U-Boot has a mechanism for offering fallback by counting boots (and saving that to local EEPROM). If you set up your watchdog correctly and the system loops to

U-Boot has a mechanism for offering fallback by counting boots (and saving that to local EEPROM). If you set up your watchdog correctly and the system loops too many times, your u-boot launch script can swap booting to safe/backup partition.