OTA Firmware Update

Delivery Mechanism

Sending a large software file over a wireless link requires a robust protocol that can handle intermittent connections and low bandwidth. An ota firmware update is typically split into many small packets that are sent one at a time to the device. The device acknowledges each packet and stores it in a temporary memory location until the entire file has been received.

If the connection is lost in the middle of the process, the device can resume the download from the last successful packet rather than starting from the beginning. This efficiency is a requirement for battery powered devices that must minimize their radio airtime to conserve energy. Once the full image is downloaded, the device performs a hash check to ensure that the file was not corrupted during transmission.

This check compares the received data against a known signature provided by the server.

Flash Integrity

Writing the new software to the internal memory of the device is a delicate operation that must be protected against power failure. Any ota firmware update process uses a dual bank memory architecture where the new code is written to an inactive partition while the old code is still running. This approach ensures that the device remains functional even if the update is interrupted.

Only after the entire new image has been verified and confirmed as valid does the device trigger a reboot to switch to the new code. The bootloader is responsible for swapping the active partition and starting the new application. If the new software fails to boot correctly, the bootloader can detect the failure and immediately revert to the previous version.

This failover mechanism prevents the device from becoming a non-functional brick if the update contains a critical error.

Rollback Safety

Maintaining control over which versions of software are running in the field allows the manufacturer to respond quickly to new security threats. The ota firmware update system includes a versioning mechanism that prevents a device from being downgraded to an older, less secure version of the code. This feature is called anti-rollback protection and is enforced by the hardware during the update process.

Administrators use a central management console to track the update status of every device in their network and identify any units that have failed to move to the latest version. Successful updates are recorded in a central log that serves as the official record of the software state for the entire fleet. This visibility is the final step in ensuring that all devices are protected and performing as intended.