If, at step 820, the reboot operation is successful with the newly installed processor code, a flag (e.g., ENV flag 0 or 1) may be set to identify which portion is the new active portion, as indicated by step 822, and end at step 808. The flag may be set by code running (sometimes referred to as “osm” code) in the software module running on the first processor. Once booted, the first processor and other booted processors are operating in accordance with the design of the hazard system. For example, if the new software update package was copied into image portion 610, and image portion 610 contains the code that was successfully installed in the first processor and booted therefrom, then the image portion 610 may be set as the active portion. If, at step 820, the reboot operation fails after a fixed number of times, the software module may instruct the boot loader to install the last known good version of the processor code (e.g., the code contained in the active portion), at step 824. The system may then progress through steps 816, 818, 820, and 822, as previously discussed but in this case using the processor code from the last good version.
It is understood that the steps shown in