The scope table
- Board bring-up and BSP. What pushes it up: custom PCB, new silicon, no reference design, multiple power domains. What keeps it down: vendor reference design, familiar SoC, evaluation board first. Typical hours: 40-160 h.
- Bootloader and secure boot. What pushes it up: key management, A/B partitions, anti-rollback. What keeps it down: MCUboot on a supported platform. Typical hours: 40-120 h.
- Device drivers and sensors. What pushes it up: undocumented parts, I2C/SPI quirks, analogue front ends. What keeps it down: in-tree drivers, well-documented sensors. Typical hours: 20-60 h per sensor.
- RTOS integration. What pushes it up: first project on the stack, tight footprint. What keeps it down: team has shipped on it before. Typical hours: 40-120 h.
- BLE stack. What pushes it up: custom profiles, pairing and bonding UX, coexistence. What keeps it down: standard profiles, vendor SDK. Typical hours: 80-240 h.
- Wi-Fi stack. What pushes it up: provisioning UX, enterprise auth, power budget. What keeps it down: module with pre-integrated stack. Typical hours: 60-200 h.
- Cellular modem integration. What pushes it up: carrier certification, roaming, power-cycle edge cases. What keeps it down: pre-certified module. Typical hours: 160-400 h.
- OTA update pipeline. What pushes it up: rollback, partial updates, fleet staging. What keeps it down: platform with an SDK for your RTOS. Typical hours: 120-320 h.
- Device identity and secure provisioning. What pushes it up: HSM or secure element, factory integration, certificate injection. What keeps it down: platform-managed provisioning. Typical hours: 60-200 h.
- Production test firmware and HIL test rig. What pushes it up: high-volume line, RF calibration. What keeps it down: low volume, manual test acceptable. Typical hours: 80-240 h.
- Embedded Linux with Yocto, if applicable. What pushes it up: custom layers, licence compliance, long support window. What keeps it down: reference distribution. Typical hours: 240-800 h.
Hours include unit testing and developer documentation; they exclude certification lab time and project management.
Board bring-up: the first real cost
Board bring-up is where a project discovers what the schematic got wrong. It covers clock configuration, power sequencing, a serial console, a working debug session over JTAG/SWD, and one peripheral proving the bus works.
The single largest determinant is whether the silicon vendor publishes a reference design close to your board. With one, much of the BSP is a starting point rather than a blank page. Without one, on new silicon, it is exploratory work with an uncertain end.
With a vendor reference design (ESP32, WiseTec sensor): about 40 hours. Without one, on new silicon: about 150 hours.
Connectivity: why cellular is the expensive radio
Adding a radio adds three costs: integration, power tuning and certification. The third is the one budgets miss.
- Bluetooth Low Energy: usually the cheapest to integrate, because vendor SDKs are mature. Certification cost is the Bluetooth SIG qualification fee: USD 12,000 per product for non-members, with Contributing Adopter membership at USD 3,500-16,500 a year reducing the per-product fee.
- Wi-Fi: integration is straightforward with a pre-integrated module; the cost lands in provisioning experience and power budget.
- Cellular over LTE-M or NB-IoT: the expensive one, and not because of code. A pre-certified module makes carrier certification nearly free; without one, PTCRB certification is a project of its own. One certification consultancy publishes a range of USD 10,000 to 500,000 without a pre-certified module, and close to zero with one. That is a vendor estimate, not a published tariff, but the shape of it is right and it is the single strongest argument for choosing a certified module.
- LoRaWAN: modest integration cost; the complexity is in network server choice and regional parameters.
The rule of thumb worth stating outright: choose the pre-certified module unless there is a compelling reason not to. The BOM saving from a bare chipset is routinely smaller than the certification cost it creates.
OTA: the two-price answer
Ask what an OTA update pipeline costs and the honest answer has two numbers: what it costs to build, and what it costs to run for every device, every year, for the life of the product. Every competing article stops at the first.
The build cost covers a bootloader with A/B partitions and verified rollback, image signing tied to secure boot, a staged release process, and the back end that decides which device gets which image. MCUboot on a supported platform shortens this considerably.
The running cost is public, and worth putting in a table because almost nobody does:
- Mender: from USD 34 a month for up to 50 devices; USD 291 a month for up to 250
- Memfault: Growth from USD 3,495 a month; Scale from USD 6,695
- Golioth: USD 0.25 per connection per month; OTA at USD 0.0095 per MB
- AWS IoT Device Management: USD 0.01-0.02 per device per month for managed integrations; USD 0.10 per 1,000 registrations; USD 1.00 per secure tunnel
The consequence for a budget: at ten thousand devices the platform line can exceed the cost of building the pipeline, every year. Choose it when you choose the architecture, not after launch.
