I've been thinking of ways to avoid sending a technician to repair a failed firmware update. I'm not sure if this will work, but it would be nice if it did.
I'm using an xmega8e5, which has 8 kB of ROM. The program uses approximately 1 kB, so there's plenty of free space. Instead of using an external flash to store a golden image that the bootloader can use in case the firmware update fails, can I store code in the unused program space? I think the bootloader would simply page erase starting at 0 and then only as far as it needs to go, which would leave the golden image untouched. For example, if the golden image is 1 kB and I store it near the end of the program space, erasing the first few kB should leave it intact. Should the firmware update fail, the bootloader can read the golden image from program memory and then program it into the live program memory section, i.e. starting at address 0.