J11 OTA Update Specification

Wi-SUN Enhanced HAN
Plus Route-B Dual Stack
J11 OTA Update Specification

First Edition
EnglishJ11 OTA Update Specification

Notice1. The contents of this document are the latest at the time of the publication of this document and may besubject to change without notice.
2. ISB Corporation does not guarantee that there are no errors in the information. Even in the event thatany damage or loss arising from any and all errors in the information provided in this document iscaused to you, ISB Corporation shall not be responsible whatsoever for such errors.
3. ISB Corporation shall not be responsible whatsoever for any and all third-party infringements of patents,
copyrights, and other intellectual property rights that were caused in relation to the use of technicalinformation provided with this document. ISB Corporation shall, in accordance with this document, notgrant any and all rights based on ISB Corporation’s or third party’s patents, copyrights, and otherintellectual property rights.
4. Reproducing or copying this document, in whole or in part, is strictly prohibited without advance
permission of ISB Corporation.

Document Convention
This document uses the following typographical convention:
Convention

Description

Request OTA Data Write

Words in bold with the first letter of each word capitalized indicate
command names.

Revision History
Date

Description

March 19, 2020

First English edition of the Japanese original first edition (1.0)

June 1, 2020

Revision of the first English edition

Copyright
Copyright ISB Corporation 2020. All rights reserved.

J11 OTA Update Specification

Contents
1.

Introduction ....................................................................................................................... 1

2.

OTA update function ......................................................................................................... 33.

OTA update communication ............................................................................................ 8

4.

3.2.1
3.2.2

OTA control packet format ........................................................................................................... 10
OTA write packet format ...............................................................................................................11

3.4.1

OTA control packet checksum ...................................................................................................... 13

3.4.2

OTA write packet checksum ......................................................................................................... 13

OTA update IF specification ........................................................................................... 15
4.1.1
4.1.2

OTA UDF packet .......................................................................................................................... 15
UART IF commands ..................................................................................................................... 15

4.2.1
4.2.2

Request/Response commands (control) ........................................................................................ 16
Request/Response commands (write) ........................................................................................... 22

4.2.3
4.2.4

Response command (other) .......................................................................................................... 24
List of response results ................................................................................................................. 25

4.3.1

Request/Response command (operation)...................................................................................... 26

4.3.2

Notification command (operation) ............................................................................................... 28

5.

OTA update sequence...................................................................................................... 30

6.

Sequence to apply firmware after rewrite..................................................................... 33

7.

Operation when an error is found ................................................................................. 34i

J11 OTA Update Specification

8.

Notes ................................................................................................................................. 35ii

J11 OTA Update Specification

List of Figures
Fig. 1: Scope of this document ................................................................................................................................ 1
Fig. 2: OTA update from gateway router ................................................................................................................ 3
Fig. 3: OTA update from OTA update dedicated device ......................................................................................... 3
Fig. 4: Target of OTA update ................................................................................................................................... 5
Fig. 5: BANK management..................................................................................................................................... 6
Fig. 6: OTA update communication system ............................................................................................................ 9
Fig. 7: OTA control packet format ........................................................................................................................ 10
Fig. 8: OTA write packet format ............................................................................................................................11
Fig. 9: Example of dividing firmware (BANK0) .................................................................................................. 12
Fig. 10: OTA Client status transition diagram ....................................................................................................... 14
Fig. 11: Sequence of OTA update start .................................................................................................................. 30
Fig. 12: Sequence of OTA update write ................................................................................................................ 31
Fig. 13: Sequence of OTA update end ................................................................................................................... 32
Fig. 14: Sequence to apply rewritten firmware ..................................................................................................... 33

iii

J11 OTA Update Specification

List of Tables
Table 1: Terms and definitions ................................................................................................................................ 2
Table 2: Reference documents ................................................................................................................................ 2
Table 3: OTA control packet format ...................................................................................................................... 10
Table 4: Command codes .......................................................................................................................................11
Table 5: OTA write packet format ..........................................................................................................................11
Table 6: OTA Client status .................................................................................................................................... 14
Table 7: UDP packet commands ........................................................................................................................... 15
Table 8: UART IF commands ............................................................................................................................... 15
Table 9: List of response results ............................................................................................................................ 25iv

J11 OTA Update Specification

1.

