Intermittent Buttonless Secure DFU Failure on Custom nRF52840 (MDBT50Q-1MV2) Hardware – Works on nRF52840-DK

[ABIRAM]

Hi Nordic Team,

We are experiencing an intermittent Buttonless Secure DFU over BLE issue on our custom hardware based on the Raytac MDBT50Q-1MV2 (nRF52840) module.

Software Environment

• nRF5 SDK 17.1.0
• SoftDevice S140 v7.2.0
• Buttonless Secure DFU over BLE
• Same application firmware
• Same bootloader
• Same DFU package

Hardware

• Custom board using Raytac MDBT50Q-1MV2
• Nordic nRF52840-DK (used as reference)

Problem Description

The exact same firmware works reliably on the nRF52840-DK, but on the custom hardware DFU fails intermittently.

Observed behavior:

• First DFU attempt after programming the board usually succeeds.
• Subsequent DFU attempts fail.
• The failure occurs more frequently after BLE data streaming.

Testing was performed separately using both:

• nRF Connect Mobile

The same behavior was observed with both applications.

Additional Validation

To isolate the issue, we performed the following tests on the custom hardware:

• Stopped BLE data streaming before initiating DFU.
• Connected the charger before initiating DFU.
• Completely powered down the ADS1299 (power pin LOW and analog power/control pin LOW) before initiating DFU.
• Repeated the DFU separately using both mobile applications.

The DFU issue still remained in all cases.

Key Observation

During successful DFU:

• The bootloader advertises using the expected incremented BLE address.

During failed DFU:

• The bootloader sometimes advertises using the same BLE address as the application instead of the incremented address expected by the Buttonless Secure DFU procedure.

Typical errors observed are:

• GATT Connection Timeout (0x08)
• DFU Service Discovery Not Started (0x1005)

Hardware Verification

We compared our schematic with the MDBT50Q-1MV2 reference design and did not find any obvious schematic differences related to power supply, DC/DC, crystal, or USB connections.

Questions

1. Are there any firmware configurations specific to the MDBT50Q-1MV2 module compared to a standard nRF52840?
2. Under what conditions can the bootloader advertise using the same BLE address as the application instead of the incremented address?
3. Are there any recommended checks for intermittent Buttonless Secure DFU failures on custom hardware when the same firmware works consistently on the nRF52840-DK?

Any suggestions would be greatly appreciated.

Thank you.

[Hung Bui]

Hi Abiram, 

Please give some more information on: 

- Do you have bonding supported in your application ? 
- You mentioned that the first DFU is always successful. Could you give more detail on that ? You will start with flashing the bootloader, softdevice , application via SWD. Then do you do bonding ? 

The reason I mention bonding is that if there is no bonding supported in the bootloader NRF_DFU_BLE_REQUIRES_BONDS=0 , the address will be increased by one. See gap_address_change() in nrf_dfu_ble.c

What you described that sometimes the address increases sometimes it doesn't is quite strange. Have you managed to reproduce this reliably? 

When the DFU is failed, did it remain in Bootloader mode ? Or it stayed in application mode ?  If it remain in bootloader mode, can you try connecting to it via nRF Connect app on the phone? 

When a DFU is failed, could you try to use a 2nd, fresh phone to try to do DFU again ?This is to rule out the issue with ATT table cache on the first phone. 

The DFU bootloader shouldn't have any dependency on the hardware. If a bootloader firmware run on the DK , the same firmware should work on your board. Unless you have some bonding data stored either on the device or on the phone making the 2 boards different.