Reliable Over-the-Air Updates in the Field with Yocto

Shipping the device is the easy part. Updating hundreds of them in the field — without bricking a single one — is where products succeed or fail. A device mounted in a bus, a substation, or a factory cabinet can't be recovered with a keyboard and a USB stick when an update goes wrong. This is where Yocto, paired with a robust update strategy, earns its keep: it makes field updates safe, atomic, and boring — in the best possible way.

Why field updates are so risky

• Power can fail mid-update. A vehicle turns off, a breaker trips — and the device is left half-written.
• A bad update with no way back means a truck roll, or a technician climbing to a rooftop enclosure, for every affected unit.
• The devices are hard to reach by design. The whole point of remote deployment is that nobody is standing next to them.

The foundation: atomic updates with rollback

A/B (dual-redundant) root filesystems

The core technique is two root filesystem slots — call them A and B. The device runs from A, and an update is written to the inactive slot B. Only after B is fully written and verified does the bootloader switch to it. If power fails partway through, the device simply boots the untouched A slot as if nothing happened.

Atomic and reversible

An update either fully applies or it doesn't apply at all — there is no half-updated state. And if the new slot boots but the application fails a health check, the bootloader automatically rolls back to the previous known-good slot. A broken update becomes a non-event instead of a field failure.

The tooling Yocto integrates

You don't have to build this machinery yourself. The mature update frameworks all ship as Yocto layers, so the mechanism is baked into the image from the start:

• RAUC, Mender, and SWUpdate — battle-tested A/B update frameworks with signing, rollback, and fleet-management options. The right choice depends on whether you want full-image, delta, or container-based updates.
• OSTree-based updates — a git-like model for the root filesystem, useful for efficient, versioned OS updates.
• Signed updates — every image is cryptographically signed, so a device only installs software that genuinely came from you.
• Read-only root + a separate data partition — the OS stays pristine and verifiable, while application data survives updates untouched.

Security is part of the same story

Reliable updates and security are two sides of one coin. Combine secure boot, signed images, and verified A/B updates and you get an unbroken chain of trust from power-on to running application — the device refuses to boot or install anything that isn't yours. For connected products, this is quickly becoming a regulatory expectation as well as good practice, with frameworks like the EU Cyber Resilience Act pushing for exactly this kind of maintainable, updatable security.

What reliable updates actually unlock

• Ship features and security patches to fielded devices with confidence, not dread.
• Cut field-service costs — most issues become a remote update instead of a site visit.
• Extend product lifespan: a device you can safely update is a device you can keep secure and relevant for years.

Where we fit in

Setting up A/B partitioning, an update framework, signing keys, and rollback correctly is fiddly the first time and easy to get subtly wrong. We build this into the Yocto image as part of delivering your industrial hardware, so your fleet ships with a safe update path from unit one.

If reliable field updates are a requirement for your deployment, get in touch and we'll walk through an update strategy that fits your hardware and your risk tolerance.