On the design itself, there is a standard rather than folklore to follow. The IETF's SUIT working group published a firmware update architecture for IoT as RFC 9019 and a manifest information model as RFC 9124. The compromise-resilient signing design most modern systems borrow from is The Update Framework, published at ACM CCS (reference) and adapted for vehicle ECUs as Uptane. A vendor who has read these will quote differently (and better) than one who has not.
Device identity and secure provisioning
This is the line item with no published price anywhere, and it has three parts.
Engineering: generating or receiving per-device credentials, writing them to a secure element or protected flash, and proving the device can present them, typically mTLS against your back end.
Bill of materials: a secure element or TPM adds unit cost. Using the MCU's own protected storage costs nothing extra and offers weaker guarantees. PSA Certified parts and TrustZone sit between.
Manufacturing time: every second added to the line is multiplied by your volume. Certificate injection takes seconds per unit, and at scale that is a real cost that appears in the contract manufacturer's quote rather than in firmware.
For the design, NIST's SP 800-193 sets out firmware resiliency expectations: protection, detection and recovery (reference), and is the right reference to hand an auditor.
Certification: the budget everyone forgets
No firmware cost article we could find prices certification. Here is what it adds.
- Bluetooth SIG qualification. Cost: USD 12,000 per product for non-members; USD 6,000-8,000 for members, plus annual dues. Timeline: weeks. Source: Bluetooth SIG fee schedule, effective March 2026.
- FCC Part 15. Cost: one consultancy publishes USD 1,500-5,000 for a simple digital device, USD 3,000-10,000 with a pre-certified module, USD 15,000-40,000 for cellular. Timeline: 2-16 weeks. Source: MarkReady (vendor estimate).
- UL. Cost: the same source publishes from USD 15,000-30,000 initial, plus annual fees. Timeline: 8-30+ weeks. Source: MarkReady (vendor estimate).
- PTCRB cellular. Cost: USD 10,000-500,000 without a pre-certified module; near zero with one. Timeline: up to 2 months. Source: emnify (vendor estimate).
- CE/RED, UKCA, ISED Canada. Cost: varies with test scope. Timeline: parallel with FCC. Source: test lab quote required.
Two scheduling points that cost more than the fees. Certification is sequential with firmware: a change after testing can mean re-testing. And since 11 September 2026 the EU Cyber Resilience Act has applied vulnerability-reporting obligations, with main obligations from 11 December 2027, which means an SBOM and a maintained update path are now compliance deliverables, not engineering preferences.
If you want this applied to your own device rather than to an example, send the board and the radio plan and we will scope it against these line items.
Book a call →What pushes a project to the top of its range
Six drivers account for most of the variance between a quote at the bottom of a range and the same scope at the top.
- Silicon maturity. Bottom of range: mature SoC, vendor reference design exists, evaluation board available. Top of range: new silicon, no reference design, errata still landing.
- Radio count. Bottom of range: one radio, pre-certified module. Top of range: two or more radios, coexistence tuning, bare chipset.
- Safety classification. Bottom of range: consumer device. Top of range: medical under ISO 13485, industrial under IEC 62443.
- Code reuse. Bottom of range: greenfield or a clean existing codebase. Top of range: inherited code with no tests, usually slower than starting clean.
- Test rigour. Bottom of range: manual bench testing accepted. Top of range: HIL test rig, automated regression, production test firmware.
- Contract shape. Bottom of range: time and materials with a shared scope document. Top of range: fixed scope on requirements that are still moving.
That last row deserves a note, because buyers often assume fixed price removes risk. Empirical research on outsourced software contracts finds that contract type systematically shapes vendor behaviour and outcomes: Gopal and colleagues in Management Science (reference). A fixed price on an unstable scope does not buy certainty; it buys a change-order negotiation.
Hire, contract, or embed a team
The comparison that matters is effective project cost, not hourly rate, because the hours differ. A team that has done board bring-up thirty times bills fewer hours than one learning on your board. Software cost estimation has modelled this since Boehm's Software Engineering Economics (reference), where team capability is among the largest cost drivers.
Market anchors, each with its source:
- A US firmware engineer averages USD 167,438 a year (ZipRecruiter, August 2026); the BLS puts electronics engineers' median at USD 130,220 with the top decile above USD 206,960 (May 2025 data).
- Freelance embedded engineers self-report an average of USD 104 an hour, with a 25th-to-75th percentile band of USD 65-120 (contractrates.fyi, June 2026, n=116).
- Nearshore Latin American senior developers run USD 60-75 an hour, juniors USD 33-45, and regional rates fell 7.1% year on year (Accelerance, November 2025).
