Cellular IIoT Router

R40 R40A R40B

User Manual
Version 2.0

Date: 2025-7-18

Shenzhen Beilai Technology

https://www.bliiot.com
 Cellular IIoT Router

Preface
Thanks for choosing BLIIoT Cellular IIoT Router. These operating instructions contain all the
information you need for operation of a device in the R40 family.

Copyright
This user manual is owned by Shenzhen Beilai Technology Co., Ltd. No one is authorized to copy,
distribute or forward any part of this document without written approval of Shenzhen Beilai
Technology. Any violation will be subject to legal liability.

Disclaimer
This document is designed for assisting user to better understand the device. As the described device
is under continuous improvement, this manual may be updated or revised from time to time without
prior notice. Please follow the instructions in the manual. Any damages caused by wrong operation
will be beyond warranty.

Revision History
DATE VERSION DESCRIPTION Editor
2020.03.13 V 1.0 First edition CJ
2020.09.30 V1.1 Modify some configuration instructions CJ
2021.2.25 V1.2 Added link to Huawei Cloud IO platform PENG
2021.03.18 V1.3 Add device mapping register address from
64-127 to 64-256 XJH

2021-9-30 V1.4 (1) MQTT: Add a new mode that only

release changed data
(2) Cellular network: Add an enable switch to
power on/ off the cellular modem
(3) Support custom MQTT data format
(4) Modbus master: Increase the setting of
acquisition cycle and response timeout time XJH
(5) Cycle timer: Increase the settings of start,
end time and cycle times
(6) Network settings: Add WAN/LAN
switching function
(7) USB interface can load external storage
for network sharing functions
2022-5-17 V1.5 Add conditional operation function,
XJH
logarithm, exponential operation
2023-2-17 V1.6 Support SNMP, add new function named
BLRMS: remote configuration, remote HYQ
upgrade firmware etc.
2025-7-18 V2.0 Optimize circuit and enclosure design, and
HYQ
refine firmware programming.

Page 2 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Table of contents
1. Product Description ............................................................................................................................ 7
1. 1 Brief Introduction ...................................................................................................................... 7

1.2 Typically Applications ................................................................................................................ 7

1.3 Safety Directions ....................................................................................................................... 7

1.4 Standard Packing List ............................................................................................................... 8

1.5 Main Features ............................................................................................................................8

1.6 Technical Parameters ................................................................................................................9

1.7 Model Selection ....................................................................................................................... 11

2. Hardware ...........................................................................................................................................11
2.1 Dimension ................................................................................................................................12

2.2 Indicator Light .......................................................................................................................... 12

2.3 Reset ....................................................................................................................................... 13

2.4 Console Port ............................................................................................................................13

2.5 SIM Card ................................................................................................................................. 13

2.6 Connect External Antenna ...................................................................................................... 14

2.7 Router GND .............................................................................................................................14

3. Installation .........................................................................................................................................14
4. Router Operation .............................................................................................................................. 15
4.1 Start the Router ....................................................................................................................... 15
4.1.1 Power on the Router ..................................................................................................... 15
4.1.2 System Running Status ................................................................................................ 16
4.2 SIM Card Operation ..............................................................................................................16

4.3 Serial Port Operation ............................................................................................................ 17

4.3.1 Modbus Master Function ............................................................................................18
4.3.2 Modbus Slave Function ..............................................................................................19
4.3.3 Transparent Transmission ..........................................................................................19
4.3.4 Modbus RTU to TCP Protocol Conversion ................................................................ 19
4.4 Digital Output Instructions .................................................................................................... 19
4.4.1 DO Wiring ......................................................................................................................20
4.4.2 DO Introduction .............................................................................................................20
4.5 Digital Input Instructions ....................................................................................................... 21
4.5.1 DI Wiring ....................................................................................................................... 22
4.5.2 DI Introduction ...............................................................................................................22
4.6 Analog Input Instructions ...................................................................................................... 22

Page 3 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router
4.6.1 AI Wiring ........................................................................................................................23
4.6.2 AI Introduction ............................................................................................................ 23
5. Login to Web Configuration .............................................................................................................. 23
5.1 Wired Connection ................................................................................................................. 24

5.2 WiFi Connection ................................................................................................................... 27

5.3 Factory Default Settings ....................................................................................................... 29

5.4 Log in to Web Configuration Page ....................................................................................... 29

6. Router Settings ................................................................................................................................. 31
6.1 Status .................................................................................................................................... 31

6.2 System .................................................................................................................................. 32

6.2.1 System Properties ...................................................................................................... 32
6.2.2 Management Rights ................................................................................................... 33
5.2.3 Software Package ...................................................................................................... 33
6.2.4 Backup/Upgrade .........................................................................................................34
6.2.5 Reboot ........................................................................................................................ 35
6.3 Network .................................................................................................................................35
6.3.1 Network Settings ........................................................................................................ 35
6.3.1.1 LAN Port ...........................................................................................................36
6.3.1.2 WAN Port ......................................................................................................... 38
6.3.1.3 WAN6 Port ....................................................................................................... 40
6.3.1.4 4G Interface ..................................................................................................... 41
6.3.2 WiFi .............................................................................................................................43
6.3.2.1 WLAN Hotspot (WiFi AP mode) .......................................................................43
6.3.2.2 WLAN Client .....................................................................................................46
6.3.3 Cellular Network ......................................................................................................... 48
6.3.4 DHCP/DNS .................................................................................................................49
6.3.5 Host Names ................................................................................................................51
6.3.6 Static Routes .............................................................................................................. 52
6.3.7 Diagnosis ....................................................................................................................53
6.3.8 Firewall ....................................................................................................................... 53
6.3.8.1 Zone Settings ...................................................................................................53
6.3.8.2 Port Forwards .................................................................................................. 56
6.3.8.3 Traffic Rules ..................................................................................................... 57
6.3.8.4 Custom Rules .................................................................................................. 57
6.3.9 Network Shares ..........................................................................................................58
6.4 VPN .......................................................................................................................................59
6.4.1 IPSec .......................................................................................................................... 59
6.4.2 L2TP ........................................................................................................................... 61
6.4.3 OpenVPN ................................................................................................................... 62
6.5 Remote I/O ............................................................................................................................64
6.5.1 Serial Port Settings .....................................................................................................64
6.5.2 Transparent Transmission ..........................................................................................65

Page 4 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router
6.5.3 Digital Input and Output ................................................................................................ 65
6.5.4 Analog Input .................................................................................................................. 66
6.5.5 Modbus RTU to TCP .....................................................................................................67
6.5.6 Modbus Slave ............................................................................................................... 68
6.5.7 Modbus Master ............................................................................................................. 69
6.6 Event and Alarm ................................................................................................................... 73
6.6.1 E-mail & SMS ................................................................................................................73
6.6.2 Device Monitor ........................................................................................................... 74
6.6.3 Event and Alarm ............................................................................................................75
6.7 Edge Computing and Logical Control .................................................................................. 75
6.7.1 Timer ...........................................................................................................................75
6.7.2 Arithmetic Operation & Logical Operation ................................................................. 77
6.7.3 Combined Conditions Operation ................................................................................80
6.8 Connection to Cloud Platform .............................................................................................. 83
6.8.1 Custom Cloud ............................................................................................................... 83
6.8.2 Alibaba Cloud Platform ...............................................................................................86
6.8.3 AWS Cloud ................................................................................................................. 87
6.8.4 Huawei Cloud ............................................................................................................. 88
6.8.5 Thingsboard Cloud Platform ...................................................................................... 89
6.9 BLRMS (Remote Management System) ..............................................................................91
6.9.1 Introduction .................................................................................................................91
6.9.2 Operation Example .....................................................................................................92
6.9.2.1 Register BLRMS Account ................................................................................ 92
6.9.2.2 Obtain Token .................................................................................................... 93
6.9.2.3 R40 Remote Configuration .............................................................................. 94
6.9.2.4 Remote Read Configuration Operation ........................................................... 97
6.9.2.5 Remote Write Configuration Operation ........................................................... 99
6.9.2.6 Remote Firmware Upgrade ........................................................................... 101
6.9.2.7 Disconnect BLRMS service ........................................................................... 104
6.10 Logout ..................................................................................................................................104
7. Communication Protocol ..............................................................................................................104
7.1 Modbus RTU Protocol ........................................................................................................ 105
7.1.1 Read Device Register Address ................................................................................ 106
7.1.1.1 DI / DO / AI DI Pulse Counter Register Address ........................................... 106
7.1.1.2 Read Device Digital Input Status ...................................................................107
7.1.1.3 Read Device Digital Output Status ................................................................107
7.1.1.4 Control Device Digital Output Status .............................................................108
7.1.1.5 Read Device AI Status and DI Pulse Counter ............................................... 110
7.1.2 Read Mapping Address ............................................................................................ 111
7.1.2.1 Mapping Register Address ............................................................................. 111
7.1.2.2 Read Boolean Mapped Address Data ..............................................................113
7.1.2.3 Modify Boolean Mapping Address Data ........................................................ 114
7.1.2.4 Read Data Type Mapping Address Data ....................................................... 115
7.1.2.5 Modify Data Type Mapping Address Data ..................................................... 116

Page 5 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

7.2 MQTT Protocol ....................................................................................................................116

7.2.1 MQTT Introduction ....................................................................................................117
7.2.2 MQTT Principle .........................................................................................................117
7.2.3 Device Communication Application ..........................................................................117
7.2.4 Device Data Publishing Format ................................................................................118
7.2.5 Device Subscription Data Format ............................................................................ 120
7.3 SNMP Protocol ................................................................................................................... 121
7.3.1 Introduction to R40 SNMP .......................................................................................... 121
7.3.2 R40 SNMP Application Operation Example ............................................................... 121
7.4 SMS Command List ................................................................................................................... 132
8. Appendix – Register Addresses ..................................................................................................... 133
8.1 Local Register Addresses ..................................................................................................... 133

8.2 Mapped Register Addresses .............................................................................................. 135

9. Warranty ..........................................................................................................................................137

Page 6 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

1. Product Description

1. 1 Brief Introduction

R40 Series is a cost-effective, high-performance, and lightweight industrial-grade edge control unit. It
features integrated routing capabilities and a built-in industrial 4G module, combining network
transmission, data acquisition, edge computing, logic control, and cloud platform connectivity in one
compact unit.
With its industrial-grade design and high reliability, the R40 Series ensures long-term stable operation
in harsh environments, delivering a full-stack solution for Industrial IoT (IIoT) applications.

1.2 Typically Applications

 Remote data acquisition and monitoring for base station transceivers, ATM surveillance, power
station monitoring, and pump station control
 Unattended equipment room monitoring, power room monitoring, and environmental monitoring
in data centers
 Remote monitoring of solar power stations and smart EV charging stations
 Electrical parameter collection from power cabinets, including current, voltage, and power
 Water-related data acquisition such as water level, pressure, flow, and velocity
 Meteorological data collection including wind speed, wind force, rainfall, and temperature
 Oil-related parameter monitoring such as oil level, temperature, and pressure
 Temperature and humidity monitoring in smart agriculture and livestock farming
 Data transmission for devices like ATMs, POS terminals, electricity meters, PLCs, and DAQ
systems
 Smart grid data transmission
 Intelligent transportation system data transmission
 Industrial automation data communication
 Environmental protection data transmission
 Data transmission in agriculture, water conservancy, coal mining, and other industries
 Applications in smart agriculture, smart firefighting, smart cities, and intelligent building control

1.3 Safety Directions

Safe Notice
Please do not use this product in places where the use of mobile phones is prohibited

Interference
Do not use the unit when using GSM/3G/4G equipment is prohibited or might bring
disturbance or danger.

Page 7 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

1.4 Standard Packing List

Router R40 X1, 4G Antenna X1, WiFi Antenna X1

35mm Standard DIN rail fixed Bracket, Wiring terminals, SIM ejector PIN
Certificate of Conformity, Warranty Card, User Manual Download Guide
Optional accessories: Power adaptor, GPS antenna, POE board

Note: The standard package does not include SIM card, Power adaptor, GPS antenna, POE board.

1.5 Main Features

 Dual SIM card redundancy and automatic failover between wired and wireless links to ensure high
network availability.
 Built-in Wi-Fi module (STA/AP modes) for easy wireless device connectivity.
 Offers 3×10/100Mbps LAN ports and 1×10/100Mbps WAN/LAN combo port, with optional PoE power
supply (IEEE 802.3af/at) to reduce cabling complexity.
 Integrated DI/DO/AI, RS485/RS232 interfaces; supports Modbus master protocol and scalable to
over 2000 data points.
 Enables local data processing and logic control, supporting coordinated cloud-edge-device
management.
 Supports L2TP, IPSec, and OpenVPN protocols to ensure secure data transmission.

