CA1239695A - Crash survivable solid state memory for aircraft flight data recorder systems - Google Patents

Abstract

CRASH SURVIVABLE SOLID STATE MEMORY FOR
AIRCRAFT FLIGHT DATA RECORDER SYSTEMS
Abstract Of The Disclosure A crash survivable memory unit for a aircraft night data recorder system is disclosed wherein an electronically erasable solid state memory for storing the night data And a memory controller circuit are housed in a penetration resistant, thermally insulated enclosure. Power dissipation within the insulated enclosure is minimized by an external switching circuit that applys operating potential to the solid state memory only when data are being transferred to and from the memory circuit. A data protection circuit, located within the insulated enclosure inhibits memory write and erase operations whenever the system operating potential falls below a predetermined level. In continuously storing flight data, the oldest stored data is overwritten with newly arriving night data and the memory controller maintains an erased boundary that defines the beginning and end of the recorded data. A power monitor circuit, located outside the insulated enclosure, resets the memory controller to the erased boundary following a power interruption. A dedicated portion of the memory space is utilized to store the address of faulty memory locations (detected during the data storage sequence) and stores the beginning and ending memory address of selected portions of the data record. The memory controller is sequenced to skip both the faulty memory locations and memory storage locations associated with the selected portions of the data record when new flight data is being stored.

Description

9~
~1-CRASH S~ BLB SOLID SIAT}~ M~M~RY ~OR
~IRCR PT PLIGHT DATA RECORDI~R SYST~S
Technical Pield This invention relates to aircraft flight data recorder systems.
More particularly, this invention relates to an environmentally protected, high reliability solid st~te memory arrangement suitable for use 8S a crash~urvivablememory unit of ~n aircraft Ilight d~ta recorder system.
eck~round of the Invention Y~rious advances in the technologies th~t relste to the fabric~tion and application of solid state memory devices and the applications thereof to circuit design have resulted in numerous circuit asrsngements ~or temporsrily orpermanent~y storing digitally encoded data. ~lthough these advances have ~w~.d widespread application, stringent design restraints h~ve heretofore prevented orsubstantially limited the use of solid state memory devices for the recording ofcertain data. One example of a situation wherein solid state memories have not found widespread application is the crash survivable unit of an aircrsft flight data recorder system wherein a signal scguisition unit processes various signalsthat are representative of the flight data to be recorded and supplies various command messages and digit~lly encoded signals representative of the flight data to the crash survivable memory unit. Since the crash survivable memory unit must retain the stored flight data when subjected to high impact (penetra-tion) forces sttendQnt an aircraft crash and, if the aircraft burns, must ret~inthe stored night dsta under exposure to high temperature environment, current night data recorder crash survivable memory ur~its generally include a penetra-tion-resistant metal housing that conts;ns a mechanism for recording the flight data on msgn`e$ic t~pe. Tv proYide thermal isolation, the msgnetic tape mech~nism is typically mounted In the centsal portion of the housing and is enc~sed by insula~ m~teri~L

~2~9695 Pr~or srt crash surv~able rnemory ur~ts of this type exhibit sever~l dis~dvRnt~ges and dra~bPcks Por cxample, ~uch memory units ~re often larger and heavier than desired~ Purther, becQuse ~uch crssh ~ur~i~able memory units re~uire utilization of numerous precisely machined and preclsely msunted components, both the initi~l cost of the memory unit snd the cost of mai~
tenance is higher than desired.
Summary of the lnvention The present invention provides a solid state memory unit th~t is particularly suited for use as 8 ilight dat~ recorder cr~sh surYiv~ble memory unit th~t is relatively small, light, of relatively low in}tisl cost and is easily and economicslly maintained. In accordance with the invention, these features are provided while simultaneously protecSing the stored flight dsta if the ~ircraft utilizing the invention cr~shes and burns, as well as protecting the stored d~taduring aircr~ft power interruptions and 1uctu~tions that often ~>ccur during an~ircraft emergency or crash.
To accomplish the above goals, the memory unit of this invent;on essentially is a self~ontsined sequentisl m~chine that synchronously ~equences to perform all memory msnagement and eommlmd tasks that are necesssry to ~tore digitally encode~ night dats in one o~ more solid stste electronically eresable rea~only memories. With respect to us~ge as the ~r~sh survivable memory unit of ~ night data recorder system, the invention is configured to operate in conjunction with a night dats recorder signal scquisition unit which supplies digitally encoded comm~nd messages (supervisory signals) and digitally encoded night data to the crasll survivable memory unit Yia a serial data bus.
The command mess~ges are decoded by e memory controller that is located in the crash survivable memory unit, with the memory controller sequencing to load the night data into the memory space defined by one or more electronically erssable read~nly memories (EEPROMS). In storing flight dats in the EEPROMS, the memory controller repeatedly cycles through the EEPROM
~0 address spsce so as to overwrite the o~dest stored flight data with newly Acquired flight data. To ~ffect this overwriting snd to provide a detectsble boundary between the newest ~nd oldest stored night data, each time the invention operates to write flight data into memory ~t sequences to erase B
portion of tl e EEPROM memory space th~t extends beyond the space to be c~ccupied by the night data being losded. This erssed boundary or marker is utilized by the ~invention to initialize the address pointer o~ the memory controller when power is applied to the crash survivable memory unit ~fter ~

~g~C~
- s -period ol time in ~hich the system i8 turned off or ~ter a ~emporary power Interruption.
To protect recorded flight d~ta from being erased durlng power interruptions or periods of low operating potential, ar~d to prevent the memor~
unit ~rom storing improper d~ta under those same conditions, the inYention includes ~n erase/write protection circuit that oper&tes to disable the EEPROM
whenever the system operating potentisl is below a predetermined le~el~ This eraselwrite protection circuit, the memory controller, the memory (EEPROMS) and an address decoding network that decodes the address signal supplied by the memory eontroller ~re packaged within OE therm~l isolsting, impect resishnt environment~l enclosure. To minimize the power dissipated by the circuits within the environmental enclosure, the invention includes a power regulator andswitch unit that is mounted outside the environmentaI enclosure ~nd suwlies operating potential to the EEPROMS (and associated memory control circuits) only when flight dstQ is being tr~nsferred between the memory controller and the EEPROMS. A E~ower monitor circuit, which detects power interruptions 0nd fluctuations to activRte the erase/write protection ~ircuit ~s also mounted outside the environmental enclosure.
To minimize maintenance requirements and increase the reliability of the stored flight data, each time the memory controller operates to store data in the EEPROMS, the dat~ tr~nsmitted to the memory is compared with the data actually stored to thereby detect inoperative memory locations. The addresses of memory l~cations that do not properly store data are stored in a reserved portion of the EEPROM memory space which serves as a "faulty address directory." As the memory controller sequences to store data, the faulty Addressdirectory is searched ~nd the memory ~ontroller skips addresses corresponding tofa~ty memory locstions.
In ~ddition to providing the ~bov~noted features, the crash survivable memory unit of this invention is selectively operAble to preserve s ~ight data record that otherwise would be erased during later portions of the aircraft flight. In this regard, it is often desirable to maintain a night d~tQ
record during short periods of irregular aircrAft behavior. To prevent such datafrom being overwritten by night data that is supplied during a subsequent p~rtion of the aircraft night, a portion Or the memory sp~ce of the EEPROM is reserved to define ~ 'tspecisl event directory" ~or storing the beginning and ending address of flight data to be preserved. The beginning and ending address for such a fligllt dats record is stored in the speciai event directory by ~he memory controller upon receipt of ~ command message from the flight data recorder ~cquisition ~2~9G9S
,~

~ystem. ~ the memory eontroller wbse~uently ~equencès to 8tore dAt~ the EEPROM, U~e special event direetory ~s eearched and newly arrlY~ light data is not written ~nto the portion of the EEPROM memory s~ace thAt conts~ns the datQ being preserved.
In a disc~osed detailed embodiment of the imention, six EEPROMS
of the type which store or erase several bytes (words) Or data during 8 single write and er~se cycle ~re utilized~ In this arrangement, the EEPROMS are interconnected as two sets of 3 EEPROMS with the first set forming the memory spaee associated with even ~ralued address 8ignals and the sec~nd set forming the memory space associated with odd v~lued addresses. This feature further decreases power dissipation within the environmental enclosure (and hence tempersture lise) ~nd in~reases the efg'ective memory write ~nd er~se rste by permitting data to be simultaneously written into (or erased from) consecutive even-valued and od~valued ~ddresses during each write (or erase),eycle. In addition, in this detailed embodiment of the invention, the memory ~ontroller se~uence U~at is effected following a power interruption stores ~ sigral in ~he EEPROM memory ~pace that serves to identify the time at which the power interruption occurred.
Brief DescriDtion of the Drawir~
These and other ~spects and advantages of the invention will be better understood upon reading the ~ollowing description of the invention in ccnjunction with the drawing wherein:
FIGURE 1 is a block diagram that illustrates a ~light data recorder system which includes d crash surYivable memory unit configured in accordance with this invention;
PIGURE 2 is a schemstic diQgram of the crflsh surviv~ble memory unit circuitry that is located outside the environmental enclosure;
FIGURE 3 is ~ schematic diagram of the crash survivable memory unit circuitry that is located within the environmental enclosure;
~IGURE 4 diagrammstically depicts the memory space allocations associated with a crash survi~rable memory unit configured in accordance with this invention;
~IGURE 5 is a flow diagram that illustrates the m~nner in which sn embodiment of the invention can be sequenced to store digitally encoded night data;
~lGIlRE 6 i.c a flow diagram th~t illustrates the manner in which an embodiment of the invention can be sequenced to store beginning and ending addresses in the special event directory; and lZ~9~95 --s--PIGURE 7 is a flow diagram that ~llustrstes the manner In which an emb~diment of the Invention can be ~equenced to resume operation after a power interruption of long or ~hort duration.
Detsiled Description of _he Invention The block diagram of ~IGVRE 1 ~llustrates 6 night data recorder system that employs a solid state crash survîvable memory unit 10 that is configured in accordance with this invention for storing parametric data that isuseful in determining the cause of various aircraft mishaps, including crashes. Ln addition to crash ~urvivable memory unit 10, the depicted night data recorder system includes a signal acquisition unit 12, which acquires and processes various parametric data from conventional aircraft sensors and systems ~nd a ground resdout unit 14, which is utilized to periodic~lly retrieve stored data from cr~sh survivable memory unit 10 and signal acquisition unit 12. As is indiceted by theblocks denoted by the numerels 16 and 18, respectively, the parametric data supplied to sign~l acquisition w~it 14 includes analog data signals and discretedatH signals. As is known in the art, analog sign~ls typically ~ccessed and utilized by a night data rec~rder system include sign~ls wch as 3-phase alternating current signals representative s~f the angular position of various aircraft components and control surfaces (i.e., "synchro signals"), ratiometric signals such as ~ignals representative of the linear displacement of ~rarious aircraft control surfaces that are provided by linear variable differential transformers; and various other time-varying signals representative of the current state of an aireraft attitude or control relationship. Discrete data signals are signals that assume one of two predetermined levels (i.e., "on" cr ~off~; nhigh" or "lown). As is known in the art, discrete signals that are useful in a night data recorder system are supplied by a variety of sources including switches that are manually or automatically operated to provide signals r~
presentative of the functional state of an aircraft system or device or to indicate the presence of a crew initiated command.
A data acquisition system 22, which is included in signal acquisition unit 12, receives the analog and discrete data sign~ls supplied by sources 16 and 18. Data acquisition system 22 is interconnected with a central processing unit 24 by means of an information bus 26 and converts ~nalog and discrete parametric data supplied by sources 16 and 18 to the particular digital format employed by the night data recorder system. Generally speaking, the signal conversion process effected by data acquisition system 22 includes gain scaling and analog-to-digital (A-D) con~ersion ~herein: CPV 24 provides a signal selection command to dsta acquisition system 22; dsta acquisition system 22 ~L239695 samples the selected analog or discrete signal, converts the selected signal to the desired digital format and provides CPU 24 with an interrupt signal via information bus 26; and CPU 24 accesses the digitally encoded signal.
As shown in FIGURE 1, information bus 26 also interconnects CPU 24 with an interface unit 28 which receives digi,ally encoded signals from a variety of digital data sources that are indicated hy block 20 of FIGURE 1. De-pending upon the application in which the flight data re-corder system is utilized, various digital data signals can be supplied to interface unit 28. In this regard, virtu-ally any digital data signa:l that is important to diagnostic-ally determining aircraft performance or the source of a mishap can be supplied to interface unit 28 for storage with-in ~he flight data recorder system of FIG~RE 1. For example, conventional flight data recorder systems typically record digitally encoded signals provided by one or more of the air-craft navigation systems.
In a current reali~ation of the type of flight ! 20 data recorder system depicted in F.GURE 1 interface unit 28 is an avionic multiplex data bus interface that is constructed to MIL-STD-153/1553B. Inte:-face units constructed to this military standard include a remote terminal section and a high-speed sequential state controller which is programmed to access the desired digital data source, provide any re-quired signal conditioning, and store the resultant signal in a random access memory unit that is located within inter-face unit 28 and acts as a buffer memory. CPU 24 is pro-grammed to transmit data request signals to interface unit 28 via information bus 26 and to asynchronously access signals provided by interface unit 28. The high-speed sequential state controller within interface unit 28 arbitrates conflict-ing signals access commands that can be generated by CPU 24 and the remote terminal section of interface unit 28.
As is indicated in the preceding paragraphs, CPU
24 functions to control data acquisition system 22 and interface unit 28 for the accessing of data for storage within the flight data recorder system. In addition, CPU 24 processes the data lZ39695 supplied by data acquisition system 22 and interface unit 24 and selectively supplies information to be recorded to: (a) memory space within _7 ~ 3~69S

