nRF51 SDK - S110 SoftDevice
 All Data Structures Functions Variables Typedefs Enumerations Enumerator Groups Pages
BLE DFU Service

The Device Firmware Update (DFU) Service exposes necessary information to perform Device Firmware Updates on the device. This service is not a service defined by the Bluetooth SIG, but a proprietary service defined by Nordic Semiconductor to demonstrate a typical Device Firmware Update on an nRF51 device.

The DFU Service does not depend on any other services. Support for the following GATT sub-procedures is mandatory for this service:

  • Write Characteristic Value
  • Notifications
  • Read Characteristic Descriptors
  • Write Characteristic Descriptors

The DFU GATT Service can operate only on Bluetooth low energy as transport.

The DFU Service does not define any new error codes for the Attribute Protocol. Data exchange is in little endian (LSB first) order.

This service is instantiated as a primary service in DFU mode.

Proprietary service UUID

The assigned service UUID is 0x1531 over proprietary base. See the following table for Nordic Semiconductor's UUID:

Description Number base
Company identifier: 0x0059
UUID base: 0x23, 0xD1, 0xBC, 0xEA, 0x5F, 0x78, 0x23, 0x15, 0xDE, 0xEF, 0x12, 0x12, 0x00, 0x00, 0x00, 0x00
Service UUID start: 0x1530
Characteristic UUID start: 0x1531

Service characteristics

The DFU Service exposes one instance of the characteristics listed in the following table. The service does not impose any security requirements.

Characteristic name Requirement Mandatory properties Description
DFU Packet M WriteWithoutResponse See DFU Packet.
DFU Control Point M Write, Notify See DFU Control Point.

DFU Packet

The UUID of the DFU Packet characteristic is 0x1532 over proprietary base.

This characteristic receives data for Device Firmware Updates as DFU packets. DFU packets can contain different types of data, depending to the Op Code that is written to the DFU Control Point before the DFU packet is transmitted.

The size of each packet must be between 1 and (ATT_MTU - 3) octets. Packets must be in little endian (LSB first) order.

The following table defines the format for a DFU packet:

Names Field requirement Format Additional information
DFU Packet Mandatory uint8 This field may be repeated up to a maximum of 20 times, which means that the maximum length of this characteristic is 20 bytes.

(Minimum and maximum values are not applicable.)

Image size

After writing "Start DFU" (0x01) to the DFU Control Point, you must write the image size to the DFU Packet characteristic.

The image size must be written in the following format:

<Length of SoftDevice><Length of bootloader><Length of application>

All lengths must be uint32. If a length is not present (for example, if only the SoftDevice is updated), the length should be given as 0. For example:

<Length of SoftDevice> 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Init packet

After writing "Initialize DFU Parameters" (0x02) to the DFU Control Point, you must write an init packet to the DFU Packet characteristic.

See Safety-checking the image for information about the format of the init packet.

Image data

After writing "Receive Firmware Image" (0x03) to the DFU Control Point, you must write packets containing image data to the DFU Packet characteristic.

The firmware image can be split up in multiple DFU packets. The full image is transferred by writing each fragment as DFU packet to the DFU Packet characteristic.

DFU Control Point

The UUID of the DFU Control Point characteristic is 0x1531 over proprietary base.

The DFU Control Point characteristic is used to control the state of the Device Firmware Update process. All DFU procedures are requested by writing to this characteristic. A response that marks the end of the procedure is received as a notification.

