Formcloud adds signed firmware rollback

Formcloud 4.3 shipped this week with signed firmware rollback for Axon Sense, Fieldmesh, and Nexa Edge devices. A fleet operator can select a device group, choose a previously deployed version, and return the group to it, staged and monitored the same way a forward update is.

Why this took a while

Rolling forward is straightforward: the new firmware knows about everything the old firmware knew about. Rolling back is not, because the older firmware has to cope with state written by a version that did not exist when it was built.

Three specific problems had to be solved before we were willing to offer this as a supported operation.

Configuration written by a newer version

A device that has run 4.2 has a configuration store with 4.2-shaped records in it. Give it 4.1 and it will find fields it does not recognize. Silently dropping them loses settings. Refusing to start is worse. Devices now write configuration in a forward-compatible envelope, and unrecognised sections survive a downgrade untouched rather than being discarded.

Buffered data

A device holds unsent measurements. If it is downgraded while holding data written in a newer record format, that data has to either survive or be explicitly abandoned, and the operator has to know which. Rollback now drains the buffer before the version change wherever it can, and where it cannot, it reports exactly how many records were held back and does not pretend they arrived.

Proving what happened

The reason rollback matters is that something went wrong. That means the record of the rollback is evidence, and evidence has to be trustworthy. Every version transition is signed by the device, recorded with its serial number, the outgoing and incoming firmware hashes, and the timestamp, and the resulting log is exportable.

What it deliberately will not do

Rollback across a major version boundary is not offered. The data formats change too much and the honest answer is that we cannot guarantee the result.

Rolling back away from a release issued for a safety reason is also blocked, and cannot be overridden from the console. If you need to do that, it is a conversation with support, and it will be a slow one on purpose.

Formcloud 4.3 is available now to all customers on a current subscription. No device-side action is needed; the capability arrives with the next firmware update in the normal cycle.