Nonstop update (NSU) is a service robot architecture to upgrade running robot controllers without suspending the services of robot systems. Its target application is mobile robots operating in remote or hazardous environments where suspension of ongoing missions is unacceptable or human intervention for changing or debugging programs is not easy. The present paper introduces NSU from a point of view of both safety and performance. The present paper defines the safety in NSU as a property that controller programs should not suspend or run away because of update-related sources. Safety issues such as deadlocks, module dependency, discontinuity of behavior between before and after update, and delays due to update overhead time are addressed. Safety and performance of NSU is examined and demonstrated by using three practical mobile systems: a mobile manipulator for a power assist system, a hexapod legged mobile robot, and a biped walking robot with wheeled legs.