Article / IoT · Firmware
1 Aug 2026
ESP32 OTA in the field without bricked nodes
Dual partitions, rollback flags and the pre-flash checklist we use before pushing firmware to devices on poles.
Why OTA fails quietly
Most bricked field nodes are not bad flash images — they are good images written at the wrong time. Wi-Fi drops mid-transfer, the pack sags during the radio burst, or the device reboots into a partition that never validated.
We treat OTA as a state machine, not a single API call: download, verify, swap, boot, self-test, commit. Each step has a timeout and a fallback.
Partitions and rollback
Two app slots plus an otadata partition are the minimum. The new image boots once with a “pending verify” flag; only after GPIO, sensor and cloud heartbeat pass do we mark it valid.
If the self-test fails, the bootloader rolls back on the next reset. Field staff should never need a USB cable for a bad push.
Before you push
Checklist: battery above threshold, RSSI stable for two minutes, no other OTA running on the fleet, and a staged rollout — five devices, then fifty, then the rest.
Log the old and new version strings to cloud either way. The worst failures are the ones you cannot correlate with a build number.