This post is older than 2 years and might not be relevant anymore
More Info: Consider searching for newer posts

nRF51 OTA DFU: cannot write to DFU control point attribute

I am trying to do over-the-air (OTA) device firmware update (DFU) on a device with bootloader same to the "dfu_dual_bank_ble_s110" example in the latest nRF51 SDK. On the other end, I am using a BLE central module. To my naive understanding (please correct me if I am wrong), the DFU process is essentially comprised of writing to DFU control point (at handle 0x0F) and DFU packet chacteristics (at handle 0x0D) in DFU service (at handle 0x0C). All I need is to write to attributes at handle 0x10 (DFU control point value) and handle 0x0E (DFU packet value).

To start the OTA DFU, I first write 0x0001 to the attribute at handle 0x11 (DFU control point CCCD) to enable CCCD notification, which is completed successfully. And then I write the DFU start opcode 0x01 to the attribute at handle 0x10 to start the DFU process. However, I get error like "write not permitted". Could anyone tell me if I miss anything?

  • Hi Hung, so there are actually two related problems here. For the first problem, I can still not write to the 0x10 to start DFU with my 3rd-party BLE central device. For the second problem, OTA DFU with Master Control Panel Android app doesn't work either, since I cannot see "Dfu_HRM" after that. The log.txt of the Windows version Master Control Panel is pasted here http://pastebin.com/PEsbxGVs . Please let me know what sniffing traces you need.

  • @Diode: For the first issue, please provide more information on your 3rd party BLE central device. A screenshot would be great. For the second issue, I'm seeing a timeout. Have you tested with an unmodified bootloader ? Which bootloader project did you use ?

    Please provide sniffer trace for both cases.

  • Hi Hung, the 3rd-party BLE central device was based on BL620 from Laird. I used it as nothing too complex other than reading from and writing to BLE peripheral. It worked for other BLE devices. Everything was in command line, so I am no sure if a screenshot made a difference. For your second comment, I was using an unmodified bootloader from nRF51 SDK 8.0.0 on nRF51-DK, and followed the instructions on developer.nordicsemi.com/.../a00091.html exactly. As for the log on my Android Master Control Panel app, I saw "Connected to XXXXXX" and "Services Discovered" after I connected to the DfuTarg service. However, once I hit the "DFU" log to upload a zip file ("dfu_test_app_hrm.zip"), the log showed "Disconnected". And in the next time when I retried, it showed the same behavior. And I also notice the VDD on board was ~2.9V instead of 3.3V.

  • @diode: I'm seeing from the log that after the bootloader received the image size it didn't response. After 10 seconds, the MCP timed out and disconnect (packet 851 at 19:48:00). I suspect there could be smth wrong with the bootloader firmware you compiled. I attached my bootloader hex file. Could you try to:

    1. Erase the chip

    2. Program softdevice

    3. Program the provided bootloader hex file using "Program Bootloader"

    4. Make sure you updated the firmware on the dongle/DK to use with MCP to v0.11

    nrf51422_xxac_bootloader.hex

  • Hi Hung, the diff output showed your bootloader and mine (that was compiled from the nRF51 SDK example without modification) were different. This time I gave it another try with PCA10000 dongle, and OTA DFU worked for both your image and my image. However, I still couldn't got it working with the Master Control Panel app (version 2.1.1) on my Android in either case. Previously, it didn't work with PCA10031 dongle either. However, I could see "DfuTarg" service and could connect to it in all cases. Why is it different on Nordic supported hardware/software?

Related