There must be a way to back-out an unsuccessful upgrade. For online upgrades, the challenge is to do this without causing the system to crash. In addition to support for runtime detection of failures and containment of faults, this requires tools and processes to map the updated system state and data back to something that the original version is able to deal with. At some point, trust is developed in the upgraded system. Once the new version is trusted, it may be possible to remove the old version and to free up the resources it consumes.
Fallback ceases to be a viable option.
The online upgrade group identified other issues worthy of study. Especially because online upgrade techniques are used in dependable and safety-critical environments, close attention must be paid to details of fault containment and upgrade rollback. Special attention must be paid to verifying and testing the proposed upgrade, or at least the recovery mechanism, before letting it go live. Many of the points made throughout this section apply to the upgrade problem in general.