OTA Updates in 2026: RAUC vs SWUpdate vs Mender for Robust Fleet Management

Over-the-air updates are non-negotiable for connected embedded devices. The question is not whether to implement OTA but which framework to use. RAUC, SWUpdate, and Mender are the three dominant open-source options for embedded Linux. Each takes a different architectural approach, and the right choice depends on your update model, fleet size, and existing build infrastructure.

Update model fundamentals

All three frameworks solve the same core problem: replace the running system software with a new version, atomically, with the ability to roll back if something goes wrong. The approaches diverge in how they achieve this.

A/B (dual-bank) updates

The device has two complete system partitions. One is active; the other receives the update. After writing the update, the bootloader switches to the new partition on the next boot. If the new version fails to boot, the bootloader reverts to the old partition.

RAUC and Mender both default to this model. It requires double the storage for the root filesystem but provides the most reliable rollback mechanism.

In-place (delta) updates

SWUpdate can apply delta patches to the running partition. This saves storage (no need for a second partition) but makes rollback more complex—you need to store the delta in reverse or keep a snapshot.

Streaming updates

Some configurations stream the update directly from the network to flash, avoiding the need to store the complete update image in RAM or on a separate staging partition. RAUC supports streaming mode; SWUpdate supports it through handlers.

RAUC

RAUC (Robust Auto-Update Controller) is a slot-based update framework developed by Pengutronix.

Architecture

RAUC uses a "slot" abstraction. Each updatable component (rootfs, kernel, bootloader, application partition) is a slot. Slots are grouped into slot classes, and the update bundle specifies which classes to update.

The update flow:

1. RAUC receives an update bundle (a squashfs image containing the update payload and metadata)
2. RAUC verifies the bundle's signature
3. RAUC writes each slot's payload to the appropriate partition
4. RAUC marks the new slot group as the boot target
5. On next boot, the bootloader starts the new slot
6. If boot succeeds, RAUC marks the slot as "good"
7. If boot fails (no mark), the bootloader reverts

Strengths

• Clean slot/class model scales to complex partition layouts
• Integrates with U-Boot, GRUB, and Barebox bootloaders
• D-Bus API for integration with management agents
• Good Yocto layer (meta-rauc) and Buildroot support
• Supports adaptive updates (binary delta)

Limitations

• No built-in fleet management server (you need a separate backend)
• Configuration requires understanding slot semantics

SWUpdate

SWUpdate is a single-image update agent developed by Stefano Babic (DENX).

Architecture

SWUpdate processes update images described by a sw-description file (in libconfig or JSON format). The description lists handlers—each handler knows how to write a specific type of artifact (raw image to partition, UBI volume, file to filesystem, script execution, etc.).

The update flow:

1. SWUpdate receives a .swu file (a cpio archive)
2. SWUpdate verifies the signature
3. SWUpdate parses sw-description and executes handlers in order
4. Handlers write partitions, run scripts, update bootloader variables
5. Bootloader variables control the next boot target

Strengths

• Extremely flexible handler system (custom handlers for any update scenario)
• Supports both A/B and in-place updates
• Built-in web server for local updates
• Suricatta module for integration with Hawkbit server
• Streaming mode reduces RAM requirements

Limitations

• Flexibility means more configuration work
• Handler ordering and dependencies need careful design
• No native fleet management (depends on Hawkbit or custom backend)

Mender

Mender is a complete OTA solution with both a client agent and a hosted or self-hosted management server.

Architecture

Mender's client writes A/B rootfs images and communicates with the Mender server for deployment orchestration, device inventory, and reporting.

The update flow:

1. Mender client polls the server for pending deployments
2. Server provides the update artifact
3. Client verifies the artifact signature
4. Client writes the rootfs to the inactive partition
5. Client sets the bootloader to boot the new partition
6. On successful boot, client commits the update
7. On failure, bootloader reverts automatically

Strengths

• Complete solution: client + server + UI
• Fleet management, deployment scheduling, device grouping out of the box
• Simple setup for A/B rootfs updates
• Good Yocto integration (meta-mender)
• SaaS option reduces operational burden

Limitations

• Less flexible than RAUC or SWUpdate for complex partition layouts
• Server component adds operational complexity for self-hosted deployments
• Mender 4.x requires specific partition layout conventions

Comparison matrix

Choosing a framework

Choose RAUC when:

• You need a clean abstraction for complex multi-slot update scenarios
• You already have or plan to build a custom fleet management backend
• You use Buildroot or Yocto and want bootloader-agnostic update logic

Choose SWUpdate when:

• You need maximum flexibility in what and how you update
• You want to combine A/B rootfs updates with file-level application updates
• You plan to use Hawkbit for fleet management
• You need in-place updates to save storage

Choose Mender when:

• You want a complete, integrated OTA solution including fleet management
• Your update model is straightforward A/B rootfs replacement
• You prefer a managed service option
• Time to market is a priority over customization flexibility

Rollback testing

Whichever framework you choose, test the rollback path more thoroughly than the update path. Common rollback failures:

• Bootloader variable corruption: Verify that failed updates leave the bootloader in a state that boots the previous version
• Partial writes: Interrupt an update mid-write (pull power) and verify the device boots the old version
• Boot count limits: Test that the boot-attempt counter correctly triggers rollback after the configured number of failed boots
• Watchdog interaction: Ensure the watchdog fires if the new image hangs during boot, triggering a reboot into the old partition

Integration with ProteanOS

ProteanOS's packaging system can generate update artifacts compatible with all three frameworks. The build pipeline produces the rootfs image; the packaging step wraps it in the appropriate bundle format.

For fleet-managed devices, the specifications section covers the interface between ProteanOS package metadata and update server APIs.

The installation guide covers setting up the partition layout for A/B updates during initial device provisioning.

Summary

All three frameworks are production-ready in 2026. RAUC offers the cleanest architecture for complex scenarios. SWUpdate provides the most flexibility. Mender provides the most complete out-of-box experience. Choose based on your update model complexity, fleet management needs, and team capacity for integration work.