OTA Firmware Updates: Updating IoT Devices Remotely

IoT devices installed in the field are rarely truly finished. There is always a newly found bug, a security hole to close, a new sensor to support, or a better way to send data. If every change means visiting devices one by one, maintenance costs balloon, especially when devices are spread across many sites.

OTA (over-the-air) firmware updates solve this: new firmware is sent over the network and installed without touching the device. This article covers the benefits, the risks, and the practices that make the process safe.

Why OTA matters

• Bug fixes without site visits. A small firmware mistake can be fixed in minutes, not after waiting for a technician.
• Security. Vulnerabilities must be patched quickly. A device that cannot be updated stays vulnerable forever.
• New features. Installed devices can gain new capabilities without replacement.
• Lower maintenance cost, especially for devices at remote sites.

Risks to understand

• Bricked devices. An update that fails halfway, for example from a power cut, can leave a device unable to boot.
• The wrong firmware. Sending firmware built for a different model can break functions.
• New bugs. An untested update spreads to every device at once and causes the same problem everywhere.
• Fake firmware. Without verification, someone could try to install malicious firmware.

Safe OTA practices

1. Two partitions and rollback. The device keeps the old firmware while installing the new one in another partition. If the new firmware fails to run, the device falls back automatically. Popular microcontrollers such as the ESP32 support this pattern.
2. Firmware verification. Check file integrity, and ideally a digital signature, before installing.
3. Test on one device first. Install on a test unit or a single field device, watch it for a while, then continue.
4. Staged rollout. Send to a small share of devices, then widen if no problems appear.
5. Check conditions before updating, such as enough battery and a stable connection.
6. Record every device's version, so it is always clear which device runs which firmware.

Managing versions across many devices

As the fleet grows, the challenge shifts from how to install an update to how to manage it. You need to know the version on every device, which updates are running, which succeeded, and which failed. Without central records, field teams struggle to answer simple questions like "which devices have not been updated yet?".

HTTP or MQTT for OTA

There are two common patterns. With polling, the device periodically asks the server whether new firmware exists, then downloads it over HTTP. With push, the server tells the device over MQTT that an update is available. Polling is simpler and suits devices that sleep between transmissions. Push is faster for devices that are always connected. The two can be combined.

Devices that do not support OTA

Not every industrial device can be updated remotely. Many power meters, PLCs, and older sensors can only be updated on site, or are never updated at all. For devices like these, a remotely updatable gateway becomes the layer that can keep adapting, while the devices behind it keep working as usual.

A checklist before running an update

• The firmware has been tested on a device with the same model and hardware revision.
• The new version number is clear and recorded, along with a list of changes.
• Target devices are selected, starting with a small group.
• The update is scheduled outside critical operating hours, so device restarts do not disrupt production.
• A plan to return to the old version is ready if problems appear.
• Someone watches the result until every device is sending data normally again.

The checklist looks long, but each item comes from real problems that happen when updates are rushed. Following it consistently makes OTA a safe routine rather than a feared event.

Frequently asked questions

Is OTA safe?

Yes, when designed properly: firmware is verified, there is a rollback mechanism, and rollouts are staged.

What happens if power fails during an update?

With the two-partition pattern, the device keeps running the old, intact firmware, and the update can be retried.

Can every IoT device be updated over the air?

No. Devices designed with OTA support, such as those based on the ESP32, can. Many older industrial devices cannot.

OTA on the INCLUDE platform

The INCLUDE platform provides firmware management: upload new firmware, create an update job per device, then deliver it over HTTP or MQTT without a site visit. The status of every job is visible on the dashboard. This works for IncludeBox devices and for your own devices that follow the protocol, as described in our guide to connecting an ESP32.