A dual-redundancy guarantee circuit and method for automatically switching boot programs of a single-chip microcomputer

Abstract

The present invention belongs to the technical field of embedded systems, and particularly relates to a dual-redundancy protection circuit and method for automatically switching boot programs in a single-chip microcomputer. The circuit comprises: a single-chip microcomputer, including an internal program storage area, internal RAM, a BOOT pin, and a RESET pin; the internal program storage area stores a boot program, and the boot program is loaded into the internal RAM for execution; the boot program is switched from the internal program storage area to an external program storage area for execution by judging the state of the BOOT pin; a peripheral functional circuit comprises an external program storage area, a watchdog reset circuit, and a D-type flip-flop circuit; the external program storage area stores a boot program, and the single-chip microcomputer outputs a watchdog reset signal to the watchdog reset circuit, causing the watchdog reset circuit to generate a trigger signal. The present invention automatically switches the boot program startup storage area to another boot program startup storage area, thereby achieving the purpose of detecting boot program anomalies and automatically switching.

Description

Technical Field

[0001] The invention belongs to the technical field of embedded systems, and in particular relates to a dual-redundancy guarantee circuit and method for automatically switching a boot program of a single-chip computer. Background Art

[0002] With the widespread adoption of embedded systems in industrial control, aerospace, automotive electronics, and other fields, the requirements for system reliability and security are increasing. As the core control unit of embedded systems, the reliable operation of microcontroller programs is crucial. However, in practical applications, microcontroller programs may experience anomalies due to various factors (such as electromagnetic interference, power supply fluctuations, and memory failures), leading to system failures and even serious consequences.

[0003] Traditional single-chip microcomputer program execution mechanisms typically use a single program memory, lacking effective fault-tolerance mechanisms during program loading and execution. Once a program memory failure occurs or program loading fails, the system will not function properly and recovery is difficult. To improve system reliability, the following methods are commonly used in existing technologies:

[0004] 1) Hardware redundancy: Using two independent hardware systems and comparing their outputs to determine if a system failure has occurred. While this approach can improve reliability, it is costly, bulky, and consumes a lot of power, making it difficult to widely use in resource-constrained embedded systems.

[0005] 2) Software fault tolerance: Incorporating error detection and recovery mechanisms into the program, such as watchdog timers and software traps. This method is simple to implement, but can only detect some types of faults and is difficult to handle for severe faults such as program memory corruption.

[0006] Given the above situation, existing technologies have difficulty effectively solving various fault problems that occur during the operation of single-chip microcomputer programs while ensuring system reliability, real-time performance, and low cost. Therefore, there is an urgent need for a circuit and method for automatically switching the boot program of a single-chip microcomputer to ensure dual redundancy. This circuit and method can automatically, quickly, and reliably switch to the backup program when the single-chip microcomputer program fails, ensuring the normal operation of the system. Summary of the Invention

[0007] The purpose of the present invention is to provide a dual-redundancy protection circuit and method for automatically switching the boot program of a single-chip microcomputer. The present invention realizes high-reliability operation of the single-chip microcomputer program by designing a dual-redundancy boot program structure and an automatic switching mechanism, and has important application value.

[0008] To solve the above technical problems, the present invention provides a single chip microcomputer automatic switching boot program dual redundancy protection circuit, comprising:

[0009] A single-chip microcomputer includes an internal program storage area, an internal RAM, a BOOT pin, and a RESET pin; the internal program storage area stores a boot program, and the boot program is loaded into the internal RAM for execution; and the boot program is switched from the internal program storage area to the external program storage area for execution by determining the state of the BOOT pin;

[0010] The peripheral functional circuit includes an external program storage area, a watchdog reset circuit and a D-type flip-flop circuit; the external program storage area stores a boot program, and the single-chip microcomputer outputs a dog-feeding signal to the watchdog reset circuit, so that the watchdog reset circuit generates a trigger signal. The D-type flip-flop circuit changes the output of the D-type flip-flop circuit by receiving the trigger signal, thereby changing the state of the BOOT pin; the RESET pin triggers the reset of the single-chip microcomputer under a low-level signal by receiving the trigger signal.

