diff --git a/Project/GateWay/MDK/GateWay.uvprojx b/Project/GateWay/MDK/GateWay.uvprojx
index 1cfa7f0..8093107 100644
--- a/Project/GateWay/MDK/GateWay.uvprojx
+++ b/Project/GateWay/MDK/GateWay.uvprojx
@@ -1165,7 +1165,7 @@
               <OCR_RVCT4>
                 <Type>1</Type>
                 <StartAddress>0x8000</StartAddress>
-                <Size>0x6c000</Size>
+                <Size>0x3a000</Size>
               </OCR_RVCT4>
               <OCR_RVCT5>
                 <Type>1</Type>
diff --git a/Project/GateWay/MDK/GateWay_app.sct b/Project/GateWay/MDK/GateWay_app.sct
index 4653f69..c9b8750 100644
--- a/Project/GateWay/MDK/GateWay_app.sct
+++ b/Project/GateWay/MDK/GateWay_app.sct
@@ -1,10 +1,10 @@
 ; *************************************************************
 ; *** Scatter-Loading Description File for GateWay APP ***
-; *** Flash: APP区 0x8000起 (Boot 32KB), 到参数区0x7C000前 ***
+; *** Flash: A区 0x8000~0x41FFF(232KB, 运行) + B区 0x42000~0x7BFFF(232KB, 升级暂存), 参数区0x7C000 ***
 ; *************************************************************
 
-LR_IROM1 0x00008000 0x00074000  {
-  ER_IROM1 0x00008000 0x00074000  {
+LR_IROM1 0x00008000 0x0003A000  {
+  ER_IROM1 0x00008000 0x0003A000  {
    *.o (RESET, +First)
    *(InRoot$$Sections)
    .ANY (+RO)
diff --git a/Project/GateWay/MDK/output/GateWay.sct b/Project/GateWay/MDK/output/GateWay.sct
index f056ad7..463e5a2 100644
--- a/Project/GateWay/MDK/output/GateWay.sct
+++ b/Project/GateWay/MDK/output/GateWay.sct
@@ -2,8 +2,8 @@
 ; *** Scatter-Loading Description File generated by uVision ***
 ; *************************************************************
 
-LR_IROM1 0x00008000 0x0006C000  {    ; load region size_region
-  ER_IROM1 0x00008000 0x0006C000  {  ; load address = execution address
+LR_IROM1 0x00008000 0x0003A000  {    ; load region size_region
+  ER_IROM1 0x00008000 0x0003A000  {  ; load address = execution address
    *.o (RESET, +First)
    *(InRoot$$Sections)
    .ANY (+RO)
diff --git a/Project/GateWay/source/User/Inc/bsp.h b/Project/GateWay/source/User/Inc/bsp.h
index f3072de..d47c579 100644
--- a/Project/GateWay/source/User/Inc/bsp.h
+++ b/Project/GateWay/source/User/Inc/bsp.h
@@ -16,12 +16,14 @@
 
 #define	FLASH_BOOT_BASE			(FLASH_BASE)
 #define	FLASH_BOOT_SIZE			(4*FLASH_SECTOR_SIZE)
-//app
+//app A区(运行, 0x8000起, 232KB) + B区(升级暂存, 0x42000起, 232KB) - 与Boot A/B分区一致
 #define	FLASH_APP_BASE			(FLASH_BOOT_BASE+ FLASH_BOOT_SIZE)
-#define	FLASH_APP_SIZE		    (58*FLASH_SECTOR_SIZE)
+#define	FLASH_APP_SIZE		    (29*FLASH_SECTOR_SIZE)
+#define	FLASH_APPB_BASE			(FLASH_APP_BASE + FLASH_APP_SIZE)
+#define	FLASH_APPB_SIZE			(29*FLASH_SECTOR_SIZE)
 
-//boot info
-#define FLASH_BINFO_BASE		(FLASH_APP_BASE + FLASH_APP_SIZE)
+//boot info (0x7C000, 位置不变)
+#define FLASH_BINFO_BASE		(FLASH_APPB_BASE + FLASH_APPB_SIZE)
 #define	FLASH_BINFO_SIZE		(1*FLASH_SECTOR_SIZE)
 
 //user config
diff --git a/Project/GateWay/source/User/Src/Update.c b/Project/GateWay/source/User/Src/Update.c
index 7d10ef1..3f17192 100644
--- a/Project/GateWay/source/User/Src/Update.c
+++ b/Project/GateWay/source/User/Src/Update.c
@@ -19,6 +19,12 @@ void Update(uint8_t *PayLoad)
 
 	memcpy(&Req, PayLoad, sizeof(UpDataRequset_t));
 
+	/*固件大小校验: 为0或超出B区容量时拒绝升级, 不置标志不复位*/
+	if(Req.AppSize == 0 || Req.AppSize > FLASH_APPB_SIZE) {
+		U_DBG_LOG("AppSize invalid: %d (max %d)\r\n", (int)Req.AppSize, (int)FLASH_APPB_SIZE);
+		return;
+	}
+
 	/*读回现有boot参数，保留FirstRunFlag等字段*/
 	dev_boot_read_param(&cfg);
 	cfg.AppSize = Req.AppSize;