Firmware over the air
Update a million devices without bricking one
Delta images that are 4% the size of a full flash, rollouts that halt themselves when failure rates rise, and A/B partitions so a bad boot rolls back on its own.
What a fleet update has to survive
Delta images
Block-level diffs against the exact version each device is running, so a fleet on nine different versions still gets a small download each.
Atomic A/B
Write to the inactive slot, verify, switch, and watch the boot. A device that fails to come up reverts without anyone visiting it.
Staged rollouts
1% canary, then 5, 25, 100 — with automatic halt on failure-rate, crash-loop or connectivity-loss thresholds you set.
Signed end to end
Manifests signed offline, verified in the bootloader. A compromised server cannot ship firmware.
Power and link aware
Devices decide when to download and when to apply based on battery, connectivity cost and a maintenance window you define.
Fleet visibility
Version distribution, campaign progress and the long tail of devices that have been offline for months.
Campaign day
What a rollout looks like from our side
A recent customer campaign: 840,000 industrial sensors, a security fix, mandatory within seven days.
- Full image 62 MB; median delta 2.4 MB across nine source versions
- Canary at 1% for six hours, then automatic promotion
- Peak 9.4 Gbit/s, 41 TB delivered over the campaign
- 412 devices rolled back automatically; none required a site visit