The Device Firmware Update (DFU) Service exposes necessary information to perform Device Firmware Updates on the device. This service is not a service defined by the Bluetooth SIG, but a proprietary service defined by Nordic Semiconductor to demonstrate a typical Device Firmware Update on an nRF51 device.

The DFU Service does not depend on any other services. Support for the following GATT sub-procedures is mandatory for this service:

Write Characteristic Value
Notifications
Read Characteristic Descriptors
Write Characteristic Descriptors

The DFU GATT Service can operate only on Bluetooth low energy as transport.

The DFU Service does not define any new error codes for the Attribute Protocol. Data exchange is in little endian (LSB first) order.

This service is instantiated as a primary service in DFU mode.

Proprietary service UUID

The assigned service UUID is 0x1531 over proprietary base. See the following table for Nordic Semiconductor's UUID:

Description	Number base
Company identifier:	0x0059
UUID base:	0x23, 0xD1, 0xBC, 0xEA, 0x5F, 0x78, 0x23, 0x15, 0xDE, 0xEF, 0x12, 0x12, 0x00, 0x00, 0x00, 0x00
Service UUID start:	0x1530
Characteristic UUID start:	0x1531

Service characteristics

The DFU Service exposes one instance of the characteristics listed in the following table. The service does not impose any security requirements.

Characteristic name	Requirement	Mandatory properties	Description
DFU Packet	M	WriteWithoutResponse	See DFU Packet.
DFU Control Point	M	Write, Notify	See DFU Control Point.

DFU Packet

The UUID of the DFU Packet characteristic is 0x1532 over proprietary base.

This characteristic receives data for Device Firmware Updates as DFU packets. DFU packets can contain different types of data, depending to the Op Code that is written to the DFU Control Point before the DFU packet is transmitted.

The size of each packet must be between 1 and (ATT_MTU - 3) octets. Packets must be in little endian (LSB first) order.

The following table defines the format for a DFU packet:

Names	Field requirement	Format	Additional information
DFU Packet	Mandatory	uint8	This field may be repeated up to a maximum of 20 times, which means that the maximum length of this characteristic is 20 bytes.

(Minimum and maximum values are not applicable.)

Image size

After writing "Start DFU" (0x01) to the DFU Control Point, you must write the image size to the DFU Packet characteristic.

The image size must be written in the following format:

All lengths must be uint32. If a length is not present (for example, if only the SoftDevice is updated), the length should be given as 0. For example:

<Length of SoftDevice> 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Init packet

After writing "Initialize DFU Parameters" (0x02) to the DFU Control Point, you must write an init packet to the DFU Packet characteristic.

See Safety-checking the image for information about the format of the init packet.

Image data

After writing "Receive Firmware Image" (0x03) to the DFU Control Point, you must write packets containing image data to the DFU Packet characteristic.

The firmware image can be split up in multiple DFU packets. The full image is transferred by writing each fragment as DFU packet to the DFU Packet characteristic.

DFU Control Point

The UUID of the DFU Control Point characteristic is 0x1531 over proprietary base.

The DFU Control Point characteristic is used to control the state of the Device Firmware Update process. All DFU procedures are requested by writing to this characteristic. A response that marks the end of the procedure is received as a notification.

The following table shows control point procedure operation codes and the respective parameters:

Names

Field requirement

Format

Additional information

Op Code

Mandatory

uint8

Enumerations:

