MCU OTA Update

Last Updated on : 2025-06-17 03:21:50download

An over-the-air (OTA) update is the wireless delivery of new software, firmware, or other data to connected devices.

The Bluetooth mesh standard protocol (generic firmware key: keyen8gu, v0.2 or later) supports OTA updates for the MCU.

Log in to the Tuya Developer Platform, upload the firmware file to Tuya’s servers, and configure upgrade settings. The Bluetooth module receives the firmware from the cloud and segments it into packets for transmission. The MCU receives the packets, verifies integrity, and writes the firmware to local flash memory. For more information, see Update Firmware and Select and Manage Firmware Versions.

Update process

Commands

Command	Description
0xD8	The module queries the MCU version number
0xD9	Proactively report MCU version
0xDA	Initiate an update request
0xDB	Send the update file information
0xDC	Request the update file offset
0xDD	Transmit the update file
0xDE	Verify the update
0xDF	Request the update result

Command design

Query MCU’s version number (0xD8)

The module sends the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xD8
4 5	2	Data length	0x00 0x00
6	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

The MCU returns the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xD8
4 5	2	Data length	0x00 0x08
6 to 13	8	Data	See the following table
14	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Data format

1-3	4-6	7-8
MCU-soft-version	MCU-hard-version	Len

MCU-soft-version: The software version number of the MCU firmware. For example, 0x010000 means the version number is 1.0.0.
MCU-hard-version: The hardware version number of the MCU firmware (PCBA version number). For example, 0x010000 means the version number is 1.0.0.
Len: The maximum packet length for OTA update data (0xDD). The MCU dynamically sets this value based on its available resources to optimize subsequent data transmissions.

The update data length (Len) that the MCU can negotiate ranges from 64 bytes to 194 bytes. If the length exceeds the range, the module will set the length to the default 194 bytes.
0xD8: After the Bluetooth module sends the first heartbeat and receives a reply each time it is started, it sends this command once to proactively query the MCU’s version number.

Report MCU version proactively (0xD9)

The MCU sends the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xD9
4 5	2	Data length	0x00 0x08
6 to 13	8	Data	See the following table
14	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Data format

1-3	4-6	7-8
MCU-soft-version	MCU-hard-version	Len

MCU-soft-version: The software version number of the MCU firmware. For example, 0x010000 means the version number is 1.0.0.
MCU-hard-version: The hardware version number of the MCU firmware (PCBA version number). For example, 0x010000 means the version number is 1.0.0.
Len: The maximum packet length for OTA update data (0xDD). The MCU dynamically sets this value based on its available resources to optimize subsequent data transmissions.

The update data length (Len) that the MCU can negotiate ranges from 64 bytes to 194 bytes. If the length exceeds the range, the module will set the length to the default 194 bytes.
0xD9: The MCU proactively sends the current version number to the module every time it starts (after the serial port initialization is completed). If no response is received, retransmission is required. The retry mechanism is determined by the MCU. This ensures the module gets and reports the firmware version promptly.

The module returns the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xD9
4 5	2	Data length	0x00 0x08
6	1	State	`0x00`: Success. `0x01`: Failure
7	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Initiate an update request (0xDA)

The module sends the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDA
4 5	2	Data length	0x00 0x00
6	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

The MCU returns the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDA
4 5	2	Data length	0x00 0x04
6-9	4	Data	See the following table
10	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Data format

1	4-6
State	version

State:
- 0x00: accepts the update.
- 0x01: rejects the update.
version: The current firmware version. For example, 0x010002 represents 1.0.2.

Send the update file information (0xDB)

Describe the information about the MCU update file. The MCU can compare the update information.

The module sends the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDB
4 5	2	Data length	0x00 0x23
6-40	35	Data	See the following table
41	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Data format

8 bytes	3 bytes	16 bytes	4 bytes	4 bytes
Product ID (PID)	Version number (not currently applicable)	MD5 hash value of the file (not currently applicable)	File length	CRC32

PID: The PID of the MCU.
Version number: The file version to be updated to. For example, 0x010001 represents version 1.0.2 (not currently applicable).
File MD5 hash: The MD5 value of the firmware update (not currently applicable).
File length: The total length of the firmware update, in bytes.
CRC32 checksum: The CRC32 value of the firmware update.

The MCU returns the following data.

No.	Length (bytes)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDB
4 5	2	Data length	0x00 0x19
6-30	25	Data	See the following table
11	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Data format

8 bytes	3 bytes	16 bytes	4 bytes
State	The size of the update that has already been downloaded.	The CRC32 checksum of the update that has already been downloaded.	The MD5 hash value of the update that has already been downloaded (not currently applicable).

