The documents needed are:
http://www.altera.com/literature/hb/nios2/qts_qii55017.pdf http://www.altera.com/literature/hb/cyc3/cyc3_ciii51016.pdf http://www.altera.com/literature/an/an521.pdf Basically the FPGA will always boot a "factory" image first. It is up to this "factory" image to configure the remote update core to attempt to boot another image known as the "application" image. The remote update core has sufficient circuitry to detect if a failure occurs while attempting to run the "application" image; in which case the "factory" image will be rebooted.
So your "factory" image needs to have enough brains to know why it booted and whether or not to try to load an "application" image. It can detect what caused the boot by reading status bits in the remote update core.
While running the "application" image, you can boot back to the "factory" image (which you might do if you've remotely updated the "application" image and want to restart).
Jake