Roll Back a Bad Update
Recover safely when an upload goes wrong.
Roll Back a Bad Update is a free Arduino & IoT Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Arduino & IoT Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Updates Can Go Wrong
Even careful OTA pushes sometimes ship broken code. A solid plan needs a way to roll back to firmware that actually worked.
The Brick Risk
If new firmware can't connect to WiFi, you lose OTA itself. Without a safety net the device becomes a useless brick.
Two Partitions Save You
The ESP32 keeps the old app in one slot while flashing the new one into another. The previous build is still intact if needed.
Mark a Build as Trusted
A fresh update boots in a pending state. Your code must prove it works and then confirm the image so it becomes permanent.
esp_ota_mark_app_valid_cancel_rollback();Self-Test on Boot
Before confirming, run a quick health check: did WiFi connect, did key sensors respond? Only then mark the build valid.
Auto Rollback on Failure
If a pending build crashes or reboots before confirming, the bootloader quietly returns to the last good firmware on its own.
Trigger It Yourself
You can also force a return to the previous image in code with esp_ota_mark_app_invalid_rollback_and_reboot() when a check fails.
esp_ota_mark_app_invalid_rollback_and_reboot();Use a Watchdog
A watchdog timer resets a frozen board. Paired with rollback, a hung update reboots straight back into working code.
Version Your Firmware
Stamp each build with a version number you can print over Serial, so you instantly know which image is actually running.
#define FW_VERSION "1.4.2"
Serial.println(FW_VERSION);Test on One Device First
Never push to your whole fleet at once. Update a single canary device, watch it, then roll out widely. 🐤
Always Keep a Recovery Path
Worst case, a USB cable still reflashes any board. Design so a bad OTA is an inconvenience, never a permanent loss.
Quick Check
Consider what happens if new firmware crashes before it confirms itself.
Recap
Keep two partitions, self-test then confirm each build, lean on auto rollback and a watchdog, and always leave a USB recovery path. 🛡️
Frequently asked questions
Is the “Roll Back a Bad Update” lesson free?
Yes — the full text of “Roll Back a Bad Update” is free to read here on the web, and the Arduino & IoT Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Arduino & IoT Academy course, upgrade to CoddyKit PRO.
What will I learn in “Roll Back a Bad Update”?
Recover safely when an upload goes wrong. You practise Arduino & IoT Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Arduino & IoT Academy?
No prior experience is required. Arduino & IoT Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Roll Back a Bad Update” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Arduino & IoT Academy lesson?
Yes. Every Arduino & IoT Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Why OTA Matters in the Field
- Enable ArduinoOTA
- Host a Web Update Page
- Roll Back a Bad Update