WO1998002887A1

WO1998002887A1 - Method and device for quantifying the impact of cosmic radiation on an electronic equipement with memory

Info

Publication number: WO1998002887A1
Application number: PCT/FR1997/001284
Authority: WO
Inventors: Christian Pitot
Original assignee: Sextant Avionique
Priority date: 1996-07-12
Filing date: 1997-07-11
Publication date: 1998-01-22
Also published as: FR2751083B1; FR2751083A1

Abstract

The invention concerns a method for quantifying the impact of cosmic radiation on an electronic equipment with memory, characterised in that it consists: in writing and verification testing of a volatile (MSN) memory, with capacity memory and sensitivity close to electronic equipment; in case of a bit upset, in determining if the upset is attributable to cosmic radiation or to a memory breakdown; in transmitting a message attributing the breakdown to cosmic radiation or the memory breakdown acceding to the results of the determining step. The invention is applicable to electronic equipment with memory loaded on aerodynes.

Description

METHOD AND DEVICE FOR QUANTIFYING THE IMPACT OF COSMIC RADIATION ON ELECTRONIC EQUIPMENT

MEMORY

The present invention relates to the field of electronic memory equipment, in particular on board aerodyne. The current memories, more and more dense because of integration, are more and more sensitive to cosmic rays and in particular to neutrons coming mainly from solar activity. These neutrons have enough energy to change the state of one or more bits of the memory. This neutron-related disturbance is known by the acronym NSEU for Neutron induced Single Event Upset or simple neutron-induced failure. Currently these disturbances are felt at the altitudes of evolution of civil aircraft, about 10 000 meters because the flow of cosmic particles is much greater at this altitude than at sea level. In the future this aggression is likely to be sensitive to the ground with the increasing integration of memories. Geographically, there are also variations in the quantity of cosmic radiation, at the level of the poles it is more important than at the equator. Over time, the amount of cosmic radiation varies, in particular depending on the solar activity.

The taking into account of these phenomena is recent and it risks constraining the design of electronic equipment with on-board memory and generating new regulatory provisions.

To date, there are electronic components with memory which are insensitive to these disturbances but they are specific components for space or nuclear applications, extremely expensive and it is, therefore, therefore undesirable to use them in on-board electronic equipment. on civil aircraft.

The present invention therefore relates to a method and a device for quantifying the cosmic aggression undergone by electronic memory equipment in particular on board aerodyne.

The method consists in testing in writing and verification a volatile memory, sensitive to cosmic rays, of memory capacity and of sensitivity approaching that of electronic equipment, - in the presence of a failure on a bit, to determine if the failure is attributable to cosmic rays or to a more conventional memory failure,

- to issue a fault message attributable to cosmic rays or a memory fault according to the results of the determination.

In the presence of the failure, the method consists in seeking beforehand, if it is a first failure occurring on this bit,

- if not, send an alleged memory failure message,

- if so, to record the context of this first failure before determining the cause.

According to this method, the determination consists in redoing the same test, on one or more previously tested bits including the faulty bit, -if the failure remains, in sending a memory failure message,

- if the fault disappears:

- in the event that several bits have been retested, to send a failure message attributable to cosmic rays, - in the event that, only the initially defective bit has been retested, to carry out the same test again on several bits previously tested including the initially defective bit, then send a fault message attributable to cosmic radiation if the fault disappears and a fault message otherwise. It is possible to consider as out of test, a part of the memory which contains one or more bits affected by at least one memory failure and to issue a message to put out of test of this part of the memory.

Messages can be saved on a non-volatile memory, insensitive to cosmic rays, before using them.

It is also possible to send messages on a digital line for processing.

It is advantageous to date the failures and / or to record the duration of the test. The present invention also relates to a device for quantifying the impact of cosmic radiation on electronic memory equipment, this device comprises:

- a volatile memory, sensitive to cosmic rays, with memory capacity and sensitivity close to that of electronic equipment,

- a test sequencing device to test the memory for writing and verification,

- a piloting and filtering device which controls the test sequencing device and which, in the presence of a failure on a bit of the memory, determines whether the failure is attributable to cosmic rays or to a memory failure and sends a failure message due to cosmic rays or memory failure according to the results of the determination. Other advantages and characteristics of the invention will appear on reading the following description, illustrated by the appended drawings which represent:

- Figure 1 a schematic example of the device according to the invention; - Figures 2 and 3 variants of the device object of the invention.

Referring to Figure 1. The device for quantifying this cosmic aggression object of the invention comprises a volatile MSN memory, sensitive to cosmic radiation. This memory is made up of several parts each corresponding to one or more words or even to one or more memory components. The different parts are symbolized by small rectangles in the figures

For the device according to the invention to be reliable, it is desirable that the MSN memory has a capacity and a sensitivity which are significant or large with respect to the memory capacity of the electronic equipment on board the aerodyne. This memory capacity corresponds essentially to that of the computers of the aerodyne. The MSN memory is chosen for its particular sensitivity to cosmic rays. This sensitivity can even be promoted by acting in particular on the supply voltage which is applied to it. This MSN memory is intended to be tested when the aerodyne is in flight but in the future this device could be used on the ground.

