MCU OTA & Fleet Updates

How firmware lands on devices after they leave your bench. Two-and-a-half problems: a bootloader that swaps images safely, a transport (Wi-Fi / BLE / cellular / USB), and (optionally) a fleet backend to track who got what. For chip-side basics see ESP-IDF and Embedded RTOSes; for the radios see MCU Wireless Stacks.

On-device OTA primitives

ESP32 / ESP8266

• ★ ESP-IDF OTA (esp_https_ota / esp_ota_* API) — Espressif's built-in OTA APIs. A/B partition scheme + rollback if boot fails. The default for IDF apps.
• ★ ArduinoOTA — push firmware over Wi-Fi from the Arduino IDE / espota.py; trivially easy for development. Limited fleet story.
• espota.py — bundled CLI for the same Arduino-style OTA.
• HTTP / HTTPS OTA — pull from your own server; ESPHome, Tasmota, ESP-IDF all do this.
• WebSerial / browser OTA — flash from a browser via ESP Web Tools; good for end-user updates.

Generic Cortex-M

• ★ MCUboot — the de-facto open-source bootloader for Cortex-M (and beyond). Supports image signing, encryption, A/B "swap" or "overwrite" or "direct-XIP" modes, downgrade prevention. Apache 2.0. Used by Zephyr, NCS, Pi Pico SDK (optional), TF-M, mbed-os, and many vendor SDKs.
• bootloader/Update Engine in nRF Connect SDK — Zephyr/MCUboot configured by Nordic for nRF chips. Pairs with MCUmgr for transport.
• STM32CubeProgrammer / FUS / SBSFU — ST's bootloader primitives.
• NXP MCUBoot / SBL — NXP wrappers around MCUboot.

Pi Pico / RP2040 / RP2350

• Native UF2 bootloader — the BOOTSEL drag-and-drop UF2 update mechanism is a great first OTA story over USB. For wireless, you build OTA on top.
• MicroPython OTA — MicroPython's built-in OTA support on Pico W.
• MCUboot for RP2040 / RP2350 — supported in 2026; pair with picotool.

Update transports

• Wi-Fi (HTTP / HTTPS / S3-style) — the simplest fleet transport on ESP / Pico W / nRF7002.
• BLE — MCUmgr / SMP — Zephyr's "Simple Management Protocol" runs OTA over BLE; nRF Connect mobile app + iOS / Android SDKs ship reference implementations.
• CoAP + Block-Wise — used in some Thread / Matter scenarios for OTA.
• Matter OTA Provider / Requestor — Matter's standard OTA protocol; defined for Matter devices.
• Cellular (LwM2M / nRF Cloud / AWS Device OTA / Azure DPS) — for nRF91 and similar.
• LoRaWAN FUOTA — fragmentation-based firmware-update-over-LoRaWAN; class-B/C; possible but slow.
• USB (UF2 / DFU) — DFU is the standard USB bootloader protocol; UF2 is Microsoft's drag-and-drop variant used on RP2040, SAMD51 boards.
• dfu-util — open-source CLI for DFU; pairs with STM32 ROM bootloaders, nRF DFU, and many others.

Fleet / OTA backend services

Open-source self-hosted

• ★ Eclipse hawkBit — open-source (EPL); the LF-Edge-class fleet update server. Targets / rollouts / cohorts / pause-resume. Battle-tested at industrial scale. Pair with hawkBit DDI client on the device. Self-host with docker-compose. The default open self-hosted choice.
• Mender (open source) — Mender Hub / Mender Server free tiers exist; primarily designed for embedded Linux but supports MCU / Zephyr. Mender Enterprise is paid.
• RAUC — Robust Auto-Update Controller; popular on embedded Linux, less common for MCUs.
• Eclipse Leshan / Wakaama — LwM2M servers; standards-based device management.
• The Things Stack FUOTA (LoRaWAN) — built into TTS for LoRaWAN device updates.

