We ship units which have an expected life in the field of ten to twenty years. They include an RTC with a replaceable coin cell. Most of the time the machines will be powered on, so the RTC battery is sitting with no drain. In these circumstances we find that most batteries will retain adequate charge for short power cuts for well over ten years.
Nevertheless, over hundreds of systems, a small percentage of failures is still a thing to be dealt with.
On all previous models that has just meant that the clock runs along at 1-Jan-2000 or something for a few minutes till we can get an NTP fix. The hassle with that is that it can cause e2fsck panics and logged data with bad dates.
What I'd prefer to do is to have a look in the RTC inside u-boot, and if it doesn't look plausible ( before 2017 is probably good enough, checksum in RTC RAM would be even better, boot to a recovery partition. Then the code in that partition could get an NTP fix and put it in the RTC, then s/w reboot, which should of course them boot to the main partition. So a couple off questions:
Does the uboot have the ability to get to the RTC.
Do I just have to write some custom C or if this doable without custom code?