Introduction

1.1

Overview

This document describes the firmware update function using Wi-SUN communication on ISB-made Wi-SUN
stack (hereinafter referred to as the "Wi-SUN Dual Stack") that is embedded in wireless modules compliant with
Wi-SUN Profile for ECHONET Lite as the international wireless communications standards (hereinafter referred
to as the "Wi-SUN") for Route B and for Enhanced HAN (hereinafter referred to as the "HAN") specified by"Wi-SUN Alliance" (hereinafter referred to as the "Module").

1.2

Scope of this specification

This document describes the functional specification on OTA update, one of the functions included in Wi-SUN
Dual Stack.

OTA update function
Route B

Enhanced HAN

Wi-SUN application layer [UART IF]
Application part

Wi-SUN application layer[OTA Client]

Layer 5 - 7
Security part

Wi-SUN security layer (Route B)[PANA] PaC

Wi-SUN security layer (EnHAN)[PANA] PAA, PaC

Wi-SUN transport layer [UDP]

Layer 4
Interface part

Wi-SUN network layer [IPv6, ICMPv6]

Layer 3

Wi-SUN adaptation layer [6LoWPAN]
Layer 2

Data link part

Layer 1

Physical layer
part

Wi-SUN MAC layer (Route B)[IEEE 802.15.4/4e]

Wi-SUN MAC layer (EnHAN)[IEEE 802.15.4/4e]

Wi-SUN physical layer [IEEE 802.15.4g (920 MHz)]

Fig. 1: Scope of this document1

J11 OTA Update Specification
1.3

Terms and definitions
Table 1: Terms and definitions

Term

Definition

Route B

Wi-SUN profile for communications between smart meters and HEMS controllers

Enhanced HAN

Wi-SUN profile for communications between HEMS controllers and homeelectronics

OTA

Over The Air

ISP

1.4

Abbreviation of In-System Programming.
Function to rewrite on-chip flash ROM that is embedded in a system.

Reference documents
Table 2: Reference documents

No.

Document name

1

J11 UART IF Specification2

J11 OTA Update Specification

2.

OTA update function

2.1

Overview

The OTA update function is firmware update function by OTA update communication using Wi-SUN

サーノード communication. OTA update communication uses UDP/IP communication and a form of OTA Server to update
firmware and OTA Client to have its firmware updated.
ァームウェアアップデート
構成イメージ②センサーノード

The figure below shows an example case of “firmware update of OTA update from a gateway” and “OTA updatefrom an OTA update dedicated device (node)”.
無線ファームウェアアップデート
構成イメージ

Download firmware fromOTA update communication
OTA Server
Download firmware fromOTA update communication

OTA Server

Firmware distribution
Gateway
Firmwaredistribution
serverOTA Server
serverNode
Gateway OTA Client
Node
OTA Server
OTA Client(Target of update)(Target of update)Fig. 2: OTA update from gateway router

OTA update communication
OTA update communication

Node
Gateway
NodeGatewayOTA Server OTA Server
OTA Client OTA Client(OTA
updatededicateddevice)(Target of update)(OTA update dedicated device)(Target of update)Fig. 3: OTA update from OTA update dedicated device3J11 OTA Update Specification
2.2

Features● OTA Server updates OTA Client’s firmware by transmitting UDP packet specified in this document.
Thus, Wi-SUN HAN stack with encrypted UDP communication allows you to use OTA Client’s OTA
update function.
● OTA update communication provides high reliable firmware update with authentication and encryption.
● Firmware update is written into a different BANK from the currently running BANK; therefore, even if
power interruption or other trouble occurs during OTA update, the firmware can recover to previously
running firmware.
● OTA update function is designed to prevent from updating firmware for other than Wi-SUN Dual Stack.
● OTA update writing requires approximately 3 minutes for completion. The writing completion timevaries, depending on wireless communication circumstance and OTA Server operation.
● After OTA update is completed, reboot of the Module is required to apply the firmware.
For details of sequence to apply the update, see Chapter 6, “Sequence to apply firmware after rewrite”.