Page 8 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router
 Passed EMC/EMI testing, features wide-temperature design and built-in hardware watchdog to
ensure stable operation in harsh environments.
 Platform connection: Support MODBUS and MQTT protocols, MQTT supports SSL encryption.
 Alarm: Supports SMS and e-mail alarm.
 Timer: Support one-time timer and period timer.
 Upgrade: Support remote upgrade through web page

1.6 Technical Parameters

Item Parameters Description

9~36VDC
Input voltage PoE Version: 48–57 VDC

Power Normal: Typical 240mA@12V

Input current
Supply PoE Version: Typical 70mA@48V
Reverse Polarity
Support
Protection
Protection ESD Level 3, EFT Level 3
CPU MIPS CPU, 580MHz Clock Speed
System Storage 16MB
Memory 128MB
PPP, PPPoE, TCP, UDP, DHCP, ICMP, NAT, HTTP,
Network Protocols HTTPs, DNS, ARP, NTP, SMTP, SSH2, DDNS, SNMP,
etc.
VPN Tunnel IPsec, OpenVPN, L2TP
Software DMZ, DoS protection, IP packet, domain name and
Firewall
Parameters MAC address filtering, port forwarding, access control
Remote Management Supports web-based remote configuration
System Log Support
Supports serial port local TFTP and web-based firmware
Firmware Upgrade
upgrade
Quantity 1
WAN Specification RJ45,10/100Mbps, Automatically adapted to MDI/MDIX
Protection ESD Level 3, EFT Level 3
Quantity 3
Specification RJ45,10/100Mbps, Automatically adapted to MDI/MDIX
Supports 3 PoE power outputs
LAN(PoE)
PoE(optional) Compatible IEEE802.3at/af
Single PoE maximum output power 30W
Protection ESD Level 3, EFT Level 3, Surge Protection
Channel 2
Type 1 RS485, 1 RS232
Serial Port 1200, 2400, 4800, 9600, 14400, 19200, 38400, 57600,
Baud rate
115200, 230400
Data Bit 5, 6, 7, 8

Page 9 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Parity Bit None, Even, Odd

Stop Bit 1, 2
Data transparent transmit, Modbus RTU to TCP,
Working mode
Modbus master, Modbus slave
Protection Isolation Protection, ESD Level 3
Channel 2
Switch Contact Signal (Dry Contact) or Level Signal
Type
(Wet Contact)
DI(Optional) 1: High level 6–30 VDC / Close signal
Input Range
0: Low level (digital 0) 0–3 VDC / Open signal
Pulse Counting Maximum Counting Frequency: 100 Hz
Protection Isolation Protection, ESD Level 3
Channel 2
Type Transistor SINK Output
DO(Optional) Load Voltage Maximum 50VDC
Load Current 500mA(per channel), 625mW
Protection Isolation Protection, ESD Level 3
Channel 4
Type 0–5V, 4–20mA, 0–20mA
AI(Optional)
ADC Resolution 16bit
Protection Isolation Protection, ESD Level 3
Supports Modbus RTU and Modbus TCP master
Modbus Master
protocols, capable of collecting 2000 data points
IoT Protocols Compatible with AWS IoT Core, Alibaba Cloud, Huawei
MQTT Protocol Cloud, ThingsBoard, MQTT custom cloud platforms, and
more.
Quantity 1
Type CONSOLE
Console
Specification Mini USB Interface
Protection ESD Level 3, EFT Level 3, Surge Protection
Antenna Quantity 1
Antenna Type SMA
Protocol 802.11a/b/g/n (mixed)
Mode AP mode, STA mode
Frequency 2.4G
Channel Channel 1 - 13
WiFi Security Open, WPA, WPA2
Encryption AES, TKIP, TKIPAES
Connection number 16(Max)
Speed 300Mbps(Max)
Transmit Distance Outdoor non-blocking/opening, covering up to 20 meters
SSID
Support
Broadcast Switch
Cellular Antenna Quantity 1
Network Antenna Type SMA

Page 10 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Quantity 2
SIM Card Slot Interface Drawer interface, supports 1.8V/3V SIM/UIM (NANO)
Protection In-built 15KV ESD Protection
ALARM Alarm indicator light
SYS System running status indicator
Indicator Light
4G 4G status indicator
WiFi WiFi status indicator
Working Temperature -26～65℃
Working
Storage Temperature -40～85℃
Environment
Humidity 5～95%RH(No condensation)
Reset Button 1
Independent watchdog Onboard independent hardware watchdog
Material Aluminum alloy
Others Dimension Height 110 mm × Length 83 mm × Width 43 mm
IP level IP30
Net weight 500g
Installation DIN35 rail mounting, Wall mounting

1.7 Model Selection

Model SIM WiFi PoE RS485/RS232 DI DO AI Software Function

R40 2 √ Optional x x x x Router-only

Router function, Modbus

1*RS485+1*RS2 master/slave, MQTT
R40A 2 √ Optional 2 2 x
32 function, logic control
function
Router function, Modbus
1*RS485+1*RS2 master/slave, MQTT
R40B 2 √ Optional 2 2 4
32 function, logic control
function

2. Hardware

Page 11 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

2.1 Dimension

2.2 Indicator Light

LED Indicator light

Name Status Description
ON DI or AI trigger alarm
ALARM Alarm indicator light
OFF Normal
Flicks slowly Normal
SYS System running status indicator
OFF Abnormal
Flicks fast Signal normal
4G 4G status indicator
OFF Abnormal

Page 12 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

ON WiFi normal
WiFi WiFi status indicator
OFF Abnormal

2.3 Reset

After the router is running normally, press and hold the Reset button with a pointed object for about
10 seconds until the WAN indicator starts blinking slowly. At this point, restarting the router will
restore the factory default settings.

2.4 Console Port

2.5 SIM Card

When inserting/removing the SIM card, first make sure that the device is turned off, insert the card
take-out pin into the small hole of the card slot, press it slightly to push the card slot out.

Page 13 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

2.6 Connect External Antenna

2.7 Router GND

The router ground wire helps prevent the effects of electromagnetic interference. Before connecting
the device, ground the device through the ground screw connection. Note: This product should be
installed on a well-grounded device surface, such as a metal plate.

3. Installation
This device supports horizontal desktop placement, wall mounting and rail mounting.

Page 14 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

4. Router Operation

4.1 Start the Router

4.1.1 Power on the Router

Power Input Port: The device operates on a DC voltage supply of 9–36V. To use the PoE power
supply function, the power source must provide a DC voltage of 48V–57V (a 48V/2A power supply is
recommended).

Page 15 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

4.1.2 System Running Status

Observe the system status indicator LED (SYS). It remains off immediately after power-on. After waiting
for 1–2 minutes, if the SYS LED starts blinking slowly, it indicates that the device has started and is
operating normally. If the LED remains off, the device may be malfunctioning.

4.2 SIM Card Operation

The device supports dual SIM cards (NANO SIM only). Please power off the device before inserting
the SIM cards. Use a SIM ejector pin to remove the SIM tray, place the NANO SIM cards into the tray
according to the indicated positions, then insert the tray back into the slot. Power the device back on
to complete the process.

After the device is powered on and running normally, log in to the router configuration interface:
Network > Cellular (for login instructions, refer to section 5: Login to Web Configuration). Here you
can view the cellular network registration status.
By default, the 4G cellular connection uses SIM card 1 as the primary option. If you want to use SIM
card 2, go to the Cellular configuration page, select SIM Card 2 in the SIM selection dropdown, then
Save and Apply to switch.
The R40 supports dual SIM card redundancy. When the current SIM card experiences network failure
for more than two minutes, the system will automatically switch to the other SIM card for
communication.
For detailed configuration, please refer to section 6.3.3 Cellular Network.

Page 16 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

4.3 Serial Port Operation

The device is equipped with one RS485 and one RS232 communication interface, supporting
functions such as Modbus Master (not supported on certain models, please check when selecting the
model), Modbus Slave, transparent transmission, and Modbus RTU to TCP conversion.
Note: Each serial port can only be assigned one function at a time. Functions cannot be shared or
used simultaneously on the same port.
If a serial port option is unavailable in a configuration page, it means the port has already been
assigned in another function module.
Different ports (RS485 and RS232) operate independently and do not affect each other.

RS485

RS232

R40A

Page 17 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

R40A Serial Port Interface Description

9 RS485 GND 10 RS232 GND
RS485 11 RS485 A+ RS232 12 RS232 RX
13 RS485 B- 14 RS232 TX

RS485

RS232

R40B

R40B Serial Port Interface Description

15 RS485 GND 16 RS232 GND
RS485 17 RS485 A+ RS232 18 RS232 RX
19 RS485 B- 20 RS232 TX

4.3.1 Modbus Master Function

Modbus Master Function: In this mode, the device acts as a Modbus Master. The serial port connects
to Modbus Slave devices. By configuring slave parameters on the configuration page 6.5.7 Modbus
Master, the device collects data from the slave devices via the Modbus protocol and stores the data in
the local mapping registers. The slave data can be viewed directly on the configuration page, or it can
be uploaded to the server via the Modbus protocol or MQTT protocol configured in section 6.8 Cloud
Platform, thus realizing the function of Modbus to MQTT protocol conversion.
When the Modbus Master setting selects the slave interface as RS485, RS232, or Ethernet, the
device will continuously and actively poll the slave devices using the Modbus RTU protocol (for
RS485 and RS232) or the Modbus TCP protocol (for Ethernet), reading the values of the registers
from the slave devices into the mapping area of the local device for storage. In this way, the register
data of the slave devices is mapped into the local device. Reading or writing the mapped registers of
the local device will directly transmit data to the slave devices via the RS485 port, RS232 port, or
Ethernet. There is a one to one correspondence between the slave register addresses and the local
device’s mapped register addresses, which forms the mapping register list.
Users can connect various slave devices through the RS485 port, RS232 port, or Ethernet port to
extend I/O capabilities and enable read/write functions for smart instruments and intelligent devices.
For example, they can connect to our IOy series Edge I/O modules to expand the number of DIN, DO,
AI, AO, and PT100 input channels, or connect to a power parameter monitoring module to read
three-phase current, voltage, and power, or connect to a UPS power supply for parameter monitoring,
and so on. Various combinations of these smart devices can meet the functional requirements of
most application scenarios.

Page 18 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

4.3.2 Modbus Slave Function

Modbus Slave Function: The device acts as a Modbus slave, and the serial port is connected to a
Modbus master device. By configuring the serial port parameters and server parameters on the
configuration page 6.5.1 Serial Port Settings, the master device can collect the I/O data of this device
via the Modbus RTU protocol (RS485 and RS232 interfaces) or the Modbus TCP protocol (Ethernet
interface).

4.3.3 Transparent Transmission

Transparent Transmission Function: The device acts as a data relay station between the server and
the slave device. By configuring the serial port parameters and server parameters on the
configuration page 6.5.1 Serial Port Settings, the device transparently forwards data uploaded from
the slave to the server and data sent from the server to the slave without processing the data content,
achieving transparent data transmission.

4.3.4 Modbus RTU to TCP Protocol Conversion

Modbus RTU to TCP Function: The device communicates with the slave devices using the Modbus
RTU protocol, and communicates with the server using the Modbus TCP protocol. By configuring the
serial port parameters and server parameters on the configuration page 6.5.1 Serial Port Settings, the
device automatically converts Modbus TCP commands from the server into Modbus RTU commands
sent to the slave devices, and converts Modbus RTU responses from the slave devices back into
Modbus TCP responses to the server, enabling communication between Modbus RTU slave devices
and Modbus TCP servers.

4.4 Digital Output Instructions

R40A

Page 19 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

R40A DO Interfaces
2 GND
4 DO1
6 DO2
8 PWR

R40B

R40B DO Interfaces
8 GND
10 DO1
12 DO2
14 PWR

4.4.1 DO Wiring

4.4.2 DO Introduction

Page 20 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Channel 2
Type SINK output
Digital Output Load voltage Max 50VDC
Load current 500mA(single), 625mW
Protection EFT: 40A(5/50ns)

1) DO1~DO2 are two channels of NPN transistor open-collector outputs. PWR is the common
terminal for the external power supply, providing clamp protection.
2) Digital output settings: Enter the router configuration interface → Remote I/O → Digital
Input/Output. In the digital output section, you can enable/disable, query, or set the digital output
status.
3) Trigger settings: Based on the status of DI digital inputs or AI analog inputs, you can set trigger
conditions to control the DO digital output operations (the confirmation time means the trigger will
activate after the condition is met continuously for X seconds).
4) For detailed configuration, please refer to section 6.5.3 Digital Input/Output.

4.5 Digital Input Instructions

R40A DI Interfaces
1 GND
3 DI1
5 DI2
7 COM

R40B DI Interface
9 DI1
11 DI2

Page 21 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

13 COM

4.5.1 DI Wiring

Note: The DI (Digital Input) is configured as wet contact by default. Please specify whether you
require dry or wet contact when placing an order.

4.5.2 DI Introduction

Channel 2
Type Dry contact, Wet contact
High level(digital 1) 5~30VDC, low level (digital
Digital input Range
0) 0~1VDC
Pulse frequency <100Hz
Protection Isolation voltage 3750Vrms

1) DI1~DI2 are two channels of digital inputs, defaulting to wet contact input.

2) Digital input settings: Enter the router configuration interface → Remote I/O → Digital
Input/Output. In the digital input section, you can enable/disable or query the digital input status
and pulse count values.

3) Trigger settings: You can set trigger conditions based on the DI digital input status to control DO
digital outputs, reboot operations, etc. (the confirmation time means the trigger activates after the
condition is met continuously for X seconds).

4) For detailed configuration, please refer to section 6.5.3 Digital Input/Output.

4.6 Analog Input Instructions

Page 22 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

AI Interface
1 AI1 2 AI3
3 AI2 4 AI4
5 GND 6 GND
7 GND 8 GND

4.6.1 AI Wiring

Note: AI inputs are factory-set as current type by default. Please specify whether you need current
type or voltage type when purchasing.

4.6.2 AI Introduction

Channel 4
Type 0~5V, 4~20mA, 0~20mA
Analog input ADC resolution 16 bit
Pulse frequency <100Hz
Protection EFT: 40A(5/50ns)

1) AI1~AI4 are four channels of analog inputs, defaulting to 4–20mA current-type analog input.
2) Analog input settings: Enter the router configuration interface → Remote I/O → Analog Input.
In the mode setting, you can select voltage 0–5V, current 4–20mA, or current 0–20mA. Set
the range by specifying the minimum and maximum values, then the actual measured value will
be displayed under the current value.
3) Trigger settings: You can set trigger conditions based on the AI analog input status to control DO
digital outputs, reboot operations, etc. (the confirmation time means the trigger activates after the
condition is met continuously for X seconds).
4) For detailed configuration, please refer to section 6.5.4 Analog Input.

5. Login to Web Configuration

The router supports web configuration and can be connected in two ways:
1) Wired connection: use an Ethernet cable to connect your computer to any LAN port of the router.

Page 23 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

2) WiFi connection: connect your computer to the router’s WiFi network.

The computer can obtain an IP address automatically via DHCP or be set with a static IP in the same
subnet as the router. Once connected, open a web browser on your computer and enter the router’s
default login address: 192.168.3.1. This will bring you to the router’s web login page. The default
username is admin, and there is no password by default.

5.1 Wired Connection

There are two ways to configure its IP address on PC, one is to enable automatic IP address
acquisition on the local connection of the PC, and the other is to configure a static IP address on the
same subnet as the router on the local connection of the PC.
Setting on Windows 7 as an example:
1. Click "Start> Control Panel> Network and Sharing Center", double-click "Local Area Connection" in
the window.

2. In the "Local Connection Status" window, click Properties.

Page 24 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

3. Select "Internet Protocol Version 4 (TCP/IPv4)" and click "Properties".

4. Two ways to configure the IP address:

Obtain an IP address automatically from the DHCP server and click "Obtain an IP address
automatically";

Page 25 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Manually configure the PC with a static IP address on the same subnet as the router address,
click and configure "Use the following IP address".

Page 26 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

5. Click "OK" to complete the configuration.

5.2 WiFi Connection

Search wireless network: The network name default is King-xxxxxx, no password.

Page 27 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Click “connect” to establish a connection.

Page 28 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

5.3 Factory Default Settings

Before logging the configuration page, please check the default settings as below:
Item Description
Login IP address 192.168.3.1
User name admin
Password none
DHCP server open
SSID：King-xxxxxx
WiFi
KEY: No encryption (open network)

5.4 Log in to Web Configuration Page

1) After connecting to the router by wired or wireless operation, open a browser on the PC, such as IE,
Edge, Google and other browsers;

2) Enter the router's IP address 192.168.3.1 on the address bar of the browser to enter the login
page;

Page 29 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router
3) On the login page, enter the user name admin (default), no password (default), and then click the
"Login" button.

