OTA · A/B updates · Signed images
Power Cut at 63%: why embedded devices need A/B updates and rollback
Every device you ship will be updated, and an update is the most dangerous moment in its life. A new image rolls out to a wind farm when a storm cuts the power to one turbine 63% into the write. A single copy cannot boot; A/B slots boot the old system and try again.
Chapters
CONCEPT FILM
The wind farm, the storm, the service van and the controller board are 3D illustrations; the 63% and turbine #0417 are part of an example scenario, not a real incident. The partition map and LED states on screen are an animation of the update logic. The only date on screen is the full application date of the EU Cyber Resilience Act.
01What the film shows
With a single copy, the update overwrites the system the device is running on. Lose power halfway and nothing bootable is left: half old, half new, and someone has to drive out and fix it by hand. With A/B slots, the new image is written to the slot that is not running; if power is lost, the device boots the old system and tries again. The bootloader switches to the new slot only on a trial basis, and the switch becomes permanent once the new system reports that it is healthy. If it never does, the device falls back on its own.
Every image is signed; if the signature does not match our key, the image is rejected and never runs. In Europe, the Cyber Resilience Act turns security updates into an obligation for the whole support period, and it fully applies from 11 December 2027. That is the architecture work we do at Spikedge: design for the update that fails.
This is a 3D illustration of an example scenario: the wind farm, the storm and the 63% are not a real incident.
02Transcript
Every device you ship will be updated. Many times.
And an update is the most dangerous moment in its life.
A new image rolls out to the whole fleet.
Then a storm cuts the power to one turbine, mid-write.
With a single copy, the update overwrites the system it is running on.
Lose power halfway, and nothing bootable is left.
Someone has to drive out and fix it by hand.
With A/B, the new image goes to the slot that is not running.
Power cut? It boots the old one, and tries again.
The switch only becomes permanent once the new system proves it is healthy.
And every image is signed.
If it isn't ours, it doesn't run.
In Europe, shipping security updates is becoming an obligation.
Design for the update that fails.