4J11 OTA Update Specification
2.3

Target of update

The target of OTA update is Wi-SUN Dual Stack firmware in the wireless Module.
HOST microcontroller
HOST application control
Applicaton part
Wi-SUN application control ［UART IF］

BP35C0-J11 (wireless module)
Route B

Enhanced HAN

Wi-SUN application layer [UART IF]
Application partSecurity part

Wi-SUN application layer[OTA]
Wi-SUN security layer (Route B)[PANA] PaC

Wi-SUN security layer (EnHAN)[PANA] PAA, PaC

Wi-SUN transport layer [UDP]Interface part

Wi-SUN network layer [IPv6, ICMPv6]

Wi-SUN adaptation layer [6LoWPAN]
Data link part
Physical layer
part

Wi-SUN MAC layer (Route B)[IEEE 802.15.4/4e]

Wi-SUN MAC layer (EnHAN)[IEEE 802.15.4/4e]

Wi-SUN physical layer [IEEE 802.15.4g (920 MHz)]

Fig. 4: Target of OTA update

5

Target offirmware update

J11 OTA Update Specification
BANK management

2.4

BANK management function is designed to rewrite and activate two BANKs alternately. When updating
firmware by OTA update, writing is executed into BANK1 when BANK0 is active or into BANK0 when
BANK1 is active.

2BANK管理

Two different firmware files are provided for BANK0 and BANK1 update, respectively.
BP35C0-J11 (wireless module)

0x1404_0000

OTA update firmware 1
BANK 10x1403_DFFFBANK 1
Writable space

FirmwareBANK10x1400_0A00
0x1400_0000
0x1004_0000

OTA update firmware 2
0x1003_DFFFBANK 0BANK 0
Writable space

Firmware0x1000_0A00
0x1000_0000

Fig. 5: BANK management

6

BANK0

J11 OTA Update Specification
2.5

Prevention of unauthorized access

For prevention of unauthorized access, unauthorized access is determined by checking timing of firmware
writing and firmware start-up.
● Determination of unauthorized access at firmware writing
When firmware for other than Wi-SUN Dual Stack firmware is written by OTA update, an error occurs
and Wi-SUN Dual Stack determines that the firmware is invalid.
● Determination of unauthorized access at firmware activation
Wi-SUN Dual Stack determines whether the firmware is running in BP35C0-J11 when the firmware is
activated, and prevents the activation when an error occurs.

7J11 OTA Update Specification

3.

OTA update communication

OTA update communication means UDP/IP communication to control the OTA update function in the Module.

3.1

Overview● OTA update communication provides UDP/IP communication using the port number 31941.
● OTA update communication defines OTA Server to update firmware and OTA Client to have its
firmware updated.
● When OTA Client requests Initiate OTA Client (§4.3.1.1), the UDP port number 31941 is automaticallyopen.
● In order for OTA Server to receive a response from OTA Client, UDP port number 31941 should be
open by the upper-level application.
● OTA update communication requires communication after connection establishment with Wi-SUN.
● OTA update communication does not accept plain text data. Encryption with Wi-SUN is required.
● OTA update function is single task. Therefore, while OTA process is being executed (waiting for a
response to a request), further request data cannot be processed.
● Checksum is used to verify if there are any errors in received UDP data.
● It is necessary to implement the upper-level application of OTA update communication into OTA Server
in order for OTA Server to perform OTA update communication with OTA Client and check responses
from OTA Client.
● Retransmission at failure of OTA Server’s OTA update communication should be implemented by theupper-level application.
● When OTA Client received UDP packets for OTA update toward OTA port after initiating OTA Client,
OTA Client automatically analyzes UDP packets for OTA update and performs internal processaccording to the requested data. OTA Client responds the processed results using UDP packets for OTA
update.
● The maximum delay time of Response command is 10 seconds.

