If your device is comparatively expensive and you can afford the cost ( and you customers care about upgrades) you can do this...
( generally this technique requires either external storage or devious use of jtag..)
Have a fixed program micro (like a little PIC) that can halt the system and reprogram it.
because you cannot change the "upgrade processor" firmware, it cannot ever go wrong.
1) the user can upgrade the device
2) if an upgrade fails, they can always try again. It cannot be bricked
3) even when your target device doesn't support a boot-loader ( it just wants to boot and run)
you can still make it do what you want to.
works for FPGA, DSP and other oddball targets.
Can have a really neat user interface ( even a PIC can run a web server....)