By RIOD Engineering · May 19, 2026
OTA Firmware Management: Update 1,000 Chargers Without Bricking One
A bad OTA campaign can take a fleet offline for days. A good OTA campaign updates a thousand chargers in a week with no visible impact on drivers, no truck rolls, and a clean audit trail of which unit runs which version.
Here's what separates the two.
Staged rollout with health gates
Never push a firmware release to the full fleet at once. Start with a canary cohort, 5-10 chargers, geographically and vendor-diverse. Watch session-success rate, OCPP disconnect rate and error-code distribution against the pre-release baseline for a soak period (24-48h).
If health gates pass, promote to cohort 1 (10% of fleet). Soak again. Then cohort 2 (30%). Then full rollout. Automatic halt on failure spikes; automatic rollback of the affected cohort if the halt criteria trigger.
Dual-partition rollback at the firmware level
The charger holds two firmware slots. OTA writes the new image to the inactive slot, signature-verifies it, then reboots into it. On boot, a small watchdog window has to be pinged before the boot is 'committed'; if the new firmware crashes or fails to phone home, the bootloader rolls back to the previous slot automatically.
Power-fail during any of this is safe: the previously-committed slot always exists. Designed to avoid bricking under normal failure modes, including power loss mid-update.
Fleet-wide version reporting
Which chargers are on 2.4.1 today? Which have not yet accepted the campaign? Which are running an old version because they were offline during the campaign window? A version dashboard answers all of these in one query and drives the followup campaigns.
Compliance reporting for regulated markets (NEVI, AFIR) uses the same data, proof that firmware updates were applied within required timelines.
OTA campaign checklist
- Canary cohort defined and locked before rollout starts
- Firmware image signature verified in the bootloader, not the OS
- Rollback slot in dual-partition flash, ready before boot commit
- Soak period per cohort (24 to 48 hours is typical)
- Halt threshold on failure spikes, applied automatically
- Retry policy for chargers offline during the campaign
- Version reporting fleet-wide so the state is queryable, not tracked in email
Health gates that gate promotion
- Session-success rate against pre-release baseline
- OCPP reconnect rate
- Error-code spike detection
- Boot-success rate on the new firmware
- Payment-success rate
- Charger online percentage after upgrade
Read Our Next Article
Secure OTA Architecture for EV Chargers
Alerting and SLA Software for Charging Networks
EV Charging Tariff Management: Change Prices Across the Network in One Click
UPI vs RFID vs App: Charging Payment Methods Compared
UPI Autopay for EV Charging Subscriptions
Dynamic QR Code Payments for EV Charging
Deploying EV charging?
Talk to our team about your project. We design, supply, and manage EV charging infrastructure across India.