Cloud / hosted (free tier or open + hosted)

• ★ ESP-RainMaker — Espressif-hosted IoT backend with OTA, dashboards, scheduling. Free hosted tier; open-source server for self-host. The path of least resistance for ESP32 OTA at hobby scale.
• ★ Nordic nRF Cloud — Nordic's cloud, free-ish for development; OTA, location services, modem updates. Tightly integrated with nRF Connect SDK.
• ★ Memfault — fleet observability + OTA; auto-decoded coredumps, metrics, releases, cohorts, rollouts. Free hobbyist tier (50 devices / 30 days history); paid for production volume. The "Sentry for embedded." Closed-source product, open SDK.
• ★ Golioth — managed device cloud aimed at Zephyr / nRF / ESP; free tier (50 devices). Modern dev experience; OTA, settings, streaming, RPC.
• AWS IoT Core OTA Jobs / Greengrass OTA — AWS's OTA story; integrates with FreeRTOS LTS.
• Azure IoT Hub Device Update — Microsoft's equivalent.
• Particle (paid + free dev tier) — full vertical IoT stack (their hardware + cloud + OTA); their own MCUs (P2, Photon 2 — STM32 based).
• Blynk — IoT platform; free tier; OTA included.
• Hologram Spacebridge / Soracom — primarily SIM-management cloud, also offer OTA tooling.

Hosted Matter / smart-home OTA

• Matter OTA — defined by spec; if your device is in someone's HomeKit / Alexa / Google ecosystem, those hubs are increasingly the OTA provider via Matter.

Code-signing / security

• ★ Image signing in MCUboot — ECDSA-P256 / Ed25519 / RSA. Standard.
• ★ ESP Secure Boot v2 — RSA-PSS / ECDSA signed images; keys burned into eFuses. Irreversible, careful.
• ★ Flash Encryption — ESP-IDF / Nordic / TF-M all offer it; keys in eFuse / KMS.
• TF-M (Trusted Firmware-M) — Arm's PSA-aligned secure firmware framework for Cortex-M with TrustZone (M33).
• MCUboot encrypted images — keys in HW unique key (HUK) on supported chips.

Fleet observability adjacent

• ESP-Insights — Espressif's hosted-or-self-hosted insights dashboard (reboot reasons, metrics, logs); free Espressif-hosted tier.
• Memfault metrics — periodic device-side metrics (battery, RSSI, custom counters) shipped to fleet dashboard.
• Golioth LightDB Stream — time-series streaming from devices.

Patterns / things to actually do

• ★ A/B partitions + rollback on failed boot. Non-negotiable for production. ESP-IDF and MCUboot do it; if you build your own bootloader, copy this pattern.
• ★ Sign your images. Even a minimal HMAC against a baked-in key beats nothing. ECDSA + secure boot if you can afford the eFuse burn.
• ★ Stage updates by cohort — never push to 100% of fleet at once; even hawkBit's free tier lets you do percentage rollouts.
• Coredump uploads. Whatever cloud you use (Memfault, Golioth, your own MQTT topic), capture and triage crashes.
• Fail-safe metrics. Track update-success rate, boot-loop-rate, time-since-last-checkin per device.
• Don't OTA over BLE if you have Wi-Fi. BLE OTA is slow (~5–20 KB/s); Wi-Fi is 100×.

Pick this if…

• Default ESP OTA, hobby / dev: ArduinoOTA or ESP-IDF OTA + your own HTTP server.
• Default ESP OTA, hosted free tier: ESP-RainMaker.
• Default Zephyr / nRF / Cortex-M OTA: MCUboot + MCUmgr (BLE) or HTTP (Wi-Fi/cellular).
• Default fleet backend, self-hosted: Eclipse hawkBit.
• Default fleet backend, hosted, fleet observability: Memfault or Golioth.
• Smart-home device OTA via the user's hub: Matter OTA.
• You sell hardware and want zero infra effort: Particle or Blynk's vertical stack.
• You're shipping fewer than 50 devices: any free tier above is fine; pick what fits your chip.