Single-chip microcomputer automatic switching bootstrap program dual-redundancy guarantee circuit and method

Abstract

The invention belongs to the technical field of embedded systems, and particularly relates to a dual-redundancy guarantee circuit and method for automatically switching bootstrap programs of a single-chip microcomputer. Comprising a single-chip microcomputer which comprises an internal program storage area, an internal RAM, a BOOT pin and a RESET pin; a bootstrap program is stored in the internal program storage area, and the bootstrap program is loaded to the internal RAM to be executed; by judging the state of the BOOT pin, the bootstrap program is switched from the internal program storage area to the external program storage area to be executed; the peripheral function circuit comprises an external program storage area, a watchdog reset circuit and a D flip-flop circuit; a bootstrap program is stored in the external program storage area, and a dog feeding signal is output to the watchdog reset circuit through the single chip microcomputer, so that the watchdog reset circuit generates a trigger signal. According to the method, the bootstrap program starting storage area is automatically switched to another bootstrap program starting storage area, so that the aims of detecting the abnormality of the bootstrap program and automatically switching the bootstrap program are fulfilled.

Description

Technical Field

[0001] The present invention belongs to the technical field of embedded systems, and particularly relates to a dual-redundancy protection circuit and method for automatically switching the boot program of a single-chip microcomputer. Background Art

[0002] With the wide application of embedded systems in the fields of industrial control, aerospace, automotive electronics, etc., the requirements for system reliability and security are increasing day by day. As the core control unit of an embedded system, the reliable operation of the single-chip microcomputer program is crucial. However, in practical applications, the single-chip microcomputer program may be abnormal due to various factors (such as electromagnetic interference, power supply fluctuations, memory failures, etc.), resulting in system failure and even serious consequences.

[0003] The traditional single-chip microcomputer program operation mechanism usually adopts a single program memory, and there is no effective fault tolerance mechanism during the program loading and running process. Once the program memory fails or the program loading fails, the system will not be able to run normally and it is difficult to recover. In order to improve system reliability, the following methods are usually adopted in the prior art: 1) Hardware redundancy: Use two sets of independent hardware systems, and judge whether the system fails by comparing the output results. Although this method can improve reliability, it has high cost, large volume and high power consumption, and it is difficult to be widely used in resource-constrained embedded systems.

[0004] 2) Software fault tolerance: Add error detection and recovery mechanisms to the program, such as watchdog timers, software traps, etc. This method is simple to implement, but it can only detect some types of faults and it is difficult to cope with serious faults such as program memory damage.

[0005] In view of the above situation, it is difficult for the prior art to effectively solve various fault problems that occur during the operation of the single-chip microcomputer program on the premise of ensuring system reliability, real-time performance and low cost. Therefore, there is an urgent need for a dual-redundancy protection circuit and method for automatically switching the boot program of a single-chip microcomputer, which can automatically, quickly and reliably switch to the backup program when the single-chip microcomputer program fails to ensure the normal operation of the system. Summary of the Invention

[0006] The purpose of the present invention is to provide a dual-redundancy protection circuit and method for automatically switching the boot program of a single-chip microcomputer. The present invention realizes the highly reliable operation of the single-chip microcomputer program by designing a dual-redundancy boot program structure and an automatic switching mechanism, and has important application value.

[0007] To solve the above technical problems, the present invention provides a dual-redundancy protection circuit for automatically switching the boot program of a single-chip microcomputer, including: The single-chip microcomputer includes an internal program storage area, an internal RAM, a BOOT pin, and a RESET pin; the internal program storage area stores a boot program and loads the boot program into the internal RAM for execution; by judging the state of the BOOT pin, the boot program is switched from the internal program storage area to the external program storage area for execution; The peripheral function circuit includes an external program storage area, a watchdog reset circuit, and a D flip-flop circuit; the external program storage area stores a boot program, and the single-chip microcomputer outputs a dog-feeding signal to the watchdog reset circuit to enable the watchdog reset circuit to generate a trigger signal. The D flip-flop circuit changes the output of the D flip-flop circuit by receiving the trigger signal to change the state of the BOOT pin; the RESET pin triggers the reset of the single-chip microcomputer under a low-level signal by receiving the trigger signal.