State:
- 0x00: The update is performed as expected.
- 0x01: The received PID does not match the one written to the device.
- 0x02: Reserved.
- 0x03: The update size exceeds the upper limit.
- Others: reserved.
The size of the downloaded update: Indicates the portion of the file that has already been updated for the MCU during a previous interrupted OTA process.
The CRC32 checksum of the downloaded update: Indicates the CRC32 checksum of the file that has already been updated for the MCU during a previous interrupted OTA process.

If the MCU supports resumable transfers, it must return its stored file information (the size and CRC32 checksum of the downloaded update). After receiving the response message, the app or gateway will calculate the CRC32 checksum of the new file and compare it to the value received. If the two match exactly, the app or gateway will change the start offset to the received data length in the following transmission request. Otherwise, the start offset is 0, meaning downloading from scratch.
If the MCU does not support resumable transfers, it must return its stored file information (the size and CRC32 checksum of the downloaded update). And all the parameters are set to 0.

If using a gateway-initiated group update, the resumable transfer feature is disabled. Regardless of whether the MCU returns a previously stored file offset or 0, the transfer will always start from offset 0.

Send the update offset (0xDC)

Send the start offset of the file and compare it with the offset returned by the MCU. If the two match exactly, the file transfer can continue from that offset. Otherwise, the entire file will be transferred from scratch.

The module sends the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDC
4 5	2	Data length	0x00 0x04
6-9	4	Offset	The offset where the file transfer starts. It is 4 bytes in length.
10	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Offset: The phone or gateway determines the transfer starting point based on the stored length and CRC32 match result from the device’s 0xDB response.

The MCU returns the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDC
4 5	2	Data length	0x00 0x04
6-9	4	Offset	The start offset required by the MCU.
10	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Offset: The update offset saved by the device.

Send the start offset of the file and compare it with the offset returned by the MCU. If the two match exactly, the file transfer can continue from that offset. Otherwise, the entire file will be transferred from scratch.
For a group update, the update offset is fixed to 0.

Transmit the update (0xDD)

The module sends the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDD
4 5	2	Data length (Len)	Upper 8 bits Lower 8 bits
6 to 6+Len-1	Len	Data	See the following table
6+Len	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Data format

4 bytes	2 bytes	2 bytes	n byte(s)
Data offset	The length (n) of current packet data	The CRC16 checksum of the current packet	The payload of the current packet

Data offset: The offset of the single update data.
Length: The maximum length of a single update data packet (Len set in 0xd8 and 0xd9 commands).
CRC16 checksum: The CRC16 checksum of a single update data packet.
Payload: The update payload.

The MCU returns the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDD
4 5	2	Data length	0x00 0x01
6	1	State	`0x00`: Success. `0x01`: Data offset exception `0x02`: The data length does not match the expected one. `0x03`: CRC check failed.
11	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

During group updates, the MCU’s response to this command is ignored by the module. The module transmits data packets at 200 ms intervals without waiting for replies between transmissions.
The MCU must support non-sequential offset writes to the flash memory. Otherwise, bulk updates cannot be performed.

Verify the update (0xDE)

The module sends the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDE
4 5	2	Data length	0x00 0x00
6	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

The MCU returns the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDE
4 5	2	Data length	0x00 0x01
6	1	State	`0x00`: Success. `0x01`: The CRC32 checksum does not match the expected one. `0x02`: The data length does not match the expected one.
7	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

Request the update result (0xDF)

The module sends the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDF
4 5	2	Data length	0x00 0x01
6	1	State	The update result. `0x00`: Success. Other values: Failure.
7	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

The MCU returns the following data.

No.	Length (byte)	Field	Description
0 1	2	Header	0x55 0xAA
2	1	Version number	0x00
3	1	Command (CMD)	0xDF
4 5	2	Data length	0x00 0x01
6	1	State	Return value. `0x00`: Success. `0x01`: Failure
7	1	CRC8	Start from the header, add up all the bytes, and then divide the sum by 256 to get the remainder

After receiving the module’s end command (0xDF), the MCU replies with a state indicating checksum verification status. If the module confirms success, the MCU waits 500 ms before rebooting to run the new firmware. No reboot occurs if the result fails.
The baud rate must be set to 115200 when you develop a product that supports MCU firmware updates. The update process involves transferring data via UART and writing to flash memory. Using a lower baud rate might trigger timeout mechanisms and cause update failures.

Prev DocExtended Function

Next DocIntegration of Bluetooth Mesh Models