The low probability of occurrence of a failure attributable to cosmic radiation makes it necessary to observe the MSN memory over very long periods during which other causes of failure can have a non-negligible probability. The device which is the subject of the invention therefore proposes to identify the failures attributable to cosmic rays and to signal the others attributable to memory failures and, if necessary, to put out of test parts of the memory having a faulty behavior which cannot be attributable to cosmic rays.

A test sequencing device DST tests this memory MSN in writing and in checking in order to detect any difference between the written data and the read data. A difference on a bit indicates a failure whose cause must be identified.

The DST test sequencing device, which may be of a known type, is controlled by a DPIF control and filtering device. The DPIF control and filtering device is intended to be connected to an operating device (not shown) to which it provides messages on the characteristics and the cause of the detected failures.

The test sequencing device DST, in a known manner, can generate for each part of the memory a sequence of addresses within the memory space associated with a sequence of data to be written in the memory boxes corresponding to the generated addresses, followed by a sequence of verification of the data entered. If no fault has appeared, the DST test sequencing device generates another sequence of addresses associated with another sequence of data to be written and then another verification sequence. This sequence continues until the memory is tested in its entirety. The DPIF control and filtering device cooperates with a non-volatile MNV1 memory, insensitive to cosmic rays, intended to memorize the context of the first fault detected for each bit during the execution of the tests, the context consisting for example of indication of bit and date. On the example of figure 1, this memory MNV1 is internal to the DPIF control and filtering device but it could be external as in Figure 2.

As soon as a failure is detected on a bit by the test sequencing device DST, the piloting and filtering device DPIF checks whether this failure is the first using the contents of the memory MNV1.

If the detected failure is not the first, it means that the part of the memory to which the erroneous bit belongs is probably broken, this failure is therefore not attributable to cosmic rays. An alleged memory failure message is sent by the DPIF control and filtering device to the operating device. It is possible to consider as out of test the part of the memory containing this faulty bit and in this case, the DPIF control and filtering device sends a message of out of test to the operating device. This separation is also recorded in the non-volatile MNV1 memory. No more messages concerning this part will be taken into account.

It can also be envisaged that the discarding of the part only intervenes subsequently, if the failure rate of the detected bit is greater than a threshold or if the part containing this bit is affected by several defective or presumed bits such . The failure rate corresponds to the number of failures per unit of time. At least one counter C1 can be provided to count the failures of each part.

If the detected failure is the first, the context of this failure, in particular the indication of the defective bit and the date, is stored in the memory MNV1. The DPIF control and filtering device will then determine the cause of this failure. The DST test sequencing device will re-perform the same test on one or more previously tested bits including the faulty bit. The retested bits are then written again with the previous values, then checked.

If the failing bit is still faulty, this failure is not attributable to cosmic rays because the characteristics of the failures generated by cosmic rays is their low probability and a random distribution in time and space. Such a failure suddenly and unpredictably affects a single bit of MSN memory.

A failure caused by cosmic rays will therefore affect a bit of memory deemed correct in the previous test and this bit will become correct again in the next test after being corrected.

A memory failure message concerning the part containing this bit is sent by the DPIF control and filtering device to the operating device. The faulty party can also in this situation be considered as out of test, a message of out of test could be sent to the operating device and the context of this out of test could be recorded in the non-volatile memory MNV1.

If the defective bit is no longer at the end of the second test, to be able to assume that the failure is attributable to cosmic rays, it is necessary to have retested several bits previously tested including the one in question in the same way as in the previous test , ie with the same registered values and the same order. A write operation in one part of the memory risks altering what is written in another part. The reliability of the test is increased if the repeat tests are modeled on the first. If the second test was only carried out on the detected faulty bit, and after the second test, the failure has disappeared, the DPIF control and filtering device cannot attribute this failure to cosmic radiation. The DPIF control and filtering device must carry out an additional test on several previously tested bits and under the same conditions in order to be able to assume it, if the bit in question is no longer faulty at the end of the additional test.

The DPIF control and filtering device then sends a failure message attributable to cosmic radiation.

Retesting only the detected faulty bit makes it possible to quickly identify most frank memory failures (not attributable to cosmic rays).

It is advantageous for a clock HO to cooperate with the control and filtering device DPIF. It makes it possible to date the failures and / or to measure the operating times of the device which is the subject of the invention. The number of faults detected during operation is not really significant in itself, what is significant is the failure rate. This failure rate can enter into the decision to exclude part of the memory from testing, as we saw previously.

