Hardware-Assisted Rollback for Embedded Linux OTA Updates

Together with Giampiero Baggiani of Sfera Labs, we have published Industrial IoT Security: Designing OTA Updates That Recover From Failure in Automation World. The article explains how A/B updates, independent storage, and hardware watchdogs help industrial Linux devices recover automatically from a failed update. It also covers signed update packages, reproducible builds, and other production considerations. Strato Pi Max and Rugix provide the practical example.

Strato Pi Max is particularly interesting for robust updates because it can hold two complete systems on independent SD cards. An onboard microcontroller controls which card is connected to the Raspberry Pi Compute Module. If the updated system stops sending its health signal to the hardware watchdog, the microcontroller can restart the device and eventually reconnect the previous card. Recovery does not depend on the updated Linux system or a network connection.

The main Rugix takeaway is how little platform-specific work this required. We described the two cards in the Rugix configuration and added a small controller script that connects Rugix Ctrl to the board’s existing controls. Rugix Ctrl, including its update package format, verification logic, and installation process, remained unchanged. This shows how hardware-specific boot and recovery mechanisms can be integrated without building a board-specific update engine.

The complete implementation is available in the open-source rugix-example-stratopi repository. It includes the dual-SD system configuration, controller script, watchdog setup, and demonstration system used in the article.

---

At Silitics, we help companies design robust OTA update architectures and integrate Rugix with custom embedded Linux hardware. If you need help adapting Rugix to your platform, we’d love to hear from you.