8②センサーノード
無線ファームウェアアップデート 構成イメージ

J11 OTA Update Specification

OTA Client

OTA Server

HOST microcontroller
Upper-level application

FirmwarebinaryUART IF commands
Initiate OTA Client
Terminate OTA Client
Notify OTA Operation Initiation
Notify OTA Operation Termination

HOST microcontroller
Upper-level application
BP35C0-J11 (wireless module)
OTA update
communication
UDP port 31941

OTA update function
OTA update
communication
UDP port 31941

Wi-SUN Module

Wi-SUN Module

UART communication
Internal control

OTA update communication
Wi-SUNUDP communication
Wireless communication

Fig. 6: OTA update communication system

9

J11 OTA Update Specification
3.2

OTA UDP packet format

OTA UDP packet falls into 2 types of OTA control packet and OTA write packet.
Set the following format into the UDP payload.

OTA control packet format

3.2.1

Control
packetheader(1byte)MessagelengthCommandcode

Commandparameter(1byte)(1byte)(variable)

Checksum(1byte)Control
packetfooter(1byte)Fig. 7: OTA control packet format

Table 3: OTA control packet format
Name

Description

Value

Control packet header

Identifier of OTA control packet

0x01

Message length

Length of command code + command parameter-

Command code

See Table 4: Command codes.

-

Command parameterSee §4.2.1 “Request/Response commands (control)”.

-

Checksum

Checksum of message length + command code + commandparameter-

Control packet footer

End of OTA control packet

0x03

10

J11 OTA Update Specification
3.2.1.1

Command codes

OTA control packet is classified into two types: Request command used to make a request from OTA Server to
OTA Client and Response command used to make a response to the request from OTA Client to OTA Server.
Table 4: Command codes
Command code

Command name

RequestResponse

Start OTA Write

0x40

0x70

End OTA Write

0x45

0x75

Start OTA Mode

0x60

0x71

Get OTA Write BANK Information

0x62

0x72

End OTA Mode

0x64

0x74

Get OTA Version Information

0x68

0x78

OTA write packet format

3.2.2

Write packet
header(1byte)Write sector
number(2byte)Messagelength(2byte)Write data

Checksum(variable)(1byte)Write packet
footer(1byte)Fig. 8: OTA write packet format

Table 5: OTA write packet format
Name

Description

Value

Write packet header

Identifier of OTA write packet identifier

0x02

Write sector number

Relative sector number of write data-

Message length

Length of write data-

Write data

Request: Firmware write data. See §4.2.2.1.1.

-

Response: Firmware write result. See §4.2.2.2.1.
Checksum

Checksum of write sector number + message length + write data-

Write packet footer

End of OTA write packet: 0x03(ETX)0x03/0x17

Transmission continued of OTA write packet: 0x17(ETB)11

J11 OTA Update Specification
3.3

Creating OTA write packet

Firmware of Wi-SUN Dual Stack is provided in the Intel Hex format. The padding of space that is out of rangeof the firmware is 0xFF.
To create OTA write packet, firmware data including the start address is divided by the sector size (512 bytes).
The write sector number begins at 1 that contains 512 bytes from the start address, and the following sector
numbers are assigned sequentially to the relative sector numbers.
The Figure below shows an example of dividing firmware by 512 bytes.

0x1003_DFFF

Write sector number

Write data

Address

Data divided by sector size (512 bytes)

0x01EB

Free space

0x1000_0A00

Data divided by sector size (512 bytes)

0x01A4

•
•
•

•
•
•

Data divided by sector size (512 bytes)

0x0003

Data divided by sector size (512 bytes)

0x0002

Data divided by sector size (512 bytes)

0x0001OTA write start UDP packet
Start address: 0x10000A00
End address: 0x1003DFFFOTA write packet
Write packet
header(1byte)Write sector
number(2byte)Messagelength(2byte)Write data(variable)

