The summary.
ABSTRACT HARDWARE SO LOGIC CAN BE TESTED WITHOUT IT
Hardware changes during a product's life, and most firmware bugs are logic bugs testable on a development machine.
RESET THE WATCHDOG ONLY WHERE THE DEVICE IS GENUINELY WORKING
Resetting it from a timer defeats its purpose entirely. And record the restart reason persistently — it is the only diagnostic for a device that rebooted in the field.
CONTINUE IF POSSIBLE, RESTART IF NOT, NEVER STOP
But back off increasing delays on repeated restarts, because a device restarting continuously exhausts its battery within hours.
PERSISTENT STORAGE HAS LIMITED WRITE CYCLES
Write rarely, distribute writes, and protect against power loss mid-write with an alternate location and a validity marker.
SEVERAL FIRMWARE VERSIONS WILL ALWAYS BE IN THE FIELD SIMULTANEOUSLY
Report versions with every message, accept old schemas, and never silently change units — it produces plausible wrong data.
SETUP IS THE LARGEST SOURCE OF SUPPORT CONTACTS
Explain precisely which step failed, provide physical status indication, and test with people who have not seen the product.
SIMULATE MANY DEVICES — PLATFORM BEHAVIOUR AT SCALE CANNOT BE TESTED WITH A HANDFUL
Especially the reconnection burst after an outage.
