ARCHIVES

Objectives: Highly integrated embedded systems such as autonomous robots, industrial automation platforms, and connected vehicles incorporate multiple System-on-Chip (SoC) processors and Microcontroller Units (MCUs) that operate in concert to deliver complex functionalities. Delivering reliable over-the-air (OTA) software updates across such heterogeneous multi-processor environments presents significant engineering challenges, particularly when different processing units support disparate update mechanisms and only a single SoC maintains external network connectivity. Methods/Statistical Analysis: This paper presents a coordinated OTA update framework that partitions all update targets into two categories: (a) SoCs equipped with a built-in update system (A/B or recovery-based) and (b) MCUs or processors that require direct firmware flashing by an external entity. A network-connected Main SoC assumes the role of update orchestrator and manages the complete lifecycle of a system-wide update, including binary download, hash-verified distribution, parallel update triggering, verification through a minimal Update Verifier Target, and atomic commit-or-rollback signalling. The framework incorporates timeout-based safety mechanisms—a five-minute auto-rollback timer at the orchestrator and an eight-minute independent timer at each SoC—to guarantee system recovery from communication failures. Findings: The proposed framework achieves atomic update consistency by ensuring that the system either fully transitions to the new software version or reverts entirely to the prior version. Parallel update execution significantly reduces total downtime compared to sequential approaches. The Update Verifier Target paradigm prevents data inconsistencies by restraining each SoC from loading full user-space services until global success is confirmed. Application/Improvements: The framework is directly applicable to robotics platforms, automotive electronic control unit (ECU) networks, and smart manufacturing systems. Future work addresses post-commit failure recovery and resilient notification protocols to eliminate residual partial-update risks