Checksum(1byte)Write packet
footer(1byte)Fig. 9: Example of dividing firmware (BANK0)OTA Client that received OTA write packet calculates an address where data will be written by using the start
address specified by OTA write start packet and write sector number (write destination address = start address +(write sector number - 1) x 512 bytes). Note that the divided data must match the write sector number.
The firmware does not include space (continuous 0xFF) that does not need data writing. When the firmware data
are merely connected, address information included in the Intel Hex format is lost. To prevent this, create OTA
write packet matching the address specified in the Intel Hex format and address of individual divided data.
When free space exists in write data space, there is no necessary to transmit OTA write packet as large as the freespace. In case of the above example, after 0x01A4 OTA write packet transmission, the following 0x01D0 OTA
write packet can be transmitted.
Specify a multiple of 4 since the minimum write unit of a message length is 1 word (4 bytes).
For the end of OTA write packet (when write sector number = 0x01D0 in the above example), specify
0x03(ETX) in write packet footer.
When OTA write packet is anything but the end, specify 0x17(ETB) in write packet footer.

3.4

Checksum

Error detection is performed on OTA UDP packet using checksum. If value integrity check is invalid, RespondError is executed.
The value decremented by 1 byte each from all data starting at the initial value 0x00 (borrow is ignored).

12

J11 OTA Update Specification
3.4.1

OTA control packet checksum

Target of calculation: Message length, command code, command parameter
Calculation example:
For Start OTA Mode Request:
Checksum = 0x00(initial value) - 0x01(message length) - 0x61(command code) - (none) (command parameter)
In case of the above example, “0x9E” is the checksum value.

3.4.2

OTA write packet checksum

Target of calculation: Write sector number, message length, write data
Calculation example:
Checksum = 0x00(initial value) - 0x00(write sector number 1) - 0x01(write sector number 2) - 0x00(message
length 1) - 0x04(message length 2) - 0xFF (write data 1) - 0x80 (write data 2) - 0x40 (write data 3) - 0x22 (write
data 4)
In case of the above example, “0x1A” is the checksum value.

13

J11 OTA Update Specification
3.5

OTA Client status transition

The diagram below shows the status transition of OTA Client.

Fig. 10: OTA Client status transition diagram

Table 6: OTA Client status
Status description

Description

Idle status

Status where OTA Client starts to accept Start OTA Mode.

Control status

Status where OTA mode starts to receive any OTA control packet.

Write status

Status where OTA write starts to receive OTA write packet.

14

J11 OTA Update Specification

4.

OTA update IF specification

4.1

OTA update IFOTA UDF packet

4.1.1

The table below lists commands to use UDP packet in the OTA update function.
Table 7: UDP packet commands
Major
category

Command code
Classification

Command name
RequestResponse

Start OTA Write

0x40

0x70

End OTA Write

0x45

0x75

Start OTA Mode

0x61

0x71

Get OTA Write BANK Information

0x62

0x72

End OTA Mode

0x64

0x74

Get OTA Version Information

0x68

0x78

Request OTA Data Write

NA

NA

Respond OTA Data Write

NA

NA

Respond Error

NA

0xE0

Control
UDP

Write
Other

4.1.2

UART IF commands

The table below lists commands to use UART IF in the OTA update function.
Table 8: UART IF commands
Major
category

UART

Command typeClassification

Command name
RequestResponse

Notification

Initiate OTA Client

0x02010x2201NA

Terminate OTA Client

0x02020x2202NA

Notify OTA Operation Initiation

NANA

0x6033

Notify OTA Operation Termination

NANA

0x6034

Operation

15

J11 OTA Update Specification
4.2

OTA UDP packet

4.2.1

Request/Response commands (control)

4.2.1.1

Start OTA Write

Request command

0x40

Response command

0x70

Function description
To make OTA Client transition to the write status to allow write of firmware program code into a specified address
space.
A Request with a specified space including active BANK space results in an error.