CPI~ a4; or ~b) crash survivable memory unit 10; or (c) an ~uxiliary memory ur~t 30, ~hich ~ l~cated ~n ~ignal ~cquisition unit 12. In this regard, in the previously mentioned current realizQtion of the type of night dat~ recorder system depicted in ~IGI~RE 1, CPU 24 operates to: (~) store data useful in determining the cause of an aircraft mishap in cr~sh survivable memory unit 10;
(b) store individusl aircraft tracking data (obtained by monitoring parameters such as the aircraft NZCG lnormal acceler~tion parameter]~ in a nonvolatile solid state memory located within CP1124; and (c) store structural losd environmental dsta and engine usage data in auxiliary memory unit 12.
In the referenced current realization of the type of ~light data recorder system depicted in ~IGURE 1, CPU 24 includes a type ~9450 micro-pro~essor circuit, manufactured by ~airchild Semiconductor of Mountain View, Cslifornia; ~n 8-kilobit nonvolatile memory for storing the individual aircr~I`ttracking data; a read-only memory which serves as a program memory for CPU 24; ~nd three serial input/output n/0) ports for interconnecting CPU 24 with nuxiliary memory unit 12, ground readout unit 14 nnd ~rash surviv~ble memory unit 10. These components are interconnected and sequenced so th~t CPU 24 sequentially accesses the signals supplied by dat~ acquisition system 22 and interface unit 28; performs sign~l processing (e.g., dats ~ompression) thAt is neceæary for storage of data within the nonvolatile memory of the CPU, crash sur~rivable memory 10 and auxiliary memory unit 12; snd facilitates transfer of dat~ to crash survivable memory unit 10, auxiliary memory unit 12 and ground readout unit 14 via the three previously mentioned serial 1/0 ports, which provide duplex operation using fixed protocol message structure.
Referring still to FIGURE 1, signal acquisition unit 12 also includes ~ power supply 30, which supplies operating power to crash survivRble m~mory unit 10, Quxiliary unit 12, data acquisition system 22, GPU 24 and interface unit 28. As shall be described relative to crash survivable memory wut 10, each unit or module that is powered by power supply 30 can include any additional regulation and power control that is required or desired.
Auxiliary memory unit 12 generally includes a nonvolatile memory (for storing the structural load environmental data and engine usage d~ta supplied by CPU 24) and a controller circuit (with aasociated memory addressing and control circuits) for receiving the serial data supplied by CPU 24 and storing that data in the nonvolatile memory. In the previously mentioned current realization of a flight data recorder system of the type depicted in FIGURE 1, auxiliary memory unit 12 is constructed in the same manner as crash survivsble memory unit 10, ~ith the difference between crash survivable memory unit 10 ~2~695 and auxlli~ry memory unit 12 of that re~lization being inclus;on of Q sub-stantially larger nonvolatlle memsry within auxiliary memory unit 12 (e.g., 4 Megablts ~5 compared to 384 kllobits, in one application).
Ground readout Imit 14 of PIGURE 1 is csnnected to CPU 24 (or, s alternatively, directly to crash wrvivable memory unit 10) wheneYer data stored by the night data recorder system is to be extracted for subsequent analysis or processing in remotely located ground based eguipment such EIS a progrAmmed general purpose computer. ln this regard, ground readout unit 14 is configured to interact with CPU a4 (or cr~sh survivable memory unit 10~ for sequenti~lly accessing mishap data stored in crash survivable memory unit 10, the individual aircraft tracking data that is stored in the nonvolatile memory of CPU 24 and the structural load and engine per~orm~nce dat~ th~t is stored in auxili~ry memory unit la. In the previously mentioned current realization of the type of flight data recorder system depicted in FIGURE 1, ground readout unit 14 includes ~ microprocessor based system (with associated random flccess and read-only memory) which is programmed to interact with CPV 24 of signal acquisitic>n unit 12 (or, slternatiYely, to directly interact with crash survivable memory unit 10) ~or transferring dlsta stored in the flight data recorder systemto magnetic discs. Oper~tor control is effected by means of a small keyboard or pad. An ~lpha numeric liquid crystal display is utilized for indication o' the selected operating mode (e.g., unloading auxiliary memory unit 12 or cr~sh survivable memory unit 10) ~s well as providing opersting instructions or "prompts" that are generated by the microprocessor based system of ground readout unit 14 and/or CPV 24 of signal acguisition unit 12 to assist the operator of ground readout unit 14.
Referring still to FIGURE 1, the crash survivable memory unit 10 of this invention includes a memory controller 32 which receives serially encoded digital data from CPU 2~ of signal acguisition unit 12, i.e., the data representing mishap information that is to be stored within crash survivable memory unit 10 and CPU generated commands that are necessary to control the operation of memory controller 32. In the arrsngement of FIGURE 1, ~ conventional serial data receiver 34 (e.g., an integrated circuit of the type known as a universal asynchronous receiver-transmitter) couples t~le data supplied at a serial input-output port of CPU 24 to ~ serial data input port of memory controller 32.
Duplex communication between CPU 24 and memory controUer 32 is effected by a conventional serisl data transmitter 36, which receives serially encoded dsta from 8 serial input-output port of memory controller 32 and couples that data toCPU 24 of signal acquisition unit 12. The signals coupled rom memory ~23~9~i95 _9_ controller 32 to CPg 24 include various control signals, e.g., an indication that the ~ontroller ~2 is ready to receive data; an indicat~on that previously trans mitted data w~ not properly received; ~nd Yarious other control signals that areknown to those skilled in the art and will be recognized upon understanding the hereinafter described operation of crash survivsble memory unit 10. In addition,when the information stored in crash survivable memory unit 10 is extracted by means of ground readout unit 14, memory controller 32 supplies the stored data either directly to ground readout unit 14 or to CPl~ 24 (along with associated acknowledgment ~nd control signals) via transmitter 36. To facilitate loading data into (and extracting data from) crash survivable memory unit 10, a portion of a r~ndom access memory, that u included in memory controller 32, serves ss 9 buffer memory. For example, in the previously referenced current realization of the flight data recorder system of ~lGVRE 1, a portion of a random access memory contained in memory controller 32 is utilized to serve as two 32-byte ~tordg~ buffers. When data is transmitted to memory controller 32 îor storsge within the memory circuits of crash survivable memory unit 10, one of the 32-byte buffer memories provides intermediate storage of the incoming serial data while data previously stored in the second 32-byte buffer memory is being written into the memory circuits of crash survivable memory unit 10. In a like manner, when dats is being read from crash survivable memory unit 10 by ground readout unit 14, one of the 32 byte buffer memories provides intermediate storage for data supplied to memory controller 32 by the memory circuits of crash survivable memory unit 10 while the second 32-byte buffer section is either being read directly by ground readout unit 14 or, in the alternative, is being read by CPU 24 of signal acquisition unit 12 and supplied to ground readout unit 14.
The portion of the random access memory contained in memory controller 32 that is not utilized 8S buffer memory for loading data into and extracting data from crash survivable memory unit 10 is used for various computation and control processes that enable memory controller 32 to effect the various operations described in more detail herein. The control processes (or sequencing) of memory controller 32 is directed by program instructions thst arestored in a rea~only memory that is also contained in memory controller 32. As will be recognized by those skilled in the art, numerous integrated circuits are3s available that contain random access memory, read-only memory and sssociated control circuits for accomplishing the described data transfer operations as well as the hereinafter described provisions for controlling data transfer between memory controller 32 and the memory circuits of ~rash survivable memory ~3~9S95 -1~

unit 10. In this regard, memory controller 38 of the previously mentioned ~urrent realization of Ule night dat~ recorder system of PIGURE 1 utilizes a 80C51 integrated circuit mlcrocontroller m~nu~ctured by Intel Corporation of Santa C:l~rs, California. As will be recogni~ed by those skilled in the ~rt, ~arious circuit err~ngements other than single chip integrated circuits csn be utilized for memory controller 32, one example being ~n 80C31 Intel Corporation integrated circuit, which is used with hn extern01 program (read-only) memory.
Regardless of the exact configuration of memory controller 3%1 crash survivable memory unit 10 includes a memory unit 38 for storing the datQ
supplied to crash survivable memory unit 10 by signal acquisition unit la. As isillustrated in ~IGURE 1, e data bus 40 interconnects memory controller 32 and memory unit 38 to fa~ilit~te transfer of dat~ between the memory controller and the memory unit and ~n address bus interconnects memory controller 32 with memory unit 38 for addressing the memory unit when data are lo~ded into the memory unit (written) and when data are extracted from the memory unit (read).
In accordance with the invention, memory unit 38 is a solid stRte er~sable rea~only memory (EEPROM) configured for continuously overwrit;ng the oldest stored data. Since current technology limits the memory eapacity of EEPROMS to less than the memory requirements of 8 t~pical night data recorder system, memory unit 38 will generally include Q plurality of separate EEPROMS that collectively provide the required memory capacity. As is illustrated in PIGURE 1, sddress bus 42 of such ~n arrangement is interconnectedwith ~n address decoder 44 that decodes the address signal supplied by memory controller 32 and supplies a "chip select" signal to memory unit 38 to activate the EEPROM that includes the memory space being addressed by memory controller 32. For example, in the hereinafter discussed, more detailed embodi-ment of crash survivable memory unit 10, memory unit 38 includes six 64-kilobit EEPROMS with memory locations hsving even numbered addresses being defined within a set of three of the EEPROMS and memory locations having odd addresses beîng defined within the remaining set of three EEPROMS. In that ~rrangement, the least most significant and the two most significant bits of the~ddress signal are coup~ed to ~ddress decoder 44, which contains logic circuits for: (a) detecting whether the selected address is even or odd (and hence which o the two sets of EEPROMS is being addressed); and (b) determining which of the three EEPROMS in the selected set ~even or odd address) is to be selected.
The,embodiment of the invention depicted in FIGURE 1 includes ~n ~d~ress latch 46 that is connected to the data bus 40 ~nd cddress bus 42.
Address latch 46 is reql~ired only in embodiments of the invention wherein :~Z~95 memory ~ontroller 32 provides signals wherein a portion Or the address signal ismultiplexed with the d~ta signaL For example, the previously mentioned Intel 80C51 microcontroller multiplexes the eight least significant bits of the address signal onto the data bus. ln such ~n ~rrangement, Rddr0ss latch 46 is activated by the memory controller address line enaWe signal (indicated by connection 47 in ~IGURE 1) to demultiplex the combined address and data signal.
In addition to the sbove~iscussed provisions for data retention, crash survivRble memory unit 10 of FIGURE 1 includes circuitry for providing operating power and monitoring the operating power being provided to: ~a) minimize the power dissipation of memory controller 32 ~nd memory unit 38 (and the associated addres~ dec~er 44 and nddress l~tch 46); ~b) reset memory controller 32 after power interruptions of both short ~nd long dur~tion; and (c~prevent both accidentsl erasure of night data stored in mernory unit 38 and ~ccidental loading of fslse dst~ into memory ulut 38 during temporary poYver interruptions. In this reg~rd, as shall be described in more detail relative to ~IG11RE a, operating power is supplied from power supply 30 of signal acquisition unit la to ~ series-type ~oltage regulator that is located in a power regulator and switch unit ~B. The output of the voltage regulEItor is supplied to switching circuitry that ~s located in power regulator and switch unit 48 ~nd is responsive to a signal supplied to power regulator and switch 48 from memory controller 32 (via an interconnection 50 in FIGURE 1). The switching circuitry within power regulator and switch unit 48 supplies operating power to a power monitor unit 52, which, in turn, continuously powers memory controller 32 and supplies power to the remaining circuitry of crash survivable memory unit 10 only when data is transferred into or out of memory unit 38 (i.e., "on demand").
Although various techniques can be employed ~or detecting data transfer between memory unit 38 and memory controller 32 and providing a signal for activating the switch circuitry of power regulator and switch unit 48, in the previously mentioned current realization of the system of FlGURE 1~
memory controller 32 is programmed to provide a switch activation signal whenever memory controller 32 decodes a signal supplied by CPU 24 of signal acguisition unit la that requires data tr&nsfer betweerl memory controller 32 and memory unit 38.
As shall be described in more detail relative to FIGURE 2, power monitor unit 52 includes circuitry for continuously powering memory con-troller 32 of crash survivable memory unit 10. Power monitor 52 further includes circuitry for supplying a reset pulse to memory controller 32 via a reset line 54 whenever the night data recorder system of FIGURE 1 is initially turned -12- ~2~95 on and when system power is supplied (via power supply 30 and power regulator and switch 48), but memory controller 32 is inactive for more than a normal period of time. In addition, power moni-tor 52 includes circuitry for supplying an interrupt signal to memory controller 32 (via a connect-ion 56 in FIGURE 1) whenever the voltage supplied by power supply 30 of signal acquisition unit 12 (and hence power regulator and switch 48 of crash survivable memory unit 10) falls below a predetermined level. In the arrangement of FIGURE 1, the interrupt signal supplied by power monitor 52 is also connected to an erase/write protection circuit, which is also connected for receiving the memory control lines and memory read and write enable lines of memory controller 32. Erase/write protection circuit 58 is arranged to inhibit both the read and write functions of memory unit 38 and disable the memory control lines when the power supply voltage is low to thereby prevent the storage oE
false data in memory unit 38 that can result due to low voltage operation of various system circuitry. A suitable erase/write protection circuit is included in the arrange-ment of FIGURE 3 and discussed in subsequent paragraphs herein.
As is indicated in FIGURE 1, the circuitry of crash survivable memory unit 10 that is necessary for re-tention of flight data (memory controller 32, memory unit 38, address decoder 44, acldress latch 46 and erase/write protection circuit 58) is enclosed in an environmental enclosure 60. As is known in the art, environmental en-closures for protecting the recording medium of a flight data recorder system are constructed to withstand penetration and exposure to the high temperature environment (a tempera-ture on the order of 2000F) that can occur if the aircraft utilizing the flight data recorder system crashe~"and burns.
An environmental enclosure that is designed specifically for use with a crash survivable memory unit that employs semi-conductor memory device is disclosed in Belgium Patent 900539 which issued on September 28, 1984 and which is assigned to the Assignee of this application.