[0011] Preferably, the watchdog reset circuit includes: a watchdog chip U3, a capacitor Cap and resistors R1 to R6; the watchdog chip U3 The pin is connected to the TGR signal and one end of the resistor R1 and the resistor R2. The other end of the resistor R1 is connected to the power supply VCC_3V, and the other end of the resistor R2 is connected to the watchdog chip U3. Pin, the VCC pin of the watchdog chip U3 is connected to the power supply VCC_3V and one end of the capacitor Cap, the other end of the capacitor Cap and the GND pin of the watchdog chip U3 are grounded together, the PFI pin of the watchdog chip U3 is connected to one end of the resistor R6, the other end of the resistor R6 is grounded, the watchdog chip U3 The pin is connected to one end of the resistor R5, and the other end of the resistor R5 is grounded. The WDI pin of the watchdog chip U3 is connected to one end of the resistor R4, and the other end of the resistor R4 is connected to the WDI signal. The pin is connected to one end of the resistor R3, and the other end of the resistor R3 is connected to the SYS_RST signal.

[0012] Preferably, the model of the watchdog chip U3 is JSR706RD.

[0013] Preferably, the D trigger circuit includes: a D trigger chip U2, a resistor R9 and an inverter chip U1; the D trigger chip U2 The pin and D1 pin are connected to the power supply VCC_3V, the CP1 pin of the D flip-flop chip U2 is connected to the TGR signal, and the D flip-flop chip U2 The pin is connected to the power supply VCC_3V, the Q1 pin of the D flip-flop chip U2 is connected to the Q1 signal, the Q2 pin of the D flip-flop chip U2 is connected to the 2A signal, and the D flip-flop chip U2 The pin is connected to the power supply VCC_3V, the CP2 pin of the D flip-flop chip U2 is connected to the 1Y signal, the D2 pin of the D flip-flop chip U2 is connected to one end of the resistor R9 and the Q1 signal, the other end of the resistor R9 is grounded, and the D flip-flop chip U2 The pin and the VCC pin are connected to the power supply VCC_3V;

[0014] The 1A pin of the inverter chip U1 is connected to the TGR signal, the 1Y pin of the inverter chip U1 is connected to the 1Y signal, the 2A pin of the inverter chip U1 is connected to the 2A signal, the 2Y pin of the inverter chip U1 is connected to the BOOT0 signal, and the VCC pin of the inverter chip U1 is connected to the power supply VCC_3V.

[0015] Preferably, the model of the D flip-flop chip U2 is 7RAC74, and the model of the inverter chip U1 is JRAC14.

[0016] Preferably, the single-chip microcomputer also includes: a single-chip microcomputer chip U4 and resistors R7~R8; the BOOT0 pin and BOOT1 pin of the single-chip microcomputer chip U4 are respectively connected in series with resistor R8 and resistor R7 and are connected to the power supply VCC_3V together, the RESET pin of the single-chip microcomputer chip U4 is connected to the SYS_RST signal, the GPIO pin of the single-chip microcomputer chip U4 is connected to the WDI signal, and the VCC pin of the single-chip microcomputer chip U4 is connected to the power supply VCC_3V.

[0017] The present invention also provides a method for automatically switching a boot program of a single-chip microcomputer with dual redundancy protection, which includes the following steps:

[0018] When the MCU is initially powered on, the boot program runs from the internal program storage area by default. When the boot program runs normally, the program can be normally transferred to the internal RAM for execution, and the MCU will continue to feed the external watchdog reset circuit.

[0019] When the boot program runs abnormally, it cannot run normally in the internal RAM, causing the watchdog feeding signal output by the microcontroller to become invalid. At this time, the external watchdog reset circuit generates a trigger signal, which changes the output of the D flip-flop through this trigger signal to achieve the purpose of changing the BOOT pin state;

[0020] At the same time, the microcontroller receives a reset trigger signal. When the reset is completed, the microcontroller detects the change of the BOOT pin, and the boot program will switch from the internal program storage area to the external program storage area to run.

[0021] Preferably, when the single-chip microcomputer is in the default state after power-on and when the boot program runs abnormally for the first time in the internal storage area, the BOOT1 / BOOT0 status of the single-chip microcomputer is 11, and the boot program starts running from the internal storage area.

