How to Implement OTA Firmware Update on MCUs

Why It Matters

Remote OTA updates eliminate costly field servicing and accelerate feature delivery for IoT devices, while the staging + copy approach safeguards devices against power‑loss failures. This reliability is essential for large‑scale deployments of wireless MCUs like the RW612.

Key Takeaways

• Staging + copy OTA avoids bricking during power loss
• RW612 uses external serial NOR flash accessed via FlexSPI ROM API
• Mongoose provides ready-to-use ota_rw612.c for rapid prototyping
• Metadata redundancy ensures recovery from interrupted updates
• OTA patterns like A/B or delta suit different flash sizes

Pulse Analysis

Over‑the‑air firmware updates have become a cornerstone of modern IoT product strategy, allowing manufacturers to push security patches, feature enhancements, and bug fixes without physical access. For wireless MCUs that lack internal flash, such as NXP’s RW612, the challenge shifts to managing external serial NOR memory safely. The FlexSPI controller, paired with NXP’s ROM‑resident API, offers a deterministic path to erase and program flash while the device continues running its existing image, dramatically reducing the risk of a failed update that could render a unit inoperable.

The “staging + copy” method highlighted in the article strikes a balance between simplicity and resilience. By reserving a secondary partition in external flash, the new firmware is downloaded and verified before any changes are made to the active image. Once validation passes, a minimal bootloader copies the staged binary into the primary region, updating a small metadata block that records the update state. The Mongoose Wizard implementation streams data directly to flash, avoiding RAM bottlenecks, and leverages the FlexSPI ROM API for sector‑erase and page‑program operations. This approach also incorporates redundancy in metadata, enabling the bootloader to recover gracefully from power interruptions during the final copy phase.

Choosing the right OTA architecture depends on flash capacity, power‑loss tolerance, and security requirements. In‑place updates minimize storage but carry higher bricking risk; dual‑slot A/B schemes provide instant rollback at the cost of doubled flash usage; delta updates conserve bandwidth but demand sophisticated diff‑reconstruction logic. The RW612 example demonstrates that a well‑engineered staging + copy flow can meet most mid‑range product needs, delivering reliable remote upgrades while keeping development effort low. As OTA becomes a de‑facto requirement across automotive, consumer, and industrial segments, mastering these patterns is essential for any company aiming to scale its connected device portfolio.