4) After successfully logging in to the router, you will enter the status overview page.
5) Note that after configuring the parameters, you need to click "Save and Apply" on the interface to
take effect.

Page 30 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6. Router Settings

6.1 Status

In the status, it provides an overview, firewall, routing table, system log, kernel log, real-time
information, etc., which is convenient for viewing the running status information of the router.

Page 31 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.2 System

6.2.1 System Properties

Configure basic information, such as host name or time zone

System Properties
Item Description
Set router time, can synchronize browser time or synchronize NTP
Local time
General server time
setting Host name Default is the router model, cannot be modified
Time zone Please select your region
Logging Log properties, it is not recommended to modify
Time synchronization Set NTP server for time synchronization
Language optional automatic (according to browser language
Language and style changes, only recognize Chinese and English), Chinese, English;
The theme cannot be modified.

Page 32 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.2.2 Management Rights

Management Rights
Item Description
Password Change the administrator password to access the device
SSH access Provides SSH access and SCP services
Compared with the use of ordinary passwords, the public key allows
passwordless SSH login with higher security. To upload the new key to
SSH keys
the device, paste the OpenSSH compatible public key line or drag
the .pub file into the input field.

5.2.3 Software Package

Software installation, clear, and upgrade. (Note: This function is for professionals!)

Page 33 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.2.4 Backup/Upgrade

Backup/Upgrade
Item Description
Click "Generate Backup" to download the tar archive of the current
Backup
configuration file.
Upload a backup archive to restore the configuration. To restore the
Restore firmware to its initial state, click "Perform Reset" (only squashfs format
firmware is valid)
Click "Save mtdblock" to download the specified mtdblock file. (Note:
Save mtdblock content
This function is for professionals!)
Upload a sysupgrade compatible image from here to update the
Flash new firmware
running firmware

Page 34 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.2.5 Reboot

6.3 Network

6.3.1 Network Settings

You can restart, close, edit, and delete existing interfaces, or add new interfaces.
Default has LAN, WAN, WAN6, 4G and other interface configurations . Click "Edit" to enter
the detailed configuration modification.

Page 35 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.1.1 LAN Port

LAN Port
Item Description
Device: br-lan
Running time: 8h 57m 16s
MAC: E2:2F:C4:54:93:BA
Status Receive: 18.81 MB (149126 data pack)
Send: 99.87 MB (132321 data pack)
IPv4: 192.168.3.1/24
IPv6: fdb2:428b:ddbe::1/60
Protocol Static address
Bring up on boot Default enable
The default IP address is 192.168.3.1.
Modifying this setting can change the network
Basic Setting
segment that DHCP assigns IP to the LAN port.
This is also used as the login address of router.
IPv4 address
If the IP address is modified, select Force
application when saving the application. After
the modification is complete, please log in with
the new IP address.
IPv4 netmask Default 255.255.255.0
Default is empty, when multiple IPv4
IPv4 gateway addresses are set, the gateway address needs
to be specified
IPv4 broadcast Default 192.168.3.255

Page 36 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Use custom DNS server Default is empty

Assign a given length part of each public IPv6
IPv6 allocation length
prefix to this interface, default 60
Assign this hexadecimal sub-ID prefix to this
IPv6 assignment tips
interface
Optional, allowed values: "eui64", "random"
and other fixed values (for example: "::1" or
"::1:2"). When the IPv6 prefix (such as
IPv6 suffix "a:b:c:d::") is obtained from the authorization
server, use the suffix (such as "::1") to
synthesize an IPv6 address ("a:b:c:d::1")
Assigned to this interface.
Use built-in
Default enable
IPv6 management
Regardless of the link status of the interface,
always use the application settings (if checked,
Mandatory link
Advanced Settings the link status change will no longer trigger
hotplug event processing). default is enable.
Reset MAC address Modify MAC address
Reset MTU Default 1500
Use Gateway Hop Default 0
Create a bridge for the specified interface,
Bridge interface
default is enable.
Enable spanning tree protocol on this bridge,
Enable STP
default is disable.
Enable IGMP snooping on this bridge, default
Physical Settings Enable IGMP sniffing
is disable
Switch VLAN: "eth0.1" (lan), wireless network:
Master "King-xxxxxx" (lan), set the physical
Interface
interface using the LAN port, generally do not
need to be modified
Assign the firewall area to which this interface
belongs, select Unspecified to move the
Create/Assign
Firewall Settings interface out of the associated area, or fill in the
firewall zone
creation field to create a new area and
associate the current interface with it.
Ignore DHCP service is not provided on this interface,
this interface default is disable
Start Start network address, default is 100.
Basic
Maximum number of address assignments.
Setting Customers
DHCP The default is 150.
Server The expiration time of the leased address is at
Lease term
least 2 minutes (2m). The default is 12h.
Provide DHCP service for all clients. If
Advanced
DHCP disabled, only customers with static leases will
settings
be served. default is enable.

Page 37 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Even if another server is detected, it is

Forcibly mandatory to use DHCP on this
network,default is disable.
IPv4 Subnet
Reset the subnet mask sent to the client.
mask
Set additional options for DHCP, for example,
DHCP Options setting "6,192.168.2.1,192.168.2.2" means to
announce different DNS servers to clients.
Route
Advertisement Default server mode
Service
DHCPv6 server Default server mode
HDP proxy Default disable
DHCPv6 mode The default is stateless + stateful
IPv6 Always Even if there is no public network prefix
setting advertise the available, it still advertises itself as the default
default route route,default is disable
Advertised
Default is empty
DNS server
Advertised
DNS domain Default is empty
name

6.3.1.2 WAN Port

Page 38 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

WAN Port
Item Description
Device: eth0.2
Running time: 9h 37m 16s
MAC: E2:2F:C4:54:93:BB
Status
Receive: 113.65 MB (290226 data pack)
Send: 19.02 MB (137282 data pack)
IPv4: 192.168.1.173/24
General Setting
Default DHCP client; If the WAN port connected
Protocol newwork requires an account and password to
log in, please select the PPPoE protocol
Bring up on boot Default is enable
Hostname sent
Default is product model
when requesting DHCP
Use built-in
Default is enable
IPv6 management
Regardless of the link status of the interface,
always use the application settings (if checked,
Mandatory link
the link status change will no longer trigger
hotplug event processing). Default is disable.
Needed by some ISPs, for example: coaxial
Use broadcast tags
network DOCSIS 3, default is disable.
Leave blank to not configure the default route,
Default gateway
Advanced Settings default is enable.
Obtain DNS Leave blank to ignore the advertised DNS server
server automatically address,default is enable.
Use Gateway Hop Default is empty
Client ID sent when
Default is empty
requesting DHCP
Vendor Class option sent
Default is empty
when requesting DHCP
Reset MAC address Modify MAC address
Reset MTU Default is 1500
Create a bridge for the specified interface,default
Bridge interface
is disable
Physical Settings Switch VLAN: "eth0.2" (wan, wan6), set which
Interface physical interface to use, generally do not need to
be modified
Assign the firewall area to which this interface
belongs, select Unspecified to move the interface
Create/Assign
Firewall Settings out of the associated area, or fill in the creation
firewall zone
field to create a new area and associate the
current interface with it.

Page 39 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.1.3 WAN6 Port

WAN6
Item Description
Device: eth0.2
MAC: E2:2F:C4:54:93:BB
Status
Receive: 115.31 MB (299495 data pack)
Send: 19.41 MB (140798 data pack)
Basic Setting Protocol Default DHCPv6 client
Bring up on boot Default is enable
Request IPv6 address Default is try
Request IPv6 prefix of
Default automatic
length
Use built-in
Default enable
IPv6 management
Regardless of the link status of the interface,
always use the application settings (if checked,
Mandatory link
the link status change will no longer trigger
Advanced Settings hotplug event processing). Default is disable.
Use default gateway Leave blank to not configure the default route
Custom assigned
Default is empty
IPv6 prefix
Obtain DNS Leave blank to ignore the advertised DNS server
server automatically address, default is enable.

Page 40 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Client ID sent
Default is empty
when requesting DHCP
Reset MAC address Modify MAC address
Reset MTU Default 1500
Create a bridge for the specified interface,
Bridge interface
Physical Settings default is disable.
Interface Switch VLAN:”eth0.2”(wan,wan6)
Assign the firewall area to which this interface
belongs, select Unspecified to move the
Create/Assign
Firewall Settings interface out of the associated area, or fill in the
firewall zone
creation field to create a new area and associate
the current interface with it.

6.3.1.4 4G Interface

4G
Item Description
Device: 3g-4G
Running time: 0h 11m 52s
Status Receive: 1.06 KB (18 data pack)
Transmit: 8.50 KB (36 data pack)
Basic Setting IPv4: 10.94.92.16/32
Protocol UMTS/GPRS/EV-DO
Bring up on boot Default is enable
Modem equipment Default/dev/ttyUSB4
Service type Default UMTS/GPRS

Page 41 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

APN SIM Card Internet access point

PIN SIM card PIN code
PAP/CHAP uername User name for PPP authentication
PAP/CHAP password Password for PPP authentication
Dial number SIM Card Internet dialing
Use built-in
Default is enable
IPv6 management
Regardless of the link status of the interface, always
use the application settings (if checked, the link status
Mandatory link
change will no longer trigger hotplug event
processing), Default is disable.
Obtain IPv6 address Default auto
Modem initialization The maximum waiting time for the modem to be ready
timeout (seconds), default 10
Leave blank to not configure the default route, default
Use default gateway
is enable.
Advanced
Use Gateway Hop Default is empty
Settings
Obtain DNS Leave blank to ignore the advertised DNS server
server automatically address,default is enable.
After the specified number of LCPs respond to the
LCP Response fault, it is assumed that the link has been
failure threshold disconnected. 0 means ignore the fault, and the
default is 0.
LCP response is sent regularly (seconds), which is
LCP Response interval only valid when the fault threshold is combined, the
default is 5
Close the inactive link after a given time (seconds), 0
Activity timeout
is to keep the connection, the default is 0
Assign the firewall area to which this interface belongs,
Firewall Create/Assign select Unspecified to move the interface out of the
Settings firewall zone associated area, or fill in the creation field to create a
new area and associate the current interface with it.

Page 42 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.2 WiFi

Supports both WLAN hotspot and WLAN client.

The wireless overview shows the current wireless status, you can click Edit to enter the detailed
configuration, or restart, scan, add, disable, remove, etc.
Connected stations shows the currently connected wireless stations, which can be disconnected.

6.3.2.1 WLAN Hotspot (WiFi AP mode)

Page 43 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

The default SSID is King-xxxxxx, no encryption method, other clients can directly search the wireless
network to connect to this hotspot.
Quick configuration: Select the wireless configuration in Master mode in the wireless profile, click
"Edit" to enter the configuration page, find "Interface Configuration"-"Basic Settings"-"ESSID" to
modify the WiFi hotspot name, find "Interface Configuration"- -"Wireless Security"-"Encryption" can
modify the encryption method to set the WiFi password.

Note: When using the WiFi connection to enter the router configuration, you need to select "Force
Application" to modify the WLAN hotspot configuration. Please click the drop-down button next to
"Save and Apply" and select " Apply unchecked".

Wireless network AP hotspot device configuration

Item Description

97%
Mode: Master | SSID: King-ff4a8a
BSSID: EE:0C:45:81:26:51
Status Encryption: None
Channel: 6 (2.437 GHz)
Transmission power: 20 dBm
General Signal: -42 dBm | Noise: 0 dBm
Setup Transmission rate: 58.5 Mbit/s | Country: 00
Wireless network
Default is enable
is enabled
If there are too many devices in use at the current
Operating frequency
frequency, please change one
Specify the maximum transmit power. Depending on
Maximum transmit
regulatory requirements and usage, the driver may
power
limit the actual transmit power below this value.
Country code Driver default
Allow traditional
Default is enable
802.11b rate
The distance (meter) of the furthest network user.
Distance optimization Automatic by default, automatically adjust the
transmission power according to the distance
Automatically send data when the data length exceeds
Fragmentation threshold
Advanced the threshold, generally use the default value
Settings Request to send/allow sending protocol. When the
data length exceeds the threshold, start the protocol to
RTS/CTS Threshold
avoid signal conflicts caused by multiple terminals
sending data to the AP. Usually use default value
Even if the auxiliary channels overlap, the 40MHz
Force 40MHz mode channel is always used. Using this option is not
compliant with IEEE 802.11n-2009! Default is disable.
Beacon interval Indicates the interval at which the wireless router

Page 44 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

periodically broadcasts its SSID. Usually use default

value.

Wireless network AP hotspot interface configuration

Item Description
Mode Access Point
Default King-xxxxxx（xxxxxx is Random numbers or
ESSID
letters）
Network lan
Basic Setting
Hide ESSID Default is disable
Wi-Fi Multimedia,providing different
WMM mode priorities for different services
to ensure service quality,default is enable
Wireless Security Encryption No encryption by default (open network)
MAC Filter MAC address filter Default is disable
Forbid communication between clients,
Isolate the client
default is disable
Interface name Reset the default interface name
Different rates need to use different Preamble
Short Preamble
(preamble),default is enable
As a terminal node, periodically wake up to send
DTIM interval
traffic indication message interval
Interval for
Temporary key (GTK), Use default
Advanced Settings re-encrypting GTK
Disable inactive
Default is disable
polling
Inactive site
Default 300 seconds
restrictions
Max allowed
Default Max 65535
listening interval
Disconnect on low Allow AP mode to disconnect wireless terminal under
Ack response low ACK,default is enable.

Page 45 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.2.2 WLAN Client

Please click "Scan" to search the wireless network, select "Join Network" to enter the quick
configuration page, if a password is required, enter the WiFi password in "WPA Key", then click
"Submit" to enter the detailed configuration page, and finally click "Save" .
Device Configuration
Item Description

100%
Mode: Client | SSID: jingekeji
BSSID: EC:0C:45:81:26:51
Status Encryption: WPA2 PSK (CCMP)
Channel: 6 (2.437 GHz)
Transmission power: 20 dBm
Signal: -38 dBm | Noise: 0 dBm
Basic Setting
Transmission rate: 1.0 Mbit/s | Country: 00
Wireless network
Default is enable
is enabled
Working If there are too many devices in use at the current frequency,
frequency please change one
Specify the maximum transmit power. Depending on regulatory
Max transmission
requirements and usage, the driver may limit the actual
power
transmit power below this value.
Country code Driver default
Allow traditional
Default is enable
802.11b rate
Advanced
The distance (meter) of the furthest network user. By default,
Settings Distance
the transmission power is automatically adjusted according to
optimization
the distance
Fragmentation Automatically send data when the data length exceeds the

Page 46 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

threshold threshold,usually use default value.