[0022] Preferably, when the boot program runs abnormally for the second time in the internal storage area, the BOOT1 / BOOT0 state of the single chip microcomputer is 10, and the boot program switches to running from the external storage area.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] When the single-chip microcomputer of the present invention is initially powered on, the boot program defaults to running from the internal program storage area. When the boot program runs normally, the program can be normally transferred to the internal RAM for execution, and the single-chip microcomputer will continue to feed the dog to the external watchdog reset circuit. Once the boot program has an abnormal operation, the program cannot run normally in the internal RAM, causing the watchdog feeding signal output by the single-chip microcomputer to become invalid. At this time, the external watchdog reset circuit generates a trigger signal, and this signal will change the D flip-flop output, thereby achieving the purpose of changing the BOOT pin state. At the same time, the single-chip microcomputer receives the reset trigger signal. When the reset is completed, the single-chip microcomputer detects the change in the BOOT pin, and the boot program switches to run from the external program storage area. The present invention can automatically switch the boot program startup storage area to another boot program startup storage area after two abnormalities occur in the single-chip microcomputer boot program by combining the single-chip microcomputer with the external watchdog circuit and the D flip-flop, thereby achieving the purpose of boot program abnormality detection and automatic switching. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 The present invention is a functional block diagram of a dual-redundancy protection circuit for automatically switching boot programs of a single-chip computer.

[0026] Figure 2 It is a schematic diagram of the watchdog reset circuit of the present invention.

[0027] Figure 3 1 is a schematic diagram of a D flip-flop circuit of the present invention; (a) is a schematic diagram of a D flip-flop chip U2, and (b) is a schematic diagram of an inverter chip U1.

[0028] Figure 4 It is a schematic diagram of the single chip microcomputer of the present invention.

[0029] Figure 5 The present invention is a flow chart of a method for automatically switching a boot program of a single chip computer and ensuring dual redundancy. DETAILED DESCRIPTION

[0030] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The advantages and features of the present invention will become more apparent from the following description. It should be noted that the drawings are greatly simplified and not to exact scale, and are only used to facilitate and clearly illustrate the embodiments of the present invention.

[0031] like Figure 1 As shown, an embodiment of the present invention provides a single-chip microcomputer automatic switching boot program dual redundancy protection circuit, including:

[0032] A single-chip microcomputer includes an internal program storage area, an internal RAM, a BOOT pin, and a RESET pin; the internal program storage area stores a boot program, and the boot program is loaded into the internal RAM for execution; and the boot program is switched from the internal program storage area to the external program storage area for execution by determining the state of the BOOT pin;

[0033] The peripheral functional circuit includes an external program storage area, a watchdog reset circuit and a D-type flip-flop circuit; the external program storage area stores a boot program, and the single-chip microcomputer outputs a dog-feeding signal to the watchdog reset circuit, so that the watchdog reset circuit generates a trigger signal. The D-type flip-flop circuit changes the output of the D-type flip-flop circuit by receiving the trigger signal, thereby changing the state of the BOOT pin; the RESET pin triggers the reset of the single-chip microcomputer under a low-level signal by receiving the trigger signal.

[0034] The MCU BOOT startup mode is shown in Table 1. In order to achieve automatic switching of the boot program and dual redundancy protection, the same boot program code needs to be stored in both the external program storage area and the internal program storage area.

[0035] Table 1

[0036] BOOT1 BOOT0 Startup Mode 0 0 Internal RAM boot 1 0 External program memory area startup 1 1 Internal program memory area starts

[0037] like Figure 2 As shown, the watchdog reset circuit includes: a watchdog chip U3, a capacitor Cap and resistors R1 to R6; the watchdog chip U3 The pin is connected to the TGR signal and one end of the resistor R1 and the resistor R2. The other end of the resistor R1 is connected to the power supply VCC_3V, and the other end of the resistor R2 is connected to the watchdog chip U3. Pin, the VCC pin of the watchdog chip U3 is connected to the power supply VCC_3V and one end of the capacitor Cap, the other end of the capacitor Cap and the GND pin of the watchdog chip U3 are grounded together, the PFI pin of the watchdog chip U3 is connected to one end of the resistor R6, the other end of the resistor R6 is grounded, the watchdog chip U3 The pin is connected to one end of the resistor R5, and the other end of the resistor R5 is grounded. The WDI pin of the watchdog chip U3 is connected to one end of the resistor R4, and the other end of the resistor R4 is connected to the WDI signal. The pin is connected to one end of the resistor R3, and the other end of the resistor R3 is connected to the SYS_RST signal.