The fully loaded cost of a hire is the salary plus benefits, equipment, recruiting and the months before they start, and the risk that a single firmware engineer is your whole capability. BLE OTA on an nRF52: about 80 hours for a team that had shipped it before, against roughly 200 hours for a first attempt.
What it costs to maintain after launch
Firmware has an annual cost, and since 2026 part of it is a legal obligation rather than a choice.
Maintenance runs about 15-20% of the original build cost per year.
- Maintenance retainer or budgeted hours: field bug fixes, new sensor variants, toolchain and dependency updates
- Platform subscription: the OTA update and device-management cost from the table above, per device per year
- Vulnerability handling: monitoring dependencies, triage, and shipping a fix, now required under the EU Cyber Resilience Act for devices sold in the EU
- Certificate lifecycle: renewals and revocation for device identity, where credentials expire
- Re-certification: triggered by radio or stack changes, not by every release
A worked example
A sensor device on a mature SoC, one radio, no safety classification, moderate volume:
- Board bring-up and BSP. Notes: vendor reference design available. Hours: 40 h.
- Device drivers: two sensors over I2C. Notes: in-tree drivers for both. Hours: 40 h.
- RTOS integration. Notes: team has shipped on this stack. Hours: 40 h.
- BLE stack, standard profiles. Notes: vendor SDK. Hours: 100 h.
- OTA update pipeline with A/B partitions. Notes: MCUboot. Hours: 160 h.
- Device identity using MCU protected storage. Notes: no secure element. Hours: 80 h.
- Production test firmware. Notes: manual bench test. Hours: 60 h.
- Bluetooth SIG qualification. Hours: USD 12,000. Notes: non-member rate, 2026 fee schedule.
- FCC Part 15 with pre-certified module. Hours: USD 3,000-10,000. Notes: consultancy estimate.
- Platform, year one, 5,000 devices. Notes: recurring. Hours: ≈ USD 15,000 on Golioth (5,000 × USD 0.25 × 12, before OTA data) to ≈ USD 42,000 on Memfault Growth (USD 3,495 × 12).
Every assumption in that table is stated, which is the point. Change one (no reference design, a second radio, a medical classification) and the total moves in a direction the drivers table predicts.
- Total engineering. Hours: 520 h.
Frequently asked questions
How much does firmware development cost for a connected device?
It depends on scope rather than on hourly rate. The five budgets are board bring-up, the connectivity stack, the OTA update pipeline, secure provisioning and certification. Certification alone starts at USD 12,000 for Bluetooth SIG qualification at the non-member rate, per the SIG's 2026 fee schedule.
What is the hourly rate for an embedded engineer in 2026?
US freelance embedded engineers self-report an average of USD 104 an hour with a USD 65-120 interquartile band (contractrates.fyi, June 2026). A US employee averages USD 167,438 a year (ZipRecruiter, August 2026). Nearshore Latin American seniors run USD 60-75 an hour (Accelerance, November 2025). Effective project cost matters more than the rate, because experienced teams need fewer hours.
How much does adding Bluetooth to a device cost, including certification?
Integration with a vendor SDK and standard profiles is usually the cheapest radio to add. Bluetooth SIG qualification is USD 12,000 per product for non-members, or USD 6,000-8,000 with membership plus annual dues from USD 3,500.
What does an OTA update system cost to build and to run?
Two numbers. Building it means a bootloader with A/B partitions, verified rollback, signed images and a release back end. Running it costs per device per year: Mender from USD 34 a month for 50 devices, Memfault from USD 3,495 a month, Golioth at USD 0.25 per connection per month, AWS IoT Device Management at USD 0.01-0.02 per device per month.
How much does secure provisioning add?
Three costs: engineering for certificate injection and mTLS identity, unit cost if you add a secure element or TPM, and seconds per unit on the manufacturing line multiplied by your volume.
Is it cheaper to hire a firmware engineer or to contract one?
Hiring is cheaper per hour and more expensive in total for bounded work, because of fully loaded cost and the months before the person starts. Contracting is cheaper when the work has a defined end. The deciding factor is usually whether firmware is your product or a component of it.
The short version
- Firmware is five budgets, not one price: board bring-up, connectivity stack, OTA update pipeline, secure provisioning, certification.
- Certification is the line most budgets miss: Bluetooth SIG qualification alone is USD 12,000 per product for non-members.
- OTA update has a build cost and a per-device annual cost; at scale the subscription can exceed the build.
- What moves a quote is silicon maturity, radio count and safety class, not the hourly rate.
- Choose the pre-certified module. The BOM saving on a bare chipset is usually smaller than the certification it creates.
