Embedded Expertise

Become a partner >>

OTA Update Tools: Find The Perfect Fit For Your Application

Updating the firmware of modern devices is an essential part of their lifecycle. This post explores the desirable features of an OTA updater and compares three popular options to help you choose the best tool.
 

Maintaining firmware in embedded systems is an ongoing challenge. Over-the-air (OTA) flash image programmers simplify this by enabling remote updates, ensuring devices remain functional, secure, and feature-complete. This guide explains OTA flash programmers, highlights the importance of A/B partitioning, and reviews three popular tools: SWUpdate, RAUC, and Mender. It also explores the concepts of attended and unattended updates and clarifies how these tools handle verification and rollback responsibilities.

While SWUpdate, RAUC, and Mender are widely used, other OTA solutions exist, and some may better suit specific contexts. However, developing your own OTA system is rarely advisable due to the complexity of handling rollbacks, security, and error recovery. Established tools allow you to focus on your application, leveraging proven solutions to avoid costly errors.

What Is an OTA Updater?

An OTA updater is a utility that manages the delivery, validation, and installation of software updates to embedded devices. These tools ensure updates are applied reliably and securely, reducing the risks of downtime or device failures.

An OTA updater is a nominal feature of a running device, meaning the device must be operational for the OTA updater to function. It typically requires either a system service running in the background or a specific command to be executed via a script. Importantly, the device must be functional and running its existing firmware to perform an OTA update.

It’s also critical to understand what an OTA updater is not:

  • It is not commonly used during development, except when testing the OTA updater itself. For most development scenarios, updates are directly applied via low-level tools or direct flashing.
  • It is not a debricking tool. If the device is already bricked or unable to boot, an OTA updater cannot recover it. In such cases, you’ll need a low-level Flash programmer (e.g., JTAG-based tools or equivalent) to restore the device.
  • It is not a production Flash programmer. Production flashing tools are designed for initial programming and setup during the manufacturing process, whereas OTA updaters are intended for devices already deployed in the field.

Why Use an OTA Updater?

OTA solutions provide several key benefits:

  1. Reliability: Robust mechanisms to recover from failed updates.
  2. Flexibility: Choose between attended and unattended updates, depending on the application:
    • Attended Updates are ideal for devices not connected to a network or in cases where updates must be explicitly performed by an authorized person, such as in mission-critical systems or controlled environments.
    • Unattended Updates are perfect for connected devices and large-scale deployments, allowing updates to be applied automatically without human intervention.
  3. Scalability: Manage updates for thousands of devices remotely.
  4. Security: Protect updates using cryptographic validation.
  5. Efficiency: Minimize downtime and operational overhead.
  6. Cost Savings: Reduce the need for on-site updates.

This flexibility ensures that OTA solutions can cater to a wide variety of deployment scenarios and device requirements.

The Role of A/B Partitioning

A/B partitioning is a critical strategy for ensuring system reliability during updates. By maintaining two partitions—A (active) and B (inactive)—devices can always revert to a stable version if the update fails.

How A/B Partitioning Works

  1. Initial Setup:
    Partition A runs the current system, while Partition B is inactive.
  2. Update Process:
    • The update is downloaded and installed on the inactive partition (B).
    • The bootloader is configured to boot from the updated partition on restart.
  3. Verification:
    • After rebooting, the system validates the updated software.
    • If the update is successful, the roles of the partitions are swapped, so that Partition B becomes active.
    • If the update fails, the system reverts to Partition A automatically.

How a Successful Update Is Determined

The verification mechanisms are a shared responsibility between the OTA updater, the bootloader, and the application runtime.

