Updating software on devices already in the field — and why it is harder than updating a phone app.
FOTA means replacing firmware on a device that is already deployed, over the network, without anyone touching it. A phone app update is trivial by comparison: the operating system underneath survives a failure, storage is plentiful, and the user can uninstall. On an embedded device the thing being replaced is the operating system, storage is scarce, and there is no user to intervene.
A working system has four parts. A server holds signed artifacts and decides who gets what. A device agent asks what it should be running. A bootloader decides which copy to boot and what to do when that fails. And a signing process ensures the device only accepts builds you actually made. Platforms differ mostly in how many of those four they hand you.
The clearest way to see the whole loop working — server, agent, bootloader integration and rollback.
To understand the server half in isolation, with no device opinions attached.
To understand the device half: what actually happens when the image is written.
One rule survives every architecture: the device must verify a signature before it writes anything. An unsigned update path is a remote code execution feature you shipped on purpose.
Tell us the target hardware, roughly how many devices, and what happens commercially if one bricks. You get back a shortlist and the reasoning. No vendor is given your details.