCP sessions and VPN tunnels during the carrier switch.

Hot-standby vs cold-standby vs load-balance. Hot-standby keeps both SIM slots registered with their respective carriers simultaneously — SIM 1 is the active data path, SIM 2 is registered and idle. Failover requires only a data path switch at the router, not a full cellular registration cycle. Failover time: 3–10 seconds. Cold-standby powers down SIM 2 when SIM 1 is active — failover requires a full cellular modem reset and new registration, typically 30–90 seconds depending on the carrier’s RACH (Random Access Channel) congestion. Load-balance distributes traffic across both SIMs simultaneously and is primarily useful for high-throughput applications, not reliability.

Carrier detection methods. The router must detect SIM 1 failure to trigger failover. Detection options in order of reliability:

• ICMP ping to the cellular gateway IP (detects modem failure but not upstream internet outage)
• DNS query to a public resolver (detects loss of DNS but passes if DNS is reachable via cellular while your target host is down)
• HTTP probe to a carrier-neutral host (most reliable — confirms end-to-end internet connectivity)

Specify the probe destination and failure threshold explicitly. A router pinging 8.8.8.8 every 5 seconds with a threshold of 3 consecutive failures will initiate failover after at least 15 seconds. For SCADA applications, set the probe target to your actual MQTT broker or SCADA server host — this catches cases where the cellular network is up but your specific destination is unreachable.

SCADA session recovery after failover. When the cellular data path changes, the source IP address changes (new IP from the new carrier’s DHCP pool), which tears down all existing TCP connections and VPN tunnels. An IPsec or WireGuard VPN tunnel must re-establish after failover. WireGuard re-establishes faster (handshake takes under 1 second once the new IP is active) than IPsec IKEv2 (3–10 seconds for IKE_SA and CHILD_SA negotiation). Your MQTT client on the device side must implement reconnect-with-backoff logic and re-subscribe to topics after reconnection — a SCADA session that does not auto-reconnect will lose data for the entire failover + VPN + broker reconnect window, which can be 60–180 seconds with cold-standby SIM configurations.

SIM management in the field. DIN-rail industrial routers use standard mini-SIM or nano-SIM slots. For deployments in sealed enclosures, confirm the SIM slots are accessible without removing the router from the DIN rail. Carrier PIN codes on SIMs add a registration delay and a failure mode — if the router reboots without saving the PIN, it will fail to register. Some Chinese OEMs do not implement PIN unlock correctly; test with a PIN-protected SIM before deployment. APN auto-detection is advertised by several manufacturers but works reliably only for major carriers in China and EU — for US MVNO SIMs or Asian regional carriers, manual APN configuration is required.

Chinese Supplier Landscape: What Separates Tier 1 from Budget OEM

The 4G/5G industrial router market from China has a wide quality range. Understanding where suppliers sit on that range reduces audit time.

Tier 1 — carrier-certified, documented reliability. Robustel (深圳市睿博联科技) and InHand Networks (映翰通) are the two Chinese OEM suppliers most commonly found in Western industrial deployments. Both hold PTCRB approval for their LTE product lines, publish MTBF figures backed by HALT/HASS test reports (not just MIL-HDBK-217F calculations), and provide firmware with a documented release cycle and CVE response process. InHand’s IR300/IR600 series has documented deployments in EU utility SCADA and US oil & gas RTU replacement. Robustel’s R2000 series covers -40°C to +70°C with a documented derating curve showing processor clock throttling above 55°C ambient. Unit pricing is $150–480 depending on cellular tier and configuration. MOQ for custom firmware or private label is typically 50–100 units.

Budget OEM tier — USR IOT, Waveshare, and catalog white-label. USR IOT (有人物联网) and Waveshare produce routers in the $85–150 range. Their Modbus-MQTT gateway firmware is functional for basic telemetry. What they typically lack: PTCRB certification (CE RED only — not valid for US carrier activation), MTBF test reports (specifications are calculated, not tested), and documented -40°C cold-start validation. Waveshare publishes operating temperature as -40°C to +75°C across their industrial line without derating curves or supporting test data. For EU industrial deployments where the installation environment is a heated control room (min 0°C), this is a reasonable choice at lower cost. For outdoor RTU cabinets in northern Europe or North America where -30°C cold-start is required, the validation gap is a risk you cannot close without commissioning your own testing.

Quality indicators to verify in a factory audit. Request: (1) PTCRB certificate if US carrier deployment is in scope — verify the certificate lists the specific model number and modem module vendor; (2) MTBF test report referencing a specific test method and sample size, not a calculated figure from a parts-count spreadsheet; (3) operating temperature test report per IEC 60068-2-1 (cold) and IEC 60068-2-2 (dry heat) with a cold-start power-on verification at -40°C; (4) firmware OTA security documentation — signed firmware images with RSA-2048 or ECDSA P-256, secure boot chain, and documented rollback behavior on failed update; (5) watchdog behavior specification for cellular modem lockup — confirm the router implements a hardware watchdog that resets the cellular modem independently of the main CPU if the modem stops responding to AT commands, without requiring a full system reboot.

For an example of how these verification criteria applied in a deployed project, see the EU industrial IoT gateway case study. For broader sourcing process guidance, see the industrial IoT hardware sourcing guide and the industrial IoT industry page.

Our sourcing service covers supplier identification and first-pass qualification across the Chinese industrial router market. The inspection service includes cellular registration testing, SIM failover timing measurement, and Modbus gateway functional verification against your specific register map before shipment.