Fazley RabbiAn over-the-air (OTA) firmware update is a way to send new software to a device that is already installed, through its own internet or network connection, instead of plugging a cable into it. Firmware is the program that runs inside the device, such as a sensor box or a controller. OTA lets you fix a bug, close a security gap or add a feature on many devices at once, without visiting every pond, shed or factory floor. It is one of the features that separates a prototype from a product you can actually support.
Why it matters for a business
Imagine a hypothetical distributor with temperature monitors in a few dozen shops across several districts. A bug causes some devices to stop sending data after a power cut. Without OTA, a technician has to travel to each shop with a laptop. With OTA, the fix is tested, then sent out, and the devices install it themselves.
OTA also matters for security. Like phones and computers, connected devices may need patches as weaknesses are discovered. A device that can never be updated stays exactly as safe as it was on the day it was installed.
How an OTA update works, step by step
Details differ by platform, but a careful process usually looks like this:
- Build and test. The new firmware is built and tested on lab units, then on a few real devices.
- Sign. The firmware file is digitally signed, so devices can confirm it came from you and was not altered.
- Publish. The file is placed on an update server, with a version number and a note of what changed.
- Check. Devices check for updates on a schedule, or the server notifies them.
- Download. The device downloads the new firmware into a separate area of its memory, while the old version keeps running.
- Verify. The device checks the signature and that the file is complete.
- Switch and restart. The device marks the new version as active and restarts.
- Confirm or roll back. If the new firmware starts correctly and reconnects, it is kept. If not, the device returns to the previous version.
Many microcontrollers used in IoT, including the ESP32 family, support this two-slot approach, often called A/B updates.
What can go wrong, and the safeguards
| Risk | What happens | Safeguard |
|---|---|---|
| Power cut during the update | Half-written firmware; the device will not start | Two-slot memory; the old version stays until the new one is confirmed |
| Bad firmware | The device starts but misbehaves or cannot connect | Automatic rollback; a staged rollout to a few devices first |
| Tampered update | Someone pushes malicious code | Signed firmware and encrypted connections |
| Weak connection | The download fails or takes very long | Resume support, small update files, retry later |
| Wrong device | Firmware for one model is sent to another | Model and hardware version checks before installing |
Rolling out updates sensibly
- Stage it. Update a small group first, watch it for a while, then update the rest.
- Choose the moment. Avoid updating a controller while it is running a pump or an aerator. Let devices update during quiet hours or when idle.
- Keep records. Know which version each device runs. This makes support calls far easier.
- Mind the data. Devices on SIM cards use mobile data for downloads. Keep updates small and infrequent.
- Keep a manual path. Even with OTA, a technician should be able to update or recover a device by cable if needed.
Common questions
Can any device be updated over the air? Only if it was designed for it. Memory space, a bootloader that supports updates and a secure connection all need to be planned from the start; see from prototype to product.
Is OTA a security risk? A poorly designed update system can be. A well-designed one, with signed firmware and encrypted connections, improves security because it lets you patch problems. The IoT security basics article covers the wider picture.
Who should be allowed to push updates? As few people as possible, with a clear approval step before anything goes out.
Before you deploy devices
Ask whoever builds your devices: Do they support OTA? Is the firmware signed? Is there automatic rollback? Can updates be staged? How will you see which version each device runs? If a supplier cannot answer clearly, plan for site visits. For devices built with these safeguards, see the IoT development service, and consider starting with an IoT pilot so the update process gets tested too.