[0008] Preferably, the watchdog reset circuit includes: a watchdog chip U3, a capacitor Cap, and resistors R1 to R6; the pin of the watchdog chip U3 accesses the TGR signal and one ends of the resistor R1 and the resistor R2. The other end of the resistor R1 accesses the power supply VCC_3V, and the other end of the resistor R2 accesses the pin of the watchdog chip U3. The VCC pin of the watchdog chip U3 accesses the power supply VCC_3V and one end of the capacitor Cap. The other end of the capacitor Cap and the GND pin of the watchdog chip U3 are grounded together. The PFI pin of the watchdog chip U3 accesses one end of the resistor R6, and the other end of the resistor R6 is grounded. The pin of the watchdog chip U3 accesses one end of the resistor R5, and the other end of the resistor R5 is grounded. The WDI pin of the watchdog chip U3 accesses one end of the resistor R4, and the other end of the resistor R4 accesses the WDI signal. The pin of the watchdog chip U3 accesses one end of the resistor R3, and the other end of the resistor R3 accesses the SYS_RST signal.

[0009] Preferably, the model of the watchdog chip U3 is JSR706RD.

[0010] Preferably, the D flip-flop circuit includes: a D flip-flop chip U2, a resistor R9, and an inverter chip U1; the pin and the D1 pin of the D flip-flop chip U2 are commonly connected to the power supply VCC_3V. The CP1 pin of the D flip-flop chip U2 accesses the TGR signal. The pin of the D flip-flop chip U2 accesses the power supply VCC_3V. The Q1 pin of the D flip-flop chip U2 accesses the Q1 signal. The Q2 pin of the D flip-flop chip U2 accesses the 2A signal. The The pin is connected to the power supply VCC_3V. The CP2 pin of the D flip-flop chip U2 is connected to the 1Y signal. The D2 pin of the D flip-flop chip U2 is commonly connected to one end of the resistor R9 and the Q1 signal. The other end of the resistor R9 is grounded. The pin and the VCC pin of the D flip-flop chip U2 are commonly connected to the power supply VCC_3V; The 1A pin of the inverter chip U1 is connected to the TGR signal. The 1Y pin of the inverter chip U1 is connected to the 1Y signal. The 2A pin of the inverter chip U1 is connected to the 2A signal. The 2Y pin of the inverter chip U1 is connected to the BOOT0 signal. The VCC pin of the inverter chip U1 is connected to the power supply VCC_3V.

[0011] Preferably, the model of the D flip-flop chip U2 is 7RAC74, and the model of the inverter chip U1 is JRAC14.

[0012] Preferably, the single-chip microcomputer further includes: a single-chip microcomputer chip U4 and resistors R7 to R8; the BOOT0 pin and the BOOT1 pin of the single-chip microcomputer chip U4 are respectively connected in series with the resistor R8 and the resistor R7 and then commonly connected to the power supply VCC_3V. The RESET pin of the single-chip microcomputer chip U4 is connected to the SYS_RST signal. The GPIO pin of the single-chip microcomputer chip U4 is connected to the WDI signal. The VCC pin of the single-chip microcomputer chip U4 is connected to the power supply VCC_3V.

[0013] The present invention also provides a method for double-redundancy guarantee of automatic switching of the bootloader of a single-chip microcomputer. Executing a circuit for double-redundancy guarantee of automatic switching of the bootloader of a single-chip microcomputer as described above, includes the following steps: When the single-chip microcomputer is initially powered on, the bootloader defaults to running from the internal program storage area. When the bootloader runs normally, the program can be normally transferred to the internal RAM for execution, and the single-chip microcomputer will continuously feed the external watchdog reset circuit; When the bootloader runs abnormally, the bootloader cannot run normally in the internal RAM, resulting in the watchdog feeding signal output by the single-chip microcomputer being invalid. At this time, the external watchdog reset circuit generates a trigger signal, and the output of the D flip-flop is changed through this trigger signal to achieve the purpose of changing the state of the BOOT pin; At the same time, the single-chip microcomputer receives the reset trigger signal. When the reset is completed, the single-chip microcomputer detects the change of the BOOT pin, and the bootloader will switch from the internal program storage area to the external program storage area for running.

[0014] Preferably, when the single-chip microcomputer is powered on by default and when the bootloader runs abnormally for the first time in the internal storage area, the BOOT1 / BOOT0 state of the single-chip microcomputer is 11, and at this time, the bootloader starts running from the internal storage area.

[0015] Preferably, when the bootstrap program runs a second exception in the internal storage area, the BOOT1 / BOOT0 state of the single-chip microcomputer is 10, and at this time, the bootstrap program switches to run from the external storage area.

