FIG. 12 shows an illustrative flowchart of steps for updating software in a processor that independently decides whether to update its software, according to an embodiment. In one embodiment, such a processor can be a safety processor (e.g., safety processor 230). As discussed above, the safety processor may serve as the “brain stem” or “medulla oblongata” of the hazard detection system and is responsible for monitoring sensors for hazardous conditions and activating an alarm in response to a detected presence of one or more hazardous conditions. As such, it maintains independent control over its operation, including deciding when to upgrade software contained within its internal memory. The decision can be made independent from the system processor operation and independent from the timing of the system processor notifying the safety processor that a software update is available. Starting with step 1202, the safety processor may receive an indication from another processor such as the system processor that a software update is available. For example, when a software update package is received and stored in the system NMV (e.g., NVM 540), the system processor may determine whether the update package contains new code for the safety processor. The system processor can determine whether the safety processor requires any updating by asking the safety processor for a version check. In response to receiving such a request, the safety processor may provide the system processor with an indication of which version of software it is running. If the system NMV contains a newer version than that running on the safety processor, the system processor may issue a notification to the safety processor that new software is available. At step 1204, the safety processor decides whether to accept the system processor's request to update. The safety processor may check its state machines to make certain no alarm or pre-alarm states are active before making this decision. If the decision is NO, the process loops back to step 1202. If the decision is YES, the code is written to the inactive portion of the safety processor's internal storage, as indicated by step 1206.