  1. OTA Updater Role
    • Downloads, validates, and installs the update package.
    • Configures the bootloader to boot from the updated partition.
    • Sets a “pending” status for the update, requiring confirmation of success.
  2. Bootloader Role
    • Boots from the updated partition and waits for confirmation of success.
    • If confirmation is not received (e.g., within a predefined time), it automatically reverts to the previous stable partition.
    • Uses flags or metadata (e.g., upgrade_available or bootcount) to pass the update’s state on to the application update’s state.
  3. Application Runtime Role
    • Performs system- or application-level checks, e.g., ensuring critical resources are present and services are running.
    • Confirms the update’s success by setting a flag or communicating with the bootloader.
    • May trigger a manual rollback if runtime issues are detected post-update.

Advantages of A/B Partitioning

  • Atomic Updates: Ensures updates are applied fully or not at all.
  • Seamless Rollback: Automatically reverts to the last known good state.
  • Minimal Downtime: The active partition continues running during the update.
  • Power Failure Safety: Active partition is untouched during the update.

Drawbacks of A/B Partitioning

While A/B partitioning provides significant reliability benefits, it comes with some trade-offs:

  1. Increased Storage Requirements:
    Since A/B partitioning requires maintaining two separate partitions, the system effectively doubles the amount of flash memory needed for the firmware or operating system.
  2. Underutilized Space:
    At any given time, one partition is inactive and not contributing to device functionality, leading to inefficient use of storage.
  3. Complex Bootloader Configuration:
    A robust bootloader setup (e.g., U-Boot or GRUB) is essential to manage partition switching and rollback, adding complexity to the system.
  4. Application Involvement in Validation:
    The application or runtime environment is often required to perform system-level checks to determine if the updated partition is functioning correctly. This adds responsibility to the application layer, requiring the design and implementation of validation logic, such as ensuring that critical services are running or hardware is operational. Without this validation, the system cannot confirm the success of the update, leaving it vulnerable to potential failures.

Despite these drawbacks, A/B partitioning remains a reliable solution for managing OTA updates, especially in critical systems where ensuring a functional fallback is essential. However, these challenges highlight the importance of selecting tools and frameworks that can help mitigate the additional complexity.

Attended vs. Unattended Updates

OTA updates can be categorized based on the level of human involvement required.

Attended Updates

Attended updates initiated and supervised by an operator.

  • Use Cases:
    • Mission-critical systems like medical devices or industrial equipment.
    • Early-stage testing where oversight ensures issues are resolved quickly.
  • Examples:
    • SWUpdate or RAUC can be invoked manually by a technician during testing or controlled updates.
  • Advantages:
    • Greater control and immediate intervention for issues.
    • Suitable for critical or non-scalable deployments.
  • Challenges:
    • Time-intensive and less scalable for large fleets.

Unattended Updates

Unattended updates are fully automated, requiring no manual intervention whether the update succeeds or fails.

  • Use Cases:
    • IoT devices like smart home appliances or automotive systems.
    • Large-scale deployments where manual updates are impractical.
  • Examples:
    • Mender’s client running in the background, automatically fetching updates from its cloud platform.
    • RAUC triggered by systemd timers or scripts for unattended workflows.
  • Advantages:
    • Highly scalable and efficient.
    • Reduces operational overhead.
  • Challenges:
    • Requires some form of outside connectivity to fetch the updates.
    • Requires robust error handling and rollback mechanisms.

A Deeper Dive Into Three Popular OTA Updaters

When selecting an OTA updater, it’s essential to understand the strengths and features of each tool. Let’s dive into SWUpdate, RAUC, and Mender, let’s review their unique features and see how they address different needs.

SWUpdate

SWUpdate is an open-source OTA tool known for its flexibility and lightweight design, making it a favorite for embedded systems that require custom update workflows. It’s like a toolbox that can adapt to various update scenarios, whether you need single-file updates or complex multi-part updates.

One of SWUpdate’s standout features is its support for Lua scripting, which lets you define how updates should be downloaded, validated, installed, and even customized. This customization makes it ideal for developers who want fine-grained control over their update process. It also supports multiple transport protocols, including HTTP, HTTPS, and even local storage methods like USB drives.

