What is a staged OTA rollout?
An over-the-air (OTA) update sends new firmware or a new configuration to devices through the cellular network, without a visit to the vehicle. A staged rollout does not send it to every device at once. It starts with a small group, waits and checks, and only then widens.
The reason is simple. If the update has a fault, a staged rollout limits it to a few devices that you can still recover. Published guidance from Memfault describes the pattern: a canary group of about 5 to 10 devices in a controlled setting, then waves of about 5, 25, 50 and 100 percent, with a soak period of about 2 days before each next wave, and a way to abort and roll back.
The percentages, the canary size and the soak days above are one published example, not a rule for any device or platform. Your own plan depends on your fleet, your risk and your update tool. Source and date checked: docs.memfault.com/docs/best-practices/ota-deploy-process, last checked 2026-11-03.
How to use the pack
- Open Start here and read the color legend: yellow cells are yours, gray cells are examples, white cells are calculated.
- Fill the Change record with the versions, the reason and the number of devices in scope.
- Set the Rollout plan with your canary size, wave shares and soak days. The Check cell must show OK.
- Write the thresholds on the Go or no-go sheet before the first wave, and replace the example checks with yours.
- Estimate the data on the Data estimate sheet. If the Check cell shows Check, the update and its rollbacks use more than one month of the SIM plan.
- Run the waves in your update tool, and enter the observed values after each one. Keep the Rollback sheet ready.
Waves and soak days
Shares are cumulative: Wave 2 at 25 percent means 25 percent of the fleet is updated after Wave 2, including the devices from earlier waves. The sheet rounds each wave up to whole devices and never goes above the number in scope. The canary group is set as a number of devices, not a share.
Success metrics and abort criteria
The published guidance says to compare device health before and after an update and to abort a release that is not working as expected, but it sets no numbers for either, and no public source sets one number for every fleet. So the Go or no-go sheet gives you the checks and leaves the thresholds to you. The example checks are: devices that reported the target version, update failures, devices that stopped reporting, devices that restart again and again, reports per device compared with before, and SIM data used per device.
Each check has a direction: at least or at most. If one observed value is on the wrong side of its threshold, that check shows Stop and so does the wave. In the example, reports per device fell to 91 percent of the earlier level against a threshold of at least 95, so the wave shows Stop and the next wave waits.
Rollback
A rollback only works if it is ready before the first wave. Name the owner, keep the previous version file and its configuration, and know who tells support and customers. The sheet lists nine steps. Set the Done column to Yes as you go, or N/A for a step that does not apply. The status shows Complete when every step that applies is done.
Whether a rollback is possible, and how, depends on your device and your update tool. This pack records the decision and the steps. It does not perform them.
Estimating the SIM data
Every device downloads the files over its SIM. The estimate adds the firmware and the configuration, a retry allowance for resends and resumed downloads, and a reserve for rollbacks that send the previous version again.
In the example, 1.5 MB of firmware and 0.1 MB of configuration with a 20 percent allowance is 1.92 MB per device. For 400 devices that is 768 MB, and with one rollback in reserve it is 1,536 MB, or 1.5 GB. For link speed and download time, use the OTA Rollout and Data Planner on this site.
Limits and sources
The pack is a planning record. It does not start, pause or roll back any update, and it does not describe how any Tracom device or platform delivers updates. The thresholds, sizes and observed values in the files are examples. The staged rollout pattern comes from the Memfault OTA deployment process page (docs.memfault.com/docs/best-practices/ota-deploy-process), last checked 2026-11-03. Read the current text before you rely on it.