Request to send/allow to send protocol. When the data length
RTS/CTS exceeds the threshold, start the protocol to avoid signal
Threshold collision caused by multiple terminals sending data to the AP,
usually use default value.
Even if the auxiliary channels overlap, the 40MHz channel is
Force 40MHz
always used. Using this option is not compliant with IEEE
mode
802.11n-2009! default is disable.
Indicates the interval at which the wireless router periodically
Beacon interval
broadcasts its SSID, usually use default value.

Interface configuration
Item Description
Mode Client
ESSID Wireless network name
Basic Setting
BSSID none
Network Wwan, no need modify it
Encryption WPA2-PSK(Strong security)
Algorithm auto
Password Wireless network password
802.11w Management Requires the full version of wpad/hostapd, and WiFi
Frame Protection driver support, default is disabled
Interface name Reset the default interface name
Different rates require different Preambl (preamble),
Short Preamble
default is enable
As a terminal node, periodically wake up to send traffic
DTIM interval
indication message interval
Wireless security
Re-encrypt GTK Temporary key (GTK)
time interval Use default value
Disable inactive
Default is disable
polling
Inactive site
Default 300 seconds
restrictions
Maximum allowed
Default max 65535
listening interval
Disconnect on low Ack Allow AP mode to disconnect wireless terminal under
response low ACK, default is enable

Page 47 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.3 Cellular Network

Cellular Network
Item Description
Register status Registered
Operator N/A
Signal Normally is 14-31
Firmware version Displays the module's firmware version
IMSI SIM card IMSI number
IMEI Device IMEI number
SIM card ID SIM card ICCID number
Card 1, Card 2, this selection as the preferred SIM card,
Card select When the preferred SIM card cannot be connected to the network, it will
automatically switch to another card to try to connect to the network
Card 1/2 number Enter SIM card number
SIM card 1/2 APN Enter APN
SIM card 1/2
Enter username
username
SIM card 1/2
Enter password
password
Default is disable
When the router supports GPS function, please check this item to enable
GPS function. GPS data will be uploaded through MQTT protocol; if the
Enable GPS router does not have GPS function, please do not enable it.
(The router does not support GPS function by factory default, if you need
GPS function, please remark when purchase)

Page 48 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.4 DHCP/DNS

Dnsmasq provides an integrated DHCP server and DNS forwarder for the NAT firewall

Server Settings
Item Description
Ignore empty
Do not forward resolution requests without DNS names,
domain name
checked by default
resolution
This is the only DHCP server in the local network,default is
Unique authorization
enable
Local domain rules. Names matching this domain are
Local server never forwarded, only resolved from DHCP or HOSTS
files
The local domain name suffix will be added to the DHCP
Local domain name
General Setting and HOSTS file entries
Write received DNS request to system log,defaule is
Record query log
disable
DNS forward List of DNS servers to which requests are forwarded
Discard RFC1918 upstream response data, default is
Rebinding protection
enable
Allow upstream response within 127.0.0.0/8 loopback
Allow local
range, for example: RBL service, default is enable.
Domain name
List of domain names that allow RFC1918 to respond
whitelist

Page 49 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

DNS service is only provided in the subnet to which the

Local service only
network card belongs,default is enable.
Dynamically bind to interface instead of wildcard address
Not all addresses
(recommended as linux default),default is enable
Listening interface Only listen to these interfaces and loopback interfaces.
Exclude interface Do not listen to these interfaces.
Use etc/ethers Configure DHCP server according to /etc/ethers,default is
Configuration enable.
The file used to store the assigned DHCP lease,default
Lease documents
HOSTS& parse is :/tmp/dhcp.leases
the file Ignore parsing file Default is disable
Ignore /etc/hosts Default is disable
Additional HOSTS
Default is empty
file
TFTP Setting Enable TFTP server Default is disable
Does not record general operation logs of these
No log
protocols,default is disable.
Sequential allocation IP addresses are assigned sequentially starting from the
IP lowest available address, default is disable.
Reverse queries without forwarding the local
Filter local packages
network,default is enable.
Filter useless Do not forward requests that the public domain name
packets server cannot respond,default is disable
If multiple IPs are available, the host name is localized
Localized query according to the subnet from which the request
originated,default is enable
Expand the host
Add the local domain name suffix to the domain name in
suffix in the HOSTS
the HOSTS file, default is enable
file
Disable invalid Do not cache useless responses, for example: domain
Advanced
information cache names that do not exist, default is disable
Settings
This file may contain formats such as
Additional SERVERS “server=/domain/1.2.3.4”or“server=1.2.3.4”.The former
file specifies a DNS server for a specific domain, while the
latter does not limit the resolution range of the server.
Query DNS server in the order of "parse file",default is
Strict order checking
disable.
Query all available upstream DNS servers,default is
All server
disable.
Ignore fake empty
List of servers allowed to respond with fake empty domain
domain name
names
resolution
DNS server port Inbound DNS query port
DNS query port Specified DNS query source port
Max DHCP leases
Maximum number of DHCP leases allowed
No.

Page 50 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Max EDNS0
Allowed max EDNS.0 UDP data pack size
data pack size
Maximum concurrent
Maximum number of concurrent DNS queries allowed
queries number
DNS Query cache Cached DNS entries numbers (maximum 10000, 0 means
size no cache)
Static leases are used to assign fixed IP addresses and
host IDs to DHCP clients. Only the specified host can be
connected, and the interface must be non-dynamically
configured.
Use the Add button to add a new lease entry. The values
of the IPv4 address and host name fields will be fixedly
Static address assignment
assigned to the hosts identified by the MAC address field.
The lease period is an optional field, and the length of the
DHCP lease period can be set separately for each host,
for example: 12h, 3d, infinite, Respectively 12 hours, 3
days, permanent.

6.3.5 Host Names

After adding the host mapping, you can access the specified IP address by accessing the host name

Page 51 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.6 Static Routes

The routing table describes the reachable path of the packet

Routes
Item Description
interface Select setting interface
Target Host IP or network, requires valid IP or network
Basic Setting IP Subnet If the object is a network, a valid IP or network is
mask required
IP gateway Need valid IP or network
Hops 0
MTU 1500
Type unicast
Advanced Settings
Routing table main(254)
Source address Auto
On-Link Routing Default is disable

Page 52 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.7 Diagnosis

Three commands are provided here: Ping, Traceroute, and Nslookup, which can perform simple
diagnosis on the network.

6.3.8 Firewall

6.3.8.1 Zone Settings

Page 53 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

The firewall controls network traffic by creating zones on network interfaces.

Firewall-Zone Settings
Item Description
This section defines the general properties of "lan". The inbound data and
outbound data options are used to set the default strategy for inbound and
outbound traffic in this area, and the forwarding options describe the traffic
forwarding strategy between different networks in the area. The covered network
designates the networks belonging to this area.
Name lan
General
Input Default is accept
Setting
Output Default is accept
Forward Default is accept
The LAN port does not need to be set, and the WAN port
IP Dynamic
address may change during dynamic allocation. You need to
camouflage
set up dynamic disguise to connect to the external network
MSS Clamp Automatically adjust MSS according to MTU

Page 54 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Covered
lan
networks
Allow forwarding
wan
to target area
Allow forwarding
unspecified
from source area
The following options control the forwarding strategy between this area (lan) and
other areas. The target area receives the forwarded traffic from lan. The
forwarding traffic matching the source area comes from other areas whose
destination is lan. The role of forwarding rules is one-way. For example, forwarding
traffic from lan to wan does not mean allowing reverse forwarding of traffic from
wan to lan.
Covered This option can classify regional traffic on original,
equipment non-UCI-hosted network devices.
This option can classify regional traffic by source or
Subnets covered
destination subnet instead of network or device.
Advanced Restricted
IPv4,IPv6
Settings address
To restrict the
source subnet of
According to actual condition
IP dynamic
masquerading
Target subnets to
restrict IP
According to actual condition
dynamic
masquerading
Enable logging
Default is disable
in this area
Do not install additional rules to deny forwarded traffic with
Allow "invalid
conntrack status invalid. This may be a necessary setting for
traffic"
Conntrack complex asymmetric routing,default is disable
Setting Automatic
Automatically assign conntrack assistant according to traffic
assistant
protocol and port,default is enable.
assignment
By passing the iptables parameter to the source and destination traffic
classification rules, you can match packets based on other conditions than the
interface or subnet. Use these options with extreme caution, as invalid values may
break the firewall rule set and expose all services to the outside world.
Additional
Additional iptables parameters are used to classify regional
iptables Additional source
inflows. For example: -p tcp --sport 443 only matches inbound
parameter parameters
HTTPS traffic.
Additional iptables parameters are used to classify regional
Additional target
outgoing traffic. For example: -p tcp --dport 443 only matches
parameters
outbound HTTPS traffic.

Page 55 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.8.2 Port Forwards

Port forwarding allows remote computers on the Internet to connect to specific computers
or services on the internal network.
Firewall-Port Forwarding
Item Description
Name Forward naming
Protocol TCP+UDP,TCP,UDP,ICMP optional
Source area wan
Match inbound traffic to the specified target port
External port
or target port range on this host
General Setting
Target area lan
Redirect matching inbound traffic to the
Internal IP address
specified internal host
Redirect matching inbound traffic to the port of
Internal port
the internal host
Source MAC address Match only inbound traffic from these MACs
Only match inbound traffic from this IP or IP
Source IP address
range
Only match inbound traffic originating from a
Source port given source port or source port range on the
Advanced Settings client host
Only match inbound traffic for the specified
External IP address
destination IP address
Enable NAT loopback Default is enable
Extra parameters passed to iptables. Be
Additional parameters
caution!

Page 56 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.3.8.3 Traffic Rules

Traffic rules define policies for packets traceling between different zones,for example to reject traffic
between certain hosts or to open WAN ports on the router.

6.3.8.4 Custom Rules

Custom rules allow you to execute any iptables command that is not part of the firewall framework.
Each time the firewall is restarted, these commands will be executed immediately after the default

Page 57 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router
rules are run.

6.3.9 Network Shares

Page 58 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.4 VPN

6.4.1 IPSec

IPSec is an open network layer security framework protocol formulated by the Internet Engineering
Task Force (IETF). It is not a single protocol, but a collection of protocols and services that provide
security for IP networks. IPSec mainly includes security protocols AH (Authentication Header) and
ESP (Encapsulating Security Payload), key management exchange protocol IKE (Internet Key
Exchange) and some algorithms used for network authentication and encryption.
IPSec mainly provides security services for IP data packets through encryption and authentication.
The security services that IPSec can provide include:
(1) User data encryption provides data privacy through user data encryption.
(2) Data integrity verification Through data integrity verification to ensure that data has not been
tampered with on the transmission path.
(3) Data source verification By authenticating the source of the sent data, the data is guaranteed to
come from the real sender.
(4) Prevent data replay by rejecting duplicate data packets at the receiver to prevent malicious users
from attacking by repeatedly sending the captured data packets.

IPSec
Item Description
IPSec Enable Tick to enable
Configuration Package type Optional tunnel mode, transmission mode. Tunnel mode

Page 59 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

means host-to-host, host-to-subnet or subnet-to-subnet

tunnel. The transmission mode indicates the transmission
method from the host to the host.
Peer gateway Peer gateway which connect with IPSEC
In the tunnel mode, the tunnel from the subnet to the subnet
Local subnet
needs to specify the local and opposite terminal network
IP/mask
ranges
In the tunnel mode, the tunnel from the subnet to the subnet
Peer Subnet
needs to specify the local and opposite terminal network
IP/Mask
ranges
Pre-shared key Default authenticate using pre-shared key
Phase 1 mainly negotiates encryption parameters,
Phase 1 settings
exchanges key information, and verifies device identity
Specify IKE (Internet Key Exchange) negotiation message
IKE Encryption Algorithm
encryption algorithm
Specify the digital signature authentication algorithm for
Authentication algorithm
encrypted messages
Specify which key group to use for DH (DiffieHellman) key
DH group
exchange
IKE version IKEv1 or IKEv2
Main mode or brutal mode. The main mode is more secure
than the brutal mode, and the brutal mode is faster. If the
responder (server) cannot know the address of the initiator
Exchange mode (end user) in advance, or the address of the initiator is always
changing, and both parties want to use the pre-shared key
authentication method to create an IKE SA,
Brutal mode can be used at this time
Responder or initiator, the initiator is equivalent to the end
Negotiation mode
user, and the responder is equivalent to the server
Can be IP address, standard domain name, email address or
Local ID
proper name, default is local IP
Can be IP address, standard domain name, email address or
Peer ID
proper name, default is peer IP
IKE live time Re-negotiate the key time
The purpose of Phase 2 is to establish an IPSec security
Phase 2 setting
association for data transmission
ESP Encryption Algorithm Specify the algorithm used for data encryption
Specify digital signature authentication algorithm for
Authentication algorithm
encrypted data
PFS (Perfect Forward Secrecy), which means that a key is
PFS group
cracked and does not affect the security of other keys
How long should it take from the negotiation to the
Survive time
connection instance
DPD（Dead Peer Detect）,When no traffic occurs for a period
DPD detection cycle of time, the local end sends a DPD message to check the
status of the peer before sending traffic

Page 60 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.4.2 L2TP

L2TP (Layer 2 Tunneling Protocol, Layer 2 Tunneling Protocol) is a type of VPDN (Virtual Private
Dial-up Network, Virtual Private Dial-up Network) tunneling protocol.
VPDN (Virtual Private Dial Network) refers to the use of public network (such as ISDN and PSTN)
dial-up function and access network to achieve a virtual private network, providing access services for
enterprises, small ISPs, and mobile office personnel.
VPDN uses a dedicated network encryption communication protocol to establish a secure virtual
private network for enterprises on public networks. Enterprises abroad and business personnel can
remotely connect to the corporate headquarters through a virtual encrypted tunnel through a public
network, while other users on the public network cannot access resources inside the corporate
network through the virtual tunnel. There are many VPDN tunneling protocols, and the most widely
used is L2TP (Layer Two Tunneling Protocol).
The PPP protocol defines a encapsulation technology that can transmit multiple protocol data packets
on a layer-2 point-to-point link. At this time, PPP runs between the user and the NAS (Network
Access Server) network access server. The L2TP protocol provides tunnel transmission support for
PPP link layer data packets, allows Layer 2 link endpoints and PPP session points to reside on
different devices, and uses packet exchange technology for information exchange, thereby
expanding the PPP model .
The L2TP function can be simply described as establishing a point-to-point PPP session connection
on a non-point-to-point network. The L2TP protocol combines the advantages of the L2F (Layer 2
Forwarding) protocol and the PPTP (Point-to-Point Tunneling protocol) protocol, and has become the
IETF industry standard for Layer 2 tunneling protocols.