4.2.1.1.1 Request command parameters
Name

Length
bytes

in

Range

Detail0x10000A00
Write start address

4orStart address of write firmware

0x14000A00
0x1003DFFF
Write end address4

orEnd address of write firmware

0x1403DFFF

4.2.1.1.2 Response command parameter
Name

Lengthbytes

Response result

1

in

Range

Detail-For command execution results, see
Table 9: List of response results.

16

J11 OTA Update Specification
4.2.1.2

End OTA Write

Request command

0x45

Response command

0x75

Function description

To end OTA Client write operation to make the transition to the control status.
This packet is used to notify that all firmware data transmission from OTA Sever to OTA Client was successfullycompleted.
After receiving this packet, OTA Client checks written firmware, if no error is found, and registers it as thefirmware to start next time into the Module.
The registered firmware will take effect next time the Module starts up.

4.2.1.2.1 Request command parameter
Name

Length
bytes

None

-

in

Range

Detail

-

-

Range

Detail-For command execution results, see
Table 9: List of response results.

4.2.1.2.2 Response command parameter
Name

Lengthbytes

Response result

1

in

17

J11 OTA Update Specification
4.2.1.3

Start OTA Mode

Request command

0x61

Response command

0x71

Function description

To make OTA Client transition to the control mode to receive any OTA control packet.
OTA Client notifies the HOST that OTA update control starts by Notify OTA Operation Initiation (§4.3.2.1).

4.2.1.3.1 Request command parameter
Name

Length
bytes

None

-

in

Range

Detail

-

-

Range

Detail-For command execution results, see
Table 9: List of response results.

4.2.1.3.2 Response command parameter
Name

Lengthbytes

Response result

1

in

18

J11 OTA Update Specification
4.2.1.4

Get OTA Write BANK Information

Request command

0x62

Response command

0x72

Function description
To check an OTA update write target BANK with OTA Client.
OTA Server selects firmware written in the BANK of the number that OTA Client responds accordingly and starts
OTA write.

4.2.1.4.1 Request command parameter
Name

Length
bytes

None

-

in

Range

Detail

-

-

Range

Detail

4.2.1.4.2 Response command parameters
Name

Lengthbytes

in

For command execution results, see
Table 9: List of response results.
Response result

1-

Write BANK number

1

0x00 to 0x01

Note: In case of failure to receive thecommand, the following parameters
will not be given.

19

0x00: BANK00x01: BANK1

J11 OTA Update Specification
4.2.1.5

End OTA Mode

Request command

0x64

Response command

0x74

Function description

To end receiving OTA control packet to make OTA Client transition to the idle status.
OTA Client notifies the HOST that OTA update control ended by Notify OTA Operation Termination (§4.3.2.2).

4.2.1.5.1 Request command parameter
Name

Length
bytes

None

-

in

Range

Detail

-

-

Range

Detail-For command execution results, see
Table 9: List of response results.

4.2.1.5.2 Response command parameter
Name

Lengthbytes

Response result

1

in

20

J11 OTA Update Specification
4.2.1.6

Get OTA Version Information

Request command

0x68

Response command

0x78

Function description

To get the firmware version information on OTA Client.

4.2.1.6.1 Request command parameter
Name

Length
bytes

None

-

in

Range

Detail

-

-

Range

Detail

4.2.1.6.2 Response command parameters
Name

Lengthbytes

in

For command execution results, see
Table 9: List of response results.
Response result1-

Firmware ID

2-0x0400: Wi-SUN Enhanced HAN
Plus Route-B Dual Stack

Major version

1

0x00 to 0xFF

Current version

Minor version

1

0x00 to 0xFF

Current version

Revision

40x00000000 to 0xFFFFFFFF

Current revision

Note: In case of failure to receive thecommand, the following parameters
will not be given.

21

J11 OTA Update Specification
4.2.2

Request/Response commands (write)

4.2.2.1

Request OTA Data Write

Request command-

Response command-

Function description
To request OTA Client to write firmware.
After receiving Request OTA Data Write, OTA Client calculates a write start address by the following formula,
after erasing a write start address’ sector, and writes firmware data of a size specified in the message length. The
data is written in units of word (4 bytes) and if it is 0xFFFFFFFF, write is omitted.
Write start address calculation method:
Write start address = write start address of Start OTA Write (§4.2.1.1) + (write sector number -1) x 512 (sector
size)

4.2.2.1.1 Request command parameter
Name

Length
bytes

in

Range

DetailWrite firmware data

Write data

4 to 512

Specify a multiple of 4 since theminimum write unit is 1 word (4bytes).

