Werner:

I understand your scheme. However it has a hole in the instance that there is an operator snafu or a power glitch during an update and the part of the FLASH where the vector table is located ends up getting trashed (i.e. erased but not re-programmed).

One must design re-programambility very carefully to circumvent the possibility that the product becomes useless. The vector table AND the boot loader must never be erased once a product is commited to its life outside the engineering lab.

Michael Karas