L2TP
Item Description
Enable Tick to enable
Username User name for PPP authentication
Password Password for PPP authentication

Page 61 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Server/client Server,client optional

Server address LNS(L2TP Network Server，L2TP network server) address
You can choose whether to use IPSec encryption or not, and
choose to use the default IPSec security policy during encryption.
IPSec encryption You do not need to manually configure IPSec.
When you choose to use a security policy, you need to configure
the IPSec policy in advance
When selecting encryption, you need to set the IPSec pre-shared
Pre-shared key
key
Security strategy Configured IPSce security policy

6.4.3 OpenVPN

OpenVPN is an application layer VPN implementation based on the OpenSSL library. It is a type of
SSL VPN. It uses a virtual network card to establish a connection to transmit data, and uses SSL to
encrypt and verify.
The virtual network card is a driver software implemented using the underlying network programming
technology, and can be configured like other network cards. If the application accesses a remote
virtual address (belongs to the address series used by the virtual network card, which is different from
the real address), the operating system will send data packets (TUN mode) or data frames (TAP
mode) to the virtual network card through the routing mechanism. After the service program receives
the data and performs corresponding processing, it is sent from the external network through
SOCKET, and the remote service program receives the data from the external network through
SOCKET, and after corresponding processing, it is sent to the virtual network card, and the
application software can receive At this point, a one-way transmission process is completed, and vice
versa. OpenVPN provides two virtual network interfaces: universal Tun/Tap driver, through which you
can establish a layer 3 IP tunnel or a virtual layer 2 Ethernet. The latter can transmit any type of layer
2 Ethernet data, and the transmitted data can be passed through the LZO algorithm compression.
The SSL protocol (Secure Socket Layer) mainly uses the public key system and X.509 digital
certificate technology to protect the confidentiality and integrity of information transmission. It includes:
server authentication, client authentication (optional), SSL chain Data integrity on the road and data
confidentiality on the SSL link. The SSL protocol is independent of the application layer protocol.
High-level application layer protocols (such as HTTP, FTP, Telnet, etc.) can be transparently built on
the SSL protocol. The SSL protocol has completed the encryption algorithm, communication key
negotiation and server authentication before the application layer protocol communication. After that,
the data transmitted by the application layer protocol will be encrypted to ensure the privacy of the
communication.

Page 62 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

OpenVPN
Item Description
Enable Tick to enable
Configure client mode Tick to client mode
VPN Subnet IP address/mask TAP mode, as a server, it can transmit from host to subnet
Server address Server address which establish VPN connect with client
The TCP/UDP port provided by the server for establishing a
Port
connection, default is 1194
Protocol UDP, TCP-Server, TCP-Client, default is UDP.
TUN mode establishes a three-layer tunnel to achieve
point-to-point transmission. TAP mode establishes a Layer 2
TUN/TAP device
tunnel, which can realize the transparent transmission of IP
packets
When security certificate authentication is not applicable, user
Username/password
name/password authentication can be used
Encryption Algorithm Choose data encryption algorithm
Authentication and
Select file upload, root certificate provided by server
authorization (root certificate)
Select file upload, the client certificate generated by the user
Local certificate
based on the root certificate
Select the file upload, the key corresponding to the client
Local private key
certificate
Used for key exchange, can be generated by openssl dhparam
DH Key exchange parameters
-out dh2048.pem 2048
Compression algorithm LZO,LZ4
The interval at which the server sends a probe message to the
Keepalive interval (seconds)
client
If the server does not receive a response to the probe message
Keepalive timeout (seconds)
at this time, it restarts the connection
Note: When uploading the certificate file, you need to find the directory where the file is saved after
you click to select the file, and then select the file after the upload is complete.

Page 63 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.5 Remote I/O

6.5.1 Serial Port Settings

The remote I/O refers to the I/O of the Modbus slave

When the R40 router is connected with the Modbus slave device through the serial port, the router
acts as the Modbus master station,

Serial Port Settings

Item Description
1200,2400,4800,9600,14400,19200,38400,57600,115200,230400
Baud rate
optional
RS485 Data bit 5,6,7,8
Parity None, Even and Odd optional
Stop Bit 1,2 optional
1200,2400,4800,9600,14400,19200,38400,57600,115200
Baud rate
optional
RS232 Data bit 5,6,7,8 optional
Parity None, Even and Odd optional
Stop Bit 1,2 optional

Page 64 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.5.2 Transparent Transmission

6.5.3 Digital Input and Output

You can view the current status of DI and DO, the DI count value, set the type of DO normally open
and normally closed, enable and disable the operation of DI and DO, and trigger settings can add DI

Page 65 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router
trigger conditions.
Trigger Setting
Item Description
Input DI1, DI2
Trigger conditions NO, NC, Counting over threshold, Recovery
The threshold value should be entered when the condition
Threshold value
selection count exceeds the threshold
Confirmation time (seconds) Trigger will be confirmed when the set time condition is met.
Action Linkage action：No, DO1, DO2, All DO, Reboot
Open, Close, When the action selects DO, the execution state
DO status
should be selected
Hold time (seconds) DO action time
Trriggering Tick to enable alarm

6.5.4 Analog Input

Note: When the device model supports analog input，this function will be displayed.
You can view the current AI value and set the mode: voltage 0~5V, current 4~20mA. Current 0~20mA,
set the minimum value and unit of the range, trigger setting can add AI trigger condition.

Trigger

Page 66 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Item Description
Input AI1, AI2, AI3, AI4
Analog input is greater than the threshold, analog input is less than
Trigger condition
the threshold
Threshold value The condition will be triggered when the set value is reached
Resume threshold When the set value is reached, it will be regarded as recovery
Confirm time (seconds) Confirm the trigger when condition reach the set time
Action Linkage action: No, DO1, DO2, All DO, Reboot
Open, Close, When the action selects DO, the execution state
DO status
should be selected
Hold time (seconds) DO action time
Trriggering Tick to enable alarm

6.5.5 Modbus RTU to TCP

Page 67 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.5.6 Modbus Slave

Page 68 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.5.7 Modbus Master

Page 69 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Note: Modbus master settings need to be selected device model to support this function will be
displayed.
Modbus Master
Item Description
Alias Name this configuration
Slave address Slave Modbus device ID
Register type Boolean,16-bit, 32-bit
01, 02, 03, 04;
01/02 Function codes apply to Boolean data types
03/04 Function codes apply to 16/32/64 bit data type；
01 function code supports 05/15 function code at the same
Function code time, 03 function code supports 06/16 function code at the
same time.
Selecting 03/16 is a special case; only Function Code 16
can be used for issuing commands.
Register start address Set according to slave register address
Data number Set according to the number of slave registers
Mapping address assignment Automatic / Manual
Select Manual Assignment Visible；
Boolean type mapping register address 64~2048，
Mapping start address
16 bit type mapping register address 20001~20999，
32 bit type mapping register address 21000~22998，

Page 70 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

64 bit type mapping register address 30000~31999

RS485, RS232, Ethernet
Slave interface If RS485 or RS232 is already connected as a serial device,
this is not visible here
Slave IP address Visible when selecting Ethernet
Port Visible when selecting Ethernet

Page 71 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Modbus Query
Name the slave data points, such as the purpose of
remarks;
Alias After the alias is set, the slave data point will be directly
displayed as the set alias on other configuration pages, or as
the mapped address if no alias is set
Data type Slave register data type
Input type Boolean data type is visible, open or close
16/32 bit data type is visible, ratio coefficient between
Coefficient
register value and real value
16/32 bit data type is visible. Greater than or equal to the
High threshold
high threshold will trigger an alarm
Detailed
High threshold 16/32 bit data type is visible. Less than or equal to the high
configuration
recovery threshold recovery value will trigger an alarm recovery
16/32 bit data type is visible. Less than or equal to the low
Low threshold
threshold will trigger an alarm
Low threshold 16/32 bit data type is visible. Greater than or equal to the low
recovery threshold recovery value will trigger an alarm recovery
Confirmation time
Confirm the trigger time of the alarm
(second)
Enable alerts Click to enable
Action Linkage local DO close or open
Hold time Do action time
Publish Tick to publish data via MQTT
It is recommended to limit each data query to no more than 100 data points. Exceeding this limit may
cause page lag or prevent proper refresh.

Page 72 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.6 Event and Alarm

6.6.1 E-mail & SMS

E-mail setting
Item Description
Enable send mail Tick to allow send e-mail
Mail Server Enter the SMTP mail server address
Port Enter the SMTP mail server port number Port: 465
Recipient Fill in the email recipient address
Sender Enter the email sender address
Enter the email sending account username(User mailbox opens
User name
smtp server)
Password Fill in the third-party password to open the smtp port in the email
Note: The mail server needs to be enabled with the SMTP service. If the mail is not sent successfully,
please make sure that the SMTP service is enabled in the mailbox settings and the account password
is entered correctly.

Page 73 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

SMS settings
Item Description
Phone Number Multiple mobile phone numbers to receive SMS messages can be added. After
entering a number, please click the "+" at the back to save
Language English or Chinese

6.6.2 Device Monitor

Device Monitor
Item Description
Register address Range 2~63
DI3~DI64, Automatically generated according to the register
Input
address, MQTT report data identifier
Device IP address Detect IP
According to the set value PING how many times, if there is no
PING times PING, then the detection equipment is disconnected from the
network
Action Linkage DO close or open
Hold time (seconds) DO action time
Trriggering Tick to enable alarm

Page 74 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.6.3 Event and Alarm

When the trigger conditions are set in the Modbus master, digital input and output, analog input,
network disconnection detection and alarm related settings and the alarm is enabled, the related
alarm events can be seen here. You can set related alarm messages and content of email. It is
recommended that the number of related alarm SMS and email messages should not exceed 25
entries.

6.7 Edge Computing and Logical Control

6.7.1 Timer

Page 75 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Timer execution actions are optional, such as trigger DO close or open, send mail, restart device etc
Regular timer: Execution at a certain regulation such as daily or weekly
Once timer: execution only one time at a certain appointed time, similar to Alarm clock
Cycle timer: execution cyclely at a certain time interval, such as every 5 seconds, every 1 hours

Page 76 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.7.2 Arithmetic Operation & Logical Operation

Arithmetic operation supports the "addition, subtraction, multiplication and division" operations
between the value type registers of the local device (R40 router) and the Modbus slave device. You
can adjust the order of operations at will, "addition, subtraction, multiplication and division" between
registers value.

For example:

Slave 2 register REG20001 adds the value of REG20002 multiplied by REG20003, performs
arithmetic operation, and outputs the result to REG20004

See below:

Page 77 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

As shown in below, use the virtual serial port tool to simulate the slave 2 register, and the operation
result is displayed in SLAVE as follows.

Note: If a 16-bit register address is used as the output result, the fractional part will be output as an
integer.

Page 78 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

The logical operation function can link the local device I/O (digital input and output, analog input) with
the Modbus slave I/O (slave device register), combine them at will as required.
See below picture examples:

Page 79 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Logical operation example (1)

Logic AND: When condition A and condition B are satisfied at the same time, the action is triggered,
and then output result Y.
Logical operation example (2)
Logical OR: Either condition C or condition D is satisfied, the action is triggered and then output result
Y.
Logical operation example (3)
Combined logical operation: the result of the above said logic operation 1 is used as an input value,
and the result of logical operation 2 is used as another input value, these two can be combined and
comprise logical operation 3.
Similary, you could create more combined logical operations.

6.7.3 Combined Conditions Operation

Combined conditions operation is an advanced function. It combines timer, arithmetic operation and
conditional operation to realize logic control under multiple conditions. it is programmable. You can
adjust the combination method, so as to achieve complex task of edge computing and logic control.

Page 80 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Page 81 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Combined conditions operation can perform exponential logarithmic operations. Take a cumulative
water flow that is accumulated every 1 minute as an example to create the process as follows:

TREG123: Circular timer acts as an accumulation count trigger.

G: Create water flow per second for the formula

B: TREG123 (condition) and (G operation result per second * 60 seconds per minute) + continuous
output result REGXXX

Equal to cumulative output value

Page 82 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.8 Connection to Cloud Platform

6.8.1 Custom Cloud

Page 83 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Cloud Connection Settings

Item Description
Enable setting Tick to enable
Cloud Platform BEILAI V2
2.0Modbus RTU : modbus.dtuip.com,
Port 6651;
2.0Modbus TCP : mbtcp.dtuip.com,
Host domain name and port
Port 6655；
2.0MQTT：mqtt.dtuip.com，
Port 1883

Page 84 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Link Protocol Modbus RTU,Modbus TCP ,MQTT

Modbus Device ID Default is 1, device ID set in the serial port settings
Server register handshake protocol package, if need contact
Register packet
salesman
Heartbeat packet Heartbeat content to avoid network offline
Modbus
Heartbeat
Protocol The server responds to the heartbeat packet
response packet
Parameters
Heartbeat
Network keep online heartbeat interval time
period(s)
Host Silence The server sends silent time without data, and will reconnect if
time(s) it times out
The client identifier used in the MQTT connection message. If
you want to use King Pigeon MQTT, you need to contact the
MQTT Client ID
sales to provide the client ID serial number. Just enter the
MQTT Protocol serial number and no other settings are required.
Parameters Publish Period
MQTT data timing publish interval
(seconds)
Enable data
Click to enable
retransmission
Cloud platform
Customize
name
Host IP or domain
Customize
name
Custom cloud Port Customize
parameters Link agreement Modbus RTU, Modbus TCP, MQTT
Modbus Device ID Default 1, device ID set in the serial port settings
Register packet Customize
Heartbeat packet, heartbeat response packet, heartbeat cycle, host silent time (as
defined above)

Page 85 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.8.2 Alibaba Cloud Platform

Ali Cloud Connection Settings

Item Description
Enable setting Tick to enable
Authenticatioin method Device secret key, X509 certificate
Product Key Set the product key on Alibaba Cloud
Device Name Set the device name on Alibaba Cloud
Device Serect Set the device key on Alibaba Cloud
Region ID Ali cloud region
Publish period (seconds) >60s
Certification authority (root certificate) Choose file upload
Local certificate Choose file upload
Local key Choose file upload
Only publish changed data Click to enable

Page 86 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.8.3 AWS Cloud

AWS Cloud Connection Settings

Item Description
Enable setting Tick to enable
Host（Endpoint） Set End point
The client identifier used in the MQTT connection
message, the server uses the client identifier to identify
Client ID
the client, and each client connected to the server has a
unique client identifier.
Thing name Set thing name
The subject name used by MQTT to publish messages.
The subject name is used to identify which information
Publish topic channel the payload data should be published to. The
subject name in the published message cannot contain
wildcards.

