7 ms·
They must use the equivalent of ECC for flash memory, I would hope. So the theory is that cosmic rays corrupted multiple bits of radiation-hardened, ECC flash
by harshreality 14y ago
They must use the equivalent of ECC for flash memory, I would hope. So the theory is that cosmic rays corrupted multiple bits of radiation-hardened, ECC flash memory? Should they have expected that? Is reverting to a backup computer the best option? How many bits were flipped? Couldn't they have used a flash memory controller with the ability to correct more than 1 bit per word?
Do space missions also have problems with bit flips in cpu cache or cpu registers? How do they deal with that?
[in 2.5Gbit of ram,] The maximum hourly error report from Cassini–Huygens in the first month in space was 3072 single-bit errors [in DRAM] per day during a weak solar flare. If the flight recorders had been designed with EDAC words assembled from widely-separated bits, the number of (uncorrectable) multiple-bit errors should average less than one per year. [1]
If flash memory reliability is one uncorrectable error every X years where X is less than hundreds or thousands (under expected environmental conditions), that doesn't seem like a comforting level of reliability if a failure means several days or weeks of using a backup computer.
[1] http://en.wikipedia.org/wiki/ECC_memory http://en.wikipedia.org/wiki/ECC_memory citing http://trs-new.jpl.nasa.gov/dspace/bitstream/2014/15831/1/00-1594.pdf http://trs-new.jpl.nasa.gov/dspace/bitstream/2014/15831/1/00...
- nwh 14y agoGiven that they use specially hardened CPUs in their rovers, one would imagine they have error correction on the flash memory too.
- primitur 14y agoDisclaimer: I'm a SIL-4 rated programmer and have worked in safety-critical systems for decades. Yes, its true: radiation can destroy the benefit of having an ECC controller in your design. There are very few hardware methods, short of encasing the entire device in several tonnes of Lead, that will prevent this from happening when you're out there beyond the atmosphere .. So the solution is, typically, a combination of hardened CPU's (as much shielding as the weight budget allows) plus SOFTWARE to detect the error, and react accordingly. Memory corruption is something that a SIL-4 or Space-rated software system HAS to check for, actively, continuously. Its quite possible to use a number of techniques to cover the cases as much as possible .. for example, you can have a process which double-checks the Text Segment for running processes and compares it with a known valid CRC for the process. You can use 2-out-of-3 style voting systems, so that redundant decision making can detect problems, and so on.