Radiation-hardened processors for space

By Paul Leys   |   September 28, 2022

Lower launch costs have helped open up a raft of applications for satellites that, by featuring advanced sensors and computing, are able to deliver novel communications and remote-monitoring services. Limited communication bandwidth to ground stations and the increasing resolution of sensors mean that sophisticated compression and onboard analysis techniques are mandated. In many cases machine learning (ML) will be relied upon. However, the presence of high levels of radiation in orbit means the use of high-speed commercial off-the-shelf (COTS) microprocessors could be problematic - and potentially result in a failed mission.

Many radiation hazards exist in space. They include cosmic rays from energetic sources in our galaxy that are many light years away, as well as particles pumped out by the Sun during solar storms. The most common threat to low-Earth orbit (LEO) satellites, however, is radiation trapped by the Earth’s magnetic fields in the Van Allen belts.

Implications of radiation exposure and sourcing radiation-hardened chips

The radiation effects outlined above can threaten the long-term operation of processors deployed in space. There are cumulative effects, such as charge build-up in the gate oxide of CMOS transistors causing the threshold voltage to shift. If the change is large enough, the transistor may fail to switch correctly, leading to a permanent failure. Another source of potential failure is leakage-induced latch-up, which is generally the result of a single-event effect (SEE), such as the passage of a high-energy particle through a device’s constituent layers.

The energy discharged by the particle results in the generation of multiple electron-hole pairs. As well as leading to accumulated charge in gate oxides, if those are in the path of the particle, a key danger lies in the pairs generated within the silicon substrate close to transistor junctions. The result can be formation of parasitic bipolar transistors in CMOS transistor wells, thereby creating low-resistance paths between power and ground. The high current this temporary channel passes can potentially lead to the permanent latch-up of a transistor so that it no longer functions. The result is a hard error in the form of a single-event latch-up (SEL).  Latch-ups can be destructive and non-destructive. A non-destructive latch-up is cleared after a power cycle, but a destructive latch-up will remain.

Though they are less able to cope with changes, because of the lower supply voltages in use for advanced processes, the vulnerability to threshold voltage shift in a central processing unit (CPU) or similar integrated circuit (IC) made on an advanced geometry is lower than for older parts. This is because the gate oxides are significantly thinner, and therefore present fewer opportunities for the capture of damaging trapped charges. Latch-up is also more common in power circuitry, where it is possible to develop very high currents when a parasitic transistor forms.

Another often unexpected consequence of accumulated radiation is when the individual strikes have comparatively low energy. Bipolar electronics can suffer from a phenomenon where low doses can still cause failures, even if they often pass tests based on higher total ionising dose (TID) levels. As a result, bipolar devices may need to be tested under an enhanced low-dose rate sensitivity (ELDRS) regime to ensure they are not susceptible to this issue.

Other problems caused by injected charges have, however, become more problematic for microcontroller and microprocessor devices over successive process generations. This is because the injected charge from an SEE often accumulates in storage cells (such as registers and static or dynamic memory cells). The positive feedback loops in flip-flops, registers and SRAM circuits makes them susceptible to bitflip once the collected charge accumulates to a critical value (Qcrit). A problem for chips built on more advanced processes is that smaller charge-storage nodes have lower Qcrit values.

Once the Qcrit level has been surpassed, the charge is strong enough to drive the node’s voltage past the switching voltage. The result is a single-event error and, and if not mitigated this will cause a single-event upset (SEU). If it is not a radiation-hardened CPU, the error will most likely cause errors in software processing. An SEU in data RAM will lead to the incorrect values being used in computations. A bit-flip in a status or control register can lead to errors such as branches being skipped or taken incorrectly. The effect can cause the component to reset or hang, subsequently requiring reset by a watchdog circuit.

Silicon-on-Insulator (SOI) Technology

Radiation-hardened chips can make use of various techniques to avoid SEUs occurring. One option is to select chips fabricated on semiconductor processes that are known to be more resistant to radiation - such as silicon-on-insulator (SOI) technology. In a SOI process, the active circuitry is separated from the bulk-silicon substrate by a thin layer of oxide insulation. This not only reduces parasitic circuit capacitances, but also significantly reduces the likelihood of SEUs triggering a latch-up failure. The RAD510 system-on-chip (SoC) developed by BAE Systems is an example of a radiation-hardened microprocessor. It is implemented on a 45nm SOI process developed in cooperation with GlobalFoundries.

Another approach, implemented by Vorago Technologies on its Hardsil technology is to use additional implant stages on conventional bulk-silicon processes, to make existing processor and other semiconductor designs more resilient to radiation damage. This approach buries guard rings in the substrate beneath the transistor areas. It acts to prevent parasitic transistors forming that would otherwise cause latch-up.

Triple Modular Redundancy (TMR) Benefits

The most reliable method for protecting against SEUs that affect the many registers in the microprocessor pipeline and execution units is to employ triple modular redundancy (TMR). This design approach works on the assumption that the probability of multiple particle strikes in the same area of silicon will be incredibly rare. The logic is implemented to allow errors to develop in one circuit element and to use calculations performed by identical copies to deliver the correct result. In the case of TMR, there are three identical circuits linked by voting logic. Most of the time, the three copies will provide identical results, but if one is affected by an SEU, two may provide one result and the affected circuit will give a different answer.

Voting logic implemented using majority logic gates determines which of the answers to send to the next stage in the logic path. The output relies on whichever pair of circuits delivers the same answer. Further protection may be included, depending on the expected radiation risk, by adding a level of redundancy to the combinatorial voting logic.

