How to design devices that support OTA updates at scale
The transition from shipping static hardware to connected products that mature in the field represents one of the largest value shifts in modern product development. A device that improves six months after purchase breaks the traditional depreciation curve, creating sustained engagement and deferred replacement cycles. But this promise collapses when scale meets probability. Deploy ten thousand units and a 99.9% success rate still leaves ten customers with bricked hardware. At fleet scale, there is no acceptable failure rate—only failure modes you have architected away. The hardware must be designed to survive its own update process without human intervention, treating recovery as a physical requirement rather than a software fallback.
That recovery requirement changes the storage architecture fundamentally. A/B update device architecture—where the device maintains two complete firmware images and swaps between them—has become the standard for reliable fleet OTA device engineering. This is not merely a firmware strategy; it is a bill of materials decision made in week one. You need physical NAND capacity for two full images plus differential patch space, which often forces you up to a higher-tier MCU or external flash chip. Tesla’s early Model S updates risked corrupting the center console firmware, requiring service center visits to reflash—a distributed recovery problem that redundant partitions solved, though at the cost of per-unit hardware expense. When designing for mass OTA capability, you are not optimizing for the flash memory you need today, but for the image size you will ship eighteen months from now.
Double the storage creates a power budget problem. Large-scale firmware updates must assume hostile power conditions because users will unplug devices during updates. The moment a homeowner yanks a smart thermostat from the wall at 47% download, or a delivery locker loses shore power mid-write, the hardware must not brick. Designers must spec supercapacitors or reserve battery cells sized to complete the final write cycle and verify the checksum. This affects PCB real estate and thermal management. Cloud OTA management also requires connectivity redundancy. A single-radio architecture creates a dead zone dependency; if your only LTE modem loses signal during the handshake, the device hangs until manually reset. Industrial design must accommodate antenna diversity—WiFi fallback circuits or dual-SIM cellular—adding RF complexity that influences enclosure materials and port placement.
This infrastructure must exist before the first unit ships. The same bootloader that recovers a failed field update must handle the initial firmware flash during manufacturing. If your factory line requires specialized programming jigs while your field update uses a different protocol, you have built two separate supply chains for the same operation. Device update infrastructure starts at the pick-and-place machine. Design your OTA mechanism to use the same cryptographic verification, partition scheme, and rollback triggers during initial flash as it will use in the customer’s home three years later. This unification reduces tooling costs and ensures that manufacturing validation actually tests the recovery paths you will depend on in the field.
The physics of scale demand that you ship the million-unit architecture to your first ten beta users. Retrofitting A/B partitions, power reserves, or secondary radios after a production run requires board spins and regulatory re-certification. When Nest’s early Protect smoke detectors lacked margin for certain power-fail scenarios during updates, the resulting recall paused sales and exposed the cost of treating the update mechanism as a secondary feature. The devices that survive scaling are those that treated firmware delivery as a system input from the schematic stage.
If you’re working through the hardware implications of fleet-wide firmware delivery, Bang Design has spent 25 years taking products from concept to manufactured reality—across consumer, medtech, and industrial IoT. Their subscription-based model means you get a full-stack team—design, engineering, and production—without the overhead of a traditional agency. Explore their work or start a project.