With A/B slots, the device runs from one slot while the update is written to the other, then boots into the new slot and falls back to the old one if it fails. A single slot saves flash but risks a bricked device if power fails mid-write. Android's A/B design shows the pattern clearly.
How Android describes it
Android's documentation says the device has two sets of partitions, called slots, normally A and B. The system runs from the current slot and the unused slot is not accessed in normal operation. The update_engine daemon writes the update to the unused slot in the background, and the bootloader boots from it on the next reboot.
The new slot must pass checks after reboot before it is marked successful. Android's update_verifier runs an integrity check using dm-verity first.
What happens when things go wrong
The document lists three cases. If the update fails to apply, the user keeps the old OS and the client can retry. If it applies but fails to boot, the bootloader falls back to the old slot and the device stays usable. If a post-install step is defined and does not exit successfully, the update fails.
That fallback is the feature. The device always has a last known good image.
The costs
Two slots need roughly double the storage for the updatable images, and a small device may not have it. Android's own page says A/B OTA updates are recommended for new devices only, and that Virtual A/B replaced Legacy A/B in Android 10. Your embedded part is not a phone, so measure your own flash budget.
A single slot done carefully
If flash is tight, a single slot can still be made safer.
- Keep a small recovery image that can fetch and verify a full image.
- Write the new image to a staging area first, verify it, then commit.
- Use a flag that the application sets only after it passes self checks.
- Make the update atomic from the bootloader's view, so a power cut leaves either the old state or the new one.
MCUboot's swap mode with test and confirm is one example of a compromise between the two: it keeps the old image in the second slot after an upgrade and reverts if the new one is not confirmed.
Pick by consequence
Ask what a failed update costs. A truck in a remote location, a pacemaker programmer or a router behind a locked door justify the second slot. A device that is trivially reflashed on a bench may not.
Quick check
Do A/B updates need free space for the download?
Android says updates can be streamed, so the device does not need free space on data or cache to hold the package.
Does A/B protect against a malicious update?
No. It protects against failed updates. You still need signature verification and rollback protection.
Where Safeguard fits
Safeguard works on the software supply chain around your firmware: SBOM and dependency scanning, policies and gates that can block a release, and compliance evidence. It does not sign images or run your bootloader. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