Page 87 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Publish period (seconds) >60s

Certification authority (root certificate) Choose file upload
Local certificate Choose file upload
Local key Choose file upload
Only publish changed data Click to enable

6.8.4 Huawei Cloud

HUAWEI CLOUD supports access to the cloud platform in two ways: Device secret key and
Authentication certificate：

Huaweicloud connection settings

Item Description
Enable setting Tick to enable
The device secret key method and the authentication certificate method
Authentication method can be selected, and the authentication certificate method needs to
upload the certificate
Devicde ID The ID of the device when HUAWEI CLOUD creates the device,eg,

Page 88 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

The product needs to create a service to report data,eg.

Service ID

The location of the device can be queried on the HUAWEI CLOUD

Region ID
platform
Publish Period(s) Above 60s
For the password entered when creating the device certificate, you can
Secret key
refer to the HUAWEI CLOUD help document to create a test certificate
Certification authority (root Root certificate provided by Huawei:rootcert.pem，It's included in the
certificate) release version, generally don't need to upload
Device certificate deviceCert.pem,Upload to the /etc/conf directory and
Device certificate select the file, you can refer to the HUAWEI CLOUD help document to
create a test certificate
Device key/deviceCert.key,Upload to the /etc/conf directory and select
Device key the file, you can refer to the HUAWEI CLOUD help document to create a
test certificate
Only publish changed data Click to enable
For the steps of creating and registering devices on the platform, please refer to the help documents
of Huawei Cloud.

6.8.5 Thingsboard Cloud Platform

Page 89 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Thingsboard Cloud Connection Settings

Item Description
Enable setting Tick to enable
Host（Endpoint） Set End point
The client identifier used in the MQTT connection message, the
Client ID server uses the client identifier to identify the client, and each
client connected to the server has a unique client identifier.
Thing name Set thing name
The subject name used by MQTT to publish messages. The
subject name is used to identify which information channel the
Publish topic
payload data should be published to. The subject name in the
published message cannot contain wildcards.
Publish period (seconds) >60s
Certification authority (root
Choose file upload
certificate)
Local certificate Choose file upload
Local key Choose file upload
Enable data retransmission Click to enable this function
Only publish changed data Click to enable this function
For Thingsboard cloud device user manual, please refer to the Thingsboard Getting Started
document

Page 90 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.9 BLRMS (Remote Management System)

6.9.1 Introduction

The R40 Edge Computing Router supports remote configuration and upgrade functions.
To use these remote features, it must be paired with the BEILAI Remote Management System
(BLRMS). Additionally, the operator performing remote actions must have an R40 Edge Computing
Router.
The login domain for the BLRMS platform is my-rtu.com.
When preparing an R40 device for remote upgrade or configuration, you need to select it as the target
device. The interface is as follows:

Remote Management Setting

Item Description
Enable setting Tick to enable
Role Select “Target device”
The user token is given by BLRMS,
User token
"device management" - "communication key"
SN is serial number of the device. People can name it by
Local device SN himself, maximum 128 characters. Never duplicate SN to
cause conflict.
Local connection status Status of connection to the BLRMS system

Another local device R40 that is operated by the user (operator-side device) settings

Page 91 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Remote Management Setting

Item Description
Enable setting Tick to enable
Role Select “Local device”
User token Must be same as that on Target device
SN is serial number of the device. People can name it by
Local device SN himself, maximum 128 characters. Never duplicate SN to cause
conflict.
When the role is choosen “Target device”, It is the Local device
Target device SN
SN
Choose from Read configuration, Write configuration, Update
Remote operate
firmware
Operate result Show the result
Local connect status The status of connection local device to BLRMS
Target connect status The status of connection Target device to BLRMS
Note: The configuration will take effect only after clicking "Save and Apply".

6.9.2 Operation Example

6.9.2.1 Register BLRMS Account

Open a browser and enter my-rtu.com to access the BEILAI Remote Management System (BLRMS).
Click Register Account on the homepage, then fill in the required information step by step, and click
the Register button to complete the process.
After successful registration, return to the main page and log in with your account and password.
Once logged in, the system will automatically generate a Token.
The login page is shown below:

Page 92 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Register

6.9.2.2 Obtain Token

After a user account is successfully registered, the system automatically generates a unique Token
(communication key) for each account. This Token serves as an identification code, once it is written
into the device, the system can recognize which user it belongs to.
All devices under the same user account must use the same Token.
After logging into the backend interface, click "Device Management" > "Token Key" from the left-side
menu. The following data list will be displayed:

Page 93 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.9.2.3 R40 Remote Configuration

1. Configure the Target Device

Open a web browser and enter the default IP address of the R40 device: 192.168.3.1, or use the
actual IP address assigned to the device to access the configuration interface.

Page 94 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

2. Configue the Local Device

Page 95 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

The device is associated with the platform successfully

Page 96 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.9.2.4 Remote Read Configuration Operation

Save the configuration after the target device adds the value

The local device reads the configuration file of the target device

Page 97 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Page 98 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

6.9.2.5 Remote Write Configuration Operation

"Remote Write Configuration" and "Remote Firmware Upgrade" operations will reboot the target
device.

Page 99 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0

 Cellular IIoT Router

Page 100 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Note:
Those setting related to networking cannot be written, such as IP addresses.
All other configuration information can be writen.

6.9.2.6 Remote Firmware Upgrade

Page 101 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Page 102 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Page 103 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

6.9.2.7 Disconnect BLRMS service

6.10 Logout

After completing the router parameter configuration, please click "Logout". The device will log out and
return to the Web login configuration page.

7. Communication Protocol

The device supports Modbus RTU protocol, Modbus TCP protocol and MQTT protocol. For specific
communication protocol, please refer to relevant materials. The following introduces the application of
Modbus RTU and MQTT protocol on the device.

Page 104 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Modbus TCP and RTU protocol are very similar, as long as an MBAP header is added to the RTU
protocol, and the two byte CRC check code of the RTU protocol can be removed.

7.1 Modbus RTU Protocol

1. Set the platform server IP and port, select Modbus RTU protocol and set the local Modbus device
ID (the effective range of Modbus device ID is 1~247)
2. Set relevant message information according to the platform to be connected (if not, you can not set
it)
[Registrer Package]: The registration package sent by the device to the server when connected to the
server.
[Heartbeat Packet]: A heartbeat packet sent by the device to the server to maintain the connection.
[Heartbeat Response Packet]: Server responds to the device's heartbeat packets.

[Heartbeat period]: The heartbeat packet sending period.

[Host Silent Time]: Silent time when no data is sent from server, timeout will reconnect.

Page 105 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

7.1.1 Read Device Register Address

7.1.1.1 DI / DO / AI DI Pulse Counter Register Address

1) Input Coil, Read Only (Function code 02)

PLC or
Modbus Register configuration
Data Name Data Type Description
Address(Decimal) address
(Decimal)
Dry contact：
0 10001 DI1 Bool 0: Open
1: Close
Wet contact：
1 10002 DI2 Bool 0: Low level (0~1VDC)
1: High level (5~30VDC)
Network
disconnection
detection device 0:offline
2~21 10003~10022 Bool
IP 1:online
(max 20 IPs can
be set)

2)Holding Coil, Read &Write (Function Code 01/05/15)

PLC or configuration
Modbus Register
address Data Name Data Type Description
Address(Decimal)
(Decimal)
0 00001 DO1 0: Open
Bool
1 00002 DO2 1: Close

3)Input Register, Read Only (Function Code 04)

PLC or
Modbus Register configuration
Data Name Data Type Description
Address(Decimal) address
(Decimal)
0~1 30001~30002 AI1
2~3 30003~30004 AI2 (32 Bit Float)
4~5 30005~30006 AI3 ABCD Real value =
6~7 30007~30008 AI4 register value
8~9 30009~30010 DI1 pulse counter 32-bit unsigned
integer
10~11 30011~30012 DI2 pulse counter
ABCD

Page 106 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

7.1.1.2 Read Device Digital Input Status

Master Send Data Format

Content Byte Data Description
Device address 1 01H 01H Device, Range: 1-247, according to setting
address
Function code 1 02H 02 read input coil DIN status
DIN Register address 2 00 00H Range:0000H-0001H, stands for DI1-DI2
Read DIN register quantity 2 00 02H Range:0001H-0002H, read quantity of DIN
16CRC verify 2 F9 CBH CRC0 CRC1 low byte in front, high byte behind

Receiver Return Data Format

Content Byte Data Description
Device address 1 01H 01H Device, according to setting address
Function code 1 02H Read input holding coil
Return bytes quantity 1 01H Return data length
Returning data 1 01H Return DI data
16CRC Verify 2 6048H CRC0 CRC1 low byte in front, high byte behind
Example: Inquiry device 2 DIN data at same time, then:
Server send: 01 02 00 00 00 02 F9 CB
01= Device address; 02= Inquiry DIN status; 00 00= DIN Starting address; 00 08= Serial reading
2 DIN status;
F9 CB = CRC verify.

Device return: 01 02 01 01 60 48
01= Device address; 02= Inquiry DIN status; 01= Returning data bytes quantity; 01= DIN status,
each byte stands for one DIN status, 01H converter to binary 0000 0001 from low to high byte,
stands for DIN1-DIN2 status,
0= Open, 1= Close.
DI2 DI1
0 1
Open Close
60 48: 16 byte CRC verify.
If need to inquiry multi DIN status, only need to change "DIN Starting Address", "Reading DI
Register Quantity", calculate CRC verify again.

7.1.1.3 Read Device Digital Output Status

Master Send Data Format:

Data
Content Bytes Description
(H: HEX)
01H Device, Range: 1-247, according to
Device Address 1 01H
setting address
Function Code 1 01H Read the hold coil, function code 01

Page 107 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Register Starting
2 00 00H Range: 0000H-0001H, stands for DO1-DO2
Address
Read Register Quantity 2 00 02H Range: 0000H-0002H
16 CRC Verify 2 BD CBH CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H device, consistent with download data
Function Code 1 01H Read the hold coil
Return Byte Length 1 01H Return data length
Returning Data 1 02H Data returned
16 CRC Verify 2 D0 49H CRC0 CRC1 low byte in front, high behind
Example: Read 2 DO states, device address 1,then,
Server Send: 01 01 00 00 00 02 BD CB
01= Device address; 01= Read Relay DO function code; 00 00= Register starting address; 00
02= Continuous reading of 2 DO data; BD CB= CRC verify.
Device Answer: 01 01 01 02 DO 49
01= Device address; 01= Read DO function code; 01=Return data length; 02=The returned data
is converted into binary: 0000 0010 from low to high byte,status value:
DO2 DO1
1 0
Close Open
D0 49: CRC verify
If you want to read the state of a DO or several DO states, you only need to modify the "DO register
start address" and "the number of read registers", then recalculate the CRC, and the returned data is
parsed according to the above description.

7.1.1.4 Control Device Digital Output Status

1) Control 1 channel DO output

Master Send Data Format:
Data
Content Bytes Description
(H: HEX)
01H Device, Range: 1-247, according to setting
Device Address 1 01H
address
Function Code 1 05H Write single holding coil type, function code 05
DO Register
2 00 00H Range: 0000H-0001H
Address
This value: FF 00H or 00 00H, FF 00H= Close DO,
Active 2 FF 00H
00 00H= Open DO
16CRC Verify 2 8C 3AH CRC0 CRC1 low byte in front, high behind

Page 108 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
01H Device, Range 1-2, according to the data
Device Address 1 01H
Master send
Function Code 1 05H Write single holding coil type
DO Register
2 00 00H Range: 0000H-0003H
Address
This value: FF 00H or 00 00H, FF 00H= Already
Active 2 FF 00H actived close relay, 00 00H= Already actived open
DO
16CRC Verify 2 8C 3AH CRC0 CRC1 low byte in front, high behind

Example: Control relay DO1 close, then:

Server send:01 05 00 00 FF 00 8C 3A
01=Device address;05= Control single relay command;00 00=Relay DO0 address;FF 00=DO0
close;8C 3A=CRC verify.
Device answer: 01 05 00 00 FF 00 8C 3A
01=Device address;05=Control single relay command;00 00=Relay DO0 address;FF 00= Active
DO0 close;
8C 3A=CRC verify.
If single control other relay outputs, only need to change "DO Register Address" and "Active",
calculate CRC verify again.

2) Multiple Control DO outputs

Master Send Data Format:
Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 0FH Write multi holding coil,function code 15
DO Starting
2 00 00H Range: 0000H-0001H, stands for DO0-DO1
Register Address
Control Relay
2 00 02H Range: 0000H-0002H
Quantity
Write Byte Write 1 byte, since device only 2DO, use 4 binary can
1 01H
Quantity do it
Writing Data 1 03H Send status data to control DO
16CRC Verify 2 9E 96H CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Content Bytes Data Description

Page 109 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

(H: HEX)
Device Address 1 01H 01H Device, according to the data Master send
Function Code 1 0FH Write multi holding coil type
DO Register
1 00 00H Range: 0000-0001,stands for DO1-DO2
Address
Range:0001H-0002H, stands for already actived
Active 1 00 02H
relays
16CRC Verify 2 D4 0AH CRC0 CRC1 low byte in front, high behind

Example: Close device 2 DO at same time, then:

Server send: 01 0F 00 00 00 02 01 03 9E 96
01= Device address; 0F= Control multi relay; 00 00= Relay DO0 starting address; 00 02= Control
2 relays;
01= Send data qty; 03= Data sent converter to binary 0000 0011 from low to high stands for
DO1-DO2 status, 0stands for open relay,1 stands for close relay:
DO2 DO1
1 1
Close Close
9E 96 CRC verify.
Device answer: 01 0F 00 00 00 02 D4 0A
01= Device address; 0F= Control multi relay; 00 00= Relay DO0 starting address; 00 02= Actived
2 relays;
D4 0A CRC verify.