SWUpdate includes a built-in rollback mechanism, which works seamlessly with A/B partitioning. Updates are applied to the inactive partition, and the system switches to the updated partition on reboot. If the update fails to boot, SWUpdate ensures the system reverts to the previous stable partition automatically, providing a robust fallback mechanism. The effectiveness of the rollback mechanism depends on the specific bootloader implementation and configuration (U-Boot rocks).

Another key feature of SWUpdate is its zero-copy update capability. Unlike some OTA tools that require the entire update package to be stored in memory or temporary storage during the process, SWUpdate writes the update data directly to the partition as it is received. This significantly reduces the memory footprint, making it particularly well-suited for resource-constrained embedded systems.

SWUpdate supports both attended and unattended updates. You can trigger updates manually in an attended mode or configure scripts and system services to automate the process. While SWUpdate doesn’t offer native cloud integration for managing large fleets, it can be extended with external tools to fit into broader system architectures.

SWUpdate is particularly well-suited for lightweight systems where resources are limited and for teams that value its high degree of customizability. However, compared to Mender or RAUC, it may require additional integration for large-scale deployment scenarios.

RAUC

RAUC, or Robust Auto-Update Controller, is a secure and reliable OTA solution designed for embedded Linux systems. Unlike SWUpdate, RAUC is built around atomic updates, ensuring that your device always boots into a functional state—even if something goes wrong during the update.

RAUC relies heavily on A/B partitioning, applying updates to the inactive partition while the current one continues running. If the system fails to boot from the updated partition, the bootloader automatically reverts to the previous one. This seamless rollback mechanism makes RAUC an excellent choice for systems where reliability is non-negotiable.

One of RAUC’s strengths is its simplicity. It doesn’t run as a persistent service but can be invoked by scripts, systemd timers, or even through its D-Bus API. This modular design allows you to integrate RAUC into your existing workflows without the overhead of a continuously running daemon. For example, you could use a custom script to check for updates periodically and then trigger RAUC to handle the installation.

RAUC supports both attended and unattended updates, giving you the flexibility to either supervise updates in critical environments or automate them for large-scale deployments. With its focus on security, atomicity, and rollback, RAUC is an excellent tool for industrial systems, IoT devices, or any scenario where downtime or bricking is unacceptable.

Mender

Mender takes a more comprehensive approach to OTA updates, offering not just an update tool but an entire ecosystem for managing device fleets. It’s a dual-licensed solution, with an open-source version providing core update functionality and a commercial version adding features like cloud-based monitoring, advanced reporting, and fleet management.

Unlike SWUpdate and RAUC, Mender is designed around the concept of unattended updates. The mender-client daemon runs continuously on the device, checking for updates from a server or the Mender cloud. This always-on design makes Mender particularly suited for IoT deployments or large-scale systems where manual intervention is impractical.

Mender relies on A/B partitioning to ensure atomic updates and rollback. The bootloader and mender-client work together to confirm that the system has booted successfully from the updated partition. If something goes wrong, the device automatically reverts to the previous state without requiring manual intervention. This level of automation makes Mender an excellent choice for environments where uptime is critical, such as consumer electronics or automotive systems.

While Mender excels in scalability and automation, its cloud features in the commercial version might be overkill for smaller projects. However, for teams managing thousands of devices, Mender’s built-in tools for update scheduling, monitoring, and rollback make it a robust choice.

Which Tool Is Right for You?

If you’re looking for a lightweight, customizable tool and don’t mind setting up some of the functionality yourself, SWUpdate is an excellent choice. On the other hand, RAUC offers unparalleled reliability with its focus on atomic updates and automated rollback, making it ideal for critical applications. Finally, Mender shines when managing large-scale deployments, especially if you need built-in cloud support and fully automated updates.

Your decision ultimately depends on your project’s scale, requirements for customization, and tolerance for complexity. Each of these tools has its place in the embedded systems landscape, and choosing the right one can make all the difference in maintaining your devices reliably and efficiently. 

Contact