> ## Documentation Index
> Fetch the complete documentation index at: https://docs.adsumnetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# LBG20x gateway firmware specification

> What the Adsum firmware for the Fanstel LBG20x does: two processors, its own GNSS position, edge processing, the uplink order, record sizes, updates over Bluetooth and the air, recovery, the reliability and security tests, and the hardware.

The reference for the firmware on the [LBG20x](/supported-hardware/fanstel/lbg20x): what runs on each processor, how it finds its position, how it chooses an uplink, what reaches your platform and what it costs, how it is updated and tested, and what this version does not do. It is the BLG20x firmware built for this board, so the [BLG20x specification](/supported-hardware/fanstel/blg20x-specification) holds wherever this page does not say otherwise.

<div className="adsum-byline">
  <span>Board <b>Fanstel LBG20BC02C, mainboard LBG-MB-V2</b></span>
  <span>Built with <b>nRF Connect SDK v3.4.0, Zephyr</b></span>
  <span>Measured and verified by <b>Adsum Networks, October 2026</b></span>
</div>

<Card title="LBG20x gateway firmware, datasheet (PDF)" icon="file-pdf" href="https://www.adsumnetworks.com/datasheets/LBG20x-NTN-Relay-Firmware-Datasheet.pdf" horizontal>
  Three pages to read away from the screen or send on: what it does, how it works, how it is tested, and the specifications.
</Card>

## Two processors, one relay, one position

The radio half listens, remembers, and sends over Wi-Fi where it can. The wide-area half takes the relay's own GNSS fix, chooses the mobile uplink and delivers. One serial link joins them and carries records, commands and the radio half's updates.

| | Radio half | Wide-area half |
| :- | :- | :- |
| **Processor** | nRF54LM20B, in a Fanstel BM20BC module | nRF9151 |
| **Radios** | Bluetooth LE, passive and active scanning, central and peripheral; Wi-Fi 6 through the nRF7002 on the LBG20BC02C | LTE-M, NB-IoT, satellite NB-NTN; GNSS (GPS and QZSS) |
| **Owns** | Scanning, access rules, per-device state and rules, the record store, the Wi-Fi uplink, commissioning, the cue light and the motion sensor | The bearer ladder, the byte governor, encoding, time and sequence, the GNSS fix, the update client |
| **Storage** | 1.4 MB external flash for the record store | Its own application and bootloader slots |
| **Talks to** | Adsum IoT Coder or the commissioning page, over Bluetooth; your platform, over Wi-Fi | Your data platform, and device management |

Both halves run Zephyr behind their own MCUboot, with TF-M on the cellular one, and the link between them is framed with a sequence number and a CRC-16, with a heartbeat every second. If the link drops, both keep working and the store keeps filling.

## Its own position

A satellite link times itself from the relay's position, so a relay that moves can lose the satellite. The LBG20x measures its own:

| | |
| :- | :- |
| **When** | At commissioning, when your platform asks, and when the motion sensor says the relay has moved |
| **How** | The cellular radio pauses for the fix, at the top of the next cycle, never inside an uplink |
| **When it stops** | At a fix of 10 m or better, 30 s after the first fix (the best is kept), or at the end of the window |
| **Windows** | Two minutes at commissioning; with no fix, five more minutes are offered once. Advanced commissioning allows 1 to 15 minutes and a cold start |
| **Kept as** | The relay's position, with the fix's accuracy as its uncertainty (5 m at best), shared with the cellular half and used by the satellite uplink |
| **Fallback** | A phone's position, or one typed in, always offered beside the fix, for a site where the sky is hidden |
| **Measured** | Warm, 37 s at 8 m. Cold, 60 s, 106 s and 182 s, at 9 to 10 m |

## Edge processing, and what each uplink carries

The radio half is an nRF54LM20B, the Edge AI processor of the pair, and it is where data is reduced before anything is sent: per-device state, rules with hysteresis and hold, alerts and digests. **The relay sends the decision, not the data**, which is what makes a satellite link of a few kilobytes a month usable.

| Uplink | What leaves the relay | Size |
| :- | :- | :- |
| **Wi-Fi, LTE-M, NB-IoT** | Digests per device, alerts, status and a daily health record | About 1 kB per cycle |
| **Satellite NB-NTN** | Alerts and status only. Everything else waits in flash for a cheaper uplink | One 128 B datagram |

## The bearer ladder

| Rung | Bearer | When |
| :- | :- | :- |
| 1 | **Wi-Fi** | On the LBG20BC02C, where a network is set: 2.4 GHz, WPA2 or WPA3. Free, so first |
| 2 | **LTE-M** | The cheapest cellular, tried first |
| 3 | **NB-IoT** | Narrowband cellular |
| 4 | **Satellite NB-NTN** | The last resort, when nothing terrestrial is in reach |

The relay falls to a lower rung after three failed attaches, with a stated reason, or when a budget is spent or a rung is removed, and returns to a cheaper one every six hours by default, set per relay. Satellite needs the satellite edition, Nordic's NB-NTN modem firmware, an NB-NTN SIM and a position. The deployment classes, terrestrial, satellite and both, are the [BLG20x's](/supported-hardware/fanstel/blg20x-specification#deployment-class).

