I built such a system for a PIC32 in a previous job. When it was online, we'd connect to it over Ethernet and send it firmware updates that it would burn to an

I built such a system for a PIC32 in a previous job. When it was online, we'd connect to it over Ethernet and send it firmware updates that it would burn to an external SPI flash chip (we used it for testing communications protocols with a wide variety of products, and it needed frequent firmware updates). If one of these updates had a bug and bricked the controller, it was a hassle (not to mention downtime!) to remove it from the machines on the production floor and bring it back to engineering to plug in the dedicated programming device. So we set up the SPI flash to store two copies of the firmware. If it went down, you could reset it while holding down a "restore last-known-good firmware" button, and the boot routine would reflash the on-board flash memory with the previous copy of the firmware from the SPI flash. I wouldn't do this every time you needed to power cycle it - but on a per-revision level it was very useful!