-12a- ~2~5 Several advantages and features of this invention can be readily appreciated in view of the block diagram re-presentation of crash survivable memory unit 10 ~FIGURE 1).
Firstly, utilizing semiconductor circuitry and including with-in environmental enclosure 60 only that circuitry that is necessary to record and protect stored flight data minimizes the power dissipated within environmental enclosure 60.
This minimizes the temperalure rise under normal operating conditions and, thus, allows the circuitry within environ-mental enclosure 60 to be lhermally isolated from the sur-rounding environment. Component power dissipation and hence temperature rise within environmental enclosure 60 is further reduced through the above-discussed operation of power 13 ~2:~9~

regulator snd switch unit 48, which supplies operating power to memory unit 38 (and all other circuitry ~vithin environmental enclosure 60 except memory controller 32) only when dat~ i~ to be transferred between memory controller ~2 and memory unit 38. In addition, the abov~discussed operetion of eddress latch 46 and erase/write protection circuit 58 ensures that memory unit 38 contsins correct night data ~nd ensures that stored data are protected during power interruption, including power interruption accompanying an Aircraft mishap and crash.
Reference is now made to PIGllRE 2, which illustrates circuitry suitable for ùse as the circuitry that is lscated outside environmental enclosure 60 of the crash survivable memory unit 10 that is shown in FlGVRE 1 (i.e., serial data receiver 34, serial data transmitter 36, power regulator snd switch unit 48 and power monitor 52). In the arrangement of PIGURE 2, seri~l dat~ recei~/er 34 and serial d~ta receiver 36 flre 8 conventional type RS 422A
differential data receiver and transmitter. Such devices are well known in the art and include, ~or example, the ll A9636 dual data seceiver and 11A9637 dual dsts transmitter that are manufactured by Fairchild Semiconductor of Mountain View, California.
In the power regulator ~nd switch unit 48 depicted in FIGURE 2, the operating voltage supplied by power supply 30 of signal acquisition unit 12 is coupled to an input ter~ninal 62, which is connected to the input terminal of a conventional linear voltage regulator 64. A filter capacitor 66 is connected between the input terminal of linear voltage regulator 64 and circuit common.
Since the operating voltage supplied by power supply 30 of signal acquisition unit 12 can be supplied at a voltage that requires a relatively small voltage drop across linear voltage regulator 64? minimal filtering is required and filter capacitor 66 generally can be a relatively small valued tantalum capacitor.
Supplying a preregulated operating voltage to terminal 62 that results in a small voltage drop across linear voltage regulator 64 is also advantageous in that thepower dissipated by the regulator circuit is minimized. This ensures that the regulator circuit is capable of operating at relatively high ambient temperature.
Resistors 68 and 70, which are serially connected between the output terminal oflinear voltage regulator 64 and CiJCUit common, establish the output voltage of linear voltage regulator 64. In this regard, the junction between resistors 68 and 70 is connected to linear voltage regulator 64 to provide the required output sensing 5eedback~ A capacitor 72 and a resistor 14 are serially connected from the output terminal of linear voltage regulator 64 to the junction between resistors 68 and 70 to aid in preventing surge currents when the switch portion of ~239695 power regulator and 8WitC5~ 48 ~ ActivQted to provide operating power to the memory circuits of crash surYivable memory unit lD.
In the power regulator ~nd switch ~8 of ~IGURE 2, the switch for providislg operating current to the memory circuits of cr~sh survivable memory unit 10 in response to a control signal supplied by memory controller 32 (FlGllRE 1) includes R p-channel met~l oxide semiconductor enhancement mode field effect transistor (MOSFET) 76, having the source electrode thereof con-nected to the output terminal of linear voltage regulator 64. The drain electrode of MOSFET 76 is connected to ~ memory power termirul 78, which is connected to supply power to ~11 componenls within environmental enciosure 60 of ~IGURE 1, except memory controller 32. The g~te electrode of MOSFET 76 is connected to the junction between the collector electrode of ~ pnp t~ensistor ~nd a resistor 82 that is connected between the collector of pnp transistor 30 ~nd circuit common. A diode 84 is connected between the output terminal of linear voltage regulator 64 and the emitter electrode of pnp tr~nsistor 80. Resistors 86 and 88 are serially connected between a switch control terminal 90 th~t receivesthe control signal generated by memory controller 32 (PIGURE 1) ~nd the output terminal of linear voltage regulator 641 with the jun~tion between resistors 85 and 88 being connected to the base electrode of pnp transistor 80.
In operation, when the switch control signsl supplied to terminal 90 by memory controller 32 (FIGVRE 1; ~IGURE 3) is at or near circuit common potential (i.e., logic level low), pnp tr~nsistor ~0 conducts (i.e., is "turned on").
This maintains the gate-source voltage of MOSFET 76 below the gste thre~hold voltage so that substantially no current can flow between the source and drain electrodes thereof (i.e., MC)SFET 76 is in the off state). When memory controller 32 supplies a positive voltage level to switch control terminal 90 (logic level high), pnp transistor 8û is turned on to estQblish the gate voltage of MOSFET 76 at a level that exceeds the gate threshold voltage. This switches MOSPET 76 to an on state wherein current flows from the output terminal of linear voltage regul~tor 64 through the drAin-to~source path (channel) of MOSFET 76 and hence to the circuits of crssh surviv~ble memory unit 10 th~t ~re powered by the switch portion of power regulator and switch 48.
As previously mentioned relative to FIGURE 1, power monitor 52 includes: (a) circuitry for continuously powering memory controller 32 during power interruptions of relatively short duration; ~b) circuitry for resetting memory controller 32 when the night datA recorder system is initially ~ctivated and when power interruptions or other conditions cause memory controller 32 to remain in~ctive for more thsn a normal period of time; and, (c) circuitry for ~,~3g6~s --lS-providing an interrupt sign~l to memory controller 3a ~nd erase/write proeectioncircuit 58 whenever the output level of power supply 30 of signal acquisition unit la (~nd hence the oper~ting vo~tage supplied to cr8sh ~urviv~ble memory unit 10) fs~s below a predetermined leveL In the arrangement of FIGURE 2, the operating voltage (Vcc) for memory controller 32 is supplied to 8 terminal 92 bymeans ~of an isolation diode 94 having the cathode thereof connected to terminal 92 and the anode connected to the output terminal of line~r voltage regulator 64. A capacitor 96, which is ~onnected between circuit common and the cathode of diode 94, charges when the night data recorder system is initially energized ~nd stores eh~rge sufficient to maintain V~!c at or near the proper ~oltage level during relatively short term power interruptions (e.g., interruptions of two to four seconds in duration).
In power monitor sa of PlGURE 2, the sign~l th~t inter~upts operation of memory unit 32 snd activates erase/write protection circuit 58 whenever the level of the operating voltage supplied by power supply 30 decreases below a predetermined level is supplied by a circuit ~dentified as power down detector 94 in PIGURE 2. The depicted power down detector 94 includes a p~h~nnel field effect transistor (PET) 96 having the drein electrode thereof eonnected to a terminal 97 end the source electrode thereof connected to circuit common. A resistor 98 is interconnected between the gate electrode of FET 96 and circuit common. A zener diode 100, having the anode thereof connected to the gate electrode of PET 96 and the cathode ~onnected to the output terminal of power supply 30 (via terminal 62 of FIGURE 2), de~ermines the voltage at which power down detector 94 supplies ~ interrupt signal to terminal 97. In p~rticular, when the output voltage of power supply 30 is above the avalanche voltage of zener diode 100, current nOws through resistor 98 ~nd FET 96 is mainWned in a nonconducting or off state. On the other hand, if the voltage supplied by power supply 30 falls below the avalanche voltage of zener diode 100, current ceases to flow through resistor 98 snd FET 96 ~onducts to supply a logic level low signal to terminal 97. As shall be described relative to ~IGURE 3, whenever terminal 97 is ~t logic level low, operation of memory controller 32 is interrupted and erase/write protection circuit 58 is activated to prevent both inadvertent destruction of flight dsta stored in memory unit 38 andthe storage of false data.
In power monitor 52 of FIGURE 2, the previously mentioned signQl for resetting metnory controller 32 when the night data recorder system is initially activated and whenever memory controller 32 is inactive for more than a normal period of time) is provided by a pnp transistor 102 that operates in ~23'969 conjunction with a power on reset circuit 104, a tailsafe reset circuit 106 and an acti~lty monitor circuit 108. In this Arr~ngement, pnp transistor 102 ~s con-ne~ted as 8 switch with the collector electrode thereof connected to a terminal 1109 which supplies ~ reset pulse to memory eontroller 32 (FIGI~RE l;
PIGURE 3). The emitter electrode c>f pnp transistor 102 is connected to the output terminal of linear voltage regulator 64 by means of a diode 112 which is connected with the csthode thereof connected to the emitter electrode of pnp transistor 102. The base electrode of pnp transistor 102 is connected to the output termln~l of voltage regulator 64 through a bias resistor 114. In addition, the base electrode of pnp transistor 102 is connected to an output terminal 116 of failsefe reset circuit 106 ~y means of ~ resistor 118 and is connected to an output terminal 120 of power on reset circuit 114 by means of a resistor 122.
As will be recognized by those skilled in the srt, when the potential at output terminals 116 and 120 of failsafe reset circuit 106 and power on resetcircuit 114 are at or near the potential supplied by linear voltàge regulator 64, pnp transistor 102 is in the off st~te ~nd the voltage level at reset terminal 110 will be at or near circuit common (logic level low). C)n the other hand, if the potentisl at output terminal 116 of failsafe reset circuit 106 or the potential at output terminal 120 of power on reset circuit 114 is at or near cir~uit common potential, pnp transistor lOa will turn on to supply a positive potential (logiclevel high) at reset terminal 110.
To cause pnp transistor 102 to supply a logic level high reset signal when the night data recorder system is initially energized, power on reset circuit 114 includes a p channel FET 124 having the drain and source electrodes thereof connected to output terminal 120 and circuit common, respectively. A
resistor 126 and a capacitor 128 are connected in parallel between the gate electrode of FET 124 and circuit common, with A resistor 130 and diode 132 being serially connected between the gate electrode of FET 124 and the output terminal of linear voltage regulator 64. With this arrangement, when the flight data recorder systern is initially energized, capacitor 128 controls the potential st the gate electrode of FET 124 in a m~nner that couples A logic level high (i.e., a ~ln) to reset signal to terminal 110. In particular, when the ~light data recorder system is initially energized, current flows through capaci~or 128 ~nd the gate electrode of ~channel FET 124 is at ~ relatively low potential. This ~llows current to flow through the drain-t~source p~th (chsnnel) of FET 124 and r sistor la2, turning on tr~nsistor 102, which, in turn, couples a positiYe potential (logic level high) signal to reset terminsl llO. As capacitor 128 of power on reset circuit 114 charges, the gat~ource voltage of ~channel ;95 PET 124 1ncreases to the ~ET plnch~ff Yoltage and ~ET 12~ turns off. When Ulis occurs, substantially no current nOws through resistor la2 ~nd transistor 102 turns o}f to terminate the reset signal supplied et terminal 110. A~ will be recognized by those skilled in the art, the duration Or the reset pulse supplied at terminal 110 is primarily deterrnined by the RC time constant of resistor 130 and capacitor 128. By suitably selecting the values of these components, a reset pulse of duration sufficient to allow the various circuits of the night data recorder system to stabilize prior to terminating the reset sign~l to memory controller 32 can be established.
The manner in which failsafe reset circuit 106 and activity monitor 108 are configured ~Lnd operate to cause pnp transistor 102 to supply a reset pulse to terminal 110 whenever memory controller 3a is inactive for more than a normal period of time shall now be described. ln this regard, activity monitor 108 includes El p~hannel ~ET 134 having the drain electrode thereof connected to terminal 60 (the output terminal of power supply 30) via series connected resistors 138 ~nd 140. A resistor 142 And a capacitor 144 are connected in p~rallel between the g~te ~nd source electrodes of ~channel ~T 134, with the gate electrode being connected to the output terminal of linear voltage regulator 64 by means o~ a series connected c~pacitor 146 and diode 148. In addition, ~ diode 150 is connected between the source ele~trode ofp channel EET 134 and the junction between capacitor 146 and diode 148.
In view of the circuit arrangement of ~ctivity monitor lD8, it can be noted that if the potential at terminsl 78 (the memory power supplied by power regulator and switch unit 48) is at or near circuit common for a period oftime that substantially exceeds the RC time constant of resistor 142 and capacitor 144, the gate-to-source voltage to ~channel FET 134 is also at or nearcircuit common potential. Under such a condition, ~channel FET 134 will be maintained in a conducting or on state, with the potential at the junction of resistors 138 and 140 being determined by the respective values of resistors 138and 140 and being lower than the potential provided by power supply 30 (at terminQl 62). If activity monitor 108 is initially in this state (i.e., no powersuppled to cr~sh survivable memory unit 10 via ~channel MOSFET 76~ and power regulator ~nd swi-tch unit 48 operates to supply memory power to terminQI 78, the potential supplied at terminal 78 causes current to flow through capacitor 146 and diode 148 to charge capacitor 144. As capacitor 144 charges, the gate to source potentisl of ~channel FET 134 increases to switch FET 134 to a nonconducting or off state. When power regulator and switch 48 operates to cease supplying memory power at terminal 78~ diode 148 folces capacitor 144 to i23g695 discharge through resistor 1~2 and ~channel PET 134 remains in the off state for 8 period of time primarily determined by the RC time constant of resistor 142 snd cap~citor 144. Thus, suitably est~blishing the RC time constantof resistor 142 and capacitor 14~ will result in ~channel PET 134 being msin-tained in the of~ state unless the potentisl at terminsl 78 rem~ins at or nesr circuit common for a predetermined period of time. In the previously referred current realization of 8 flight data recorder system of the type depicted in FIGURE 1, memory controller 32 activates power regulator and switch unit 48 at least twice a second. In th~t arrangement, the RC time constant of resistor 142 ~nd capacitor 144 is established so that ~channel FET 134 s off if a positive potentisl is supplied to terminal 78 st this minimum repetition rate.
F~ilsafe reset circuit 106 of FIGURE 2 is configured t~ actiYate pnp transistor 102 so ns to supply a reset pulse to terminal 110 whene~er P-chsnnel FET 134 of activity monitor 108 turns on. ln this regard, failsa~e resetcircuit 106 includes an oscillstor circuit that is formed by a differential serial data receiver 150, ~ capacitor 15a ~nd a resistor 154. Differentisl serial data receiver 150 can be identical to serial data receiver 34 with the noninverting input ~erminal thereof being coMected to the junction between resistors 138 and 140 of activity monitor 108. Peedback is supplied ~ia capacitor 15a ~nd resistor 154, with resistor 154 being connected between the output and no~
inverting input terminals of receiver 150 and capacitcr 152 being connected between circuit common and the inverting input terminal of receiver 150. With this arrangement, when crash survivable memory unit 10 is operating normally, memory controller 32 (FIGURE l; FIGURE 3) ~ctivates power and regulator switch 48 at a repetition rate that maintains p-channel FET 134 of ~ctivity monitor 108 in a nonconducting or off state, which maintains the noninverting input termin~l of receiver 150 at or near the circuit supply voltage to prevent oscillation of the circuit formed by receiver 150, capacitor 152 and resistor 154.
When power regulator and switch unit 48 remains inactive for more than a normal period of time, ~channel FET 134 of activity monitor 108 turns on, causing receiver 150 to oscillate at a rel~tively low frequency. When this occurs, the signal supplied at the output termin~l of receiver l5û is differentiated by a capacitor 156 and a resistor 158 that are connected in series between the output terminal o~ receiver 150 and circuit common. The signal developed across resistor 158 switches on an npn transistor 160, having its baseelectrode connect,ed to the ~junction between capacitor 156 and resistor 158 andits emitter electrode connected to circuit common potenti~l, to conduct. Since the collector electrode of npn transistor 160 is connected to resistor 118 (via ~Z~69~;