## What reaches your platform

The records are the BLG20x firmware's: a 52 B digest per device per window, a 13 B alert, a 30 B status, and a 76 B daily health record, up to eight records in one confirmable send of about 1 kB. Sizes are in protobuf; CBOR is also supported, and MQTT with or without TLS off satellite.

**A satellite datagram is 128 B at most.** One real datagram carried 46 B of transport and 40 B of payload, one status and one alert, with 42 B of headroom: sent over a geostationary NB-NTN service on 9 October 2026, on the relay's own GNSS position, and acknowledged by the platform with 2.01. Registration on the satellite took 117 to 122 s.

## Devices, access and records

| | |
| :- | :- |
| **Access rules** | Up to 32 ordered rules, each ending in drop, count or quarantine |
| **Expected devices** | A list of up to 128, named before they are heard, each admitted on its own |
| **Connected devices** | Three at once |
| **State and rules** | Per device, with hysteresis and hold, so an alert is raised once rather than flapping |
| **Record store** | 1.4 MB of external flash, released only on acknowledgement; alarms are never overwritten, and every dropped record is counted |
| **Time** | 64-bit timestamps, and a relay sequence that survives reboots |

## Commissioning, and the buttons

<Steps>
  <Step title="Open the window">Hold DFU1 for 3 to 8 seconds. A new device pairs only after this hold.</Step>
  <Step title="Connect">Pair over LE Secure Connections, from Adsum IoT Coder or a phone's browser.</Step>
  <Step title="Position">The relay's own GNSS fix, or a phone's, or typed in, with its uncertainty.</Step>
  <Step title="Commission">Name and credential, Wi-Fi, the mobile network and the class, the platform, the expected devices.</Step>
  <Step title="Verify">Read the unit back and compare it field by field.</Step>
</Steps>

| Button | What it does |
| :- | :- |
| **DFU1, a tap** | Identify: the relay flashes twice |
| **DFU1, held 3 to 8 s** | Opens the commissioning window |
| **DFU1, held 10 s** | Factory reset |
| **DFU1, held at power-on** | Self-test, with its verdict on the Bluetooth light: green three times passed, red twice means the cellular half's facts are missing |

DFU1 reaches both processors, so a press both report within two seconds counts once.

### The cue light

The LBG20x has no sounder. A light plays the BLG20x's sounds as flashes, and every cue also shows on the front lights:

| Flash | Meaning |
| :- | :- |
| **Short** | A write accepted |
| **Long** | A write refused |
| **Three** | Commissioned |
| **Two** | Identify |
| **Three, then a minute steady** | The first data sent: you can leave |

The relay lights it once at power-on, as a lamp test.

## Updates, and recovery

Updates arrive **over Bluetooth** at the desk, both processors from Adsum IoT Coder or the commissioning page with every setting kept, and **over LTE-M and NB-IoT** in the field. Images are signed, with a test boot that confirms behind a health gate and rolls back by itself if it does not. An update never travels over satellite. A relay claimed with your computer's key takes images from no one else. Measured on the unit, 11 October 2026: both processors over Bluetooth, 947 kB in 101 seconds and 450 kB in 132 seconds.

Recovery is the BLG20x firmware's: a hung processor is rebooted by its watchdog and the cause reported; a dropped link between the halves stops neither; an update that does not confirm is undone at the next boot; a configuration that fails three boots is rolled back and reported; acknowledged records are already in flash when power is lost.

## Tested to prove it

Industrial grade is a claim about tests, so these are the tests the firmware goes through on the real board, not in a simulator. A version you customise goes through them again.

### Reliability: does it keep working?

<div className="adsum-fig">
  <div className="adsum-lanes">
    <div className="adsum-lane"><b>Function</b><span>Every feature, end to end, on every release, across Bluetooth devices, SIMs and networks; GNSS with and without sky.</span></div>
    <div className="adsum-lane"><b>Failover</b><span>Each uplink lost and recovered, LTE-M to NB-IoT to satellite and back; SIM, network and roaming refusals.</span></div>
    <div className="adsum-lane"><b>Stress</b><span>The full device list, floods of Bluetooth traffic, bursts of alerts, a full store, weak and patchy signal.</span></div>
    <div className="adsum-lane"><b>Durability</b><span>Soak runs for days; thousands of power cycles, cold boots and brown-outs; flash wear; memory watched for leaks.</span></div>
    <div className="adsum-lane"><b>Fault injection</b><span>Power cut mid-write and mid-update, a corrupted image, a bad configuration, a stalled processor. It must recover alone.</span></div>
    <div className="adsum-lane"><b>Updates</b><span>Every release applied over the air from the last one, interrupted, resumed, confirmed, and rolled back.</span></div>
  </div>
</div>