[0016] Compared with the prior art, the present invention has the following beneficial effects: When the single-chip microcomputer of the present invention is initially powered on, the bootstrap program defaults to run from the internal program storage area. When the bootstrap program runs normally, the program can be normally transferred to the internal RAM for execution, and the single-chip microcomputer will continuously feed the external watchdog reset circuit. Once the bootstrap program has a running exception and the program cannot run normally in the internal RAM, the watchdog feeding signal output by the single-chip microcomputer will fail. At this time, the external watchdog reset circuit generates a trigger signal, which will change the output of the D flip-flop to achieve the purpose of changing the state of the BOOT pin. At the same time, when the single-chip microcomputer receives the reset trigger signal, when the reset is completed, the single-chip microcomputer detects the change of the BOOT pin, and the bootstrap program switches to run from the external program storage area. By combining the single-chip microcomputer with the external watchdog circuit and the D flip-flop, the present invention can automatically switch the bootstrap program startup storage area to another bootstrap program startup storage area after the bootstrap program of the single-chip microcomputer has two exceptions, achieving the purpose of bootstrap program exception detection and automatic switching. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a functional block diagram of a dual-redundancy protection circuit for automatically switching the bootstrap program of a single-chip microcomputer according to the present invention.

[0018] Figure 2 is a schematic diagram of the watchdog reset circuit of the present invention.

[0019] Figure 3 is a schematic diagram of the D flip-flop circuit of the present invention; wherein (a) is a schematic diagram of the D flip-flop chip U2, and (b) is a schematic diagram of the inverter chip U1.

[0020] Figure 4 is a schematic diagram of the single-chip microcomputer of the present invention.

[0021] Figure 5 is a flowchart of a method for automatically switching the bootstrap program of a single-chip microcomputer with dual-redundancy protection according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0022] The following further describes the present invention in detail with reference to the accompanying drawings and specific embodiments. According to the following description, the advantages and features of the present invention will be clearer. It should be noted that the drawings are all in a very simplified form and use non-precise scales, only for the purpose of conveniently and clearly assisting in explaining the purpose of the embodiments of the present invention.

[0023] Such as Figure 1As shown in the figure, an embodiment of the present invention provides a dual-redundancy protection circuit for automatically switching the bootloader of a single-chip microcomputer, including: A single-chip microcomputer, including an internal program storage area, an internal RAM, a BOOT pin, and a RESET pin; the internal program storage area stores a bootloader and loads the bootloader into the internal RAM for execution; by judging the state of the BOOT pin, the bootloader is switched from the internal program storage area to the external program storage area for execution; A peripheral function circuit, including an external program storage area, a watchdog reset circuit, and a D flip-flop circuit; the external program storage area stores a bootloader, and the single-chip microcomputer outputs a watchdog feeding signal to the watchdog reset circuit to enable the watchdog reset circuit to generate a trigger signal. The D flip-flop circuit changes the output of the D flip-flop circuit by receiving the trigger signal to change the state of the BOOT pin; the RESET pin triggers the reset of the single-chip microcomputer under a low-level signal by receiving the trigger signal.

[0024] The BOOT startup mode of the single-chip microcomputer is shown in Table 1. In order to achieve automatic switching of the bootloader and dual-redundancy protection, the same bootloader code needs to be stored in both the external program storage area and the internal program storage area.

[0025] Table 1 BOOT1 BOOT0 Startup Mode 0 0 Internal RAM Startup 1 0 External Program Memory Startup 1 1 Internal Program Memory Startup As Figure 2 shown, the watchdog reset circuit includes: a watchdog chip U3, a capacitor Cap, and resistors R1 to R6; the pin of the watchdog chip U3 is connected to the TGR signal and one ends of resistors R1 and R2. The other end of resistor R1 is connected to the power supply VCC_3V, and the other end of resistor R2 is connected to the pin of the watchdog chip U3. The VCC pin of the watchdog chip U3 is connected to the power supply VCC_3V and one end of the capacitor Cap. The other end of the capacitor Cap and the GND pin of the watchdog chip U3 are grounded together. The PFI pin of the watchdog chip U3 is connected to one end of resistor R6, and the other end of resistor R6 is grounded. The pin of the watchdog chip U3 is connected to one end of resistor R5, and the other end of resistor R5 is grounded. The WDI pin of the watchdog chip U3 is connected to one end of resistor R4, and the other end of resistor R4 is connected to the WDI signal. The pin of the watchdog chip U3 is connected to one end of resistor R3, and the other end of resistor R3 is connected to the SYS_RST signal.