We could, for example, use a standalone digital clock, powered by battery.

A message signaling a failure linked to cosmic rays emitted by the DPIF piloting and filtering device will for example include the time group, the part of the memory comprising the failure, the faulty bit, the direction of tilting. A message signaling a failure of a part of the memory will include, for example, the time group, the part of the memory involved, possibly the number of failures affecting this part if the counter C1 is provided.

The recordings of a first one-bit failure and of the out-of-control part of the memory MSN in the non-volatile memory MNV1 are also preferably made with their date.

When powering up the device intended to quantify the impact of cosmic rays, when the aerodyne is in flight for example, the non-volatile memory MNV1 is initialized, it records the time group of power-up because it acquires the context of first faults detected and signaling that part of the memory is out of control.

When the device intended to quantify the impact of cosmic rays is switched off, the non-volatile memory MNV1 is put into a state which allows it to safely wait for the supply voltage to disappear and the device operating time is totaled.

In the example of. In FIG. 1, the failure messages are sent over a serial digital link, for example of the ARINC 429 type, to the operating device which can for example be the flight recorder of the aerodyne or an external on-board test equipment.

During the full MSN memory test, each of its parts is tested completely before moving on to the next part. If a failure is detected, the cause of this failure is sought as described above. It is preferable, during the tests, that the selection of the parts of the MSN memory be done in a fixed order.

In order to make the MSN memory test as exhaustive as possible, the DST test sequencing device may include two identical pseudo-random generators formed by shift registers known by the Anglo-Saxon name of LFSR for Linear Feedback Shift Register. One of these registers is used for writing and the other for verification.

Inside a part of the memory, the addresses are generated by the register dedicated to writing, in a pseudo-random order which is more representative of the use of the memory in any application. Possibly to be even more exhaustive, the browsing of the memory space will be executed in an order for writing and in reverse order for verification, the choice of the order can be made in a random or pseudo-random manner.

The DPIF control and filtering device can advantageously be produced by a microcontroller in technology little sensitive to cosmic radiation. Programmable SRAM-based technologies will not be considered. The MSN memory will preferably have a capacity of at least 64 megabits so as to allow significant detection at the flight altitudes of current aerodynes.

This capacity can for example be divided into at least 64 SRAM components of one megabit each or at least 16 DRAM components of 4 megabits each.

Taking into account an average neutron rate of 1 / cm ² in the atmosphere at 10,000 meters above sea level and the data taken from the SRAM memory components, we can expect a failure rate attributable to cosmic radiation close to 1 per hour. . If the MSN memory has 64 megabits organized in words of

16-bit, testing 64 megabits requires 4 million write operations and as much verification. If a read or verify operation is performed in approximately 100 nanoseconds, the entire memory test takes about 0.8 seconds. Such a short time limit considerably the risk of collecting several failures attributable to cosmic radiation by testing the entire memory.

This duration, however, ensures good dating accuracy for each detected failure and excellent separability and traceability of the detected failures.

Instead of the DPIF control and filtering device transmitting failure messages directly to an operating device via a serial link, it is possible that these messages are stored in a non-volatile memory insensitive to cosmic radiation. Figure 2 illustrates this variant. The non-volatile memory is referenced MNV2. This memory MNV2 is chosen intrinsically insensitive to cosmic rays or made robust by the use of redundant coding of the information it contains. It can for example be carried out by an EEPROM memory with a capacity of approximately 32 to 128 kilobits organized in 8-bit words.

This memory MNV2 is intended to be accessible for reading by the operating device for the purposes of exploiting the results. The operating device can be on board or on the ground, in the latter case the counting will be carried out in deferred time. Preferably, the memory will be chosen to be erasable. It may be reinitialized at least once during the life of the aircraft. This operation will typically only be done in the workshop during the maintenance of the on-board electronic equipment.

When the DPIF control and filtering device is associated with such a memory, it is advantageous that it also stores the context of the bits detected failing for the first time, as well as the signaling of the parts of memory MSN considered to be out of test because in breakdown. This avoids keeping this information in the internal memory of the DPIF control and filtering device. Advantageously, this non-volatile memory MNV2 can even store the status of each part of the memory MSN after the test it has just undergone. During a subsequent test, the status of said part can be extracted in parallel by a sequential analysis to be taken into account by the DPIF control and filtering device in order to contribute to the validation of the cause of a detected failure. After a complete reset, the non-volatile memory MNV2 could, for example, be filled with the value FF in all of its memory boxes. Subsequently, it is possible to store the power-on time group, the power-off time group, the characteristics of memory failures, the characteristics of failures attributable to cosmic radiation and the signaling with date of deactivation. control of a broken part of the MSN memory, the operating time, possibly the context of the faulty bits for the first time, and even the status of each part of the MSN memory as we have just seen.