Key	Value	Requirement	Description
0	Reserved for future use
1	Start DFU	C4	Initiate the firmware update procedure. The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the request Op Code 0x01 and the appropriate Response Value.
2	Initialize DFU Parameters	C5	Prepare to receive init packets. The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the request Op Code 0x02 and the appropriate Response Value.
3	Receive Firmware Image		Prepare to receive the firmware data. The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the request Op Code 0x03 and the appropriate Response Value.
4	Validate Firmware		Validate the received firmware. The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the appropriate Response Value.
5	Activate Image and Reset		Activate the previously received image and perform a system reset. There is no response to this Op Code.
6	Reset System		Perform a system reset. There is no response to this Op Code.
7	Report Received Image Size		Request the DFU target to report the total number of bytes of firmware data received (excluding the start data and init data). The response to this Op Code is a notification of the control point with Op Code 0x10, followed by the request Op Code 0x07, the appropriate Response Value, and the number of bytes in the Response Parameter.
8	Packet Receipt Notification Request	C1	Request the DFU target to enable/disable notifications of the control point characteristic each time the specified number of packets containing firmware data has been received. There is no response to this Op Code.
16	Response Code	C2	The Response Code is followed by the Request Op Code, the Response Value, and optionally the Response Parameter.
17	Packet Receipt Notification	C3	A notification sent by the DFU target indicating that a new set of the preconfigured number of firmware data packets has been received.
9-15	Reserved for future use
18-255	Reserved for future use

Number of Packets
Information: Parameter value for the Packet Receipt Notification Request Op Code

C1

uint16

Number of packets of firmware data to be received by the DFU target before sending a new Packet Receipt Notification (control point notification with Op Code = 7). If this value is 0, the packet receipt notification will be disabled by the DFU target.

Request Op Code
Information: Parameter value for the Response Code Op Code

C2

uint8

Refer to the Op Code table above for additional information on the possible values for this field.

Response Value
Information: C2: This field is mandatory for the Response Code Op Code. Otherwise, this field is excluded.

C2

uint8

Enumerations:

Key	Value	Description
0	Reserved for future use
1	Success	Response for successful operation.
2	Invalid State	The DFU controller has performed an operation that is not valid in the current state of the firmware update process.
3	Not Supported	The previous operation performed by the DFU controller or the data sent by the DFU controller is not supported.
4	Data Size Exceeds Limit	The DFU controller is trying to send more firmware data than expected.
5	CRC Error	A CRC error has occurred. This Response Value is used only by the Validate Firmware procedure.
6	Operation Failed	Response if the requested procedure failed.
7-255	Reserved for future use

Response Parameter
Information: C2: This field is optional for the Response Code Op Code. Otherwise, this field is excluded.

C2

variable

Note: The Response Parameter of the response to the control point is a variable length field to allow a list of different values defined by the service specification.

Number of Bytes of Firmware Image Received
Information: C3: This field is present if the Op Code is 0x11 (Packet Receipt Notification).

C3

uint32

Number of bytes of firmware data (excluding the start and init data) received by the DFU target at the given point of time.

DFU Image Type
Information: C4: This field is present if the Op Code is 0x01 (Start DFU). This field is parsed as bit field where each bit that is set indicates the image transferred for the requested DFU.

C4

uint8

Enumerations:

Key	Value	Description
0x00	No Image	No image will be updated.
0x01	SoftDevice	A SoftDevice image will be transferred.
0x02	Bootloader	A bootloader image will be transferred.
0x03	SoftDevice Bootloader	A SoftDevice with Bootloader image will be transferred.
0x04	Application	An application image will be transferred.
0x05-0x07	Other image combinations	Currently not supported.
0x08-0xFF	Reserved for future use

DFU Init Packet
Information: C5: This field is present if the Op Code is 0x02 (Initialize DFU Parameters).

C5

uint8

Enumerations:

Key	Value	Description
0x00	Receive Init Packet	Ready to receive the DFU init packet.
0x01	Init Packet Complete	Transmission of the DFU init packet is complete.

(Minimum and maximum values are not applicable.)

General error handling procedures

If an Op Code is written to the DFU Control Point characteristic and the Client Characteristic Configuration Descriptors of either or both of the DFU Control Point or the DFU Status Report are not configured for notifications, the DFU target will return an error response. The Attribute Protocol Application error code of this response will be set to "Client Characteristic Configuration Descriptor Improperly Configured" (as defined in CSS Part B, Section 1.2 of Supplement to the Bluetooth Core Specification, Version 3 or later).