Boot protected

I’m designing a unit based on TX1 and I need to keep “robust” the starting of the system also when the tegra is not powerd off following the shutdown procedure.
The soc module will be installed inside an avionic unit which can be halt in any time.
In this case I’m afraid wich the OS can (and the filesystem of the partition) can be compromised without a rescue.
What do you suggest to solve this problem?
I would like to avoid a partition in Ram because I need to use all memory available for other functions.
Exists a fast method (whithin 5-10 seconds) to rewrite a baseline image of the startup partition when the filesystem is damaged? In this case, need I an another memory where the image of the os is stored?
Thank you.

Just some thoughts. Will you need to write to eMMC for normal operation? If not, and if this can be mounted read-only (except for temp files), then it is a non-issue.

If you must write to disk, then you could accept slower performance and mount synchronous…but this will wear out the eMMC much faster and the expected lifetime would drop (old fashioned hard drives don’t have that issue…anything solid state does).

So the answer requires knowing exactly the nature of what is written to disk when, and if the system is to come back up as some reference version without any changes, or if instead changes need to persist (for example, custom waypoints).