The firmware update that never bricks
A/B partitions, signed images and a watchdog that knows how to roll back. The boring trio that keeps a fleet alive.
A bricked device is the most expensive object in the support inbox. Every update flow we ship assumes the network will drop, the power will fail and the user will pull the plug.
We have shipped enough programs to know that the difference between a product that lands on time and one that slips by a quarter is rarely a single heroic decision. It is the accumulation of small ones, made early, defended quietly, and revisited only when the evidence demands it.
What the work actually looks like
Two partitions. One running, one staged. A signed manifest. A watchdog that boots the old image if the new one does not check in within sixty seconds.
In practice the schematic, the layout, the firmware skeleton and the test plan start in the same week. Not the same quarter. The same week. The team is small enough that one engineer can hold the whole picture in their head, and disciplined enough that nobody pretends to when they cannot.
A/B partitions, signed images and a watchdog that knows how to roll back. The boring trio that keeps a fleet alive.
Where it usually goes wrong
The failure mode we see most often is not technical. It is a handoff. A spec leaves one team without the context a second team needs to act on it. Two weeks later, something obvious has been missed, and the cost of fixing it has multiplied by ten.
- One owner per decision, named in writing.
- One review per gate, scheduled before the gate opens.
- One source of truth for the design, the BOM and the test plan.
- One number that says whether the program is on track this week.
It is not clever. It is just refusal to ever explain to a customer why their device will not turn on.
The quiet result
A program run this way feels boring from the inside. There are no rescue missions. There is no hero week. The board enters the lab, passes, and goes into production. The line calls once, to say the first thousand units shipped clean.
That is the work. It is not glamorous. It is the only way we know to build hardware that survives the year after launch, and the four years after that.
