Units update over the air. They check periodically, and install a new release when one is published for their model.
- Every image is signed, and a unit refuses one whose signature doesn't verify — so a compromised network can't install its own firmware on your hardware.
- Releases roll out gradually rather than to the whole fleet at once.
- Cellular units update over their own cellular connection — no store Wi-Fi, and nothing for you to configure. It costs about a cent of data per unit, which is the right trade: shipping a safety fix must never depend on someone visiting every site.
- An update that doesn't work undoes itself. A new build has to prove it can read its sensor and reach the network before it is kept; if it can't, the unit returns to the previous version on its own.
Nothing is required of you. A unit that updates stays paired, keeps its history, and keeps its store assignment.
While an update installs, the unit shows UPDATING on screen. If it fails at any point — a dropped connection, a bad download — nothing is installed and the unit carries straight on measuring. An update that installs but cannot then read its sensor or reach the network removes itself and the unit returns to the version it was running.