A/B Partition Update
Writing firmware to an inactive partition and switching on next boot, so a failed update falls back to the previous image rather than bricking the device.
Updating firmware in place is the arrangement that produces bricked devices. Power loss, a corrupted transfer or an image that fails to boot leaves the device with neither the old firmware nor a working new one, and no remote path to recovery.
The dual-partition scheme removes the class. The device runs from partition A and writes the new image to B, verifying its signature and checksum before doing anything irreversible. It then marks B as the boot target and restarts. If B boots and confirms health within a watchdog period, the switch is committed; if it fails to boot or fails to confirm, the bootloader reverts to A.
The properties that make it safe are the ones most often incompletely implemented. Verification before switching, so a corrupt image is never activated. A watchdog-confirmed boot, because an image that boots and then cannot reach the network is as bad as one that does not boot — the health check must include connectivity, not merely successful startup. Atomic switching, so power loss at any moment leaves a valid target.
The cost is storage: two full images plus working space, which on a constrained device is a real constraint and is why the alternative — delta updates into a single partition — persists despite being materially riskier.