Remote update question

Hi,

I am trying to implement remote updating on the Cyclone IV using a EPCS flash. The EPCS should have a safe image (HW and SW) and an application image (HW and SW).

As far as i understand the safe image should always start after powering up and this one should start the application image though a reconfiguration cycle (using the SOPC remote update Cyclone III component).

Several documentation tells me that if reconfiguration fails that the safe image is loaded again.

However, how to prevent an endless reconfiguration loop in that case? For example when the application image has been destroyed in flash.

How can I detect this issue in order to prevent another reconfiguration cycle and continue starting my Nios code to flash another application image?

regards