Plan for faults that affect hardware and stored state

Energetic particles can disturb electronic devices. Some single-event effects change stored state temporarily; others can interrupt operation or cause more serious device effects. Accumulated exposure can also matter. The appropriate mitigation depends on the component, environment and consequences of the particular effect.

A flipped memory bit is a useful introductory example, but not every radiation effect is a harmless bit flip and not every incorrect bit was caused by radiation. Fault investigation needs evidence. The computing architecture should address relevant failure modes rather than assuming one universal cause or cure.

An error-detecting code can identify certain corrupted data patterns. An error-correcting code — open definition can repair specified patterns within its designed capability. Neither label promises that every possible corruption will be handled. The supported fault model and response to uncorrectable conditions must be explicit.

In a fictional three-channel voter, two channels report 7 and one reports 9. Majority voting selects 7 under an assumption that the two agreeing channels are trustworthy and the voter works. If all channels share the same wrong input or software defect, agreement does not establish a correct physical answer.

Agreement depends on the fault model

A watchdog — open definition can detect a missing expected sign of progress and trigger a defined recovery action, such as a reset. That can restore service after some faults, but it does not repair a permanently damaged component or guarantee that the state after restart is appropriate.

Test the recovery path, including saved state, initialization, communication and repeated faults. A spare computer may share power or sensors with the primary. Independence must be assessed through those connections. The objective is sustained required function under a stated set of faults, with remaining limitations understood.