In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

e regarded as appropriate since the system is serviceable, it does not enableeasy collection and analysis of the rates and effects of SEE.• It can be difficult to determine if a transient fault in a non-EDAC system was theresult of SEE or other factors. It is therefore likely that most SEE are notrecognised or reported.• Many transient faults would not be recognised by other aircraft systems or byflight and maintenance crews. For example:– a corrupted data parameter in a computer’s memory may be overwrittenbefore it is used elsewhere– a single corrupted databus message would simply be ignored by othersystems– a short-duration erroneous parameter would normally be filtered out bydownstream systems, or have effects that would not be noticeable (such as amomentary change in a cockpit display or an engine’s fuel flow).• The rates of occurrence of SEE in commercial avionic systems, if known, aregenerally considered proprietary information and are not normally shared.SEE mitigation strategiesHardware and software design features can be used to mitigate the effects of SEEs,including:• Radiation hardening uses less sensitive internal circuit components and designs,including integrated circuits that use higher voltage levels or larger transistors. Aless common form of hardening involves the use of a physical shield to absorbsome energetic particles before they can pass through onto the chip, but thistechnique is generally impractical for airborne systems where weight is alimitation. An aircraft’s physical structure can shield against low-energy chargedparticles but can actually increase the fluxes of certain energy neutrons as aresult of nuclear interactions.• Redundancy provides duplicate systems, subsystems, or components whichenables a fault (regardless of whether triggered by an SEE) to be detected. Forexample, a set of transistors can be duplicated within a chip, an entire block ofmemory may be duplicated on multiple chips, or normally idle CPUcomputation cycles can be used to execute duplicate instructions. These methodsgenerally require additional hardware and complexity.• Databuses usually use simple forms of data redundancy methods such as paritychecks and checksums, where extra information is transmitted to enable datacorruption to be detected.• Partitioning enables part of a faulty system to be isolated from other parts, whichcan then continue to operate correctly.• EDAC is a form of redundancy that stores additional (‘redundant’)information 225 in memory, to enable data to be checked when it is read.225Redundancy in this context refers to the storage and/or transmission of more information thanwould be required by the system in the absence of data corruption. Methods of producing thisredundant information include duplication of data, parity, checksums, and other more complexalgorithms.- 264 -