June 5, 2026 · 7 min read · Technical Whitepapers
A 2 MB firmware update over NB-IoT at 20 kbps takes 13 minutes — assuming the connection doesn't drop. Over LTE-M at 350 kbps, the same update takes 45 seconds. Add delta compression (xdelta3) and it becomes 120 KB taking 6 seconds. This is why your OTA strategy determines your cellular data bill — and your device's usable lifetime.
A 2 MB firmware image transmitted to 10,000 devices costs 20 GB of cellular data. At the GlobalIoT.sim catalogue rate of EUR 0.7344/GB, that is EUR 14.69 — negligible. But update 10,000 devices four times per year, and the annual firmware data cost is EUR 58.75. Still negligible. The real cost is not the data — it is the downtime. On NB-IoT at 20 kbps effective throughput, a 2 MB file takes 13 minutes to transfer. During those 13 minutes, the device is offline — not sensing, not transmitting, not generating value. A water meter that misses 13 minutes of readings once per quarter is a compliance issue. A vehicle tracker that goes dark for 13 minutes during a firmware update is a fleet management gap. An industrial sensor that stops reporting for 13 minutes triggers a false alarm at the SCADA console. The OTA strategy is not about data cost — it is about operational continuity.
A 2 MB firmware image compressed with zstd (level 6) becomes approximately 800 KB — a 60% reduction with zero engineering effort. Apply xdelta3 delta compression against the previous version and the update package shrinks to 50-120 KB — a 94-97% reduction from the original. The transfer time comparison:
| Method | Package Size | NB-IoT (20 kbps) | LTE-M (350 kbps) | Cat-1 bis (5 Mbps) |
|--------|-------------|------------------|------------------|-------------------|
| Full binary | 2,000 KB | 13 min 20 sec | 46 sec | 3.2 sec |
| zstd compressed | 800 KB | 5 min 20 sec | 18 sec | 1.3 sec |
| xdelta3 delta | 120 KB | 48 sec | 2.7 sec | 0.2 sec |
| xdelta3 + zstd | 80 KB | 32 sec | 1.8 sec | 0.13 sec |
The delta approach transforms NB-IoT OTA from "impossible for production" to "viable for quarterly updates." It transforms LTE-M from "acceptable" to "invisible."
Source: SEGGER, "emCompress and emCompress-ToGo for Indian IoT", 2025. Available at https://gsasindia.com/blog/segger-emcompress-iot-firmware-delta-update-india
Three algorithms dominate IoT delta updates in 2026:
xdelta3 (VCDIFF): streaming, low memory (<50 KB RAM on device), fast. Compression ratio: 60-80%. Best for: MCU-class devices with <256 KB RAM. This is the default recommendation for NB-IoT and LTE-M sensors.
bsdiff: highest compression (90-97%), but memory-intensive (>1 MB RAM) and slow. Best for: server-side batch processing where RAM is abundant. Generate diffs on the server, not the device.
HDiffPatch: optimized for extreme RAM constraints (<50 KB), runs on Cortex-M0+. Compression: 70-85%. Best for: ultra-constrained devices where xdelta3 cannot fit.
For most IoT deployments, the architecture is: server generates bsdiff patches offline → compresses with zstd → device decompresses with zstd (needs ~8 KB RAM) → applies xdelta3 patch (needs ~40 KB RAM). Total device-side RAM requirement: under 64 KB. This works on an STM32L4 or nRF9160 without external RAM.
Source: IEEE, "Evaluating Differential Firmware Updates for Embedded IoT Device Fleets", 21st International Conference on Factory Communication Systems, 2025. Available at https://www.semanticscholar.org/paper/Evaluating-Differential-Firmware-Updates-for-IoT-Sorensen-Rashid/d7ea07a0faf892fd0e75dbf96a24304af9696966
NB-IoT can do firmware updates. China Mobile IoT proved this with Redstone OTA on devices with 4 MB Flash and under 1.5 MB RAM. But the constraints are severe: the device must support flash-based breakpoint resume (NB-IoT connections drop unpredictably during long transfers), the update package must be under 200 KB (limited by NB-IoT's effective throughput and PSM wake windows), region-based staggered deployment is required to avoid cell congestion, and every 3-5 versions, push a full-image anchor to reset the delta chain.
The practical rule for 2026: if your device needs quarterly firmware updates and runs on NB-IoT, design for delta updates under 100 KB. If your firmware changes are regularly larger than 500 KB even after delta compression, the device should use LTE-M or Cat-1 bis — not NB-IoT. The SIM choice at procurement determines the OTA strategy for the device's entire 5-10 year lifecycle. Changing it later means a truck roll.
Source: Redstone OTA, "How China Mobile IoT Leverages Redstone OTA To Overcome NB-IoT Software Update Challenges", 2025. Available at https://www.redstoneota.com/ja/how-china-mobile-iot-leverages-redstone-ota-to-overcome-nb-iot-software-update-challenges/
Dual-bank flash (A/B partitioning) is the safest OTA architecture: the device stores two complete firmware copies. The update writes to the inactive bank while the active bank continues running. If the update fails, the device reboots to the known-good bank. If it succeeds, the banks swap. The cost: double the flash requirement. A device that needs 1 MB for firmware now needs 2 MB. For a 10,000-unit deployment, this adds $0.50-2.00 per unit in flash cost — $5,000-20,000 total. Against the cost of bricking 100 devices in the field and sending technicians to recover them (at $200-500 per visit), dual-bank flash pays for itself at a 1-2% field failure rate.
Single-bank flash with a bootloader-based recovery is cheaper but riskier: if power is lost during the update, the device may require physical re-flashing via JTAG/SWD — a technician visit. For accessible devices (indoor gateways, vehicle-mounted trackers), this risk may be acceptable. For inaccessible devices (underground water meters, remote solar sensors, offshore equipment), dual-bank is the correct specification.