[0038] Furthermore, the model of the watchdog chip U3 is JSR706RD.

[0039] like Figure 3 As shown, the D trigger circuit includes: a D trigger chip U2, a resistor R9 and an inverter chip U1; the D trigger chip U2 The pin and D1 pin are connected to the power supply VCC_3V, the CP1 pin of the D flip-flop chip U2 is connected to the TGR signal, and the D flip-flop chip U2 The pin is connected to the power supply VCC_3V, the Q1 pin of the D flip-flop chip U2 is connected to the Q1 signal, the Q2 pin of the D flip-flop chip U2 is connected to the 2A signal, and the D flip-flop chip U2 The pin is connected to the power supply VCC_3V, the CP2 pin of the D flip-flop chip U2 is connected to the 1Y signal, the D2 pin of the D flip-flop chip U2 is connected to one end of the resistor R9 and the Q1 signal, the other end of the resistor R9 is grounded, and the D flip-flop chip U2 The pin and the VCC pin are connected to the power supply VCC_3V;

[0040] The 1A pin of the inverter chip U1 is connected to the TGR signal, the 1Y pin of the inverter chip U1 is connected to the 1Y signal, the 2A pin of the inverter chip U1 is connected to the 2A signal, the 2Y pin of the inverter chip U1 is connected to the BOOT0 signal, and the VCC pin of the inverter chip U1 is connected to the power supply VCC_3V.

[0041] Furthermore, the model of the D flip-flop chip U2 is 7RAC74, and the model of the inverter chip U1 is JRAC14.

[0042] like Figure 4 As shown, the single-chip microcomputer also includes: a single-chip microcomputer chip U4 and resistors R7~R8; the BOOT0 pin and BOOT1 pin of the single-chip microcomputer chip U4 are respectively connected in series with resistors R8 and R7 and are connected to the power supply VCC_3V together, the RESET pin of the single-chip microcomputer chip U4 is connected to the SYS_RST signal, the GPIO pin of the single-chip microcomputer chip U4 is connected to the WDI signal, and the VCC pin of the single-chip microcomputer chip U4 is connected to the power supply VCC_3V.

[0043] like Figures 2 to 4As shown, the purpose of the present invention is to automatically switch to another storage area to boot the program for execution after two exceptions occur in the boot program running in one storage area. In the default state of the single-chip microcomputer power-on, the state of BOOT1 and BOOT0 of the single-chip microcomputer is 11 under the action of the pull-up resistor. As can be seen from Table 1, the boot program code starts to run and execute from the internal storage area. It can be seen from the characteristics of the external watchdog reset circuit JSR706RD that Figure 2 When the WDI pin of the JSR706RD device has a timed flip level input, the 8th pin Will continue to output a high level, the device JSR706RD outputs TRG high level signal; when the WDI pin does not regularly flip the level input, the 8 pin Will continue to output a low level, the device JSR706RD generates a TRG level signal that is first pulled low and then pulled high, the TRG signal is given to After the signal is received, the device JSR706RD will output a RESET low signal at pin 7. Figure 1 As can be seen, when the MCU bootloader runs normally in the internal memory area after power-up, the program is automatically loaded into the internal RAM to execute the functional code, enabling the GPIO pins to regularly output level-toggling signals. However, if the MCU bootloader encounters an abnormality in the internal memory area, the program cannot automatically load into the internal RAM to execute the functional code, resulting in the MCU GPIO pins being unable to regularly output level-toggling signals. In this case, a TRG level signal is generated that is initially pulled low and then pulled high. The characteristics of the D-type flip-flop 7RAC74 show that when pins CP1 / CP2 have a rising edge, the device 7RAC74 synchronizes the signal state of pins D1 / D2 to pins Q1 / Q2 and maintains this state until the next rising edge of CP1 / CP2. The characteristics of the inverter JRAC14 show that pins 1Y / 2Y output the inverse state of pins 1A / 2A.