FIG. 3 also shows a variant of the device according to the invention. In this variant, the DPIF control and filtering device delivers its messages on the one hand to the non-volatile memory MNV2 intended to be processed in deferred time in the workshop and on the other hand to an on-board operating device, via a digital link. It is assumed that the context of the failing bits for the first time and the context of the memory parts not tested are also recorded in this memory MNV2. Other arrangements are possible as in Figure 1.

The use of failure messages attributable to cosmic rays makes it possible to know the distribution in the memory space of failures but also the distribution over time and in geographical space of the failure rate.

The distribution over time makes it possible to check the consistency of the failures detected with the calendar of solar flares. The distribution in the geographical space makes it possible to check, a posteriori, the coherence of the failures detected with the established charts and the statements of other aerodynes having flown in the same zones.

This assumes that the geographic coordinates latitude, longitude, altitude are part of the information stored as the context associated with the NSEUs.

This information can be provided by navigation equipment, not shown.

Claims

1. Method for quantifying the impact of cosmic radiation on electronic memory equipment, characterized in that it consists:

- to test in writing and verification a volatile memory (MSN), sensitive to cosmic rays, of memory capacity and of sensitivity approaching that of electronic equipment,

- in the presence of a failure on a bit to be sought if it is a first failure on this bit,

- if not, send an alleged memory failure message, - if so, record the context of this first failure and determine the cause of this first failure, then send a failure message attributable to cosmic rays or failure memory according to the results of the determination.

2. Method according to claim 1, characterized in that the determination consists in redoing the same test, on one or more previously tested bits including the faulty bit,

-if the fault remains, to send a memory fault message, - if the fault disappears:

- in the event that several bits have been retested, to send a failure message attributable to cosmic rays,

- in the event that only the initially defective bit has been retested, to carry out the same test again on several previously tested bits including the initially defective bit, then to issue a failure message attributable to cosmic radiation if the failure disappears and a failure message otherwise.

3. Method according to one of claims 1 or 2, characterized in that it consists in considering as out of test, part of the memory

(MSN) which contains one or more bits affected by at least one memory failure and to send a message to put out of test of this part of the memory.

4. Method according to claim 3, characterized in that it consists in counting the number of memory failures in the part of the memory, before the emission of a message to put out of test.

5. Method according to one of claims 3 or 4, characterized in that it consists in recording the context of the part considered to be out of test.

6. Method according to one of the preceding claims, characterized in that it consists in recording the messages on a memory

(MNV2) non-volatile, insensitive to cosmic rays, before using them.

7. Method according to one of claims 1 to 6, characterized in that it consists in sending the messages on a digital line with a view to their exploitation.

8. Method according to one of claims 1 to 7, characterized in that it consists in dating the failures and / or in counting the test duration.

9. Device for quantifying the impact of cosmic radiation on electronic memory equipment, characterized in that it comprises a volatile memory (MSN), sensitive to cosmic radiation, with memory capacity and sensitivity close to that of the equipment electronic,

- a test sequencing device (DST) to test the memory for writing and verification,

- a control and filtering device (DPIF) which controls the test sequencing device (DST) and which, in the presence of a failure on a memory bit (MSN), searches beforehand if this failure is the first, then if not, issues an alleged memory failure message and if so, records the context of the first failure in a non-volatile memory (MNV1, MNV2) insensitive to cosmic radiation and then determines whether the failure is attributable to cosmic rays then determines whether the failure is attributable to cosmic rays or to a memory failure and issues a message of failure attributable to cosmic rays or to memory failure according to the results of the determination.

10. Device according to claim 9, characterized in that the piloting and filtering device (DPIF) sends a message to put out of test a part of the memory (MSN) which contains one or more bits affected by at least memory failure.

11. Device according to claim 10, characterized in that it comprises at least one counter (C1) for accounting for the number of memory failure affecting the part of the memory (MSN) before the sending of the out-of-test message.

12. Device according to one of claims 9 to 11, characterized in that it comprises a non-volatile memory (MNV2) insensitive to cosmic radiation intended to record the messages with a view to their exploitation.

13. Device according to one of claims 9 to 12, characterized in that the messages are sent on a digital line for their exploitation.

14. Device according to one of claims 9 to 13, characterized in that it comprises at least one clock (HO) intended to date the failures and / or to count the duration of the test.

15. Device according to one of claims 9 to 14, characterized in that the context of the first failure and / or the context of the part considered to be out of test are recorded in a memory

(MNV1) non-volatile insensitive to cosmic rays internal to the piloting and filtering device (DPIF).

16. Device according to one of claims 9 to 15, characterized in that the context of the first failure and / or the context of the part considered to be out of test are stored in a memory (MNV2) external to the control and filtering (DPIF). the context of the part considered to be out of test are stored in a memory (MNV2), non-volatile insensitive to cosmic radiation, external to the piloting and filtering device (DPIF).