According to one embodiment, updating software in a remote device comprises operating on a first image of an operating system code, updating to a second image of the operating system code, wherein updating to the second image comprises operating on the second image while maintaining the first image in memory, and in response to detecting an error in operating on the second image, operating on the first image of the operating system code maintained in the memory accessible by the ECU. Operating on the first image of the operating system code can comprise saving the first image in the memory and executing the first image based on a pointer to the first image. Updating can comprise saving the second image without overwriting or erasing the first image and executing the second image based on a pointer to the second image.