Facility manager at a 120-room hotel. Every room has a thermostat controller from a small vendor, ESP32 inside, connected to Hermetry over the hotel Wi-Fi. They want to fix a bug where the fan stays on, and the plan is to use Hermetry’s firmware updates.
I asked if they could send “just the fix” to keep it quick. The vendor said no, the flash can only be erased in blocks so they always send the whole 1.4 MB image. That sounds plausible but I don’t really understand it. My real worries are 120 rooms downloading at once on the guest Wi-Fi, and a bad image leaving rooms with no heat in November. Is pushing the full image to all of them risky?
The block thing is true but not really why. Flash is erased in 4 KB sectors and written in pages, so you can’t patch bytes in place. Delta updates are still possible, the device rebuilds the new image from old image plus patch into a spare partition. It needs extra code on the device and a patch tool on the vendor’s side. Most small vendors don’t bother.
The safety bit you want to ask about is whether they have two OTA partitions. Then the new image goes into the inactive one and the old one is still there if it fails to boot.
Asked them. They say “ota_0 and ota_1 with rollback enabled”, 4 MB flash. Also signed images, whatever that means for me.
Then the full image is fine, I’d stop worrying about delta. We pushed a 1.6 MB image to about 200 controllers at our plant last spring. The rollout is what made it calm.
On the package assignment pick Every device of the profile and turn on Send in waves. The usual plan is a canary of 1% (at least one, at most ten), then 10%, then 50%, then the rest, with 15-30 minute waits between, and it pauses itself if a wave has more than 5% failures. For a hotel I’d edit the waves: first wave 3 rooms you can walk to, wait a couple of hours, then 20, then the rest overnight. Nobody downloads before their wave, so the Wi-Fi only ever sees a few at once.
Other things that helped us:
- Test with One device assignments on two units first.
- The download link expires after 15 minutes but the device can ask again and resume with an HTTP Range request, so a flaky room isn’t a disaster.
- A device that doesn’t come back on the new version shows as Went back to the old version, that’s your rollback working.
Details: Rolling out firmware in waves.
We did it last week with my own waves, 3 rooms on floor 2 first, then 20, then the rest at 1 a.m. One room showed Not for this device in wave 2, its controller was on a version older than the package’s lowest allowed one, so it got skipped. Vendor is flashing that one by hand. Fan bug gone everywhere else. Much less scary than I expected.
- You must be logged in to reply to this topic.
Join the conversation
Sign in to ask and answer, like helpful posts and mark the reply that solved your problem. Every contribution earns points and levels.