When you use serial (HCI) transport to send Device Firmware Updates, there are four different types of packets that you must send to the DFU bootloader in sequence:

One start packet to initiate the firmware update procedure.
One init packets that is used to safety-check the new image.
Any number of data packets that contain the new image.
One stop packet to notify the bootloader that the transfer has completed and the image should be activated.

Start packet

The first packet that the DFU bootloader must receive is the start packet. This packet informs the DFU bootloader about the kind of update and the length of the binary image. The length of the image is sent as an unsigned 32-bit integer in LSB first order.

The following table gives an example of a DFU start packet. Values in italics are example values and will be different for your update.

Value	Description
0xC0	SLIP start/stop
0xD1 0x4E 0x01 0xE0	Packet header
0x03 0x00 0x00 0x00	DFU bootloader start packet
0x04 0x00 0x00 0x00	Type of the image to be transferred (0x04 for an application image)
0x00 0x00 0x00 0x00	Length of the new SoftDevice image, or 0 if no SoftDevice image is transferred
0x00 0x00 0x00 0x00	Length of the new bootloader image, or 0 if no bootloader image is transferred
0x0C 0x5D 0x00 0x00	Length of the new application image, or 0 if no application image is transferred
0xC6 0xFC	CRC check
0xC0	SLIP start/stop

The following values can be used to define the type of the image:

Value	Image type
0x01	SoftDevice
0x02	Bootloader
0x03	Combined SoftDevice and bootloader
0x04	Application

Init packet

The init packet contains information about the application that is transferred. The DFU bootloader checks this information to determine if the image is valid for the device. If it is, it prepares (erases) the flash memory to accommodate the new image.

The following table gives an example of a DFU init packet. Values in italics are example values and will be different for your update.

Value	Description
0xC0	SLIP start/stop
0xDA 0x4E 0x01 0xD7	Packet header
0x01 0x00 0x00 0x00	DFU bootloader init packet
0xFF 0xFF	Device type
0xFF 0xFF	Device revision
0xFF 0xFF 0xFF 0xFF	Application version
0x01 0x00	Length of the list of valid SoftDevices
0xFE 0xFF	List of valid SoftDevices
0xCA 0x2C	CRC of the image that will be transferred
0x00 0x00	Filler
0x7E 0xBD	CRC check
0xC0	SLIP start/stop

Data packet

Data packets contain the actual image that is transferred. The maximum size of a data packet is 512 bytes + header.

The following table gives an example of a DFU data packet. Values in italics are example values and will be different for your update.

Value	Description
0xC0	SLIP start/stop
0xE3 0x4E 0x20 0xAF	Packet header
0x04 0x00 0x00 0x00	DFU bootloader data packet
0xA8 0x2F 0x00 0x20 ...	Image data, max. 512 bytes
0x51 0xC7	CRC check
0xC0	SLIP start/stop

Stop packet

When the new image has been transferred to the nRF51 IC, the image must be copied and activated. The stop packet informs the DFU bootloader that the image has been transferred completely and can now be activated.

The following table gives an example of a DFU data packet. Values in italics are example values and will be different for your update.

Value	Description
0xC0	SLIP start/stop
0xC8 0x4E 0x00 0xEA	Packet header
0x05 0x00 0x00 0x00	DFU bootloader stop packet
0x36 0x0A	CRC check
0xC0	SLIP start/stop

Packet header

See the Bluetooth Core Specification (Volume 4, Part D, Chapter 4) for detailed information about the packet header.

The following figure illustrates the packet header for the example Start packet:

Packet header