# Tripp Lite B093 boot and recovery: no A/B fallback, a watchdog and the ERASE button

> What I learned about how a Tripp Lite B093 boots and how it recovers from a bad firmware write. It always boots one image slot, a watchdog reboots it after about four minutes, and the way back is the ERASE button and a serial cable.

- Source: https://bytesizedtechsolutions.com/articles/tripp-lite-b093-boot-and-recovery/
- Author: Craig Miller
- Published: 2026-11-07
- Tags: console servers, firmware, embedded linux, u-boot, recovery
- License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

> **Warning: Proceed at your own risk.** This series is about loading another vendor's firmware onto a Tripp Lite B093 console server. Neither Tripp Lite (Eaton) nor Opengear supports this, and it may void your warranty and your support entitlement.
>
> A failed or interrupted write can leave the unit unable to boot until someone recovers it in person over a serial console cable. A mistake can also erase its configuration.
>
> Everything here was done on one unit in my own lab. Your hardware, model or firmware may behave differently. Back up the configuration first, keep serial console access, and don't try it on a unit you depend on or can't physically reach.
>
> You're responsible for making sure you're licensed to use any firmware you install. This is shared as is, without warranty, and it isn't vendor guidance. You act on it at your own risk, and I accept no liability for damage, downtime or data loss.

**Tripp Lite B093 cross-flash series** (part 3 of 3)

- Overview: [Cross-flashing Tripp Lite B093 console servers to Opengear firmware](https://bytesizedtechsolutions.com/projects/tripp-lite-b093-crossflash/)
- Part 1: [Tripp Lite B093 vs Opengear firmware: kernel, CVEs and features](https://bytesizedtechsolutions.com/articles/tripp-lite-b093-why-opengear-firmware/)
- Part 2: [Why netflash looked like it bricked my Tripp Lite B093: the -C flag only compares](https://bytesizedtechsolutions.com/articles/tripp-lite-b093-netflash-compare-only/)
- Part 3: Tripp Lite B093 boot and recovery: no A/B fallback, a watchdog and the ERASE button (this page)

Before writing firmware to a console server you can't easily reach, you want to know exactly what happens if the write goes wrong. These are the things I found on my lab B093, from reading its bootloader and from testing it with a serial cable attached.

## There is no A/B fallback

U-Boot always boots `image_1`. If `image_1` is bad, nothing else is tried. There is a second image slot on the flash, but the bootloader never boots from it. Without a serial cable, a failed write means someone has to go to the box.

That's why any write should end with a read-back check of `image_1` *before* the unit reboots.

## How the image slots are written

The image slots are UBI volumes exposed as MTD devices through *gluebi*. Besides `netflash` (part 2), two lower-level writes also worked:

- `ubiupdatevol` on the UBI volume, and
- `dd` onto the gluebi MTD device, as long as the writes are **aligned to the erase-block size** reported in `/proc/mtd`.

## A watchdog reboots it after about 258 seconds

A hardware watchdog resets the unit after about 258 seconds without being fed. A unit that hangs mid-upgrade reboots on its own into whatever is in `image_1`. That's only safe if `image_1` is complete and verified, so the write and verify window has to be short.

## The serial way back is the ERASE button

Holding ERASE while powering on stops at the U-Boot prompt on Port 1, and from there TFTP plus the unit's own `program_image` command rewrites `image_1`.

U-Boot could not bring up the USB ports on this board, so USB-stick recovery is out.

## Watch out for the factory fallback

If ERASE is held at power-on and U-Boot *doesn't* detect the Port 1 serial line, its stored factory script erases the whole NAND and restores the factory image from SPI flash. On my unit that factory image is an old Opengear release, not Tripp Lite. I worked this out from the bootloader; I haven't triggered it and don't plan to.

The practical rule: if holding ERASE at power-on gives you no output on Port 1 within a few seconds, power off at once.

## A config reset is not a firmware reset

Pressing ERASE twice while the unit is running wipes the configuration only. The firmware stays whatever is in `image_1`. People call both of these a "factory reset", and they are very different:

| | Config reset | Full factory reflash |
| --- | --- | --- |
| How | ERASE pressed twice while running | Bootloader's stored factory script (ERASE at power-on with no Port 1 detected) |
| What it wipes | The configuration | The whole NAND: both image slots and the configuration |
| Firmware afterwards | Unchanged | The factory image from SPI flash |
| Tested | Yes | No, read from the bootloader |

## Going back to Tripp Lite with an Opengear config locks you out

After a downgrade to Tripp Lite firmware that kept the Opengear configuration, SSH and the web UI refused connections and no password worked on serial. A config reset fixed it. The clean way back is to wipe the configuration as part of the write: a web UI downgrade with Firmware Options `-H -i -E` came back on factory settings and new SSH host keys, with no lockout. Either way, plan on reconfiguring the unit afterwards.

## Other models may be different hardware

All of this is from one B093. The B097 and B098 are treated as unknown until someone checks one with a serial cable attached.