Design over-the-air updates for devices where a failed update means a physical service visit.

The requirement that dominates

A failed update must not brick the device. Recovery by physical visit is expensive and sometimes impossible, so the update mechanism's reliability requirement is far higher than the software it delivers.

The design

• A/B partitions. Write the new image to the inactive partition, verify it, then switch. If the new image fails to boot, the bootloader falls back to the known-good partition automatically.
• Cryptographic signature verification before installation, since an update channel is the most powerful possible attack path into a fleet — it delivers arbitrary code to every device by design.
• Atomic switching, so power loss at any point leaves the device on one complete image rather than a partial one.
• A watchdog confirming the new image actually works — booting is not the same as functioning, and an image that boots and cannot reach the network is unrecoverable without a rollback trigger.
• Resumable downloads, because connectivity is intermittent and restarting a large image repeatedly may never complete.

Rollout control

• Staged rollout with automated halt on failure-rate regression. This is the mechanism that prevents a bad update reaching the whole fleet, and it is the difference between an incident and a recall.
• Device-side eligibility conditions — sufficient battery, not in use, connected — evaluated locally, because the platform's view of the device's situation is stale.
• A defined update window where the device's function permits it, since updating a vehicle mid-journey is not acceptable regardless of urgency.

The operational necessities

Version distribution telemetry, so it is known what is actually deployed rather than what was sent. Long-tail handling for devices offline for months, which will eventually reconnect on a very old version and must be able to update through whatever version sequence is required. And an emergency path for a security fix that must bypass the normal staged schedule — built and tested before it is needed.