BLG20x gateway firmware, datasheet (PDF)
Three pages to read away from the screen or send on: what it does, how it works, how it is tested, and the specifications.
Two processors, one gateway
The radio half listens, remembers, and sends over Wi-Fi where it can. The wide-area half chooses the mobile uplink and delivers. One serial link joins them and carries records, commands and the radio half’s updates.
Both halves run Zephyr behind their own MCUboot, and the link between them is framed with a sequence number and a CRC-16, with a heartbeat every second. If the link drops, both keep working and the store keeps filling.
Edge processing, and what each uplink carries
The radio half is an nRF54LM20B, the Edge AI processor of the pair, and it is where data is reduced before anything is sent: per-device state, rules with hysteresis and hold, alerts and digests. The gateway sends the decision, not the data, which is what makes a satellite link of a few kilobytes a month usable.The bearer ladder
The ladder is discovered at boot from the SIM, the silicon and the modem firmware. The unit falls to a lower rung after three failed attaches, or when a budget is spent or a rung is removed, and returns to a cheaper one on a schedule: every six hours by default, set per relay. Satellite needs the satellite edition, Nordic’s NB-NTN modem firmware, an NB-NTN SIM and a position set at commissioning.
A rung is removed for a stated reason, never silently: no access on the SIM, silicon unsupported, modem firmware without satellite, no satellite subscription, disallowed by configuration, locked network absent, or roaming refused.
Deployment class
The class is set at commissioning and fixes the transport and the encoding for the life of the record store: a record written on LTE-M has to be sendable unchanged over satellite.
What reaches your platform
Sizes are in protobuf, measured. CBOR is also supported. Records are confirmable: they leave the gateway only when your platform acknowledges them.
A satellite datagram is 128 B, the largest the satellite uplink accepts: 46 B of CoAP header, token and path, 53 B of payload carrying one status and two alerts, and 29 B of headroom. One real datagram was sent and acknowledged over a geostationary NB-NTN service on 13 September 2026.
Devices, access and records
Commissioning, in five steps
1
Connect
Pair over LE Secure Connections, from Adsum IoT Coder or a phone’s browser. A new device pairs only after a 3-second button hold.
2
Position
The phone’s fix, typed, or surveyed, with its uncertainty.
3
Credentials
Name the unit and give it its data platform token.
4
Commission
Class, network policy, rules and expected devices.
5
Verify
Read the unit back and compare it field by field.
Updates over the air, and recovery
Updates arrive over Bluetooth at the desk, both processors from Adsum IoT Coder or the commissioning page with every setting kept, and over LTE-M and NB-IoT in the field, so a security fix or a new feature reaches the relay with no site visit. Images are signed, for both halves, with a test boot that confirms behind a health gate and rolls back automatically if it does not. Over the mobile network the radio half is updated through the wide-area half. An update never travels over satellite: it waits for a cellular uplink, so the satellite allowance is never spent on firmware. A relay claimed with your computer’s key takes images from no one else. Measured on the hardware: both processors over Bluetooth in 337 seconds; 409 kB downloaded over LTE-M in 129 seconds, swapped, tested and confirmed.Tested to prove it
Industrial grade is a claim about tests, so these are the tests the firmware goes through on the real board, not in a simulator. A version you customise goes through them again.Reliability: does it keep working?
FunctionEvery feature, end to end, on every release, across a library of Bluetooth devices, SIMs and networks.
FailoverEach uplink lost and recovered, LTE-M to NB-IoT to satellite and back; SIM, network and roaming refusals.
StressThe full device list, floods of Bluetooth traffic, bursts of alerts, a full store, weak and patchy signal.
DurabilitySoak runs for days; thousands of power cycles, cold boots and brown-outs; flash wear; memory watched for leaks.
Fault injectionPower cut mid-write and mid-update, a corrupted image, a bad configuration, a stalled processor. It must recover alone.
UpdatesEvery release applied over the air from the last one, interrupted, resumed, confirmed, and rolled back.
Security: can it be broken into?
Boot and updateOnly signed images start. Tampered, unsigned and downgraded images are refused.
HardeningDebug ports locked in production; no open shell, no default password, no secret left in the image; keys in secure storage.
BluetoothPairing, replay and man-in-the-middle attacks; unauthenticated writes refused; a flood cannot fill the store.
NetworkEncrypted transport checked; malformed, oversized, replayed and spoofed messages refused.
Fuzzing, pen testMalformed data thrown at every input for hours; static analysis; a penetration test of each major release.
Supply chainA software bill of materials (SBOM) from the real build, scanned against known vulnerabilities on every release.
CRA readiness
Security fixes are free for five years from each licence’s first download: the support period the EU Cyber Resilience Act asks of a manufacturer. Every production licence includes the evidence pack: the certificate, the test report, an SBOM in SPDX for each build, the advisory register and VEX, with the secure-by-design posture the CRA readiness check reports and the update, roll-back and vulnerability-handling behaviour described on this page. The demo carries none of it. Licences are per relay at www.adsumnetworks.com.The hardware, from Fanstel
Hardware facts are Fanstel’s, from fanstel.com and the schematic Fanstel publishes for the BLG20. The BLG20 comes in several models, so check the one you order.
Flash, read from the shipped images
What this version does not do
- The evidence pack comes with the production licence, not with this demo version. See CRA readiness.
- The modem firmware is installed before deployment and cannot be updated in the field.
- No GNSS fix: the BLG20x’s position is set at commissioning. For a relay that finds its own, see the LBG20x.
- Evaluation images carry no production signing keys yet, so no security claim is published for them.
- Radio, capacity and power figures are published for the shipping configuration once it is confirmed.
Figures were measured on the evaluation configuration, a BLG20XE02C-V1 board.
The BLG20x
The board, the firmware, and every way to have it.
The first run, step by step
Flash both halves, commission, and see readings on your platform.
Datasheet (PDF)
Three pages, for reading away from the screen.
Satellite IoT: NB-NTN
What a satellite link is good for, and what it costs.