We’ve all been there: an update goes south, and suddenly your device is comatose. With intensive care and proper treatment it might come back to life, no worries, but that means the ambulance has to drop by. In the world of connected devices, that's the ultimate fallback: truck rolls, and you want to avoid it as much as possible.

A/B switching is the safety net for this, but not all nets are woven the same. Depending on your SoC choice and hardware design, it might be provided by ROM code, as part of the bootloader process or even on the operating system level. All of these have their own strengths, weaknesses and integration challenges.

In this session, I’ll strip away the marketing fluff to look at how we can actually implement "fail-safe, A/B" booting in 2026. We will dive into:
- The Hardware Layer: How silicon vendors handle redundancy before the first line of C code even runs.
- The Bootloader Race: U-Boot is often the first and default choice, but there are others. How do they compare?
- The High Level: What you can do if you want to use more complex mechanisms, managed by operating system and userland tools.
- Bonus episode: Watchdogs: Why your A/B switch is useless if you don't have a "dead man's switch" that actually works.

We will wrap up with a comparison table to easily gauge the benefits and drawbacks of each solution. Choosing the most suitable solution helps attendees spending their resources on improving their devices instead of being nerdy ICU nurses.

Benefit Ecosystem: Understanding the benefits and limitations of redundant boot strategies and the various levels of implementation in different devices. A decision matrix to select redundancy strategies to minimize field failure rates is provided.

Target Audience: Embedded Linux developers, firmware developers, platform developers and architects.