Fleet robot firmware updates: avoiding bricks with A/B partitions and MCUboot

A robotics engineer from a small fleet operator posted on the OpenEmbedded community forum about the challenge of updating microcontroller firmware on a fleet of autonomous mobile robots (AMRs). The robots run ROS 2 Humble on Jetson Orin modules, with STM32 microcontrollers handling motor control and safety. While over-the-air updates for the Linux stack are smooth (using Mender), every MCU firmware update still requires a manual USB cable connection. On 30 robots, that's a full day lost.

The engineer explored several options: a custom UART bootloader that pulls signed firmware from the Jetson (recovery is fragile), using Mender for the Jetson side only (doesn't touch the MCU), and implementing A/B partitions on the MCU flash with a watchdog to select the active image. The A/B approach was deemed most promising. The community weighed in, suggesting MCUboot as an open-source bootloader for MCU OTA, though robotics-specific examples are thin. Key discussion points included how to coordinate the handoff between Linux and the MCU during an update, whether to pause ROS nodes or let them run on old firmware until reboot, and whether to keep firmware in the same repo as ROS packages or split them. Agency Tool Co. also introduced their ATC Deploy product as a commercial solution targeting this exact embedded robotics pain point.