### Security: can it be broken into?

<div className="adsum-fig">
  <div className="adsum-lanes">
    <div className="adsum-lane"><b>Boot and update</b><span>Only signed images start. Tampered, unsigned and downgraded images are refused.</span></div>
    <div className="adsum-lane"><b>Hardening</b><span>Debug ports locked in production; no open shell, no default password, no secret left in the image; keys in secure storage.</span></div>
    <div className="adsum-lane"><b>Bluetooth</b><span>Pairing, replay and man-in-the-middle attacks; unauthenticated writes refused; a flood cannot fill the store.</span></div>
    <div className="adsum-lane"><b>Network</b><span>Encrypted transport checked; malformed, oversized, replayed and spoofed messages refused.</span></div>
    <div className="adsum-lane"><b>Fuzzing, pen test</b><span>Malformed data thrown at every input for hours; static analysis; a penetration test of each major release.</span></div>
    <div className="adsum-lane"><b>Supply chain</b><span>A software bill of materials (SBOM) from the real build, scanned against known vulnerabilities on every release.</span></div>
  </div>
</div>

Radio type approval and electromagnetic compliance belong to the hardware and to Fanstel, model by model.

## CRA readiness

**Security fixes are free for five years** from each licence's first download: the support period the EU Cyber Resilience Act asks of a manufacturer. **Every production licence includes the evidence pack**: the certificate, the test report, an SBOM in SPDX for each build, the advisory register and VEX, with the secure-by-design posture the [CRA readiness check](/cra-readiness) reports. The demo carries none of it. Licences are per relay at [www.adsumnetworks.com](https://www.adsumnetworks.com/licensing/).

## The hardware, from Fanstel

| | |
| :- | :- |
| **Models** | LBG20BC and LBG20BC02C: one image, the Wi-Fi found at boot. The LBG20BXE and the LoRa models: next |
| **Cellular and satellite** | Nordic nRF9151: LTE-M and NB-IoT (Release 14), 23 dBm; NB-NTN (Release 17) with Nordic's NTN modem firmware |
| **GNSS and antennas** | GPS and QZSS L1 C/A; the LTE antenna inside or on SMA; the GNSS antenna on u.FL |
| **Bluetooth and Edge AI** | Fanstel BM20BC module on the Nordic nRF54LM20B, Bluetooth 6.0: Cortex-M33 at 128 MHz, 2036 KB RRAM, 512 KB RAM, and an Axon NPU for edge AI |
| **Wi-Fi and LoRa** | nRF7002 on the BC02C: Wi-Fi 6, 2.4 and 5 GHz. LoRa (LR2021) in its place on the BC21EE |
| **Power and sensors** | USB-C (power) or M12; an nPM1300 charger, an optional 18650 cell, solar ready; a 3-axis motion sensor |
| **Enclosure and climate** | IP67; 107 × 141 × 40 mm with a wall-mount bracket; −40 to +85 °C |
| **Certifications** | Fanstel's, model by model; Fanstel designs, makes and sells it: [fanstel.com](https://www.fanstel.com/lbg51e20c) |

Hardware facts are Fanstel's, from its product specification (draft 0.90, September 2026). The LBG20 comes in several models, so check the one you order.

## What this version does not do

* **Battery and charging** are next: the nPM1300's charger status and the battery level, on your platform.
* **Tamper and orientation** are next, from the motion sensor, which already wakes a fix when the relay moves.
* **LoRa** is next, once its M.2 card is available.
* **No USB data on the mainboard V2.** Its USB-C carries power only, so claiming and updating go over Bluetooth.
* **The modem firmware** is installed before deployment and cannot be updated in the field.
* **The evidence pack** comes with the production licence, not with the demo.

<Note>
  Figures were measured on the evaluation configuration, an LBG20BC02C with the mainboard LBG-MB-V2. Features marked next are in development.
</Note>

<CardGroup cols={2}>
  <Card title="The LBG20x" icon="microchip" href="/supported-hardware/fanstel/lbg20x">
    The relay, the firmware, and every way to have it.
  </Card>

  <Card title="The first run, step by step" icon="route" href="/supported-hardware/fanstel/lbg20x-first-run">
    Pair, claim, commission, and see readings on your platform.
  </Card>

  <Card title="Datasheet (PDF)" icon="file-pdf" href="https://www.adsumnetworks.com/datasheets/LBG20x-NTN-Relay-Firmware-Datasheet.pdf">
    Three pages, for reading away from the screen.
  </Card>

  <Card title="Satellite IoT: NB-NTN" icon="satellite" href="/satellite-ntn">
    What a satellite link is good for, and what it costs.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.