The following table shows control point procedure operation codes and the respective parameters:

NamesField requirementFormatAdditional information
Op Code Mandatory uint8 Enumerations:
KeyValueRequirementDescription
0Reserved for future use
1Start DFUC4Initiate the firmware update procedure. The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the request Op Code 0x01 and the appropriate Response Value.
2Initialize DFU ParametersC5Prepare to receive init packets. The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the request Op Code 0x02 and the appropriate Response Value.
3Receive Firmware ImagePrepare to receive the firmware data. The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the request Op Code 0x03 and the appropriate Response Value.
4Validate FirmwareValidate the received firmware. The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the appropriate Response Value.
5Activate Image and ResetActivate the previously received image and perform a system reset. There is no response to this Op Code.
6Reset SystemPerform a system reset. There is no response to this Op Code.
7Report Received Image SizeRequest the DFU target to report the total number of bytes of firmware data received (excluding the start data and init data). The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the request Op Code 0x07, the appropriate Response Value, and the number of bytes in the Response Parameter.
8Packet Receipt Notification RequestC1Request the DFU target to enable/disable notifications of the control point characteristic each time the specified number of packets containing firmware data has been received. There is no response to this Op Code.
16Response CodeC2The Response Code is followed by the Request Op Code, the Response Value, and optionally the Response Parameter.
17Packet Receipt NotificationC3A notification sent by the DFU target indicating that a new set of the preconfigured number of firmware data packets has been received.
9-15Reserved for future use
18-255Reserved for future use
Number of Packets
Information: Parameter value for the Packet Receipt Notification Request Op Code
C1 uint16 Number of packets of firmware data to be received by the DFU target before sending a new Packet Receipt Notification (control point notification with Op Code = 7). If this value is 0, the packet receipt notification will be disabled by the DFU target.
Request Op Code
Information: Parameter value for the Response Code Op Code
C2 uint8 Refer to the Op Code table above for additional information on the possible values for this field.
Response Value
Information: C2: This field is mandatory for the Response Code Op Code. Otherwise, this field is excluded.
C2 uint8 Enumerations:
KeyValueDescription
0Reserved for future use
1SuccessResponse for successful operation.
2Invalid StateThe DFU controller has performed an operation that is not valid in the current state of the firmware update process.
3Not SupportedThe previous operation performed by the DFU controller or the data sent by the DFU controller is not supported.
4Data Size Exceeds LimitThe DFU controller is trying to send more firmware data than expected.
5CRC ErrorA CRC error has occurred. This Response Value is used only by the Validate Firmware procedure.
6Operation FailedResponse if the requested procedure failed.
7-255Reserved for future use
Response Parameter
Information: C2: This field is optional for the Response Code Op Code. Otherwise, this field is excluded.
C2 variable Note: The Response Parameter of the response to the control point is a variable length field to allow a list of different values defined by the service specification.
Number of Bytes of Firmware Image Received
Information: C3: This field is present if the Op Code is 0x11 (Packet Receipt Notification).
C3 uint32 Number of bytes of firmware data (excluding the start and init data) received by the DFU target at the given point of time.
DFU Image Type
Information: C4: This field is present if the Op Code is 0x01 (Start DFU). This field is parsed as bit field where each bit that is set indicates the image transferred for the requested DFU.
C4 uint8 Enumerations:
KeyValueDescription
0x00No ImageNo image will be updated.
0x01SoftDeviceA SoftDevice image will be transferred.
0x02BootloaderA bootloader image will be transferred.
0x03SoftDevice BootloaderA SoftDevice with Bootloader image will be transferred.
0x04ApplicationAn application image will be transferred.
0x05-0x07Other image combinationsCurrently not supported.
0x08-0xFFReserved for future use
DFU Init Packet
Information: C5: This field is present if the Op Code is 0x02 (Initialize DFU Parameters).
C5 uint8 Enumerations:
KeyValueDescription
0x00Receive Init PacketReady to receive the DFU init packet.
0x01Init Packet CompleteTransmission of the DFU init packet is complete.
(Minimum and maximum values are not applicable.)

General error handling procedures

If an Op Code is written to the DFU Control Point characteristic and the Client Characteristic Configuration Descriptors of either or both of the DFU Control Point or the DFU Status Report are not configured for notifications, the DFU target will return an error response. The Attribute Protocol Application error code of this response will be set to "Client Characteristic Configuration Descriptor Improperly Configured" (as defined in CSS Part B, Section 1.2 of Supplement to the Bluetooth Core Specification, Version 3 or later).