[0044] By combining Figures 2 to 4The circuit principle shows that after power-up, the MCU's BOOT1 / BOOT0 pins are in the state of 11 due to the pull-up resistors. When the bootloader encounters its first abnormality in the internal memory area, the first TRG signal is generated. At the falling edge of TRG, inverter JRAC14 triggers a rising edge on CP2. Due to the pull-down resistor, the D2 input state is 0, and the Q2 output state is 0. After the inverter, the BOOT0 state remains at 1. At the rising edge of the first TRG signal, a rising edge on CP1 is triggered. Due to the pull-up resistor, the D1 input state is 1, and the Q1 output state is 1. Therefore, when the bootloader encounters its first abnormality in the internal memory area, the BOOT1 / BOOT0 state remains at 11. The MCU triggers a RESET reset due to the low TRG signal, and the bootloader continues to run from the internal memory area. If the internal memory area returns to normal, the bootloader can resume normal operation.

[0045] The bootloader encounters a second exception while running in the internal storage area. Device JSR706RD generates a second TRG signal. At the falling edge of TRG, inverter JRAC14 triggers a rising edge on CP2. During the first TRG signal, Q1 maintains output state 1, meaning D2 is input high. At this point, Q2's output state is 1, and after the inverter, BOOT0's state is 0. Therefore, when the bootloader encounters a second exception while running in the internal storage area, the BOOT1 / BOOT0 states change to 10. The low TRG signal triggers a RESET reset on the MCU. As shown in Table 1, the bootloader switches to running from the external storage area.

[0046] like Figure 5 As shown, an embodiment of the present invention also provides a dual-redundancy guarantee method for automatic switching of the boot program of a single-chip microcomputer, including the following process: when the single-chip microcomputer is initially powered on, the boot program runs from the internal program storage area by default. When the boot program runs normally, the program can be normally transferred to the internal RAM for execution, and the single-chip microcomputer will continue to feed the external watchdog reset circuit. Once the boot program runs abnormally, the program cannot run normally in the internal RAM, causing the watchdog feeding signal output by the single-chip microcomputer to become invalid. At this time, the external watchdog reset circuit generates a trigger signal, and this signal will change the output of the D flip-flop, thereby achieving the purpose of changing the state of the BOOT pin. At the same time, the single-chip microcomputer receives the reset trigger signal. When the reset is completed, the single-chip microcomputer detects the change of the BOOT pin, and the boot program switches to run from the external program storage area.

[0047] In summary, the present invention utilizes a single-chip microcomputer (MCU) and, through external hardware circuit design, implements switching between the MCU's boot program magnetic storage areas. Furthermore, the MCU includes a mechanism for automatically detecting boot program anomalies and switching between them. The MCU's internal and external memory simultaneously store the same boot program. The present invention utilizes an external watchdog circuit, a D-type flip-flop circuit, and MCU software logic circuitry to achieve boot program anomaly detection and automatic switching.

[0048] The above description is only a description of the preferred embodiments of the present invention and does not limit the scope of the present invention. Any changes and modifications made by ordinary technicians in the field of the present invention based on the above disclosure shall fall within the scope of protection of the claims.

Claims

1. A single chip microcomputer automatic switching boot program dual redundancy protection circuit, characterized in that: include: A single-chip microcomputer includes an internal program storage area, an internal RAM, a BOOT pin, and a RESET pin; the internal program storage area stores a boot program, and the boot program is loaded into the internal RAM for execution; and the boot program is switched from the internal program storage area to the external program storage area for execution by determining the state of the BOOT pin; The peripheral function circuit includes an external program storage area, a watchdog reset circuit, and a D-type flip-flop circuit; the external program storage area stores a boot program, and the single-chip microcomputer outputs a dog-feeding signal to the watchdog reset circuit, so that the watchdog reset circuit generates a trigger signal. The D-type flip-flop circuit receives the trigger signal to change the output of the D-type flip-flop circuit, thereby changing the state of the BOOT pin; The RESET pin triggers the reset of the microcontroller under a low level signal by receiving the trigger signal; The D flip-flop circuit includes: a D flip-flop chip U2, a resistor R9 and an inverter chip U1; The D flip-flop chip U2 The pin and D1 pin are connected to the power supply VCC_3V, the CP1 pin of the D flip-flop chip U2 is connected to the TGR signal, and the D flip-flop chip U2 The pin is connected to the power supply VCC_3V, the Q1 pin of the D flip-flop chip U2 is connected to the Q1 signal, the Q2 pin of the D flip-flop chip U2 is connected to the 2A signal, and the D flip-flop chip U2 The pin is connected to the power supply VCC_3V, the CP2 pin of the D flip-flop chip U2 is connected to the 1Y signal, the D2 pin of the D flip-flop chip U2 is connected to one end of the resistor R9 and the Q1 signal, the other end of the resistor R9 is grounded, and the D flip-flop chip U2 The pin and the VCC pin are connected to the power supply VCC_3V; The 1A pin of the inverter chip U1 is connected to the TGR signal, the 1Y pin of the inverter chip U1 is connected to the 1Y signal, the 2A pin of the inverter chip U1 is connected to the 2A signal, the 2Y pin of the inverter chip U1 is connected to the BOOT0 signal, and the VCC pin of the inverter chip U1 is connected to the power supply VCC_3V.