-

4.2.2.1.2 Example of creating a Request command
For an example of creating a Request command, see §3.3 “Creating OTA write packet”.

22J11 OTA Update Specification
4.2.2.2

Respond OTA Data Write

Request command-

Response command-

Function description
To respond the result of OTA Client data write.
After firmware data write, the written sector is read and CRC32 is executed.
If the response result or write result is an error, 0 is set in checksum.

4.2.2.2.1 Response command parameters
Name

Lengthbytes

Response result

Write result

Checksum

in

Range

Detail1-

For command execution results, see
Table 9: List of response results.

1-

For data write results, see Table 9:
List of response results.

4

Result of read and CRC32
calculation of written sectors-

Note: If the response result or write
result is an error, 0 is set.

23

J11 OTA Update Specification
4.2.3

Response command (other)

4.2.3.1

Respond Error

Request command-

Response command

0xE0

Function description
To respond an error response code when an error is found due to undefined command codes and invalid UDP
packet format.

4.2.3.1.1 Response command parameter
Name

Lengthbytes

Response result

1

in

Range

Detail-For command execution results, see
Table 9: List of response results.

24

J11 OTA Update Specification
4.2.4

List of response results

The table below lists response results set to Response commands.
Table 9: List of response results
Response
resultResponse
result

(DEC)

(HEX)

5

0x05

Error with invalid command information (parameter)

6

0x06

Response succeeded.

7

0x07

Error with abnormal frame data received

21

0x15

Negative response (error with failure of unmatch of the status, etc.)

28

0x1C

Write error to flash memory

29

0x1D

Write process was omitted because write data is all "0xFF" or the same data have been
written.

30

0x1E

Error of integrity check on the entire firmware

Description25

J11 OTA Update Specification
4.3

UART IF commands

4.3.1

Request/Response command (operation)

4.3.1.1

Initiate OTA Client

Request command

0x0201

Response command

0x2201

Function description
To initiate OTA Client and put it into operation in the status in which OTA UDP packets can be accepted.
At execution of Initiate OTA Client, open the UDP port of 31941 to be used.

4.3.1.1.1 Request command parameter
Name

Length
bytes

None

-

in

Range

Detail

--4.3.1.1.2 Response command parameter
Name

Length in
bytes

Range

DetailResponse result

1-

For command execution results, see
the document, “J11 UART IF
Specification”.

26

J11 OTA Update Specification
4.3.1.2

Terminate OTA Client

Request command

0x0202

Response command

0x2202Function description
To terminate OTA Client and return it to the status in which no OTA UDP packets can be accepted.
At execution of Terminate OTA Client, close the UDP port of 31941 in use.

4.3.1.2.1 Request command parameter
Name

Length in
bytes

Range

Detail

None

-

-

-

4.3.1.2.2 Response command parameter
Name

Length in
bytes

Range

DetailResponse result

1-

For command execution results, see
the document, “J11 UART IF
Specification”.

27

J11 OTA Update Specification
4.3.2

Notification command (operation)

4.3.2.1

Notify OTA Operation Initiation

Notification command

0x6033Function description
To notify the initiation of OTA updating operation.
The initiation is notified when the OTA Client receives an OTA mode initiation packet.

4.3.2.1.1 Notification command parameter
Name

Source IPv6 address

Length
bytes

16

in

Range

Detail0xFE80000000000000XXXXXXXXXXXXXXXX
XX represents MAC address.

28

IPv6 address of the source of OTA
data
Note: The lower 2nd bit of the first 1
byte of the MAC address is inverted.

