If something goes wrong during the upgrade, how will you revert to the former state? How will you “undo”? How long will that take? Obviously, if something small goes wrong, the usual debugging process will try to fix it. However, you can use up the entire maintenance window—time allocated for the outage—trying just one more thing to make an upgrade work. It is therefore important to have a particular time at which the back-out plan will be activated. Take the agreed on end time and subtract the back-out time, as well as the time it would take to test that the back-out is complete. When you reach that time, you must either declare success or begin your back-out plan. It is useful to have the clock watcher be someone outside the group directly performing the upgrade, such as a manager. The back-out plan might also be triggered by one or more key tests failing, or by unexpected behavior related to the upgrade.
Small-to medium-size systems can be backed up completely before an upgrade begins. It can be even easier to clone the disks and perform the upgrade on the clones. If there are serious problems, the original disks can be reinstalled. Larger systems are more difficult to replicate. Replicating the system disks and doing incremental backups of the data disks may be sufficient in this case.