2. A single chip microcomputer automatic switching boot program dual redundancy protection circuit as claimed in claim 1, characterized in that: The watchdog reset circuit includes: a watchdog chip U3, a capacitor Cap and resistors R1 to R6; The pin is connected to the TGR signal and one end of the resistor R1 and the resistor R2. The other end of the resistor R1 is connected to the power supply VCC_3V, and the other end of the resistor R2 is connected to the watchdog chip U3. Pin, the VCC pin of the watchdog chip U3 is connected to the power supply VCC_3V and one end of the capacitor Cap, the other end of the capacitor Cap and the GND pin of the watchdog chip U3 are grounded together, the PFI pin of the watchdog chip U3 is connected to one end of the resistor R6, the other end of the resistor R6 is grounded, the watchdog chip U3 The pin is connected to one end of the resistor R5, and the other end of the resistor R5 is grounded. The WDI pin of the watchdog chip U3 is connected to one end of the resistor R4, and the other end of the resistor R4 is connected to the WDI signal. The pin is connected to one end of the resistor R3, and the other end of the resistor R3 is connected to the SYS_RST signal.

3. A single chip computer automatic switching boot program dual redundancy protection circuit as claimed in claim 2, characterized in that: The model of the watchdog chip U3 is JSR706RD.

4. A single chip computer automatic switching boot program dual redundancy protection circuit as claimed in claim 1, characterized in that: The model of the D flip-flop chip U2 is 7RAC74, and the model of the inverter chip U1 is JRAC14.

5. A single chip computer automatic switching boot program dual redundancy protection circuit as claimed in claim 1, characterized in that: The single-chip microcomputer also includes: a single-chip microcomputer chip U4 and resistors R7~R8; the BOOT0 pin and BOOT1 pin of the single-chip microcomputer chip U4 are respectively connected in series with resistors R8 and R7 and are connected to the power supply VCC_3V together, the RESET pin of the single-chip microcomputer chip U4 is connected to the SYS_RST signal, the GPIO pin of the single-chip microcomputer chip U4 is connected to the WDI signal, and the VCC pin of the single-chip microcomputer chip U4 is connected to the power supply VCC_3V.

6. A method for automatically switching a boot program of a single-chip microcomputer with dual redundancy protection, comprising executing a circuit for automatically switching a boot program of a single-chip microcomputer with dual redundancy protection as claimed in any one of claims 1 to 5, characterized in that: The steps include: When the MCU is initially powered on, the boot program runs from the internal program storage area by default. When the boot program runs normally, the program can be normally transferred to the internal RAM for execution, and the MCU will continue to feed the external watchdog reset circuit. When the boot program runs abnormally, it cannot run normally in the internal RAM, causing the watchdog feeding signal output by the microcontroller to become invalid. At this time, the external watchdog reset circuit generates a trigger signal, which changes the output of the D flip-flop through this trigger signal to achieve the purpose of changing the BOOT pin state; At the same time, the microcontroller receives a reset trigger signal. When the reset is completed, the microcontroller detects the change of the BOOT pin, and the boot program will switch from the internal program storage area to the external program storage area to run.

7. A method for automatically switching boot programs of a single chip microcomputer as claimed in claim 6, characterized in that: When the single chip is powered on and in the default state and when the boot program runs abnormally for the first time in the internal storage area, the BOOT1 / BOOT0 states of the single chip are both 11, and the boot program starts running from the internal storage area.

8. A method for automatically switching boot programs of a single chip microcomputer as claimed in claim 6, characterized in that: When the boot program runs abnormally for the second time in the internal storage area, the BOOT1 / BOOT0 state of the microcontroller is 10, and the boot program switches to running from the external storage area.

Images