In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

portions of memory are constantly being written, read, and rewritten. As a result ofthis complexity, it can be difficult to predict or trace the effect of an SEE.Often, an affected transistor is part of a memory device and the SEE changes thedata stored at one particular location in memory. The consequence of such amemory change depends on the type of data stored in that memory location, thepoint during the software program sequence at which the event occurs, and thevalue that the memory takes on as a result of the event.Many SEE events result in a near-complete loss of system functionality (a ‘crash’ or‘hang’) since the devices in a CPU are critical to nearly every function of thesystem. The effects of SEE on memory devices are usually more limited in scope.There have been SEEs on other systems where units provided ongoing data outputerrors without a complete loss of functionality. These were primarily associatedwith issues with a CPU’s program counter (a segment of memory that points to thenext instruction to be executed).The potential for, and impact of SEE is very dependent on the architecture,components, and software of each specific device or system. A particle could affectany one (or more) of billions of transistors and at any particular moment in time in asystem that changes its state millions of times a second, so it can be very hard topredict the outcome. For example, the downstream effect of an SEE on a memorycell is highly dependent on the purpose of the memory cell and whether it is readand used prior to it being overwritten.Effects on spacecraft and aircraftThe risk of SEE is a primary concern for designers of spacecraft, partly due to thevery high levels of reliability required by such autonomous and costly systems.Accordingly, spacecraft SEE is better understood and more widely studied thanground or atmospheric SEE.A number of studies have examined SEE using test equipment (comprising memorychips and equipment to continually monitor the state of those chips) either carriedon aircraft or in a simulated aircraft environment. Studies 223 in the 1990s reportedrates equivalent to about 10 -4 to 10 -2 per flight hour for 544 kB of random-accessmemory (RAM). 224The prevalence of transient SEE on commercial avionics equipment is not wellstudied or recorded, for several reasons:• A fault detected by an error detection and correction (EDAC; see Single eventeffects mitigation strategies below) system would not normally be recorded oranalysed.• A transient fault occurring on a non-EDAC avionic system in flight would notreoccur when the system is subsequently tested on the ground. In mostcircumstances, the engineers would then record ‘no fault found’ in themaintenance records and return the system to service. Although this action could223224Normand (1996) summarised a number of tests conducted up to the mid-1990s and correlated theresults with theoretical models. Johansson et al. (1998) and Olsen et al. (1993) also conductedrelevant studies.The figures were adjusted for the amount of RAM used by the LTN-101 ADIRU.- 263 -