Meanwhile I have found this thread, where someone managed to get redundant boot working on an iMX.53:
i.MX53 Redundant Boot -blog archive
This works on Vybrid, too. You just have to know that the boot address is NOT the address of the IVT. The IVT is located 1k after the boot address. This is also true for the secondary image. In my case I have the primary u-boot at 0x400 (starting with the IVT):
$ hexdump /dev/sdd -n 16 -s 1024
0000400 00d1 4020 8000 3f40 0000 0000 7918 3f40
The secondary u-boot is at 501k:
&hexdump /dev/sdd -n 16 -s 501k
007d400 00d1 4020 8000 3f40 0000 0000 7918 3f40
The firstSectorNumber in the secondary image table is set to 500k (0x3e8 = 1000 blocks of 512 bytes):
$ hexdump /dev/sdd -n 20 -s 512
0000200 0000 0000 0000 0000 2233 0011 03e8 0000
I think it would be helpful to clarify this in the VYBRIDRM, or at least in the Vybrid Security RM. Also in the description of the secondary image table format it should be noted that each entry is 4 bytes wide.