Abstract: Flash ROM memory may be utilized to enable field updates of system-level code necessary for providing system operation. However, a disruption during downloading can render a system inoperable. With alternating use of two memory areas, downloading is provided on a fault tolerant basis. A previously-stored functional code version is held in a first memory area. A second memory area is erased and an update code version is downloaded and stored therein. In case of unsuccessful downloading, the previously-stored functional code version remains usable. For the next downloading a later update version is loaded into the first memory area, while the previously downloaded update code version is held in the second memory area for use if needed. By this alternation of memory areas, one memory area can safely be erased or over-written for new code downloading, while an operationally validated prior version of the code remains available in case of downloading failure.