Abstract: A content channel is periodically or permanently allocated for use as an “update channel” or “firmware-image download” channel. Any firmware images downloaded to receivers in the system are thoroughly tested prior to being distributed among the receivers. Header information is included in the firmware image when it is transmitted to the receivers, and the firmware image is not accepted for use by the receivers until it is verified on the receiver side. Further, rather than overwriting the existing firmware, the new validated firmware updates are stored separately on the receivers and are utilized when the receiver is rebooted during power-up or by the host controller. If, during this reboot process, an error occurs in the new firmware image, the receiver is configured to revert back to the original firmware image so that it will remain operational, albeit without the updated firmware features.