[0026] Further, the model of the watchdog chip U3 is JSR706RD.

[0027] As Figure 3As shown, the D flip-flop circuit includes: a D flip-flop chip U2, a resistor R9, and an inverter chip U1; the pin and the D1 pin of the D flip-flop chip U2 are commonly connected to the power supply VCC_3V, the CP1 pin of the D flip-flop chip U2 is connected to the TGR signal, and the pin of the D flip-flop chip U2 is connected to the power supply VCC_3V, the Q1 pin of the D flip-flop chip U2 is connected to the Q1 signal, the Q2 pin of the D flip-flop chip U2 is connected to the 2A signal, and the pin of the D flip-flop chip U2 is connected to the power supply VCC_3V, the CP2 pin of the D flip-flop chip U2 is connected to the 1Y signal, the D2 pin of the D flip-flop chip U2 is commonly connected to one end of the resistor R9 and the Q1 signal, the other end of the resistor R9 is grounded, and the pin and the VCC pin of the D flip-flop chip U2 are commonly connected to the power supply VCC_3V; The 1A pin of the inverter chip U1 is connected to the TGR signal, the 1Y pin of the inverter chip U1 is connected to the 1Y signal, the 2A pin of the inverter chip U1 is connected to the 2A signal, the 2Y pin of the inverter chip U1 is connected to the BOOT0 signal, and the VCC pin of the inverter chip U1 is connected to the power supply VCC_3V.

[0028] Furthermore, the model of the D flip-flop chip U2 is 7RAC74, and the model of the inverter chip U1 is JRAC14.

[0029] As Figure 4 shown, the single-chip microcomputer further includes: a single-chip microcomputer chip U4 and resistors R7 to R8; the BOOT0 pin and the BOOT1 pin of the single-chip microcomputer chip U4 are respectively connected in series with the resistor R8 and the resistor R7 and then commonly connected to the power supply VCC_3V, the RESET pin of the single-chip microcomputer chip U4 is connected to the SYS_RST signal, the GPIO pin of the single-chip microcomputer chip U4 is connected to the WDI signal, and the VCC pin of the single-chip microcomputer chip U4 is connected to the power supply VCC_3V.

[0030] As Figures 2 to 4 shown, the purpose of the present invention is that after an exception occurs twice during the operation of the bootloader program in a storage area, it can automatically switch to the operation of the bootloader program in another storage area. In the default power-on state of the single-chip microcomputer, the BOOT1 and BOOT0 of the single-chip microcomputer are in the state of 11 under the action of the pull-up resistors. As can be seen from Table 1, the bootloader code starts to run and execute from the internal storage area. According to the characteristics of the external watchdog reset circuit JSR706RD, when Figure 2 there is a timed flipped level input at the WDI pin of the device JSR706RD, the 8th pin will continuously output a high level, and the device JSR706RD outputs a high-level TRG signal; when there is no timed flipped level input at the WDI pin, the 8th A low level will be continuously output. The device JSR706RD generates a TRG level signal that is first pulled low and then pulled high. The TRG signal is given to After the signal, the device JSR706RD will output a RESET pull-down signal at pin 7. From Figure 1 It can be seen that when the Bootloader runs normally in the internal storage area after the single-chip microcomputer is powered on, the program will be automatically loaded into the internal RAM to execute the function code, so that the GPIO pin can output a flipped level signal regularly. When the bootloader of the single-chip microcomputer runs abnormally in the internal storage area, the program cannot be automatically loaded into the internal RAM to execute the function code, resulting in the inability of the GPIO pin of the single-chip microcomputer to output a flipped level signal regularly. In this case, a TRG level signal that is first pulled low and then pulled high will be generated. From the characteristics of the D flip-flop 7RAC74, when there is a rising edge at the pins CP1 / CP2, the device 7RAC74 will synchronize the signal states of the pins D1 / D2 to the pins Q1 / Q2 and maintain the state until the next rising edge of CP1 / CP2. From the characteristics of the inverter JRAC14, the output pins 1Y / 2Y output the inverted states of the pins 1A / 2A.

