>> Just code self-check part the way it won't burn anything
>> in case it gets corrupted.
>
> You have no way of knowing what it might do if it gets
> corrupted.
>
> Having the suspect code check itself is frankly a silly
> idea.
>
>> And, yes, bootloader with a checksum
>> probably would be a better choice.
>
> Just probably?

Yes, probably, cause if the communication channel is as reliable as
the microcontroller flash memory, you have basically the same
probability for the bootloader to get corrupted in case if it is in
the memory already, or is just loaded to the memory. You said "Navy",
I'm not sure flash is always the most reliable choice in this case.
Here comes R, I bet :-)
--=20
http://www.piclist.com PIC/SX FAQ & list archive
View/change your membership options at
http://mailman.mit.edu/mailman/listinfo/piclist
.