Shipping firmware to 6,000 imaging consoles without a truck roll

The situation

Every software release for the console fleet meant scheduling a field engineer, carrying validated media to a hospital, negotiating a slot when the room was not in clinical use, and repeating that several thousand times. A security patch took two quarters to reach the whole fleet. That is a commercial problem and, increasingly, a regulatory one.

The constraint

Four constraints made this harder than a normal over-the-air update problem.

• The device is regulated. Any change to what runs on it must be traceable to an approved package, with evidence retained — and the update mechanism itself is part of the submitted design.
• Hospital networks are hostile by design: outbound proxies, deep packet inspection, no inbound access, and in several sites a bandwidth budget measured in kilobits during working hours.
• A console mid-examination cannot be interrupted, and a console that fails to boot after an update is a clinical incident, not a support ticket.
• The fleet is not homogeneous. Hardware revisions, regional configurations and optional modules produce hundreds of valid combinations.

What we built

A package format with provenance built in

Signed, versioned packages with a manifest declaring hardware compatibility, prerequisite versions and a post-install verification set. Signature verification happens on-device before anything is unpacked; key rotation was designed in from the start rather than deferred.

An A/B partition with an automatic fallback

Updates are written to the inactive partition and only become active after verification passes and a watchdog confirms a clean boot into a working clinical application. If it does not, the device returns to the previous partition on its own and reports why. Rollback is not a procedure someone has to run; it is the default behaviour on failure.

Delivery that survives the network it is on

Chunked, resumable transfer with checksum verification per chunk, bandwidth throttling by site policy, and a scheduling window so downloads happen overnight. Where a site allows only one egress path, a single on-premise cache serves the consoles behind it.

A campaign console for the release manager

Fleet segmentation by model, region, current version and site; staged rollout with automatic halt rules if the failure rate in a wave crosses a threshold; and a per-device history that produces the audit evidence a regulator or an internal quality team asks for, without anyone assembling a spreadsheet.

What changed

A security patch now reaches the addressable fleet in days rather than quarters, and the field engineering budget moved from routine updates to installation and clinical support work. The audit trail that used to be reconstructed after the fact is now a by-product of the mechanism.

What we would do differently

We modelled the fleet inventory from the manufacturing record. It disagreed with reality often enough — boards swapped in the field, options enabled post-sale — that we added an on-device capability report in the third month. That should have been the first thing built, before any campaign logic that depended on knowing what a device actually is.

Outcomes

Field engineer visits per release

cut by roughly 90%

Failed updates requiring intervention

a small fraction of a percent

Rollback time on a bad package

a few minutes, automatic

Client identity withheld under a mutual NDA. Figures are illustrative — rounded and directional, meant to show the shape of the change rather than an audited result. We will walk through the real numbers, and how they were measured, under NDA on a call.