Firmware and OTA

Version and model

Each model has its own version number, three plain digits (e.g. 0.21.1). Firmware files are named edge-snt-g1-idf-<version>.bin. Every image carries a model tag, and the node rejects images of another model (image untuk model lain: SNT-G2 (perangkat ini SNT-G1)), whether through gateway OTA, Celestian rollout, or web upload.

The running version appears on the LCD (Device menu), in config/reported.fw, and in status.

Ways to install

Way	When
OTA through the gateway	day-to-day installs: the node downloads from the gateway’s OTA server on the rack LAN
Rollout from Celestian	many nodes in stages; files are forwarded by the gateway from Celestian
Upload from the web	units without a route to the broker or OTA server (Web interface)
USB	first time at the bench (flash bootloader, partitions, and application)

Flash mode must remain QIO 80 MHz: a bootloader with a mode different from the application can corrupt the configuration storage. Install the bootloader and application from the same build.

Firmware target from the server

The server states the desired version; the node installs it itself.

Key	Notes
fw_version	target version, e.g. 0.21.1. Empty = no target
fw_url	address of the .bin file. Starting with / = fetched from the gateway (http://<gateway>:8080/…)
fw_sha256	the file’s SHA-256 (64 hex). If set, the firmware is only activated if the hash matches

Flow: if fw_version differs from the running version, the node downloads fw_url, checks the SHA-256, installs, then restarts. The status is in fw_status in config/reported:

fw_status	Meaning
current	no target, or the running version already equals the target
updating to <version>	downloading and installing
installed <version>, rebooting	installed, the node is about to restart
failed: <reason>	failed (HTTP error, interrupted download, SHA-256 mismatch, empty fw_url). Retried every 10 minutes, or immediately when config is re-sent
mismatch: terpasang <a>, target <b>	firmware installed but reports a different version. The node does not install again until fw_version is changed

Computing a file’s SHA-256:

shasum -a 256 edge-snt-g1-idf-0.21.1.bin

The one-off ota command

{"action":"ota","url":"/fw/snt-g1/edge-snt-g1-idf-0.21.1.bin","sha256":"<64 hex>"}

A relative URL (/fw/…) is built against the effective broker host. In gateway mode that is the DC Gateway; in direct mode, the gateway IP from DHCP. Files live in Gateway/firmware/snt-g1/ (OTA on the gateway).

Automatic rollback

An image just installed through OTA is not yet considered valid. The node marks it valid only after Ethernet and MQTT stay connected for 60 seconds. If the image is not healthy within the time limit after boot, or crashes, hangs (30-second watchdog), or reboots before becoming valid, the node returns to the previous version by itself. Reported in config/reported:

Field	Meaning
fw_pending_verify: true	the running image has not proven healthy; do not yet treat it as successful because it can still be rolled back
fw_rolled_back: "<version>"	the firmware version cancelled by the bootloader. Present until that slot is overwritten by the next OTA

Consequence for the server

After a rollback the node reports the old version with fw_status: mismatch: terpasang <old>, target <new> and does not install the same version again until fw_version is changed. For rollout success, check the running version and the disappearance of fw_pending_verify, not only fw_status.

Limitations

• OTA over HTTPS does not yet verify the server certificate; OTA through the gateway uses HTTP on the rack LAN. File integrity is protected by the SHA-256 if fw_sha256 is set — always set it.
• Anti-cloning protection (flash encryption and secure boot) is not yet enabled in this version.