Designing Resilient OTA for Cellular IoT
Why OTA is hard on cellular
Field devices on LTE/GSM links face intermittent connectivity, variable latency and hard power budgets. A naive 'download the whole image then flash' approach fails the moment a link drops mid-transfer or the device browns out during flash. Resilience has to be designed into the protocol, not bolted on.
Chunked transfer with per-chunk integrity
Split the firmware image into fixed-size chunks, each carrying its own CRC. The device acknowledges each chunk; the server resends only what failed. This bounds the cost of any single failure to one chunk rather than the whole image, and lets transfers resume across reconnects.
A/B partitions and atomic swap
Stage the incoming image in an inactive bank while the running firmware stays untouched. Only after a full-image CRC and signature check passes do you flip the active-bank pointer and reboot. If validation fails — or the new image fails to boot — the bootloader rolls back to the known-good bank.
Results
On a production smart-meter NIC, chunked transfer plus A/B swap cut OTA duration by ~50% versus the legacy monolithic updater and eliminated bricking from power loss during update.