A drawback of the TMR approach is that it adds latency to every pipeline stage that employs it. Consequently, it lowers the maximum clock rate, as well as increasing the costs involved. The need to replicate logic also leads to a 200% increase in die area. For these reasons, radiation-hardened microcontrollers and microprocessors with TMR tend to only be used in the most extreme environments, and where mission longevity is a prime factor. Examples include deep-space probes and satellites in orbits that require multiple passes through the Van Allen belts, where particle radiation is most prevalent.

There are less expensive mitigation techniques that focus primarily on critical registers and memories. Radiation-hardened architectures have been developed that limit the ability of an SEE to affect the overall register state. One architectural option available is error-detection and correction circuitry (ECC). This is found in many memory products and is aimed at Earth-bound use, as well as in space. It adds several extra bits to each word of data memory, and the data itself is encoded in such a way that a single bit-flip can be both flagged and corrected.

Scrubbing and Error Correction

Scrubbing logic can be used to rewrite affected words after detection, to minimise the risk of further SEUs compromising the data to a point where it cannot be corrected. As the ECC logic is usually in the memory interfaces, and so only triggered when data is accessed, regular scrubbing of memory contents is often used on missions to check that infrequently accessed data in volatile memories has not been affected by SEUs.

Registers can be protected through the use of specially designed memory cells that feature a larger number of transistors, and which are more resistant to SEUs. In these memories, there are two or more storage nodes, both of which need to be changed to result in an SEU - which is highly unlikely under most conditions. The use of these and related techniques make it possible to deliver radiation-hardened semiconductors without incurring the high cost of employing TMR throughout all of the critical subsystems.

Historically, the range of processor architectures available for space use was limited. There remains a smaller choice of architectures available to the designer compared to COTS parts, but a variety of suppliers have stepped into the market in recent years to offer radiation-hardened Arm processor designs in addition to the IBM Power or Oracle SPARC based designs that have been the mainstay of the space industry for more than a decade.

New Radiation Hardened Processors

Examples of radiation-hardened Arm processors intended for use in space include the SAMRH71 from Microchip Technology, developed in collaboration with the European and French space agencies, the Hardsil-augmented Cortex-M0 and Cortex-M4 devices supplied by Vorago, and the quad-core computer developed by NASA around the Cortex-A53 architecture.

NASA’s High-Performance Spaceflight Computing (HPSC) project’s design will employ the same lock-step operation as that is used in commercial automotive microcontrollers to provide a higher degree of redundancy and resilience than is possible with a single processor core, but without the cost of a traditional TMR implementation. The latest offering here from Microchip - the SAMRH707 - is a 32-bit 150krad radiation-hardened 50MHz (>100 DMIPS) Arm Cortex M7 microprocessor. It includes a range of interfaces like SpaceWire, 1553 and dual CAN-FD, as well as 12-bit ADC/DAC, in order to expand the features available to customers even further.

Employing programmable logic processing solutions

Radiation-hardened FPGAs, such as the AMD Xilinx Kintex UltraScale XQRKU060, are another processing option for engineers to consider - offering elevated levels of system flexibility and enabling allocated engineering effort to be reduced through design re-use. Based on a 20nm process technology, these high-performance space-grade programmable logic devices have a typical TID resilience of 100krad and a 80MeV-cm2/mg SEL immunity. Possessing over 330,000 look-up tables (LUTs), they have a block RAM memory implementation. Each FPGA has 10 digital signal processing (DSP) cores embedded into it for carrying out assigned computing workloads (with ample provision for undertaking ML-related activities). They are supplied in ruggedized column grid array packages. A wide range of I/Os are supported to facilitate integration.

Differentiating radiation-tolerant from radiation-hardened devices

More choices are available if the project can use radiation-tolerant devices in place of radiation-hardened ones. This also provides an opportunity to reduce system bill-of-materials (BoM) costs. Typically, radiation-tolerant parts are derived from existing COTS parts. The manufacturer may make minor modifications, but the emphasis is on testing/screening to ensure that devices can survive a certain TID and recover from SEEs effectively. Whereas radiation-hardened ICs are offered up to QML V level of the MIL-PRF-38535 standard and need to use certain types of hermetically sealed package, a radiation-tolerant device can use COTS packaging and can be tested to the less stringent QML Y level.

Often, radiation-tolerant processors operate at higher clock speeds than radiation-hardened ones, as they employ fewer safety interlocks. Though the radiation-tolerant parts are less resistant to ionising radiation, they are often suitable for LEO missions where the satellite may be expected to operate for fewer than ten years. An example of a radiation-tolerant processor designed for space applications is the NXP PC8548 (tested and screened by Teledyne e2v). This is built around a Power architecture e500 core and has the capacity to operate at up to 1.2GHz.

Radiation-tolerant COTS processors can be used in space with additional support logic to implement redundancy and recovery operations in case the firmware fails because of an SEU or full latch-up. This may be effective in systems that are not critical, but which are used to control additional experiments on the satellite. However, evaluating the effectiveness of this approach is more difficult if the supplier has not performed (and subsequently disclosed) radiation testing, as phenomena such as ELDRS are difficult to predict without a detailed knowledge of device architecture.

Conclusion

The range of solutions that can cater for the processing needs of satellites is expanding, as more organisations are looking to develop their own space projects. Conducting a risk analysis of the threats posed by radiation will help to determine the degree of radiation hardness required. Design-in support from a distribution partner with experience in this area will help designers with their product selection, so that they will come to the right decision.

Follow Avnet Silica on LinkedIn

About Author

Paul Leys

Paul Leys is the Market Segment Manager for the Aerospace and Commercial Avionics business at Avnet ...

View Bio