erminal 116), thls causes pnp tr~ns~tor 102 to turn on and thereby provide a reset pulse ~t termlnal 11û ~vith the duration of the reset pulse primarily being determined by the RC time cons~ant of capacitor 156 amd resistor 158 of fsilsafereset circuit 106.
S ~IGURE 3 illustrates a more detailed realization of the crash survivable memory unit circuitry contained within the environmental enclosure 60 of PIGURE 1. The arrangement of FIGI~RE 3 utilizes the previously mentioned type 80C51 ~ontroller manufactured by Intel Corporstion of Santa Clara, California, with two of the available input/output (I/O) ports being connected for receiving the serial data signals supplied by data receiver 34 andd~ta transmitter 38. A third l/O port of memory controller 32 in ~IGVRE 3 is connec~ed to terminal 90 of FIGURE 1 fot activating power regulator and switch unit 48 in the manner described relative to PIGURES 1 and 3. The oper~qting voltage and memory reset signals, each of which is produced in the manner described relative to ~lGUR~S 1 and a, are respeclUvely coupled to terminals of memory controller 32 that are identified as V~c tmd RST. The interrupt signal (developed st terminal 97 of PIGURE 2 in the previously described manner3 is ~onnected to an input terminal of memory ~ntroller 32 that interrupts circuit operation whenever a }ogic level low is present (identified as termin~l lNT in YIGURE 3). In addition, the interrupt signal is supplied to a disable termin~l of ~ddress decoder 44 to disable operstion of address decoder 44 whenever the interrupt signQl is at logic level low to indicate that the operating voltage supplied by power supply 30 of signal acquisition unit 12 is below the level determined by zener diode of power down detector 94 ~FIGURE 2). Further, the interrupt signal is connected to a first input terminal of two 2-input ~AND
gates 162 and 164 that are located within the erase/write protection unit 58 of FIGURE 3. The second input terminals of NAND gates 162 and 164 sre respectively connected to the output terminals of NAND gates 166 and 168. The input terminals of NAND gate 166 are commonly connected to an output terminal of memory controller 32 that provides a logic level low signal (~) when memory controller 32 is seguenced to read night data that is stored within memory unit 38 (i.e., when ground readout unit 14 of FIGURE 1 is utilized to extrsct data from crash survivable memory unit 10). In a similar manner, the two input terminals of NAND gate 168 are connected to a terminal (WR) vf memory controller 32, which supplies a logic level low signQl whenever data is to be written into memory unit 38 o~ crash survivable memory unit 10. The output terminals of NAND gates 162 and 164 are connected to ~ control bus 178 that provides control signals to rnemory unit 38 with resistors 172 and 174 being 123~
--2~-coMected between the ci-cuit operating potentlal ~cc) ~nd the output terminals of ~AND gates 162 and 164, respectively. In this ~rr~ngement, NAND gates 162 ~nd 164 are of the open~ollector ~rariety ~nd NAND gates 166 and 168 serYe ~s Imlerter circuits. Thus, it csn be recognized that whenever an interrupt signal (logic level low) is provided to NAND gates 162 and 164, the output terminals ofNAND gates lS2 and 164 are pulled-up to the potential then being supplied by power regulator and switch unit 48. Thus, whenever the output level of power supply 30 falls below the voltage estsblished by zener diode 100 of power down detector 94, the resulting ~nterrupt signal c~uses the potential at the output terminals of NAND gates 162 and 164 to substantially correspond to (track) the operating potential being supplied by power supply 30 of PIGURE 1 (via power regulator and switch 48). Since, in the arrangement of FIGURE 3, the memory re~d and w~ite functions of memory unit 38 of FIGURE 3 are enabled by signQls at logic level low snd since these signals are supplied by NAND gates 162 end 164, respectively (via control bus 170), data cannot be read from or written into mem~ry unit 38 whenever the voltage supplied by power supply 30 of FIGURE 1 is below the previously discussed predetermined leveL On the other hand, whene~ver the voltage suppl~ed by power supply 30 is ~bove this predetermined level, the interrupt signal supplied to NAND gates 162 ~nd 164 is at ~ lo~ic level high and NAND gates 16~ and 164 invert the signals supplied by NAND gates 166 and 168, respectively. Since NAND gates 166 and 168 act as inverters, signals substantially identical to the read and write enable signals produced by memory controller 32 will be generated by NAND gates 162 and 164 (respectively) and are coupled to memory unit 38 ViA control bus 170.
In addition to controlling the read and write enable lines, erase/write protection unit 58 of FIGURE 3 includes an arrangement of logic gates that causes the mode selection control lines that interconnect memory controller 32 and memory unit 38 to be at the operating voltage supplied by power supply 30 (FIGI~RE 1) if: (a) the voltage supplied by power supply 30 is less than the previously discussed predetermined level; or (b) improper operation of memory controller 32 during periods of abnorrnal operating Yoltage or other malfunctions cause memory controller 32 to supply unreliable control signals. Inthis regard, memory unit 38 of FlGURE 3 is responsive to two control signsls (CTLl and ClrL2) that are supplied by memory controller 32 to place memory unit 38 in ~n operating mode for the writing of data into memory, an operating mode for reading data out sf memory and an erase mode. In the arrangement of PIGURE 3, memory controller 32 not only supplies the CTL1 Rnd CTL2 signals, hut also supplies the complements (logicsl negation) o~ those sign~ls, CTL1 and ~23~i~i95 crLa. The CTL1 ~nd the C~Ll signals are coupled to the ~irst ~nd second Input termlnals o~ ~n exclusi~re OR gAte 176 having the output terminal thereof connected to one input termin~l of a two Input NAND gate 178. In a similar manner, the CTL2 and ~ ~ignals are coupled to the two input terminals of an S exclusive OR gate 180 having the output terminal thereof ~onnected to the second input terminal of tw~input AND gate 178. With this arrangement, NAND gate 178 will supply a logic level low signal if, ~nd only if, memory controUer 32 supplies CTLl and CTLl ~nd supplies CTL2 ~d CTL2 which are blnary complements.
The signal provided by NAND gate 178 is connected to one input terminal of a NAND gate 182 hs~ring the second input terminal thereof connected to the output terminal of an exclusive OR gate 184. The first input terminal of exclusive OR g~te 18a is connected for receiving tlle interrupt signal supplied by power down detector 94 of FIGURE 2 whenever the oper~ting voltage suppli~d by power supply 30 is below the previously determined limit. Since the second input terminal of exclusive C~R gate 184 is connected to circuit common, NAND gate 182 supplies a signal At logic level ~ero i either the ~perating voltage wpplied by power supply 30 is below the predetermined level or memory controller 32 is not ~upplying the proper complementa~ry control signals. This signal is connected to one input terminsl of two open collector, tw~input NAND
gates 186 and 188 and disables NAND gstes 186 and 188 if either of the sbov~
mentioned conditions exist. Since the output terminals of NAND gstes 186 snd 188 ~re connected to control bus 170 for supplying the two required control signals to memory unit 38 and are also connected to the circuit opersting potential via resistors 190 and 192, respectively, the memory unit control signals will track the circuit operating voltage i that operating voltage is below the previously discussed predetermined level or if improper control signals are provided by memory controller 32. On the other hsnd, since the CTLl and the CTL2 control signals are respectively connected to the second input terminals ofNAND gates 186 and 188, it can be recognized that signals equivalent to CTL1 ~nd CTL2 are coupled to control bus 170 by NAND gates 186 und 188 whenever the circuit operating potentiRl is ~bove the predetermined level and memory controller 3~ is properly supplying control signals that are complements of one another.
Memory unit 38 of PlGURE 3 utilizes six EEPROMS that col-lectively form a, two~imensionRl arrsy of storage locations for storing tlle digita31y encoded mishap data supplied by memory controller 32 via data bus 40 and Ior storing hereinafter discussed data that is import~nt to the practice of this invention. ~s ~s Illustrated in PIGURE ~ EPROMS 194, 1~6, 198~ 200, 202 and 204 e~ch haYe Ule control terminals thereof connected for receiving the control signals ~;upplied by NAND gates 162 and 164 and NAND ~ates 186 ~nd 18B. In ~ similar manner, each of the EEPROMS is connected for receiving the address signals supplied by memory controller 32 vi~ address bus 42 and is interconnected witll dats bus 40 for the transfer of dflta between memory controller 32 and memory unit 38. As WQS discussed relstive to the embodiment of FIGURE 1~ address decoder 44 decodes the two most si~nific~nt bits and the least most si~r~ific~nt bit of the address signsl supplied by memory controller 32 to provide chip select signals that activate the particulQr EEPROM (194, 196, 198, 200, 202 or 204) being addressed by memory controller 32. In this regard, t~le embodiment of the invention depicted in FIGURES 2 and 3 operates so that odd valued addresses access memory locations within three of the SLl~ depicted EEPROMS, whereQs memory addresses ha~ing even valued addresses, access memory l~c~tions within the remaining three EEPROMS. Por convenience, the left-hand vertical column of EEPROMS in PIGURE 3 (EEPROMS 194, 198 snd 202) will be describsd ss including the storsge locations for even valued address signals and the right-hand column of EEPROMS (EEPROMS 196, 200 ~nd 204) will be described as conteining the ~torage locations for odd Yalued address signflls.
With the EEPROMS partitioned into two subsets that are respectively associated with even and odd ~slued Hddress signals, it can be recognized that the le~st significant bit of the address signal supplied by memory controller 32 identiiies the subset of EEPROMS to be accessed and the two most significant bits of the address signal identify which of the three EEPROMS within that subset is being accessed.
In the previously referenced, current refllization of crash survivable memory unit 10, EEPROMS 194-204 are NCR 52864 64 kilobit EEPROMS, manufactured by NCR Corpor~tion of Dayton, Ohio. These particular devices ~re configured or ~ccessing 16 bytes of memory (with each byte of memory storing an B-bit data word) with Q single 16-bit address signaL
Each EEPROhq includes 16 address and data latches that flllOW 16 bytes of data (one "pagen) to be read into memory during each write cycle (of ~pproximately 10 milliseconds) and allows an entire page of dat~ to be erased during eflch erase cycle (approximately 100 milli~econds). Arrangement of this type of EEPROM in the mQnner depicted in FlGURE 3 permits data to be simultaneously written into (or erased from),the memory locations associated with An even v~lued address signal and ~n odd velued address signal (2~g., one page of memory in EEPROMS 194, 198 or 2D2 and one page of memory in EEPROMS 196, 200 Hnd ~Z39695 204~. This organization permits dats to be stored in memory unit 38 of PIGURE 2 at r~tes exceeding 256 bytes per second.
In addition, memory unit 38 Is or~nized and ~ontrolled by memory controller 32 to implement cert~in other features ~nd aspects of this inYention,including: (a) establishment of the previously mentioned, stored address directory that identifies faulty memory locations; (b) identification and protec-tion of "special events," which are not overwritten with subsequent flight data when the flvailable storage locstions in memory unit 38 have all been utilized;
(c) stor~ge Or flight data in Q manner which iclentifies the time at which powerinterruptions occur; (d) the ongoing establishment of a boundary or marker between the oldest and newest stored night data (which serves as a marker when the stored dat~ is analyzed ~nd when oper~tion of the crash survivable memory unit resumes ~fter being interrupted3; and (e) storage of ~n identification code in each of the EEPROMS of memory unit 38 to ~llow identification of the EEPROMS if they sre dislodged during an ~ircraft crssh ~nd also to permit detection of a "stuck" address line (i.e., 8 circuit fail~e that causes one or more address lines to remain at a fixed potential regardless of the applied address signal).
The manner in which the crash survivable memory unit of this invention provides the sbove-mentioned features can be understood with reference to FIGURE 4, which illustrates the memory organizQtion in the embodiment of the invention that is employed with the previously mentioned, current realization of the night data recorder system of FIGURE 1. In FIGURE 4, the memory space of Memory Nos. 1~ (memories 194, 196,198, 200, 202 and 204 in FIGURE 3~ are depicted in the same relRtionship as was utilized relative to FIGURE 3. That is, the memory locstjons wi~hin Memory Nos. 1, 3 and 5 (memories 194, 198 and 202 of PIGURE 3) collectively form 8 column of memory locations, e~ch of which is accessed by an even valued address sign~l.
The memory locations of Memory Nos. 2, 4 and 6 (memories 196, 200 ~nd 204 of FIGURE 3) collectively form a second (right-hand) column of memory locations in FIGURE 4, with these memory locations being accessed by even vslued address signals. Thus, consecutive address signals that increase in vslue alternately access memory locations in the left- ~nd right-hand columns of the memory space depicted in FIGURE 4 with sequential addressing proceeding from the top to bottom of the memory space.
As ~s also indicated in FIGURE 4, the memory space of memory unit 38 is divided into pages, with each p~ge consisting of memory loc~tions within the left-hand and right-h~nd columns of the depicted memory space. In i~39~95 this regard, in the ~urrent embodiment of the lnvention wherein ench of the ~L~
memorie3 (194-204 in PIGURE 3) access 16 bytes of memory space with esch ~ddress signal~ the invention employs a 32~yte (word) page consisting of 16 bytes of memory in the left-hand column of memory space and the nextmost addressed 32-bytes of memory in the right-hand column of the address space of PlGURE 4. Por example, the first page of memory consists of the first 16 bytes of memory spaee within Memory No. 1 and the first 16 bytes of memory space within Memory No. 2, with the first stored word being located in the first byte of memory sp~ce in Memory No. 19 the second stored word being located in the first byte of memory space in Memory No. 2, the third stored word being locAted in the second byte of memory in Memory No. 1, etc. With this arr~ngement, the 64-kilobit EEPRC)MS utilized in the referenced embodiment of the invention result in the first 512 pages of memory being îormed by Memory Nos. 1 and 2 (194 and 196 in E~113URE 3); pages 512-1024 being formed by Memory Nos. 3 and 4 (198 and 200 in ~IGURE 3); and pQgeS 1025-1536 being formed by Memory Nos. S
and 6 (202 and 204 in ~IGURE 3).
As is indic~ted in FIGURE 4, the memory space of memory unit 38 (the ~ix EEPROMS) is partitioned to provide memory space for the storage of recorded night data ~nd memory space that is dedicated to the storage of dat~
which is necessary for the practice of the invention. In this regard, in the memory space allocation depicted in FIGURE 4, the first six pages of memory space that are defined by Memory Nos. 1 and 2 ~re reserved or dedicated, while the remaining 506 pages of memory space are available for storing flight recorded data. In a similar manner, the first 510 pages of memory space defined by Memory Nos. 3 and 4 are available for storage of recorded flight d~ta whereas the last two pages thereof are reserved memory locations. With respect to the memory space formed by Memory Nos. 5 and 6, the first two pages of memory space are dedicsted for storage of ~rarious data that is used in the practice of the invention and the remaining 510 pages (pages 1027-1536) are available for the storage of recorded flight data. As can be seen in FIGl)RE 4, partitioning the memory space in the above described manner in effect forms two blocks of memory space for storage of flight data (i.e, pages 7-1022, defined by Memory Nos. l, 2, 3 ~nd 4 and pages 1027-1536, which are defined by Memory Nos. S and 6).
The abov~described dedicated portions of the memory space of ~IGIIRE 4 are utilized for storing: ta) ncheckword" that uniquely identifies each of the six memory circuits; (b~ "built-in test words," which are utilized by memory controller 32 in determining the operational status of each memory ~Z3~i9S

