FIGS. 16A-F show a sequence of illustrative block diagrams of images 1610 and 1620 that show hazard system recovering from a corrupted software update package, according to an embodiment. FIG. 16A may represent an initial state of images 1610 and 1620, where the system processor is running code stored in image 1610. In response to a user demand to change the language to English or other language, the system may download a software update package. As shown in FIG. 16B, the English audio kit is downloaded into image 1610, which is the inactive portion. However, there was an error in the downloaded file and it is corrupted. When the system attempts to boot from the corrupted coded in image 1610, it fails, as shown in FIG. 16C. The system may revert to a previously known good code image, such as image 1620 and reboot (shown in FIG. 16D). With the system running on code contained in image 1620, the system may download another software update package in image 1610 (shown in FIG. 16E). This time, however, the package is not corrupt and the system is able to boot using code stored in image 1620 (shown in FIG. 16F). Accordingly, the system is running with the English language audio kit.
