1. The error that had to be survived
Andy Weir’s The Martian returns as the recalled work because Mark Watney’s survival depends on equipment tolerating faults that would be trivial if a human could just walk over and reset it. The desktop cannot be walked over. The SEU recovery test matrix is the inventory of bit-level faults that the platform must survive without human intervention.
This entry defines the single-event upset recovery test matrix.
2. Test setup
The test uses a flight-representative computing stack on representative hardware or a high-fidelity emulator. Single-bit and multi-bit errors are injected into memory, registers, cache lines, and FPGA configuration frames. The platform is expected to detect, correct, or recover from each fault without losing critical function. Error counts, correction events, recovery actions, and system state are recorded continuously.
3. The test matrix
| Case | Scenario | Location | Expected outcome |
|---|---|---|---|
| 1 | Single-bit upset | Data memory with SEC-DED ECC | ECC corrects the bit; error is logged; computation continues. |
| 2 | Single-bit upset | Code memory | ECC corrects the bit; instruction execution is unaffected or retried. |
| 3 | Single-bit upset | General-purpose register | Register is rewritten or the task is restarted; result is validated. |
| 4 | Single-bit upset | Processor status register | Fault is detected; corrupted state is discarded or recomputed. |
| 5 | Multi-bit upset | Data memory within ECC correction limit | Advanced ECC or RAID-like memory layout recovers the data. |
| 6 | Multi-bit upset beyond correction | Data memory | Uncorrectable error is detected; affected task is restarted or rolled back. |
| 7 | FPGA configuration upset | Configuration bit in non-critical logic | Scrubber detects and repairs the bit; logic function is restored. |
| 8 | FPGA configuration upset | Configuration bit in critical logic | Scrubber repairs the bit; output is checked against a reference or voter. |
| 9 | Upset during write | Flash or persistent storage | Write is verified; corrupted block is rewritten or marked bad. |
| 10 | Upset in recovery logic | ECC engine or scrubber state | Watchdog or alternate path detects the fault; safe mode is entered if needed. |
4. What is measured
For each case the test records:
- Detection time and classification accuracy.
- Whether the error was corrected, masked, or required recovery.
- Whether critical services remained available.
- Whether the fault propagated to other tasks or cells.
- Recovery time and method.
- Whether data integrity was preserved.
- Whether the platform returned to a stable state.
- Whether ground received a coherent error report.
5. What this changes
- The single-event upset recovery test has a concrete matrix.
- The matrix links back to the radiation reading and autonomous radiation mitigation wondering arcs.
- The next entry will define pass and fail criteria.