cireu~t; (c~ the previously mentioned "directory of special events," which provides the beginniru~ ~nd ending address ror a block of recorded flight data that is to ~e maintained within memory unit 38 until ~t is extr~cted by the ground readout unit (14 in ~IGURE 1~; ~nd (d) ~ directory of the f~ulty sddress locations within memory unit 38 that ere detected during operation of the invention.
Checkwords for Memory Nos. 1 and 2 are stored in the first two bytes of the first page of memory; the checkwords for Memory Nos. 3 and 4 are stored in the last two bytes of memory defined by Memory Nos. 3 ~nd 4 (i.e., the last two bytes of memory in page 1024); and the checkwords for Memory Nos. 5 and 6 sre stored in the first two bytes of the memory space defined by Memory Nos. 5 and 6 (i.e., the first two bytes of page 1025~.
The checkwords which will identify the respective memories are stored Rt the above-indicated locations during fabrication and testing of the crash survivable memory unit of this invention to permit the previously me~
tioned memory circuit identification if the memory circuits are dislodged duringan aircrsft crash. ~urther, organizing the memory space of memory unit 38 to store the check words in the abov~indicated manner is advantageous in that the mernory gpsce for storing recorded flight dsta is defined as two (rather th~n three) blocks of memory lccstions. Purther, since the checkwords for Memory Nos. 1, 2, 5 and 6 ere stored at the first memory location within those memories(Hddress signal all zeros) and the checkwords for Memory Nos. 3 snd 4 Are store~in the last memory locstions of those memories (sddress signal ~11 ones), the indicated memory allocation facilitates checking the sddress lines between memory controller 32 and memory unit 38. In particular, as the checkwords are accessed during operation of the invention, memory controller 32 c~n readily determine stuck address lines ss it accesses and reads the checkwords for Memory Nos. 1-6 OI FIGURE 4.
In the current realization of the invention, during fin~l assembly and testing, digitally encoded informstion that indicates proper operation Or cr&sh survivable memory unit 10 is written into the memory locations of memory unit 38 thst are dedicated to built-in testing (i.e., the second mernory bytes in Memory Nos. 1, 2~ 5 ~nd 6; end the penultimate memory bytes in Memory Nos. 3 and 4). During operation of the invention, memory controller 32 periodic~lly checks the dsta words stored at these locations (e~g. performs a checksum) to 3s verify the operational status of crash survivAble unit 10.
As i,s sho~n in ~IGI~RE 4, in the embodiment of the invention being described, the directory of special events for the entire memory space (Memory Nos. 1-6) is defined within a portion of the dedicated memory space of Memory 12;~9~95 Nos. 1 ~nd 2. ~s shall be described iin rnore detail in descrlbing the operation of the invention, when CPU 24 of ~ignal acquisition unit 12 (PlGUPsE 1) supplies memory control~ler 32 of crash ~urvivable memory unit 10 ~rith a digitally encoded mess~ge indicating that a portion of the data being recorded Is to be preserved until unloaded by ~round readout unit 14 of ~IGVRE 1, memory controller 32 ~ddresses the next avHilable two bytes of memory within the space dedicated for the directory of special events and stores d beginning snd ending address which identifies the flight data within memory unit 38 that is to be preserved. During periods in which memory controller 32 is accessing memory unit 38 to st~re ~dditional flight d~t~, each time men-ory controller 32 reachesan address corresponding to the start of a new p~ge o~ memory that is ellocated for storage of flight data, the memory controller searches the special events directory. If the next page of night data memory is to be preserved (i.e., the page ~ddress is stored in the special events directory), memory controller 32 ndv~nces to the beginning of the first page of flight dsta memory that does not include flight dat~ thQt is to be preserved.
Referring still to PIGURE 4, the faulty address directories that are defined iin the dedicated memory space of Memory Nos. 1~ ~memories 194, 196, 198, 200, 202 snd 204 in FIGURE 3~ are utilized for storing addresses of the respective memory circuits which are detected as not properly storing data during the sequencing of memory controller 32. In this regard, and as shall be described in more detail relative to the operation of this invention, each time memory controller 32 operates to load data into the EEPROMS, the memory controller reads the data thst has been loaded and compares it with the data that was transmitted to memory unit 38. If the loaded data does not correspond with the data transmitted to memory unit 38, memory controller 32 loads the address of the memory location being accessed into the next avail~ble byte location in the faulty sddress directory of the memory circuit being accessed. For example, in the previously mentioned current realization of the type of flight dsta recorder systern depicted in FIGURE 1~ the data word stored in the addressed location of memory unit 38 is compared with the data word which was trans-mitted to memory unit 38 from storage loc~tions within the previously men-tioned two 32-byte buffer memories o~ memory controller 32. If ~ data error is detected, memory controller 32 sequenees to store the address contained in address lateh 46 in the faulty address disectory o the memory unit 38. By searching this directory when data is being stored in memory unit 38, memory cdntroller 32 is sequenced to skip failed storage locations within memory unit 38.
This aids in ensuring thst the night data stored in crash survivable memory

2~ 95 un~t 10 is accurate ~nd, ~ccordislgly~ enhances the accurscy and reliability of the analysis process that is performed on data stored within memory unit 38 when attempting to determ~ne the c~use of aircraft rnlshap or crash. In addition, sincc ~ailure of memory locations within con~rentional EEPROMS occurs gradually, the d~ta compsrison technique utilized in the practice of the invention extends the effective lifetime of the EEPROMS thst make up memory unit 38 and Shereby decreases maintenance requirements for crash survivable memory unit 10.
The operation of a crash survivable memory unit configured in accordsnce with this invention can be more completely understood by conside~
ing the structure ~nd memory organization described relatiYe to FIGURES 1 through 4 in conjunction with the system flow dia~rams depicted in FlGURES 5 through 7.
In viewing FlGURE S, it should be recalled that CPU 24 of signal acquisition unit 12 provides digitally encoded eommand messages to memory controller 32 of crash sur~rivable memory unit 10 via receiver 34 SFIGl~RES 1 and

3). As is indicated by the decisional block 210 in ~IGURE 5, when CPV 2~
supplies a command message to cause ~rssh survivable mem~ry unlt 10 to store night data in memory unit 38, memory controller 32 activates power regulator ~nd switch unit 48 (indicated by block 212 ~n ~IGURE 5). Activation of power regulator ~nd switch unit ~8 by means of the preYiously discussed switch controlsignal supplies operating power all the circuitry within environment enclosure 60, except memory controller 32.
When sufficient time is allowed for the circuits to settle, memory controller 32 tests the current memory address signal to determine whether it corresponds to a reserved page of memory space within memory unit 38. This operation is indicated by decisional block 214 of FIG11RE S. lf the addressed page of memory space is not reserved, memory controller 32 searches the special event directory described relstive to FIGURE 4 to determine whether the Hddress corresponds to a pflge of memory space that stores data for a special event. If decisional block 216 of FIGI~RE S results in ~ determinstion that memory controller 32 is sttempting to access a page of memory space that includes special event data, or if decisional block 214 results in a determination that a page of memory space being accessed is a portion of the previously discussed reserved memory space, the address signsl supplied by memory controller 32 is advanced to the address for the next page of memory (indicated at block 215 of ~lGURE 5). The newly formulated ~ddress then is tested ~t decisional blocks 214 ~nd 216 to determine whether the page memory spsce corresponding to that address is available for storage of flight data.

