The MultiBoot image is first loaded at power-up from an upper address space. If this image fails configuration, the device automatically triggers a fallback to the golden image stored at address 0. This enables systems to upgrade their own bit files and then boot from power-up to the latest image. The upgrade process can occur, and then the design can trigger a reload of the most recent version of the design. Fallback logic ensures the system recovers from any failure to load the MultiBoot image and loads the golden image. The golden image can then fix any errors in the flash and trigger a configuration from the MultiBoot image again.
The following figure shows the flow for the initial setup of the MultiBoot image.