OTA时，由USER2.BIN更新USER1.BIN出错，无法启动怎么解决？

BOOT.BIN用的1.5版的．
SDK用的1.5.2,由USER1.BIN更新USER2.BIN时正常，重启后能运行到USER2.BIN，但随即从USER2.BIN更新USER1.BIN时，FLASH超时，触发WDT RESET ，系统一直报错，无法启动．重新通过串口刷一次USER1.BIN，重启后是从USER2.BIN启动．相关日志如下：

第一次启动信息：
ets Jan  8 2013,rst cause:2, boot mode:(3,7)

load 0x40100000, len 1856, room 16
tail 0
chksum 0x63
load 0x3ffe8000, len 776, room 8
tail 0
chksum 0x02
load 0x3ffe8310, len 552, room 8
tail 0
chksum 0x79
csum 0x79

2nd boot version : 1.5
  SPI Speed      : 40MHz
  SPI Mode       : QIO
  SPI Flash Size & Map: 8Mbit(512KB+512KB)
jump to run user1 @ 1000

SDK version:1.5.2(80914727)
------------------------------------
OAT升级USER2.BIN部分日志：
HEAD /agent/update/user2.bin HTTP/1.1
Host: 192.168.1.140
Connection: close
Content-Length: 0
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4

pusrdata = HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"236356-1456840445390"
Last-Modified: Tue, 01 Mar 2016 13:54:05 GMT
Content-Type: application/octet-stream
Content-Length: 236356
Date: Tue, 01 Mar 2016 13:55:07 GMT
Connection: close


sumlength = 236356
sec_block 58
..........................................................upgrade_get_sum_disconcb 41696
erase sector=129 ok
erase sector=130 ok
erase sector=131 ok
erase sector=132 ok
erase sector=133 ok
---------------------------------------------
执行OAT升级USER2.BIN时，启动信息：
totallen = 236356
upgrade file download finished.
flash_crc = 896672383
img_crc = 896672383
upgrade_check
upgrade successful
reboot to use2
state: 5 -> 0 (0)
rm 0
pm close 7
del if0
usl

ets Jan  8 2013,rst cause:2, boot mode:(3,7)

load 0x40100000, len 1856, room 16
tail 0
chksum 0x63
load 0x3ffe8000, len 776, room 8
tail 0
chksum 0x02
load 0x3ffe8310, len 552, room 8
tail 0
chksum 0x79
csum 0x79

2nd boot version : 1.5
  SPI Speed      : 40MHz
  SPI Mode       : QIO
  SPI Flash Size & Map: 8Mbit(512KB+512KB)
jump to run user2 @ 81000

SDK version:1.5.2(80914727)
----------------------------------------------
再次执行OAT，升级USER1.BIN日志信息：
HEAD /agent/update/user1.bin HTTP/1.1
Host: 192.168.1.140
Connection: close
Content-Length: 0
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4

pusrdata = HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"236356-1456840451625"
Last-Modified: Tue, 01 Mar 2016 13:54:11 GMT
Content-Type: application/octet-stream
Content-Length: 236356
Date: Tue, 01 Mar 2016 13:55:28 GMT
Connection: close


sumlength = 236356
sec_block 58
..........................................................upgrade_get_sum_disconcb 41696
erase sector=1 ok

ets Jan  8 2013,rst cause:4, boot mode:(3,7)

wdt reset
load 0x40100000, len 1856, room 16
tail 0
chksum 0x63
load 0x3ffe8000, len 776, room 8
tail 0
chksum 0x02
load 0x3ffe8310, len 552, room 8
tail 0
chksum 0x79
csum 0x79

2nd boot version : 1.5
  SPI Speed      : 40MHz
  SPI Mode       : QIO
  SPI Flash Size & Map: 8Mbit(512KB+512KB)
jump to run user2 @ 81000

Fatal exception (0):
epc1=0x40201a18, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000
Fatal exception (0):
epc1=0x40201a18, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000
Fatal exception (0):
epc1=0x40201a18, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000
Fatal exception (0):
epc1=0x40201a18, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000
Fatal exception (0):
epc1=0x40201a18, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000
Fatal exception (0):
epc1=0x40201a18, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000
Fatal exception (0):
epc1=0x40201a18, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000
...................
后面一直是这个错误信息，重新上电直接报这个错误，无法启动．
通过串口单独烧录USER1.BIN到0X01000后，启动成功，启动信息：
ets Jan  8 2013,rst cause:2, boot mode:(3,6)

load 0x40100000, len 1856, room 16
tail 0
chksum 0x63
load 0x3ffe8000, len 776, room 8
tail 0
chksum 0x02
load 0x3ffe8310, len 552, room 8
tail 0
chksum 0x79
csum 0x79

2nd boot version : 1.5
  SPI Speed      : 40MHz
  SPI Mode       : QIO
  SPI Flash Size & Map: 8Mbit(512KB+512KB)
jump to run user2 @ 81000
don't use rtc mem data