`g~

As Ss indicated by decisional block 218, when memory controller 32 provides nn address signal th~t corresp~nds with an ~v~ilable p~ge of memory ~p~ce, memory controller 32 ~earches the fsulty Rddress directory of the memory eircuits being ~ccessed. If the fsulty address directory contains one or more addresses within the page of memory space to be sccessed, memory controller 32 transfers those addresses to its random access memory for sub-sequent use in determining which memory loc~tions are svailable during the write cycle of memory unit 38. This oper~tion is indicated by blocks 218 and 220of FIGURE 5.
~aving determined t~e address of the next available page for storing flight data and having determined which addresses within that portSon ofmemory are faulty, the system sequences to erase the oldest stored night d&ta so that new data can be written into memory unit 38 in a manner that maintains ~t least one fully erased page of memory space between newly recorded flight d~ta ~nd the oldest stored flight dat~. This is ~ccomplished by er~sing a singlepage of memory space each time data is to be written into memory, with the pege that is erased being the page that will be written into during the next most memory-write cycle. Thust when an erase sequence i~ complete, two erAsed pages of memory spaee separate the oldest and newest recorded night dat~ and at least one rull page of erased memory space will separate the oldest and newest recorded dat~ when the hereinafter described page write cycle is complete. Maintaining sueh an erased boundary within the memory space of memory unit 38 provides a marker that is used to identify the beginning ~and end~
of the flight data record when crash survivable memory unit 10 is powere~up or activated efter a power interruption and when d~ta is retrieved from crash survivable memory unit by ground re~d out unit 14.
In the 1OW diagram of FIGURE 5, the seguence for erasing the page of memory space that will be written into during the next p~ge write cycle ~i.e., to provide two erQsed pQges of memory space) consists of advancing the address signal supplied by memory contro31er 32 to an address that corresponds with the next ~v~ilable page of memory in memory unit 38 (block 222 in FIGURE 5). The new page nddress is then tested st decisional block 22~ to determine whether the corresponding page of memory space is reserved. If the new cddress corresponds to a reserved page of memory sp~ce, the address is 3s ~g~in advanced ~t block 222 of ~IGURE 5 ~nd retested ~t decisional block 224.
Once the address of the next 0.vailable page o~ memory space is detesmined, memory controller 32 sequences to erase the night data pre~iously recorded in the corresponding memory locations. This operation, indicated ~t block 226 of ~2~9159S

~IGURE 5, Includes supplying the ~ssociated hddress signal to memoty unit 38, ~etting the control lines (CTLl, CTL2, ~ ~nd ~;~;~ to correspond with the two bit ~ignal (and Its ~omplement) th~t enables the erase circu~ts of memory unit ~8. When the erase cycle ~s complete, memory contro~ler 32 restores the address signal that was provided prior to the time at which the erase cycle begQn ~indicated by block 223 in FIGURE 5).
Next, memory controller 32 determines whether flight data is ~vailable for loading into the accessed page oit memory space. In the realization of the night data recorder ~ystem of ~lGURE: 1 that is being discussed, night d~ts is loaded into memory un~t 38 if the previously mentioned 32-byte buffer memory within CPU 24 of signal acquisition unit 12 contains ~t least 16 bytes ofdata (half-filled) or alternati~rely, if 16 bytes of data are not made availablewithin a predetermined time intervaL In this regsrd, in the sequence r~
presented by PIGURE 5, memory wut 3a tests a neg th~t is set by CPU 24 when at lea~t 16 bytes o~ data are available in the buffer memory (at decisional block 230). If the flag is present, memory controller 32 advances to block 232 of PiGURE 5 to begin the page write cycle, which loads dath into memory w~it 38.
If the buffer flag is not present, a timer flag is teste~ by memory controller 32 at decisional block 234, ~IGURE 5. The timer flag, which is set by an internal clock (counter) of memory ~ontoller 32 and which is reset each time memory controller 32 accesses a new page of memory space, provides a flag signal if memory controller 32 operates in the data store mode for ~ predetermined time without accessing a new page of memory space~ In the arrangement of FIGVRE 5, if the timer nag is present, memory controller 32 advances to block 232 to begin the page write cycle. On the other hand, if the timer flag isnot present (i.e., the required period of time has not elapsed), memory controller 32 again tests the buffer ready flag (at decisional block 232) and the timer fl~g (at decisional block 234) until either the buffer memory is filled to the level at whi~h the buffer flag is set or the required period OI time elapses.
As is indicated at block 232 of FlGURE 5, the page write cycle begins with the transfer of night data from the 32-byte bufier memory of memory controller 32 to the two 16-byte registers of the two memory circuits that are associated with the p~ge of memory space being addressed (one 16-byte address and one 16-byte data register being located OD each of the two EEPROMS that define that page of memory space). When the memory registers are loaded, memory unit 32 sets the control lines (CTLl, CTL2, CTLl and CTL2) to provide a two bit control signal (and its complement) that enables the write circuits of the selected EEPROMS via er~se/write protection circuit 58 of ~Z3'~36~35 -~o-~IGURES 1 ~nd 3. When the write circuits sre enabled (indicated at block 236 of ~IGIlRl~ 5), memory oontroller 32 supplies a write enable pulse (~) to memory unit 38 vla erase/write protection circuit 58. ThSs ~auses the first byte of flight data in each of the registers of the two selected EEPROMS to be loaded into the S EEPROMS as the first ~nd second bytes of memory space within the access page of memory space. Thus, two bytes of night data are loaded with each pass through the page write cycle of ~IGURE 5.
As is indicate~ by decisional block 240, memory controller 32 then sequences to compare the data stored in memory unit 38 with the corresponding data within the intermediate buffer memory of memory controller 32. If the stored dats is not equivalent to the data within the buffer memory, and if the address of that byte of memory space is not already contained in the associated faulty address directory (determined at decisional block 242), the address of the memory location being sccessed is stored in the associated faulty address directory (block 244, ~IGURE 5). The address signal supplied by memory controller 32 is then advanced to the next flight data storage location (at block 246) and the data write cycle is repeated with the same flight data. When the data stored in memory unit 38 corresponds with the d~ta provided by the memory controller intermediate buffer memory (indicated by the "yes" branch of decisional block 240), the address signal is adlranced to ~ccess the next two bytes of memory space (at block 248) and memory controller 32 determines whether that address signsl corresponds with an address transferred to the random accessmemory of controller 3a during the portion of the sequence previously discussed relative to block 220 of FlGURE 5. As is indicated by decisional block 250, if the new address corresponds to a faulty memory address, memory controller 32 continues to advance the address signal until the next most fully functional byte of memory space is located. As is indicated by decisional block 250 of FIGURE 5, memory controller 32 then checks the new address to determine whether execution of the page write cycle has filled the page of memory space being written into (decisional block 252 in ~IGIlRE 5). If the page write cycle has not seguenced the number of times required to fill the page o~ memory space, memory controller 32 selects the next byte of night data from each of the two memory registers and again executes the above described write cycle.
If the page of memory space has been filled, the memory address signal is examined at decisional block 254 to determine whether the page of memory space filled duri~g the 3ust executed page write cycle corresponds to the last page of memory space (i.e., page 1536 in the memory space depicted in ~IGURE 4). If this is the case, memory controller 32 establishes the sddress ~Z39~5 -3l--dgnal ~o that page 7 of the memory space of PIGURE 4 w511 be accessed (the first non-reserved page of memory space ~n ~IGURE ~) and ~equences to record d~t~ In page 7 of memory space by a~ain executing the s~ep indicated at decisional block 216 of ~IGURE 5 to determine whether the addressed page of memory space stores prstected, special event night data. If it is determined that the page of memory space filled by the page write cycle is not the last available page of memory space for recording night data (not page 1536 in FIGURE 4), the address signal is set for accessing the next page of memory space (block 258 in PIGURE 5). Memory controller 32 then begins s$orage of the next page of night dat& by sequencing to decisional block 214 of PIGURE 5 to determine whether the new page address corresponds to 8 psge of memory spsce that is available for recording night data.
As previously mentioned, in the night data recorder system of ~IGURE 1, CPI~ 24 of signsl acquisition unit 12 supplies an encoded command message to crash survivable memory unit 10 whene-~er night data corresponding to a predetermined period of time is to be msintained in memory ur~it 38 as a protected, ~ecial event. In a night dsta recorder system of the type illustratedin PIGURE 1, CPU a4 can be configured ~nd sequenced to supply such a command message In response to mJmerous input signals, including a signal that is provided by a switch that is activated by 8 crew member whenever irregulari-ties in aircraft performance exist and/or R signal that is automatically generated by one or more aircrQft systems. For example, ~ signal can be provided to CPIl unit 24 whenever a monitored aircraft performance or status parameter such as engine gas temperature or rate of descent exceeds a selected ~ralue.
Regardless of the manner in which CPU unit 24 signal acquisition unit 12 is activated to supply a command message to crash survivable memory unit 10, CPI) 24 and memory controller 32 of crash survivable memory unit 10 are collectively configured and sequenced to determine the beginning and end address of the memory space within memory unit 38 that contains night dsta associated with that particulsr special event. For example, in the previously referenced current realization of the flight data recorder system of FlGURE 1, CPU 24 and memory controller 32 operate so that 30 seconds of recorded night data are preserved each time CPU 24 supplies a special event message to crash survivable memory unit 10. This operation is illustrated by the flow diagram of PIGURE 6 which can be used in a night data recorder system conîiguration wherein CPU 24 s,imply provides a command signal th~t identifies the time at which one.of the OEircraft systems or a crew member requests storage of special event flight dat&. As is indicated by blocks 260 and 262 of FIGURE 6, in such an lZ39~i9~

~rrangement, memory controller 32 seguences to determine the st~rting address of the flight data to be protected whenever CPU 24 provides the 8ppropr}ate command message. To determine the starting addre~s for the special event, memory controller 32 searches the data stored ~n U)e memory space of memory unit 38 to locate the s~ored byte of night data that corresponds to the desired starting time of the special event. In this regard, memory unit 32 generally operates to l~cate a byte of stored flight data that corresponds with A point intime that preceded the time at which the command message was supplied to crash survivable unit 10. ~or example, it may be desirable to se~uence memory controller 32 so that each recorded special event consist~ of flight data corresponding to equal intervals of time that precede and follow the time st which a command message is generated by CPU 24.
As is indicated by block 264 of FIGURE 6, once the address of the memory location that stores the first byte of night data of the special event isdeterrnined, memory controller 32 operates to determine the address of the page of memory space containing that byte of night data. This procedure is utilized to allow the page writing and erasing procedure previously discussed herein. As is indicated by block 266 of PIGURE 6, once the address of the first page of stored flight data of the special event is determined, the address is stored in the next most available byte of the memory space that is reserved ~s the special events directory. As is indicated by block 268 of EIGURE 5, at this point, memory controller 32 loads night data into memory unit 38 in the manner described relative to ~IGURE 5. As flight data is loaded into memory, memory controller 32 sequences to determine whether the byte of flight data being loaded corresponds to the end of the special event of interest (indicated by decisional block 270 of FIGURE 6). When the last byte of night data for the special event is loaded into memory 38, memory controller 32 sequlences to determine the address of the end of the page of memory space that stores the final byte of special event night data (blGck 272) and stores that address in the special events directory of memory space (block 274). Memory controller 32 then continues its normal sequence for loading night data and self test until itreceives another special event command message. As previously mentioned and described relative to ~IGURE 5, the flight data corresponding to the recorded speci01 event is preserved until that data is transferred to ground read out unit 14 of FIGURE 1, ~t which time both the night data and the corresponding beginning and ending address that is stored in the special events directory ~re erased.

