Firmware OTA FAQ
Plain answers to what teams ask before committing to an update platform.
What does FOTA actually mean?
Firmware over-the-air: replacing the software on a device already in someone’s hands, without touching it. The term is used most in embedded and IoT, where the thing being replaced is firmware rather than an app. OTA is the broader word; FOTA is specifically about firmware.
What is the single biggest risk?
Bricking a device with no physical access. An update that fails halfway, or boots into something broken, turns a product into scrap unless the device can detect the failure and return to what worked. This is why the rollback mechanism, not the feature list, is the first thing to evaluate.
What is an A/B update?
The device carries two copies of the system. The update is written to the inactive copy while the active one keeps running, then the bootloader switches over. If the new copy fails to boot or fails to confirm itself, the bootloader reverts. It costs roughly double the storage and buys near-certain recoverability — usually a good trade.
Do MCUs and Linux devices need different platforms?
In practice yes. Embedded Linux updates whole filesystems or containers and has room for two copies. A microcontroller with a few hundred kilobytes of flash needs a small bootloader, a compact image and careful power-loss handling. Mender and balena live on the Linux side; Golioth and Memfault on the MCU side; hawkBit and AWS sit above both.
Should we self-host or buy hosted?
Self-hosting removes per-device fees and keeps artifacts in your infrastructure, but you own uptime, backups, key handling and the on-call. Hosted costs money per device and buys you not having to think about any of that. Small teams almost always underestimate the operational half — the honest question is whether anyone will actually maintain the server in year three.
Are delta updates worth it?
On metered connections, yes — sending only what changed can cut a firmware update by an order of magnitude, which on cellular is money and on battery devices is runtime. They add build complexity and a dependency on knowing exactly what the device currently runs, so they earn their place on large or cellular fleets and rarely on ten devices over wifi.
How do we stop a bad rollout?
Staged rollouts with an abort condition. Ship to a small cohort, watch a signal that actually reflects health, and stop automatically if it degrades. The signal is where platforms differ: most watch whether devices report back, while Memfault watches crash rates — a much earlier warning than silence.
Do updates need to be signed?
Yes, without exception. An unsigned update path is a remote code execution feature you built and shipped deliberately. The device must verify a signature before writing anything, the signing key must live somewhere that is not a developer laptop, and revocation should be thought about before you need it. Signing keys and device identity are where this overlaps with certificates and PKI.