Thermal Conditions During OTA: Hold Installation Without Creating an Endless Retry Loop

Put an update into a visible thermal hold when the required operating conditions are not established. Release that hold only after fresh, correctly mapped temperature evidence satisfies the product’s qualified recovery rule. Bound the waiting period so an installation cannot cycle forever between “retrying” and “too hot.”

This article defines an original updater eligibility state machine, using Linux 6.12 thermal telemetry as the concrete interface. It provides no universal temperature limit. Actual component datasheets, sensor placement, enclosure behavior and measured update workload must establish the deployed thresholds and margins.

1. Map the reading to the component at risk

A CPU temperature is not automatically the temperature of an external flash package, battery or regulator. Identify which component limits constrain the installation and how each monitored zone relates to them. If the relationship is indirect, qualify its uncertainty and response lag.

The Linux 6.12 thermal interface exposes thermal-zone type, current temperature, trip points and associated cooling devices. Those objects provide observations and thermal-management context; they do not define the updater’s component-specific programming limits.

Bind the observation to the verified zone identity rather than assuming the first numbered directory always represents the same sensor. Record the driver, board revision, mapping and whether the reading is fresh enough for the intended admission decision.

The pinned thermal sysfs ABI defines the thermal-zone temp value in millidegrees Celsius. Keep that distinct from interfaces that use other units. Reject unavailable or failed reads as unknown; zero can be a real temperature and must not double as an error marker.

2. Define two thresholds and one dwell rule

Let Thold be the qualified upper threshold that blocks a new installation, and Trelease a lower threshold required to leave a thermal hold. Let Tdwell be the required continuous qualifying interval. These symbols stand for product evidence, not recommended numeric values.

Start in HOLD or UNKNOWN until eligibility is established. When valid readings remain at or below Trelease for Tdwell, transition to READY. A valid reading at or above Thold returns READY to HOLD. Between the thresholds, retain the existing hysteresis state rather than toggling at every small change.

Any other required operating limit still applies, including a lower temperature limit where relevant. Hysteresis around an upper limit cannot make an out-of-range cold component eligible.

Current condition	State decision	Evidence to preserve
Unknown, stale or failed sensor reading.	UNKNOWN; clear the qualifying dwell.	Read failure, age or mapping reason.
At or above Thold before admission.	HOLD; do not begin installation.	Fresh observation and policy revision.
Held, now at or below Trelease.	Begin or continue qualifying dwell.	Continuous valid observation interval.
Dwell interrupted or sampling gap too large.	Remain held and restart qualification.	Gap or excursion, without extending the campaign deadline.
All limits and dwell satisfied.	READY for a final admission recheck.	Current evidence generation.

Define the permitted sample gap and the time source. Two cool readings separated by an unobserved interval do not prove continuous cooling. A sensor reset or mapping change invalidates the old dwell evidence.

3. Keep the deadline independent of cooling progress

Set a maximum permitted deferral interval or an existing campaign expiry according to product policy. A brief cool sample, reconnect or application restart must not automatically grant a new full waiting period.

When the deadline is reached, report a terminal or explicitly renewed state such as “deferred pending operator decision.” Do not mark the update installed, and do not keep silently restarting the same attempt. Preserve the artifact identity and the reason it never became eligible.

Choose bounded rechecks triggered by meaningful thermal events or a qualified timer. Polling faster than the sensor or platform refreshes adds work without necessarily adding information. A tight retry loop can also increase the workload while the product is trying to cool.

Retain a staged verified artifact when policy permits. Repeated download, decompression or hash preparation should not be used as a cooling timer. If those activities materially affect temperature, include them in the stage-specific thermal plan.

4. Keep admission separate from emergency protection

An updater’s READY state permits entry into a qualified operation; it does not replace the platform’s thermal governor, shutdown protection or hardware limits. Do not disable cooling, raise critical trips or write emulated temperatures to make an update pass.

Recheck the evidence immediately before the last safely deferrable boundary. If the operation has already become noninterruptible, follow the product’s qualified completion or recovery behavior. A thermal hold rule for new admissions is not authority to terminate an active flash write arbitrarily.

The kernel interface includes controls as well as observations. Keep this workflow read-only. Thermal emulation and trip-point changes require a separately reviewed lab plan and are unnecessary for testing the application’s decision logic.

5. Use synthetic observations before heating hardware

1. Provide a fresh sequence entirely above Thold and verify bounded deferral.
2. Cross below Trelease briefly, then rise before Tdwell; require continued hold.
3. Remain between the thresholds and verify state-dependent hysteresis.
4. Insert an invalid read or excessive sampling gap during the cool dwell.
5. Change the sensor identity or reset its acquisition generation.
6. Expire the campaign while cooling and verify no later stale callback starts installation.
7. Reach READY, then become ineligible before final admission.

These are proposed software fixtures, not executed tests. Their oracle should compare state, dwell origin, deadline and reason code after each event. Use abstract temperatures relative to the policy thresholds so the fixture does not pretend to certify an actual component.

Later environmental qualification needs approved test equipment, the real enclosure, known-safe loads and the exact update path. Preserve component limits and measurement uncertainty. Deliberately overheating a production device is not a useful substitute for that controlled procedure.

6. Explain a persistent hold honestly

Report the relevant observation age, zone identity, bounded temperature category, admission state and remaining authorization. Distinguish a genuinely hot product from missing evidence or an incorrectly mapped sensor. Avoid exposing unnecessary device-specific information in routine campaign logs.

In a hypothetical enclosed gateway, temperature drops below Trelease for one sample but rises again before the required dwell completes. The updater stays held. After the allowed deferral interval ends, it requests a reviewed disposition rather than repeatedly declaring the next retry imminent.

The engineering result is a thermal-admission contract with stable states and a finite outcome. Its thresholds remain tied to actual hardware evidence, while the software tests establish that uncertainty, oscillation and expired permission cannot silently become installation approval.