[0031] By combining Figures 2 to 4 According to the circuit principle, after power-on, the states of the single-chip microcomputer BOOT1 / BOOT0 are 11 under the action of the pull-up resistors. When the bootloader runs abnormally for the first time in the internal storage area, the first TRG signal will be generated. At the falling edge of the TRG, due to the action of the inverter JRAC14, there will be a rising edge trigger on CP2. Under the action of the pull-down resistor, the input state of D2 is 0, so the output state of Q2 is 0. After passing through the inverter, the state of BOOT0 remains 1. At the rising edge of the first TRG signal, there will be a rising edge trigger on CP1. Under the action of the pull-up resistor, the input state of D1 is 1, so the output state of Q1 is 1. It can be seen that when the bootloader runs abnormally for the first time in the internal storage area, the states of BOOT1 / BOOT0 remain 11, and the single-chip microcomputer is triggered to RESET under the low-level action of the TRG signal, and the bootloader still runs from the internal storage area. If the internal storage area returns to normal, the bootloader can run normally.

[0032] The bootloader runs in the internal storage area and generates a second exception. Under the action of the device JSR706RD, a second TRG signal will be generated. At the falling edge of the TRG, due to the action of the inverter JRAC14, there will be a rising edge trigger on CP2. When the first TRG signal is triggered, Q1 maintains the output state 1, that is, D2 has a high-level input. At this time, the output state of Q2 is 1. After the action of the inverter, the BOOT0 state is 0. It can be seen that when the bootloader runs the second exception in the internal storage area, the BOOT1 / BOOT0 state changes to 10, and the single-chip microcomputer is triggered to reset by the low level of the TRG signal. As can be seen from Table 1, the bootloader switches to run from the external storage area.

[0033] As Figure 5 shown, the embodiment of the present invention also provides a method for double-redundancy guarantee of automatic switching of the bootloader of a single-chip microcomputer, including the following process: When the single-chip microcomputer is initially powered on, the bootloader defaults to run from the internal program storage area. When the bootloader runs normally, the program can be normally transferred to the internal RAM for execution, and the single-chip microcomputer will continuously feed the external watchdog reset circuit. Once the bootloader has a running exception and the program cannot run normally in the internal RAM, the watchdog feeding signal output by the single-chip microcomputer will fail. At this time, the external watchdog reset circuit generates a trigger signal, which will change the output of the D flip-flop to achieve the purpose of changing the state of the BOOT pin. At the same time, when the single-chip microcomputer receives the reset trigger signal, when the reset is completed, the single-chip microcomputer detects the change of the BOOT pin, and the bootloader switches to run from the external program storage area.

[0034] In summary, the present invention uses a single-chip microcomputer to achieve the switching of the magnetic storage area of the bootloader of the single-chip microcomputer through the design of an external hardware circuit; at the same time, the single-chip microcomputer has a mechanism to automatically identify the exception of the bootloader multiple times and then switch the bootloader. The same bootloader is stored in both the internal memory and the external memory of the single-chip microcomputer. The design of the present invention uses an external watchdog circuit, a D flip-flop circuit, and a single-chip microcomputer software logic circuit to achieve the purpose of detecting and automatically switching the bootloader exception.

[0035] The above description is only a description of the preferred embodiments of the present invention, and does not limit the scope of the present invention in any way. Any changes and modifications made by those of ordinary skill in the field of the present invention according to the above disclosure are within the protection scope of the claims.

Claims

1. A dual-redundancy protection circuit for automatic switching of boot programs of a single-chip microcomputer, characterized in that: include: A single-chip microcomputer comprises an internal program storage area, an internal RAM, a BOOT pin and a RESET pin; the internal program storage area stores a boot program, and the boot program is loaded into the internal RAM for execution; by judging the state of the BOOT pin, the boot program is switched from the internal program storage area to the external program storage area for execution; The peripheral function circuit includes an external program storage area, a watchdog reset circuit and a D trigger circuit; the external program storage area stores a boot program, and the single-chip microcomputer outputs a dog feeding signal to the watchdog reset circuit, so that the watchdog reset circuit generates a trigger signal, and the D trigger circuit changes the output of the D trigger circuit by receiving the trigger signal, thereby changing the state of the BOOT pin; the RESET pin triggers the reset of the single-chip microcomputer under a low-level signal by receiving the trigger signal.

