Chapter 3

OTA Firmware Updates

Remote firmware deployment via SyncFM

Overview

OTA (Over-The-Air) updates are managed centrally through SyncFM. No physical access to any unit is required. Updates are broadcast to the fleet via MQTT and each device downloads and installs the new firmware independently from the SyncFM HTTP server.

1How OTA Updates Work

Trigger: SyncFM broadcasts an UPDATE_FIRMWARE command to the device's OTA MQTT topic. The command includes the target firmware version, a download URL pointing to the SyncFM firmware server, and a checksum for integrity verification.

Security verification: The device verifies the authenticity of the command using a security key before acting on it. If verification fails - due to a passkey mismatch, time sync issue, or hierarchy mismatch - the command is silently discarded and the device continues normal operation.

Stagger delay: Devices are divided into 6 groups based on their MAC address, with a 30-second interval per group (maximum 150 seconds). This prevents all devices downloading simultaneously and saturating the network.

Download and install: The device disconnects from MQTT, downloads the firmware binary from SyncFM, writes it to the inactive flash partition, verifies the checksum, and reboots into the new firmware.

Retry behaviour: If the attempt fails, the device reboots and retries automatically. Up to 3 total attempts are made with 3-minute intervals between each. If all 3 fail, the device reverts to normal operation on the existing firmware and reports the failure to SyncFM.

Result broadcast: On the first boot following a completed update attempt, the device publishes the outcome to SyncFM via MQTT so fleet progress can be tracked.

2LCD States During OTA

During an OTA update the web interface becomes inaccessible and MQTT publishing is suspended. The LCD shows the full progress sequence below. The device takes sole control of the display for the duration of the update.

OTA LCD State Sequence

① Stagger wait - normal display

② Downloading

③ Installing

④ Verifying

⑤ Success

⑥ After reboot - new firmware

OTA Failure States

Failed (all attempts exhausted)

Retry pending (attempt 2 of 3 shown)

3What the Operator Should Know

Do not power cycle during an OTA update. If power is lost mid-write, the device detects the incomplete state on next boot and retries automatically.

All NVS preferences are preserved. Network settings, device name, MQTT hierarchy, credentials, and calibration values are untouched by the update. See Section 7 - Device Preferences.

The web interface is unavailable during the update. This is expected - typically 2-3 minutes from when the stagger delay begins.

After a successful update, verify the firmware version in System Status (§2.2.1) to confirm the new version is running.

Factory defaults may change after an OTA update. If a factory reset is performed after an update, the device will restore to the defaults compiled into the new firmware. See §5.4.