7.1.1.5 Read Device AI Status and DI Pulse Counter

Master Send Data Format:

Data
Content Bytes Description
(H: HEX)
01H Device, Range: 1-247, according to setting
Device Address 1 01H
address
Function Code 1 04H Read input register, function code 04
Register Starting Every 2 16-bit address corresponds to 1 AI 32-bit
2 00 00H
Address register
A total of 12 16-bit addresses are read, each of the
Read Register two 16-bit addresses is combined into a 32-bit
2 00 0CH
Quantity address, a total of 6 32-bit addresses, that is, the
number of read AI 4 and the DI pulse count 2
16 CRC Verify 2 F0 0FH CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Content Bytes Data Description

Page 110 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

(H: HEX)
Device Address 1 01H 01H device, consistent with download data
Function Code 1 04H Read the hold coil
Return Bytes
1 18H Return data length
Quantity
3B 98 4E 40 40 80 00
Return AI data,32-bit float,ABCD. The DI
00 3C 89 15 BE 3B D7
Returning Data 16 pulse count value is a 32-bit unsigned
51 8B 00 00 00 03 00 00
integer, with byte order arranged as ABCD.
00 06H
16 CRC Verify 2 22 80H CRC0 CRC1 low byte in front, high behind
Example: Inquiry device 4 AIN and 2 DIN pulse data at same time, then:
Server send: 01 04 00 00 00 0C F0 0F
01= Device address; 04= read input register; 00 00= Starting address ; 00 0C= Serial reading 12
input register value:F0 0F= CRC verify.

Device return: 01 04 18 3B 98 4E 40 40 80 00 00 3C 89 15 BE 3B D7 51 8B 00 00 00 03 00 00
00 06 22 80
01= Device address; 04= read input register; 18= Return data byte ; 3B 98 4E 40 40 80 00 00 3C
89 15 BE 3B D7 51 8B 00 00 00 03 00 00 00 06=return data, detail as follows:

Analog input AI4 AI3 AI2 AI1 DI1 pulse DI2 pulse
Receiving Data 3B D7 3C 89 40 80 3B 98 3B 98 3B 98
（32-bit floating） 51 8B 15 BE 00 00 4E 40 4E 40 4E 40
Real value 0.006571 0.016734 4 0.004648 3 6
22 80: CRC verify.

7.1.2 Read Mapping Address

7.1.2.1 Mapping Register Address

1) Boolean type slave mapped register addresses: Holding coils and input coils, supporting function
codes 01, 02, 05, and 15.
PLC or
Modbus Register configuration
Data Name Data Type Description
Address(Decimal) address
(Decimal)
64 00065 or 10065 Bool 64 Bool Boolean type,
65 00066 or 10066 Bool 65 Bool slave mapping address,
66 00067 or 10067 Bool 66 Bool can map the slave input
… … … Bool coil and holding coil
… … … Bool state,
2048 02049or 12049 Bool 2048 Bool 1985 addresses in total.

Page 111 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router
2) 16-bit data type slave mapped register addresses: Holding registers and Input registers, supporting
function codes 03, 04, 06, and 16.
PLC or configuration
Modbus Register
address Data Name Data Type Description
Address(Decimal)
(Decimal)
20001 420002 or 320002 16 Bit data 20001
20002 420003 or 320003 16 Bit data 20002 It can map
The specific
20003 420004 or 320004 16 Bit data 20003 slave holding
data type
………. ………. ………. registers and
depends on
input
the data type
registers, with
of the slave
a total of 999
mapping.
20999 421000 or 321000 16 Bit data 20999 addresses.

3) 32-bit data type slave mapped register addresses: holding registers and input registers, supporting
function codes 03, 04, 06, and 16.
PLC or
Modbus Register configuration
Data Name Data Type Description
Address(Decimal) address
(Decimal)
21000 421001 or 321001 32 Bit data 21000
21002 421003 or 321003 32 Bit data 21002
21004 421005 or 321005 32 Bit data 21004
………. ………. ………. The specific It can map
data type slave holding
depends on registers and
the data type input
of the slave registers, with
22998 422999 or 322999 32 Bit data 22998 mapping. a total of 1000
addresses.

4) 64-bit data type slave mapped register addresses: holding registers and input registers, supporting
function codes 03, 04, 06, and 16.
PLC or
Modbus Register configuration
Data Name Data Type Description
Address(Decimal) address
(Decimal)
30000 430001 or 330001 64 Bit data 30000
30004 430005 or 330005 64 Bit data 30004

Page 112 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

30008 430009 or 330009 64 Bit data 30008

………. ………. ………. The specific It can map
data type slave holding
depends on registers and
the data type input
of the slave registers, with
31996 431997 or 331997 64 Bit data 31996 mapping. a total of 500
addresses.

7.1.2.2 Read Boolean Mapped Address Data

Master Send Data Format：

Content Bytes Data Description
01H Device, Range: 1-247, according to setting
Device ID 1 01H
address
Function Code 1 01H Read holding coil type, function code 01
Boolean data mapping start address 0040H. For
Boolean Register
2 00 40H detailed address correspondence, please refer to
Starting Address
the mapped register addresses.
Read Register Quantity 2 00 0AH Quantity of Boolean data to read
16 CRC Verify 2 BD D9H CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Content Bytes Data Description
Device ID 1 01H 01H Device, according to setting address
Function Code 1 01H Read holding coil type
Return Data Length 1 02H Return data length
Returning Data 2 73 01H
16 CRC Verify 2 5D 0CH CRC0 CRC1 low byte in front, high behind
Example: Start from address 64, read 10 Boolean mapping data value, then:
Server send: 01 01 00 40 00 0A BD D9
01= Device ID; 01 = Read holding coil; 00 40 = Read Boolean data start from address 64; 00 0A
= Serial to read 10 Boolean status; BD D9 CRC Verify.

Device answer: 01 01 02 73 01 5D 0C
01= Device ID; 01 = Read holding coil; 02= Return Data byte; 73 01= Return 10 Boolean status.
High byte stands for low address data, low address stands for high address. According to
Modbus protocol, fix 73 01H real value to be 01 73H, converter to Binary as below:
Register
Invalid Invalid Invalid Invalid Invalid Invalid 73 72
mapping address

Page 113 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Value 0 0 0 0 0 0 0 1
Register
71 70 69 68 67 66 65 64
mapping address
Value 0 1 1 1 0 0 1 1
The address value higher than 10 digits will be seen as invalid.
5D 0C CRC Verify.

7.1.2.3 Modify Boolean Mapping Address Data

To control the status of holding coils on the connected slave device, you must configure and add a
slave mapping with function code 01. When the mapped address value is changed, the
corresponding data will be written to the slave device.
Master Send Data Format:
Data
Content Bytes Description
(H: HEX)
01H Device, Range: 1-247, according to setting
Device Address 1 01H
address
Function Code 1 05H Write single holding coil, function code 05H
Boolean data mapping start address 0040H. For
Boolean Mapping
2 00 40H detailed address correspondence, please refer to
Register Address
the mapped register addresses.
This value: FF 00H or 00 00H, FF 00H stands for
Write value 2 FF 00H
write 1; 00 00H stands for write 0
16 CRC Verify 2 8D EEH CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, according to the data Master send
Function Code 1 05H Write single holding coil
Boolean Mapping
2 00 40H Modify Boolean Data Mapping Address 0040H
Register Address
This value: FF 00H or 00 00H. FF 00H stands for
Write value 2 FF 00H
write 1, 00 00H stands for write 0.
16 CRC Verify 2 8D EEH CRC0 CRC1 low byte in front, high behind
Example: Modify Boolean mapping address 64 status, modify to 1, then:
Server send: 01 05 00 40 FF 00 8D EE
01= Device address; 05= Write boolean value; 00 40=The mapping address which need to
revise;
FF 00 = Write 1; 8D EE CRC Verify.
Device answer: 01 05 00 40 FF 00 8D EE
01= Device address; 05= Write boolean value; 00 40= The mapping address which need to write;
FF 00= Write 1; 8D EE CRC Verify.

Page 114 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router
If need multiple modify, pls check function 15 of Modbus protocol.

7.1.2.4 Read Data Type Mapping Address Data

Master Send Data Format:

Data
Content Bytes Description
(H: HEX)
01H Device, Range: 1-247, according to setting
Device Address 1 01H
address
Function Code 1 03H Read holding register, function code 03
One address can read 2 bytes. Mapping data type
Mapping Register
2 4E 21H address range, refer to [“Slave Mapping Register
Starting Address
Address”] at manual bottom.
Read Mapping
2 00 0AH Read input register quantity
Register Quantity
16 CRC Verify 2 82 EFH CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device No. 01H, data matches the issued
Device Address 1 01H
command.
Function Code 1 03H Read holding register
Range Data Bytes 1 14H
00 14 00 1E 00 28
00 32 00 4B 00 41
Returning Data 20 Returning Data
00 0A 00 25 00 14
00 2AH
16 CRC Verify 2 FB 34H CRC0 CRC1 low byte in front, high behind
Example: Mapping address start from 20001, read 10 address data, then:
Server send: 01 03 4E 21 00 0A 82 EF
01= Device address; 03= Read holding register ; 4E 21=Mapping register starting address,
current is Decimal data 20001; 00 0A = Read 10 register value; 82 EF=16 CRC Verify.
Device answer: 01 03 14 00 14 00 1E 00 28 00 32 00 4B 00 41 00 0A 00 25 00 14 00 2A FB 34
01= Device address; 03= Read holding register; 14= Returning 20 byte; 00 14 00 1E 00 28 00 32
00 4B 00 41 00 0A 00 25 00 14 00 2A = Returning data.
Register
Mapping 20010 20009 20008 20007 20006 20005 20004 20003 20002 20001
Address
Value 00 2A 00 14 00 25 00 0A 00 41 00 4B 00 32 00 28 00 1E 00 14
FB 34=16 CRC Verify.

Page 115 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

7.1.2.5 Modify Data Type Mapping Address Data

If need to revise slave data which RS485 connected, need to add slave in salve list of configurator.
Write command 03 for mapping, when mapping address value modified, will write to RS485 matched
slave address.
If address 20001 mapping slave data type is Signed Int, sort AB.
Master Send Data Format:
Data
Content Bytes Description
(H: HEX)
01H Device, Range: 1-247, according to setting
Device Address 1 01H
address
Function Code 1 06H Write single holding register, function code 06
Mapping Register Mapping data type address range, refer to [“Slave
2 4E 21H Mapping Register Address”]
Address
Write Data 2 00 64H Data writing value is Decimal data 100
16 CRC Verify 2 CF 03H CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, data matches the issued command.
Function Code 1 06H Write single holding register
Mapping Register
2 4E 21H Mapping data type
Address
Write Data 2 00 64H Write 100 successfully
16 CRC Verify 2 CF 03H CRC0 CRC1 low byte in front, high behind
Example: If address 20001 mapping slave data type is Signed Int, sort AB, modify mapping
address 20001 register to 100, then:
Server send: 01 06 4E 21 00 64 CF 03
01= Device address; 06= Modify single holding register value; 4E 20=Modify address 20001
register value; 00 64 = Write Decimal value 100; CF 03=16 CRC Verify.
Device answer: 01 06 4E 20 00 64 CF 03
01= Device address; 06= Modify single holding register value; 4E 20= R Modify address 20001
register value; 00 64= Modify to Decimal value 100, CE 03=16 CRC Verify.
If need to modify multiple data type mapping address, pls check function code 16 in Modbus
protocol.

7.2 MQTT Protocol

MQTT is a client-server based message publish/subscribe transport protocol. The MQTT protocol is
lightweight, simple, open, and easy to implement, and these features make it very versatile. In many

Page 116 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

cases, including restricted environments such as machine to machine (M2M) communication and the
Internet of Things (IoT). It is widely used in satellite link communication sensors, occasionally dialed
medical devices, smart homes, and some miniaturized devices. The MQTT protocol runs on TCP/IP
or other network protocols, providing ordered, lossless, two-way connectivity.

7.2.1 MQTT Introduction

MQTT is a client-server based message publish/subscribe transport protocol. The MQTT protocol is
lightweight, simple, open, and easy to implement, and these features make it very versatile. In many
cases, including restricted environments such as machine to machine (M2M) communication and the
Internet of Things (IoT). It is widely used in satellite link communication sensors, occasionally dialed
medical devices, smart homes, and some miniaturized devices. The MQTT protocol runs on TCP/IP
or other network protocols, providing ordered, lossless, two-way connectivity.

7.2.2 MQTT Principle

There are three identities in the MQTT protocol: Publisher (Publish), Broker (Server), Subscriber
(Subscribe). Among them, the publisher and subscriber of the message are both clients, the message
broker is the server, and the message publisher can be the subscriber at the same time.

7.2.3 Device Communication Application

1. Connect Platform: Beilai V2.0 or other cloud platform to enter the corresponding IP and port.
2. Connection protocol: MQTT protocol.
3. MQTT client ID: Unique identification of the device, which can be a serial number, device ID, or
IMEI code.
4. MQTT account: Account where the device publishes the theme on the proxy server.
5. MQTT password: Device's account password for publishing the theme on the proxy server
6. Publish topic: Topic of the device publishing uplink data to the platform.
7. Subscription topic: Topic that the device subscribes to when receiving downlink data.
8. Release cycle (seconds): MQTT data release interval.
9. Publisher QOS: The service quality level guarantee for application message distribution, 0-at most
once, 1-at least once, 2-only once, you can choose according to your needs.
10. Encryption: You can use encryption to connect to the server according to your needs.
11. Enable data retransmission: Check enable, after enabling, when reconnecting to the cloud
platform, the data during the offline period will be retransmitted.
12. Data packing: After checking, send multiple data in one message, when unchecked, one
message corresponds to one I/O data point.
After the configuration is complete, the client will initiate a connection to the server:

Page 117 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

CONNECT: The client sends a CONNECT connection message request to the server;
CONNACK: The server responds with a CONNACK confirmation connection message, indicating
that the connection is successful;
After the client establishes a connection, it is a long connection, and the client can publish or
subscribe to the message on the server;
For example the device and the client's mobile phone as the client:
After the device publishes the topic on the proxy server, customers can view the data through
subscription. That is, the device is the publisher and the customer's mobile phone is the subscriber.
Users can also publish topics through the MQTT server to control the device. That is, the user is the
publisher and the device is the subscriber.

7.2.4 Device Data Publishing Format

If “pack the data” is checked, multiple I/O data points will be sent in one message. In case there are
too many data points, they will be sent separately by multiple messages. each message contains
multiple data points. If "Data Packing" is not checked, a message contains only one I/O data point.
Please kindly take noted about such differences between the two publishing formats.