2. A single chip computer automatic switching boot program dual redundancy protection circuit as claimed in claim 1, characterized in that: The watchdog reset circuit includes: a watchdog chip U3, a capacitor Cap and resistors R1 to R6; The pin is connected to the TGR signal and one end of the resistor R1 and the resistor R2. The other end of the resistor R1 is connected to the power supply VCC_3V, and the other end of the resistor R2 is connected to the watchdog chip U3. The VCC pin of the watchdog chip U3 is connected to the power supply VCC_3V and one end of the capacitor Cap. The other end of the capacitor Cap and the GND pin of the watchdog chip U3 are grounded together. The PFI pin of the watchdog chip U3 is connected to one end of the resistor R6. The other end of the resistor R6 is grounded. The pin is connected to one end of the resistor R5, and the other end of the resistor R5 is grounded. The WDI pin of the watchdog chip U3 is connected to one end of the resistor R4, and the other end of the resistor R4 is connected to the WDI signal. The pin is connected to one end of resistor R3, and the other end of resistor R3 is connected to the SYS_RST signal.

3. A single chip computer automatic switching boot program dual redundancy protection circuit as claimed in claim 2, characterized in that: The model of the watchdog chip U3 is JSR706RD.

4. A single chip computer automatic switching boot program dual redundancy protection circuit as claimed in claim 1, characterized in that: The D trigger circuit includes: a D trigger chip U2, a resistor R9 and an inverter chip U1; The pin and D1 pin are connected to the power supply VCC_3V, the CP1 pin of the D flip-flop chip U2 is connected to the TGR signal, and the The pin is connected to the power supply VCC_3V, the Q1 pin of the D flip-flop chip U2 is connected to the Q1 signal, the Q2 pin of the D flip-flop chip U2 is connected to the 2A signal, and the The pin is connected to the power supply VCC_3V, the CP2 pin of the D flip-flop chip U2 is connected to the 1Y signal, the D2 pin of the D flip-flop chip U2 is connected to one end of the resistor R9 and the Q1 signal, the other end of the resistor R9 is grounded, and the The pin and the VCC pin are connected to the power supply VCC_3V; The 1A pin of the inverter chip U1 is connected to the TGR signal, the 1Y pin of the inverter chip U1 is connected to the 1Y signal, the 2A pin of the inverter chip U1 is connected to the 2A signal, the 2Y pin of the inverter chip U1 is connected to the BOOT0 signal, and the VCC pin of the inverter chip U1 is connected to the power supply VCC_3V.

5. A single chip computer automatic switching boot program dual redundancy protection circuit as claimed in claim 4, characterized in that: The model of the D flip-flop chip U2 is 7RAC74, and the model of the inverter chip U1 is JRAC14.

6. A single chip computer automatic switching boot program dual redundancy protection circuit as claimed in claim 1, characterized in that: The single-chip microcomputer also includes: a single-chip microcomputer chip U4 and resistors R7~R8; the BOOT0 pin and BOOT1 pin of the single-chip microcomputer chip U4 are respectively connected in series with resistors R8 and R7 and then connected to the power supply VCC_3V, the RESET pin of the single-chip microcomputer chip U4 is connected to the SYS_RST signal, the GPIO pin of the single-chip microcomputer chip U4 is connected to the WDI signal, and the VCC pin of the single-chip microcomputer chip U4 is connected to the power supply VCC_3V.

7. A method for automatically switching a boot program of a single-chip microcomputer with dual redundancy protection, executing a circuit for automatically switching a boot program of a single-chip microcomputer with dual redundancy protection as claimed in any one of claims 1 to 6, characterized in that: The steps include: When the MCU is initially powered on, the boot program runs from the internal program storage area by default. When the boot program runs normally, the program can be normally transferred to the internal RAM for execution, and the MCU will continue to feed the external watchdog reset circuit. When the boot program runs abnormally, it cannot run normally in the internal RAM, causing the watchdog feeding signal output by the microcontroller to become invalid. At this time, the external watchdog reset circuit generates a trigger signal, which changes the output of the D flip-flop through this trigger signal to achieve the purpose of changing the BOOT pin state; At the same time, the microcontroller receives a reset trigger signal. When the reset is completed, the microcontroller detects the change of the BOOT pin, and the boot program will switch from the internal program storage area to the external program storage area to run.

8. A method for automatically switching boot programs of a single chip microcomputer as claimed in claim 7, characterized in that: When the single-chip microcomputer is powered on in the default state and when the boot program runs abnormally for the first time in the internal storage area, the BOOT1 / BOOT0 states of the single-chip microcomputer are both 11, and the boot program starts running from the internal storage area.

9. A method for automatically switching boot programs of a single-chip computer as claimed in claim 7, characterized in that: When the boot program runs abnormally for the second time in the internal storage area, the BOOT1 / BOOT0 state of the single-chip microcomputer is 10, and the boot program switches to running from the external storage area.

Images