A Bluetooth module in the field is only as good as the firmware you can push to it. OTA (over-the-air) DFU is how you fix bugs, close CVEs, and add features without a truck roll. This article covers the update architecture for a Bluetooth module: dual-bank, signed images, delta diffs, and rollback.
Update topologies
A Bluetooth module can receive firmware two ways:
- Direct: the smartphone connects and streams the image over GATT (typical for consumer devices).
- Indirect: a gateway buffers the image and relays it to many modules (industrial fleets).
Dual-bank vs single-bank
The safest Bluetooth module design keeps two banks:
| Scheme | Risk on failure | Storage cost |
|---|---|---|
| Single-bank | brick if power lost mid-write | 1x |
| Dual-bank (A/B) | boot old bank on failure | 2x |
| External SPI flash staging | boot internal on fail | 1x + ext |
Dual-bank is worth the flash for anything safety- or revenue-critical.
Signed images
Never flash unsigned code. The Bluetooth module verifies a signature before swapping banks:
if Verify(pubkey, image_hash, sig) == OK:
swap_bank()
else:
reject_and_stay()
Use ECDSA P-256 with a root key fused at factory. A bad image simply does not boot.
Delta / partial updates
Full images are 200-500 KB; sending that to 10,000 modules hurts. A delta diff ships only the changed blocks:
patch = bsdiff(old_image, new_image) # often 5-20% of full size
The Bluetooth module applies the patch in the staging area, verifies the result hash, then swaps. This cuts bandwidth and update time dramatically.
The update state machine
A disciplined Bluetooth module DFU runs as a state machine:
IDLE -> DOWNLOAD -> VERIFY -> SWAP -> REBOOT -> (OK | ROLLBACK)
On any checksum mismatch it rolls back to the known-good bank and reports the failure. Never erase the active bank until the new one is verified.
Power and timing
A DFU at 1-2 KB/s over BLE takes minutes for a full image; a delta is seconds to a minute. Warn the user, keep the device powered (or require >50% battery), and throttle to avoid overheating.
Security notes
- Authenticate the source: only a signed image from your server, over an encrypted channel.
- Rate-limit updates to block a DoS that wears the flash.
- Version the protocol so old modules still update.
A Bluetooth module with signed dual-bank DFU and delta support turns a firmware emergency into a quiet background job.