~;~3~9~9S

PIGURE 7 ~llustrates ~ sequence that utilizes the previously dis eussed signal supplied by power down detector 94 to reactivAte crfish survivablememory unit 10 ~ollowing ~ pow r Interruption of substantial duration (e.g., normal activation of the night data recorder system after it has been turned off) or after a power {nterruption of short duration that results ~rom unintended fluctu~tions in the operflting potential provided by power supply 30 of FIGl~RE 1.
ln the flow diagram of ~IGURE 7, memory controller 31 checks the st~tus of its random access memory whenever the memory controller determines that oper~t-ing power has been restored to crash survivable memory unit 10 (indicated by blocks 280 and 282 of ~l&URE 7~. In this regard, memory controller 31 can be provided with a signal by CPU 24 of signal acquisition unit la each time power is restored to the system or, alternatively, memory unit 31 c~n periodicslly monitor the status of the signal supplied by power down detector 94 (~lGURE 2) to detect a signal transistion indicating that power has been restored. In either case, upon detecting the restoration of operating power, memory unit 31 then searches a dedicated portion Or the random ~ccess memory contained in memory controller 31 to determine whether that portion of memory contains a pre-determined binary coded pattern. In this regard, as sh~l be described, each timethe sequence of ~IGURE 7 is performed following a power interruption of long dur~tion (n~old power upn), a checkerboard pattern of ones ~nd zerss is stored within the dedicated portion of the random access memory contained in memory controller 31. If the checkerboard pattern is present after a power interruption(determined at decisional block 284 of FIGURE 7~, the power interruption was of short duration (nw~rm power up") 6nd memory controller 31 continues its operational sequence after first verifying that the data stored in the previously discussed intermediate buffer memory has been properly loaded into memory unit 38 (determined at block 286 of FlGURE 7). On the other hand, if the checkerboard pattern is not fully present in the memory controller random sccess memory, memory controller 31 is sequenced through the cold power up procedure which consists of: resetting the memory controller counter to zero (block 288); initializing the output ports of crash survivable memory unit 10 (block 290); initializing the various memory registers of memory controller 31 and memory unit 38 (block 292); and loading the previously mentinned checker board pattern into the rsndom access memory of controller 31. As is indicated at block 296 of FIGURE 7, memory controller 31 is then sequenced to determine the memory addre~s Or the flight data that was stored in memory 38 immedistely prior to the power interruption. To sccomplish this, memory ccntrsller 31 sequentially accesses ehe first four bytes (words) of each page o~ flight data that 23~
-~4-~s stored in memory unit 38. When A page is locsted wherein the first ~our words~onsists of binary ~eros, memory controller 31 examines the information stored within the remaining portion of that p~ge. If binary zeros are stored ~t ead memory location, the page of data corresponds to the erased pages of memor~
space that ~re establ;shed during the data loading sequence of FI~URE S ~nd serYe as a marlcer between the most recently recorded page of flight data and the oldest recorded night data.
Although memory controller 31 could continue its normal sequence from the located address, and thereby store night data in the proper tin-e se~uence, memory controller 31 prefersbly is sequenced to provide a record of the power interruption. This operation is indicated by block 298 of FIGURE 7 and, in the current embodiment of crash survivable memory unit 10 consists of advancing the memory controller address pointer to leave a four byte erased gap (all binary zeros) between the night dat~ stored prior to the power interruptionand any night data thAt iS loaded into memory unit 38 after power is restorea This provides a marker that will be retained until overwritten with new night data. Such a marker can provide important information, ~or example, relative to power interruptions that occur immediately before an ~ircraft crash or if Ue period of time ~t which the power interruption occurs be preserved as a special aQ event.
It should be recognized by those skilled in the art that the foregoing description is exemplary in nature and that various changes and modifcations can be made without departing from the scope ~nd spirit of the invention. For example, although the invention has been disclosed relative to a memory unit 38 that is organized to utilize write, read and ersse cycles that operate on a multiple byte or page-by-page basis, memory circuits of the type that function on ~ byte-by-byte basis can be utilized by suitably sequencing memory controller 32 (i.e., by providing suitable stored instructions in the rea~
only memory that progr~ms the memory controller). In addition, it will be apparent to those skilled in the ~rt that various other circuit arrangements c~
be used for the circuits discussed herein, including those arrangements utilizedfor power and regulator switch 48, power monitor 52 and erase/write protection circuit 58.

Claims (60)

The embodiments of the invention in which an exclusive property or privilege is claimed are defined as follows:

1. A crash survivable solid state memory for storing digitally encoded flight data comprising:
memory means having a power input terminal for applying an operating potential to said memory means and having a plurality of storage locations that are selectively accessed by supplying a digitally encoded address signal to said memory means, said memory means being responsive to a control signal for storing supplied digitally encoded data at storage locations corresponding to said address signal supplied to said memory means when said operating potential is supplied to said power input terminal and said control signal is supplied to said memory means;
switch means having an input terminal, ar output terminal and a control terminal, said output terminal of said switch means being coupled to said power input terminal of said memory means, said switch means being responsive to a switch control signal for coupling an electrical potential supplied to said input terminal of said switch means to said switch means output terminal only when said switch control signal is supplied to said control terminal of said switch means; and memory controller means for supplying said switch control signal to said switch means and for supplying said address signals and said control signal to said memory means, said memory controller means including means for executing an operational sequence wherein said address and control signal is periodically supplied to said memory means and wherein said switch control signal is supplied to said switch means only during periods of time in which said address and control signal is supplied to said memory means.

2. The crash survivable solid state memory of Claim 1 wherein said memory means and said memory controller means are contained within an environmental housing to thermally insulate said memory means and said memory controller means from the surrounding environment, and wherein said switch means is located outside said environmental housing.

3. The crash survivable solid state memory of Claim 1 wherein said memory controller means further includes means responsive to an applied interrupt signal for interrupting said operational sequence of said memory controller means, said crash survivable solid state memory comprising power monitor means for monitoring an applied signal representa-tive of the operating potential supplied to said input term-inal of said switch means, said power monitor means includ-ing means for supplying said interrupt signal to said memory controller means when the level of said applied signal is less than a predetermined value.

4. The crash survivable solid state memory of Claim 3 wherein said memory means and said memory controller means are contained within an environmental housing to thermally insulate said memory means and said memory controller means from the surrounding environment, and wherein said switch means and said power monitor means are located outside said environmental housing.

5. The crash survivable solid state memory of Claim 3 wherein said memory mean, includes means responsive to said control signal for enabling digital data transfer be-tween said memory controller means and said selectively accessed storage locations when the magnitude of said con-trol signal is within a predetermined range and for dis-abling digital data transfer between said memory controller means and said selectively accessed storage locations when said magnitude of said control signal is outside said pre-determined range, said solid state memory further comprising memory protection means connected for receiving said inter-rupt signal supplied by said power monitor means, said memory protection means including means for supplying said control signal to said memory means at a magnitude within said predetermined range when said interrupt signal is not supplied to said memory protection means and means for supplying said control signal to said memory controller means at a magnitude that is outside said predetermined range when said interrupt signal is supplied to said memory protection means.

6. The crash survivable solid state memory of Claim 5 wherein said memory means, said memory protection means and said memory controller means are contained within an environmental housing to thermally insulate said memory means, said memory protection means and said memory controller means from the surrounding environment, and wherein means from the surrounding environment, and wherein said switch means and said power monitor means are located outside said environmental housing.

7. The crash survivable solid state memory of Claim 3 wherein said memory controller means is responsive to a reset signal for initializing said operational sequence of said memory controller means and said power monitor means further comprises means responsive to said electrical po-tential supplied at said output terminal of said switch means for supplying said reset signal to said memory con-troller means when said operating potential for said memory means is not present at said output terminal of said switch means for a predetermined period of time.

8. The crash survivable solid state memory of Claim 7 wherein said memory means and said memory controller means are contained within an environmental housing to thermally insulate said memory means and said memory controller means from the surrounding environment, and wherein said switch means and said power monitor means are located outside said environmental housing.

9. The crash survivable solid state memory of Claim 3 wherein said switch controller means is responsive to a reset signal for initializing said operational sequence of said memory controller means and said power monitor means further comprises means responsive to said operating potential supplied to said input terminal of said switch means for supplying a reset signal to said memory controller means each time operating potential is supplied to said input terminal of said switch means.

10. The crash survivable solid state memory of Claim 9 wherein said memory means and said memory controller means are contained within an environmental housing to thermally insulate said memory means and said memory controller means from the surrounding environment, and wherein said switch means and said power monitor means are located outside said environmental housing.

11. The crash survivable solid state memory of Claim 7 wherein said power monitor means further comprises means responsive to said operating potential supplied to said in-put terminal of said switch means for supplying a reset signal to said memory controller means each time operating potential is supplied to said input terminal of said switch means.

12. The crash survivable solid state memory of Claim 11 wherein said memory means and said memory controller means are contained within an environmental housing to thermally insulate said memory means and said memory con-troller means from the surrounding environment, and wherein said switch means and said power monitor means are located outside said environmental housing.

13. The crash survivable solid state memory of Claim 1 wherein:
(a) said memory controller means includes means for receiving digitally encoded data signals and for supply-ing said received digitally encoded signals to said memory means during said operational sequence of said memory con-troller means;
(b) said solid state memory includes means for temporarily storing said digitally encoded data signals supplied by said memory controller means to said memory means;

(c) a predetermined set of said plurality of storage locations of said memory means is dedicated for storing the addresses of other storage locations within said memory that do not properly store digitally encoded data coupled thereto when said controller means supplies said control signal to said memory means, and (d) said memory controller means includes means for:
(1) reading the data stored in the storage locations being addressed each time said memory controller means supplies said control signal to said memory means, (2) comparing the data read from said addressed storage locations with the data stored in said means for temporarily storing said data signals, (3) storing the addresses of addressed storage locations in said predetermined set of dedicated storage locations of said memory means when said data read from said addressed storage locations does not correspond to said data stored in said means for temporarily storing said data signals, (4) comparing each of said address signals supplied by said memory controller means with said addresses stored in said predetermined set of dedicated storage locations, and (5) generating a different address signal each time said address supplied by said memory controller means is identical to one of said addresses stored in said predeter-mined set of dedicated storage locations.

14. The crash survivable solid state memory of Claim 13 wherein said memory means, said means for temporarily starting said digitally encoded data signals and said memory controller means are contained within an environmental housing to thermally insulate said memory means, said means for temporarily storing said digitally encoded data and said memory controller means from the surrounding environment, and wherein said switch means is located outside said environmental housing.
15. The crash survivable solid state memory of Claim 13 further wherein said memory controller means further in-cludes means responsive to an applied interrupt signal for

Claim 15 continued interrupting said operational sequence of said memory controller means, said crash survivable solid state memory comprising power monitor means for monitoring an applied signal representative of the operating potential supplied to said input terminal of said switch means, said power monitor means including means for supplying said interrupt signal to said memory controller means when the level of said applied signal is less than a predetermined value.

16. The crash survivable solid state memory of Claim 15 wherein said memory means, said means for temporarily starting said digitally encoded data signals and said memory controller means are contained within an environmental housing to thermally insulate said memory means, said means for temporarily storing said digitally encoded data and said memory controller means from the surrounding environ-ment, and wherein said switch means and said power monitor means are located outside said environmental housing.

17. The crash survivable solid state memory of Claim 7 wherein said memory means includes means responsive to said control signal for enabling digital data transfer between said memory controller means and said selectively accessed storage locations when the magnitude of said control signal is within a predetermined range and for disabling digital data transfer between said memory controller means and said selectively accessed storage locations when said magnitude of said control signal is outside said predeter-mined range, said solid state memory further comprising memory protection means connected for receiving said interrupt signal supplied by said power monitor means, said memory protection means including means for supplying said control signal to said memory means at a magnitude within said predetermined range when said interrupt signal is not supplied to said memory protection means for supplying said control signal to said memory controller means at a magnitude that is outside said predetermined range when said interrupt signal is supplied to said memory protection means.

18. The crash survivable solid state memory of Claim 17 wherein said memory means, said memory protection means, said means for temporarily storing said digitally encoded data and said memory controller means are contained within an environmental housing to thermally insulate said memory means and said memory controller means from the surrounding environment, and wherein said switch means is located out-side said environmental housing.

19. The crash survivable solid state memory of Claim 15 wherein said memory means includes means responsive to said control signal for enabling digital data transfer between said memory controller means and said selectively accessed storage locations when the magnitude of said control signal is within a predetermined range and for disabling digital data transfer between said memory controller means and said selectively accessed storage locations when said magnitude of said control signal is outside said predeter-mined range, said solid state memory further comprising memory protection means connected for receiving said inter-rupt signal supplied by said power monitor means, said memory protection means including means for supplying said control signal to said memory means at a magnitude within said predetermined range when said interrupt signal is not supplied to said memory protection means and means for supplying said control signal to said memory controller means at a magnitude that is outside said predetermined range when said interrupt signal is supplied to said memory protection means.

20. The crash survivable solid state memory of Claim 19 wherein said memory means, said memory protection means, said means for temporarily storing said digitally encoded data and said memory controller means are contained within an environmental housing to thermally insulate said memory means, said memory protection means, said means for tempor-arily storing said digitally encoded data and said memory controller means from the surrounding environment, and where-in said switch means and said power monitor means are located ouside said environmental housing.

21. The crash survivable solid state memory of Claim 15 wherein said memory controller means is responsive to a reset signal for initializing said operational sequence of said memory controller means and said power monitor means further includes means responsive to said electrical potential supplied at said output terminal of said switch means for supplying said reset signal to said memory controller means when said operating potential for said memory means is not present at said output terminal of said switch means for a predetermined period of time.

22. The crash survivable solid state memory of Claim 21 wherein said memory means, said means for tempor-arily storing said digitally encoded data and said memory controller means are contained within an environmental housing to thermally insulate said memory means, said means for temporarily storing said digitally encoded data and said memory controller means from the surrounding environment, and wherein said switch means and said power monitor means are outside said environmental housing.

23. The crash survivable solid state memory of Claim 15 wherein said switch controller means is responsive to a reset signal for initializing said operational sequence of said memory controller means and said power monitor means further comprises means responsive to said operating potent-ial supplied to said input terminal of said switch means for supplying a reset signal to said memory controller means each time operating potential is supplied to said input terminal of said switch means.

