MAX 10 – Sporadic configuration failure after firmware update

I am using the internal configuration flash for field firmware updates. The factory/golden image is programmed via JTAG during production and write-protected, while the application image is updated in CFM2.

Sporadically, an update fails and the FPGA subsequently cannot configure from either the factory or application image. Reprogramming the internal flash via JTAG restores normal operation.

Expected: If the application update is interrupted or corrupted, the protected factory image should remain bootable as a fallback.

Support request: What could cause both images to become unbootable after a failed update? Could an interrupted flash operation or power-down with excessive supply-voltage slew rate affect flash/configuration data required for fallback? Please advise which power-sequencing, slew-rate, brownout, or flash-update requirements and diagnostics should be checked.