1) Payload Data Format in Device Published Messages (Data Packaging)

Publish Topic: Serial Number (corresponding to the configured "Publish Topic" setting)
{
"sensorDatas":
[
{
//Switch Type
"switcher":"1", //Data Type and Its Value
"flag":"DI1" //Read/Write Flag
},
{
//Slave Switch Type
"switcher":"0", //Data Type with Corresponding Value
"flag":"REG64" //Read/Write Flag
},
{
//Numerical Type
"value":"10.00",
"flag":"AI1"
},
{
//Slave Numerical Type
"value":"217.5",
"flag":"REG20001"
},
{

Page 118 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

//Positioning Type
"lat":"39.9", //Latitude Data
"lng":"116.3", //Longitude data
"spd":"0.0", //Speed data
"dir":"0.0", //Direction data
"flag":"GPS"
}
],
"time":"1602324850",
//Time Identifier, Data Publish Timestamp in UTC Format
"state":"alarm",
//The Alarm/Recovery Flag is present only in alarm or recovery data; it is not included in periodic
reporting data.
"retransmit":"enable"
//The Retransmission Flag signifies historical data and is included only in retransmitted historical data;
real-time data does not carry this flag. }

Note:
//Data Type and Value: Categorized by type as follows:
1. The numeric character is "value" followed by: "data value".
2. The switch character is "switcher" followed by: "0"or"1" (0 is close,1 is open).
3. Positioning data :
The GPS longitude character is "lng" and the value is: "data value".
The GPS latitude character is "lat" and the value is: "data value".
The GPS speed character is "spd" and the value is: "data value".
The GPS direction character is "dir" and the value is: "data value".
// Read/Write Flag: The character is "flag", which represents the read/write identifier of the I/O data
point, as detailed below:

Read/Write Flag of Local I/O Data Points:

Data name Flag Data type Description
Digital output DO1, DO2 Switcher 0 is open, 1 is close
Digital input DI1, DI2 Switcher 0 is open, 1 is close
Analog input AI1, AI2, AI3, AIN4 Value The actual value = original value
Network failure DI3~DI22 Switcher 0 is offline, 1 is online
Pulse count COUNT1, COUNT2 Value The actual value = original value

Extended Read/Write Flag for Slave I/O Data Points:

Data name Flag Data type Description
Boolean REG64~256 Switcher Defined according to slave data
16 Bit REG20000~20127 Value Defined according to slave data
32 Bit REG20128~20254 Value Defined according to slave data
64 Bit REG30000~31996 Value Defined according to slave data

//Time flag: The character is "time", followed by "specific reporting timestamp"

Page 119 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

//Alarm/Recovery Flag: The character is "state", followed by either "alarm" or "recovery" ("alarm"
represents alarm data, "recovery" represents recovery data).
//Retransmission flag: The character is "retransmit", followed by "enable"
The data collected during the network offline period will be temporarily stored in the device, and will
be republished when the network is restored. It is identified by the "retransmit" field to indicate
historical data. (Need to check the enable data transmission on the configuration interface)

2) Payload Data Format in Device Published Messages (Data Not Packaged)

Publish Topic: Serial numbers
{
"switcher": "0",
"flag": "DI1",
"time": "1602324850"
}
Note: When the data is unpacking, there is a little difference except for the format, the others are
exactly the same. This is an example of DI1. For other data types, please refer to the above
description.

7.2.5 Device Subscription Data Format

Payload Data Format in Device Subscription Messages

Subscription Topic: SerialNumber/+ (corresponding to the configured subscription topic setting)
(In Beilai V2.0, the topic name used for downstream published messages is
“SerialNumber/SensorID,” so the device subscription topic needs to include the wildcard “/+” in order
to receive data sent from the platform and enable control.)
{
"sensorDatas":
[
{
"sensorsId": 211267, //Platform Sensor ID
"switcher":1, //Data Type and Value
"flag":"DO1" //Read/Write Flag
}
],
"down":"down" //Platform Downlink Message Identifier
}

//Sensor ID: The character is "sensorsID", and the ID is automatically generated according to the
platform definition.
//Data type and value:
1. The switch character is " switcher " followed by: "0"or "1", 0 is open, 1 is close.
2. The numeric character is " value " followed by: "data value"
//Read/Write Flag: The character is "flag", which represents the read/write identifier of the IO data
point.

Page 120 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

//Platform Downlink Message Identifier: The character is "down", followed by "down", indicating this is
platform downlink data.

7.3 SNMP Protocol

7.3.1 Introduction to R40 SNMP

Administrators need to configure and manage devices distributed across the entire network. Since
these devices are widely dispersed, it is impractical for administrators to perform on-site configuration.
Moreover, if these network devices come from different manufacturers, each providing its own
independent management interface (such as different command line interfaces), the workload for
batch configuring the network devices becomes enormous. In such cases, relying on traditional
manual methods results in high costs and low efficiency.
To address this, network administrators can utilize the R40 edge computing router. Various network
devices connect to the R40, which supports the SNMP protocol. The network management system
obtains the status information of the R40 via SNMP, enabling real-time monitoring of the managed
devices.
The Network Management System (NMS) can obtain device status information from the R40 in real
time at any moment and perform remote control of the managed devices. Currently, the R40 supports
SNMPv1 and SNMPv2c versions. Both SNMPv1 and SNMPv2c use community string authentication.
SNMP MIBs (Management Information Bases) are a core module in SNMP protocol software. The
R40 uses the ENTITY-SENSOR-MIB to operate its local I/O (including DI/DO/AI). Additionally, it can
manage mapped registers established through the “Modbus Master” function, thereby enabling
protocol conversion between Modbus and SNMP.

7.3.2 R40 SNMP Application Operation Example

Using the MG-SOFT MIB Browser tool to connect to the R40 via SNMP, with the R40 connected to a
network slave device as an example.
Open the MG-SOFT MIB Browser and enter the IP address of the R40.
If the MG-SOFT MIB Browser is running on a server connected through the R40’s LAN port, enter
192.168.3.1 (default LAN IP).
If the MG-SOFT MIB Browser server is on the same LAN as the R40’s WAN port, enter the R40 WAN
IP address.
The UDP port is 161.

Page 121 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

MG-SOFT MIB Browser configuration, select SNMPV1.

Click "OK" and then connect successfully.

Page 122 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Add MIB infobase, select ENTITY-SENSOR-MIB from MIB Modules, and load the infobase.

Page 123 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Information base node

Walk R40 system information,

Click "System", right-click the mouse and choose "walk" to read all information.

Page 124 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

To monitor the data points of the network devices controlled by the R40, click entPhySensorValue and
choose Walk, Get or Get Next from the right mouse button to monitor the data of the R40.

The entPhySensorUnitsDisplay node displays the ID of the R40 data point.

Page 125 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

The value of the data point obtained on the network management system is compared with the value
of the data point monitored on the R40 web page.
On the entPhySensorUnitsDisplay node, 1 is DI1 and 19 is REG20128.
You can view the corresponding value on the entPhySensorValue node. If 1 is 1, DI1 is in the closed
state, and if 19 is 1230, REG20128 is 1.23. The value of numeric data on SNMP is increased by 1000,
and the Boolean value remains the original value.
In the entPhySensorScale node, you can view how many times each data point has grown or shrunk.

Page 126 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router
On the R40 page, "DI1" and "REG2018" are monitored as follows:

Page 127 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Use the network management system to control R40. For example, write "3" (DO1) to "1" (Close on
R40) and "20" (REG20130) to "2356" (2356 on R40).
On MG-SOFT MIB Browser, click the "entPhySensorValue" node, right-click, and select "set...
[read-only] ".

Page 128 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Click entPhySensorValue.3 (DO1) in the displayed box. You can also view that the current value of
entPhySensorValue.3 is 0.

Enter "1" in "Value to Set" and click the icon.

Page 129 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Click "entPhySensorValue.20" (REG20130) in the box in the same way as controlling DO1. You can
also monitor that the current value of "entPhySensorValue.20" is "0" in the box.

Page 130 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router
Enter 2356 in "Value to Set" and click the icon.

Check the status of DO1 on the R40 page as close.

Page 131 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router
Check the value of register 20130 of the network port slave on the R40 page as "2356".

7.4 SMS Command List

This device supports remote query and control operations through SMS commands. The following
are the precautions:
1. The default password is 1234, you can edit the SMS command to modify the password;
2. The "password" in the SMS command refers to the device password, such as 1234, just enter the
password directly;
3. The "+" sign in the SMS command is not used as the content of the SMS, please do not add any
spaces or other characters;
4. The SMS command must be CAPITAL LETTERS, such as "PWD" instead of "pwd";
5. If the password is correct but the command is incorrect, the device will return: SMS Format Error,
Please Check! Please ensure the input method (Chinese/English) and letter case are correct.
6. If the password is entered incorrectly, no information will be returned;
7. Once the Unit received the SMS Command, will return SMS to confirmation, if no SMS return,
please check your command or resend again.

Page 132 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router
1) Modify Password, 4 digits, default is 1234
SMS Command Return SMS Content
Old Password＋P＋New Password Password reset complete
2) Inquiry Current Status SMS Command
SMS Command Return SMS Content
password+EE Model:xxx
Version:xxx
IMEI:xxx
GSM Signal Value:xxx
3) Inquiry DI Status
SMS Command Return SMS Content
Inquiry Status password+DINE DIN1:Open/Close
DIN2: Open/Close
4) Set Digital Output
SMS Command Return SMS Content
Switch ON DO1(Close) password+DOC1 DO1: Close
Switch OFF DO1(Open) password+DO1 DO1: Open
Switch ON DO2(Close) password+DOC2 DO2: Close
Switch OFF DO2(Open) password+DO2 DO2: Open
Inquiry DO Current Status password+DOE DO1: Open/Close
DO2: Open/Close
5) Inquiry AI Status
SMS Command Return SMS Content
Inquiry Status password+AINE AIN1: xxx
AIN2: xxx
AIN3: xxx
AIN4: xxx
6) Digital Pulse Counter
SMS Command Return SMS Content
Inquiry Pulse Counter password+PR DI1 counter value:xxx
Value DI2 counter value:xxx
Clear DI1 Pulse Counter password+DI1CLR DI1 clear successfully
Clear DI2 Pulse Counter password+DI2CLR DI2 clear successfully

8. Appendix – Register Addresses

8.1 Local Register Addresses

Local DI/DO/AI/DI Pulse Count Register Addresses

1) Input Coil, Read Only (Function code 02)

Page 133 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

PLC or
Modbus Register configuration
Data Name Data Type Description
Address(Decimal) address
(Decimal)
Dry contact：
0 10001 DI1 Bool 0: Open
1: Close
Wet contact：
1 10002 DI2 Bool 0: Low level (0~1VDC)
1: High level (5~30VDC)
Network
disconnection
detection device 0:offline
2~21 10003~10022 Bool
IP 1:online
(max 20 IPs can
be set)

2) Holding Coil, Read &Write (Function Code 01/05/15)

PLC or configuration
Modbus Register
address Data Name Data Type Description
Address(Decimal)
(Decimal)
0 00001 DO1 0: Open
Bool
1 00002 DO2 1: Close

3) Input Register, Read Only (Function Code 04)

Modbus PLC or
Register configuration
Data Name Data Type Description
Address(De address
cimal) (Decimal)
0~1 30001~30002 AI1
2~3 30003~30004 AI2 32 Bit Float
4~5 30005~30006 AI3 ABCD Real value =
6~7 30007~30008 AI4 register value
8~9 30009~30010 DI1 pulse counter 32-bit unsigned
integer
10~11 30011~30012 DI2 pulse counter
ABCD
Clear Pulse
Use Function Code 03
Count
32-bit Data Type Local Intermediate Register Addresses: Holding register type and input register
type; supports Modbus function codes 03/04/06/16.
Used in conditional operations.
Channel 1 Intermediate
4000~4001 34001~34002
Register Address
32 Bit Float Real value =
Channel 2 Intermediate
4002-4003 34003~34004 ABCD register value
Register Address
... ... ...

Page 134 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

Channel 32 Intermediate
4062-4063 34063~34064
Register Address

8.2 Mapped Register Addresses

The platform can access slave devices by accessing the mapped addresses of the local device via
the Modbus protocol. The correspondence between the mapped addresses and the slave device
addresses needs to be configured through the 6.5.7. Modbus Master Configuration page.
1) Boolean type slave mapped register addresses: Holding coils and input coils, supporting function
codes 01, 02, 05, and 15.
PLC or
Modbus Register configuration
Data Name Data Type Description
Address(Decimal) address
(Decimal)
64 00065 or 10065 Bool 64 Bool Boolean type,
65 00066 or 10066 Bool 65 Bool slave mapping address,
66 00067 or 10067 Bool 66 Bool can map the slave input
… … … Bool coil and holding coil
… … … Bool state,
2048 02049or 12049 Bool 2048 Bool 1985 addresses in total.

2) 16-bit data type slave mapped register addresses: Holding registers and Input registers, supporting
function codes 03, 04, 06, and 16.
PLC or configuration
Modbus Register
address Data Name Data Type Description
Address(Decimal)
(Decimal)
20001 420002 or 320002 16 Bit data 20001
20002 420003 or 320003 16 Bit data 20002 It can map
The specific
20003 420004 or 320004 16 Bit data 20003 slave holding
data type
………. ………. ………. registers and
depends on
input
the data type
registers, with
of the slave
a total of 999
mapping.
20999 421000 or 321000 16 Bit data 20999 addresses.

3) 32-bit data type slave mapped register addresses: holding registers and input registers, supporting
function codes 03, 04, 06, and 16.
PLC or
Modbus Register
configuration Data Name Data Type Description
Address(Decimal)
address

Page 135 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

(Decimal)
21000 421001 or 321001 32 Bit data 21000
21002 421003 or 321003 32 Bit data 21002
21004 421005 or 321005 32 Bit data 21004
………. ………. ………. The specific It can map
data type slave holding
depends on registers and
the data type input
of the slave registers, with
22998 422999 or 322999 32 Bit data 22998 mapping. a total of 1000
addresses.

4) 64-bit data type slave mapped register addresses: holding registers and input registers, supporting
function codes 03, 04, 06, and 16.
PLC or
Modbus Register configuration
Data Name Data Type Description
Address(Decimal) address
(Decimal)
30000 430001 or 330001 64 Bit data 30000
30004 430005 or 330005 64 Bit data 30004
30008 430009 or 330009 64 Bit data 30008
………. ………. ………. The specific It can map
data type slave holding
depends on registers and
the data type input
of the slave registers, with
31996 431997 or 331997 64 Bit data 31996 mapping. a total of 500
addresses.

Page 136 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0
 Cellular IIoT Router

9. Warranty

1) This equipment will be repaired free of charge for any material or quality problems within one year
from the date of purchase.
2) This one-year warranty does not cover any product failure caused by man-made damage,
improper operation, etc

Shenzhen Beilai Technology Co., Ltd.

Website: https://www.bliiot.com

Page 137 of 137 Shenzhen Beilai Technology Co., Ltd. Ver 2.0