24. The crash survivable solid state memory of Claim 23 wherein said power monitor means further includes means responsive to said electrical potential supplied at said output terminal of said switch means for supplying said reset signal to said memory controller means when said operating potential for said memory means is not present at said output terminal of said switch means for a predeter-mined period of time.

25. The crash survivable solid state memory of Claim 24 wherein said memory means, said means for tempor-arily storing said digital data and said memory controller means are contained within an environmental housing to thermally insulate said memory means, said means for temporarily storing said digital data and said memory con-troller means from the surrounding environment, and wherein said switch means is mounted outside said environmental housing.

26. The crash survivable solid state memory of Claim 17 wherein said memory controller means is responsive to a reset signal for initializing said operational sequence of said memory controller means and said power monitor means further includes means responsive to said electrical potential supplied at said output terminal of said switch means for supplying said reset signal to said memory control-ler means when said operating potential for said memory means is not present at said output terminal of said switch means for a predetermined period of time.

27. The crash survivable solid state memory of Claim 26 wherein said memory means, said means for tempor-arily storing said digitally encoded data and said memory controller means are contained within an environmental housing to thermally insulate said memory means, said means for temporarily storing said digitally encoded data and said memory controller means from the surrounding environment, and wherein said switch means and said power monitor means are outside said environmental housing.

28. The crash survivable solid state memory of Claim 17 wherein said switch controller means is responsive to a reset signal for initializing said operational sequence of said memory controller means and said power monitor means further comprises means responsive to said operating potential supplied to said input terminal of said switch means for supplying a reset signal to said memory controller means each time operating potential is supplied to said input terminal of said switch means.

29. The crash survivable solid state memory of Claim 28 wherein said memory means, said means for tempor-arily storing said digitally encoded data and said memory controller means are contained within an environmental housing to thermally insulate said memory means, said means for temporarily storing said digitally encoded data and said memory controller means from the surrounding environ-ment, and wherein said switch means and said power monitor means are mounted outside said environmental housing.

30. The crash survivable solid state memory of Claim 28 wherein said power monitor means further includes means responsive to said electrical potential supplied at said output terminal of said switch means for supplying said reset signal to said memory controller means when said operating potential for said memory means is not present at said output terminal of said switch means for a predeter-mined period of time.

31. The crash survivable solid state memory of Claim 30 wherein said memory means, said means for temp-orarily storing said digital data and said memory controller means are contained within an environmental housing to thermally insulate said memory means, said means for temp-orarily storing said digital data and said memory controller means from the surrounding environment, and wherein said switch means is mounted outside said environmental housing.
32. The crash survivable solid state memory of Claim 1 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) The decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to n and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;

Claim 32 (b) continued...

(b) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to address signals supplied to said memory means;
(c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address pairs consisting of a first address that corresponds to the storage location address at which a selected one of said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of signals is stored, and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers that is defined by the decimal equivalent values of said first and second address for each of said address pairs.

33. The crash survivable solid state memory of Claim 32 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predetermined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.

34. The crash survivable solid state memory of Claim 1 wherein:
(a) said digitally encoded data signals are a sequence of signals with each data signal of said sequence having a maximum bit length;
(b) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of signals in said memory means;
(c) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to said address signals supplied to said memory means;
(d) said memory controller means is configured and arranged to store each digitally encoded data signal of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said pre-determined maximum bit length; and (e) said memory means is configured and arranged to supply said second control signal to said memory means for erasing a set of storage locations in said memory means prior to storage of each particular digitally encoded data signal of said sequence, said set of erase storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
35. The crash survivable solid state memory of Claim 3 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means Claim 35 (a) continued includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;
(b) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to address signals supplied to said memory means; and (c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address pairs consisting of a first address that corresponds to the storage location address at which a selected one of said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of signals is stored; and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers that is defined by the decimal equivalent values of said first and second address for each of said address pairs.
36. The crash survivable solid state memory of

Claim 35 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predetermined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of

Claim 36 (c) continued said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.

37. The crash suvivable solid state memory of Claim 5 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;
(b) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to address signals supplied to said memory means; and (c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address pairs consisting of a first address that corresponds to the storage location address at which a selected one of said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of signals is stored; and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers that is defined by the decimal equivalent values of said first and second address for each of said address pairs.

38. The crash survivable solid state memory of Claim 37 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said pre-determined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
39. The crash survivalbe solid state memory of Claim 7 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;
(b) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to address signals supplied to said memory means; and (c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address pairs consisting of a first address that corresponds to the storage location address at which a selected one of

Claim 39 (c) continued said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of signals is stored; and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers that is defined by the decimal equivalent values of said first and second address for each of said address pairs.

40. The crash survivable solid state memory of Claim 39 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predeter-mined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
41. The crash survivable solid state memory of Claim 9 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal

Claim 41 (a) continued equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;
(b) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to address signals supplied to said memory means; and (c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address pairs consisting of a first address that corresponds to the storage location address at which a selected one of said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of signals is stored; and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers that is defined by the decimal equivalent values of said first and second address for each of said address pairs.

42. The crash survivable solid state memory of Claim 41 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predetermined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.

43. The crash survivable solid state memory of Claim 11 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) the decimal equivalent values of the digitally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;
(b) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to address signals supplied to said memory means; and (c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address at which a selected one of said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of signals is stored; and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers that is defined by the decimal equivalent values of said first and second address for each of said address pairs.
44. The crash survivable solid state memory of

Claim 43 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said

Claim 44 (b) continued predetermined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
45. The crash survivable solid state memory of Claim 13 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) the decimal equivalent values of the digitally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;
(b) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to address signals supplied to said memory means; and (c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address pairs consisting of a first address that corresponds to the storage location address at which a selected one of said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of signals is stored; and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers

Claim 45 (d) continued that is defined by the decimal equivalent values of said first and second address for each of said address pairs.

46. The crash survivable solid state memory of Claim 45 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predetermined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
47. The crash survivable solid state memory of Claim 15 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;
(b) said memory controller means further includes means for suppling a second control signal for erasing data

Claim 47 (b) continued stored at storage locations corresponding to address signals supplied to said memory means; and (c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address pairs consisting of a first address that corresponds to the storage location address at which a selected one of said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of said sequence of said sequence of signals is stored; and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers that is defined by the decimal equivalent values of said first and second address for each of said address pairs.

48. The crash survivable solid state memory of Claim 47 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said pre-determined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.

49. The crash survivable solid state memory of Claim 17 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to n and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;
(b) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to address signals supplied to said memory means; and (c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address pairs consisting of a first address that corresponds to the storage location address at which a selected one of said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of signals is stored; and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers that is defined by the decimal equivalent values of said first and second address for each of said address pairs.
50. The crash survivable solid state memory of

Claim 49 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of

Claim 50 (b) continued said memory means at least equal in bit length to said pre-determined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
51. The crash survivable solid state memory of Claim 19 wherein said digitally encoded signals are a sequence of data signals and wherein:
(a) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of data signals in said memory means;
(b) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to address signals supplied to said memory means; and (c) a predetermined set of said plurality of storage locations of said memory means is reserved for storing address pairs consisting of a first address that corresponds to the storage location address at which a selected one of said digitally encoded data signals of said sequence of signals is stored and a second address that corresponds to the storage location address at which a subsequent digitally encoded data signal of said sequence of signals is stored; and (d) said memory controller is further configured and arranged for supplying said second control signal only for storage location addresses having a decimal equivalent value that is outside the range of consecutive integers that

Claim 51 (d) continued is defined by the decimal equivalent values of said first and second address for each of said address pairs.

52. The crash survivable solid state memory of Claim 51 wherein:
(a) each said digitally encoded data signal of said sequence of signals exhibits a predetermined maximum bit length;
(b) said memory controller means is configured and arranged to store each digitally encoded signals of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predeter-mined maximum bit length; and (c) said memory means is configured and arranged to supply said second control signal for erasing a set of storage locations in said memory means prior to storage of each digitally encoded data signal of said sequence of said signals, said set of erased storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
53. The crash survivable solid state memory of Claim 3 wherein:
(a) said digitally encoded data signals are a sequence of signals with each data signal of said sequence having a miximum bit length;
(b) the decimal equivalent values of the digitally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of signals in said memory means;
(c) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to said address signals supplied to said memory means;

Claim 53 (d) continued (d) said memory controller means is configured and arranged to store each digitally encoded data signal of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predetermined maximum bit length; and (e) said memory means is configured and arranged to supply said second control signal to said memory means for erasing a set of storage locations in said memory means prior to storage of each particular digitally encoded data signal of said sequence, said set of erase storage locations in-cluding storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
54. The crash survivable solid state memory of Claim 5 wherein:
(a) said digitally encoded data signals are a sequence of signals with each data signal of said sequence having a miximum bit length;
(b) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to n and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of signals in said memory means;
(c) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to said address signals supplied to said memory means;
(d) said memory controller means is configured and arranged to store each digitally encoded data signal of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predetermined maximum bit length; and (e) said memory means is configured and arranged to supply said second control signal to said memory means for

Claim 54 (e) continued erasing a set of storage locations in said memory means prior to storage of each particular digitally encoded data signal of said sequence, said set of erase storage locations in-cluding storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.

55. The crash survivable solid state memory of Claim 7 wherein:
(a) said digitally encoded data signals are a sequence of signals with each data signal of said sequence having a maximum bit length;
(b) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ?
and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signal to store said digitally encoded data signals of said sequence of signals in said memory means;
(c) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to said address signals supplied to said memory means;
(d) said memory controller means is configured and arranged to store each digitally encoded data signal of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said pre-determined maximum bit length; and (e) said memory means is configured and arranged to supply said second control signal to said memory means for erasing a set of storage locations in said memory means prior to storage of each particular digitally encoded data signal of said sequence, said set of erase storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.

56. The crash survivable solid state memory of Claim 9 wherein:
(a) said digitally encoded data signals are a sequence of signals with each data signal of said sequence having a maximum bit length;
(b) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digit-ally encoded data signals of said sequence of signals in said memory means;
(c) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to said address signals supplied to said memory means;
(d) said memory controller means is configured and arranged to store digitally encoded data signal of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predeter-meined maximum bit length, and (e) said memory means is configured and arranged to supply said second control signal to said memory means for erasing a set of storage locations in said memory means prior to storage of each particular digitally encoded data signal of said sequence, said set of erase storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
57. The crash survivable solid state memory of Claim 13 wherein:
(a) said digitally encoded data signals are a sequence of signals with each data signal of said sequence having a maximum bit length;
(b) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are

Claim 57 (b) continued a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of signals in said memory means;
(c) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to said address signals supplied to said memory means;
(d) said memory controller means is configured and arranged to store each digitally encoded data signal of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predetermined maximum bit length; and (e) said memory means is configured and arranged to supply said second control signal to said memory means for erasing a set of storage locations in said memory means prior to storage of each particular digitally encoded data signal of said sequence said set of erase storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
58. The crash survivable solid state memory of Claim 15 wherein:
(a) said digitally encoded data signals are a sequence of signals with each data signal of said sequence having a maximum bit length;
(b) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to ? and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of signals in said memory means;

Claim 58 (c) continued (c) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to said address signals supplied to said memory means;
(d) said memory controller means is configured and arranged to store each digitally encoded data signal of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said predeter-mined maximum bit length; and (e) said memory means is configured and arranged to supply said second control signal to said memory means for erasing a set of storage locations in said memory means prior to storage of each particular digitally encoded data signal of said sequence, said set of erase storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
59. The crash survivable solid state memory of Claim 17 wherein:
(a) said digitally encoded data signals are a sequence of signals with each data signal of said sequence having a maximum bit length;
(b) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to n and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of signals in said memory means;
(c) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to said address signals supplied to said memory means;
(d) said memory controller means is configured and arranged to store each digitally encoded data signal of said sequence of signals in a set of storage locations of

Claim 59 (d) continued said memory means at least equal in bit length to said pre-determined maximum bit length; and (e) said memory means is configured and arranged to supply said second control signal to said memory means for erasing a set of storage locations in said memory means prior to storage of each particular digitally encoded data signal of said sequence, said set of erase storage locations including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.
60. The crash survivable solid state memory of Claim 19 wherein:
(a) said digitally encoded data signals are a sequence of signals with each data signal of said sequence having a maximum bit length;
(b) the decimal equivalent values of the digit-ally encoded address signals supplied to said memory means are a set of consecutive integers ranging from 0 to n and said operational sequence of said memory controller means includes repeatedly accessing the storage locations of said memory means in ascending order relative to said decimal equivalent values of said address signals to store said digitally encoded data signals of said sequence of signals in said memory means;
(c) said memory controller means further includes means for supplying a second control signal for erasing data stored at storage locations corresponding to said address signals supplied to said memory means;
(d) said memory controller means is configured and arranged to store each digitally encoded data signal of said sequence of signals in a set of storage locations of said memory means at least equal in bit length to said pre-determined maximum bit length; and (e) said memory means is configured and arranged to supply said second control signal to said memory means for erasing a set of storage locations in said memory means prior to storage of each particular digitally encoded data signal of said sequence, said set of erase storage locations

Claim 60 (e) continued including storage locations that will store the next most digitally encoded data signal of said sequence of digitally encoded data signals.