J11 OTA Update Specification
4.3.2.2

Notify OTA Operation Termination

Notification command

0x6034

Function description
To notify the termination of OTA updating operation.
The termination is notified when the OTA Client receives an OTA mode termination packet.

4.3.2.2.1 Notification command parameters
Name

Length
bytes

in

Range

Detail
0x01: Version upgrade succeeded

OTA update result

10x01 to 0x03

0x02: Version upgrade failed
0x03: No version upgrade

Source IPv6 address

160xFE80000000000000XXXXXXXXXXXXXXXX
XX represents MAC address.

29

IPv6 address of the source of OTA
data
Note: The lower 2nd bit of the first 1
byte of the MAC address is inverted.

J11 OTA Update Specification

5.

OTA update sequenceThis chapter describes sequences between OTA Server and OTA Client after Wi-SUN connection completion.
Firmware can be rewritten by sequentially executing steps 1. to 3. below.
Steps
1. Sequence of OTA update start (see §5.1)
2. Sequence of OTA update write (see §5.2)
3. Sequence of OTA update end (see §5.3)

5.1

Sequence of OTA update startFig. 11: Sequence of OTA update start30

J11 OTA Update Specification
5.2

Sequence of OTA update write

Fig. 12: Sequence of OTA update write31J11 OTA Update Specification
5.3

Sequence of OTA update end

Fig. 13: Sequence of OTA update end

32

J11 OTA Update Specification

6.

Sequence to apply firmware after rewrite

After successful OTA update, to make the update take effect, restart of the Module is required. An example ofsequence to apply firmware update is shown below.
The sequence includes the following 2 cases:● OTA Client leads to apply written firmware● OTA Server leads to apply written firmware

Fig. 14: Sequence to apply rewritten firmware

33

J11 OTA Update Specification

7.

Operation when an error is found

7.1

OTA UDP packet reception during command processing

While OTA Client is being process a command, OTA UDP packet cannot be processed. In this case, RespondError is not executed and all UDP packets received are discarded. After transmitting a Request command, wait
until receiving a Response command, and then transmit a Request command.

7.2

Invalid parameter of OTA UDP packet

If an undefined value is specified in a Request command’s parameter, Respond Error is executed and all UDP
packets received are discarded.

7.3

Error during firmware write

If an error occurs with firmware write at OTA Client, Respond Error is executed and all UDP packets received
are discarded.
If an error occurs with Respond OTA Data Write (§4.2.2.2) at OTA Server, retransmit Request OTA Data
Write (§4.2.2.1) where an error occurred.

7.4

Write error of firmware for other than Wi-SUN Dual Stack

When firmware for other than Wi-SUN Dual Stack is written for OTA update, OTA Client detects an error during
integrity check process of End OTA Write (§4.2.1.2) and transmits Respond Error.

7.5

Damage check and rollback at Module start-up

When the Module starts up, damage check of the firmware is performed. If damaged, firmware rollback is
executed to revert to the previous firmware version and start the Module.
If the previous firmware version is also damaged, the Module starts up in a firmware rewrite mode via UART.

7.6

Error in writing firmware of a non write target BANKWhen OTA Server transmits firmware data in BANK that is not a write target (in other words firmware runningin the active BANK), OTA Client detects an error during integrity check process of End OTA Write (§4.2.1.2)
and transmits Respond Error.
Recheck a write target BANK and retransmit correct firmware data by Request OTA Data Write (§4.2.2.1).

34

J11 OTA Update Specification

8.

Notes

 The flash memory embedded in BP35C0-J11 can be rewritten up to 100 times; therefore, use the OTA
update function only if necessary.
 When OTA Client is an end device with the sleep function enabled. OTA update is executed via indirectcommunication. Accordingly, periodically transmit a poll request during a period of time fromrequesting Initiate OTA Client (§4.3.1.1) until receiving Notify OTA Operation Termination(§4.3.2.2).
 OTA Client executes OTA update by following packets transmitted from OTA Server; therefore,
exclusively control OTA update by the upper-level application in order to avoid OTA update execution
from multiple OTA Servers to the same OTA Client.

35