FPGAs fit for space
The arrival of Space 2.0 has democratised the use of satellites and opened up an array of applications that can be serviced by electronics in low-Earth orbit (LEO) as well as those on higher trajectories such as geosynchronous equatorial orbit (GEO).
Although launch costs have fallen rapidly, development cost and time present their own challenges. Even if deployed in large constellations of several hundred satellites like some of the LEO communications networks now orbiting, space electronics designs are intrinsically low-volume applications. Even for larger satellites expected to go into high orbit and with budgets approaching half a billion euros, it is difficult to justify the creation of a custom application-specific integrated circuit (ASIC) to handle processing or I/O control. Many projects opt to employ the technology of the field-programmable gate array (FPGA) in space because the technology offers faster time to market than the ASIC path. There is also little opportunity to amortise the non-recurrent engineering costs that can easily run into tens of millions of dollars if manufacturing needs to be carried out on an advanced process node, which further favours the use of FPGAs.
FPGA advantages
The advantage of the FPGA is that it provides the means to implement custom digital and sometimes even mixed-signal circuitry in low quantities: even one-off builds. The FPGA delivers a level of customisation for applications at a much finer-grained level than is possible with microcontrollers or microprocessors and is highly suited to situations where a real-time response with low energy consumption is required, such as the demodulation of complex communications protocols or processing streaming data from sensors.
An FPGA is typically implemented as a two-dimensional array of programmable logic blocks accessed using a programmable interconnect matrix and configurable I/O blocks that range from simple digital interfaces to high-speed serialiser/deserialiser (SERDES) modules. There are architectural differences between different FPGA families, but typically the core logic block contains one or more lookup tables to implement logic and arithmetic functions. Many FPGA implementations augment these fine-grain logic blocks with memory and digital signal processing (DSP) blocks to support advanced communications and analysis functions.
FPGA types: SRAM, flash and antifuse
The state of the FPGA is represented by the contents of the lookup tables and the interconnect, which is controlled either by a distributed array of memory cells or by hardwired links formed by the one-time programming of antifuses. How the configuration is stored if power is removed or the device is reset is one of the key differentiating factors in FPGA buying decisions particularly for space applications. In the case of SRAM-based FPGAs, such as those manufactured by Xilinx, the configuration needs to be read in after a power-cycling operation as the internal state is not preserved if the supply voltage is removed. In the case of flash or antifuse FPGAs, the configuration is non-volatile and preserved across power cycles.
The nature of the memory cells used to store configuration has an even more important effect on the overall reliability of the system after orbital insertion. Ionising radiation is an ever-present danger to any electronics, not just an FPGA in space. The risk comes from the large number of high-energy particles encountered even in LEO. They can pass through dense matter such as circuit boards but as they do so they will lose energy and leave in their wake electron-hole pairs that disrupt normal operation.
Registers and SRAMs are generally the most vulnerable to this charge build-up. Below a threshold value, the excess charge will not result in a change of state. But above the threshold, enough charge can accumulate to flip the state of the memory cell or flip-flop. If this leads to a change in system behaviour, the result is a single-event upset (SEU). In a microprocessor, such an error would most likely appear in software execution. In an FPGA that uses memory cells to configure the interconnect, this can lead to a change in configuration state and the addition or removal of a circuit path if a configuration cell is directly affected.
The relationship between sensitivity to SEUs and process technology is complex. Typically, with smaller process geometries, the static cross section – a measurement used in typical tests to determine the SEU resilience of each individual cell – reduces. The reduction in static cross section results from the lower likelihood of a cell capturing the stray carriers that result from ionising radiation. However, as newer devices take advantage of smaller transistors to improve density this leads to an increase in the probability of SEUs being encountered somewhere on a device if careful circuit design is not used to mitigate these problems.
There are some other possibly counterintuitive relationships between process geometry and radiation. One potential source of failure is radiation-induced threshold voltage shift. The magnitude of this shift is correlated with the thickness of insulating oxides, which are far thinner in advanced processes, making them less prone to this type of failure. Leakage currents formed by parasitic channels being opened up by charge cascades are also not more likely in advanced nodes. The design and shape of oxide isolation has a far stronger effect on radiation susceptibility and the potential for leakage-induced latchup. Typically, it will be larger transistors in power circuitry that will be more vulnerable to latchup.
Antifuse FPGAs for high resilience
Different types of FPGA vary in how they cope with radiation. Traditionally, antifuse-based FPGAs such as the Axcelerator family manufactured by Microchip Technology provide the greatest resistance to SEUs. The core cell used for configuration is based on an antifuse structure that is programmed once the design is complete and which cannot be reversed once the conductive path has been formed between the two layers of metal linked by the antifuse. Antifuse technology supports high interconnect density and low power consumption and avoids the need to read in the configuration after each power cycle. But the number of system gates available tends to be lower compared to other space-grade FPGA technologies: the Axcelerator family currently provides up to 4 million gates. One potential drawback to the use of antifuse FPGAs is that as they are one-time programmable, revisions to the circuitry can be expensive, as they will require new components to be supplied. In orbit reprogrammability is also not possible using this technology.
Flash memory cells tend to be more resistant to SEUs as the stray carriers are trapped on the floating gate comparatively rarely. However, over time, energetic carriers will be trapped permanently in the floating gate, which will cause the cell’s behaviour to change and respond more slowly to accesses until it fails once its total ionising dose has passed a threshold. Products such as those in the Microchip RTG4 use additional transistors in the memory-cell design to avoid this slow down. The result is a device with high resistance to SEUs and long-term radiation damage in their configuration logic that is coupled with the ability to reconfigure the device during prototyping and even runtime.
Though non-volatile memory can improve radiation hardness, registers and SRAMs remain vital parts of any satellite circuitry. Volatile storage is required for efficient software processing. The use of these volatile elements simply needs some level of redundancy or protective design to mitigate the problems caused by high levels of ionising radiation and it is the same for any space-qualified FPGA that uses SRAM cells. The key difference lies in how the system is architected to handle SEUs and how sensitive to other considerations such as required gate count and power budget influence the specifications. Another tradeoff is the need for reprogrammability during the design process and possibly in orbit.
Redundancy for radiation resistance
The volatile registers in radiation-hardened antifuse products are typically implemented using a triple-modular redundancy scheme. If the particle has high enough energy to flip the state of a register, the use of redundant flip-flops feeding into the voting logic will result in the correct output: the probability of two strikes producing SEUs in two flip-flops so close together is extremely low even in periods of high solar activity.
Radiation-hardened FPGA architectures that employ SRAM for configuration generally employ specially designed and larger-area memory cells to protect against SEUs. In these memories, there are two or more storage nodes, both of which needs to be changed to result in an SEU, which is highly unlikely under most conditions. Some SRAM-based FPGAs are implemented using silicon-on-insulator process technology instead of bulk CMOS as this provides greater protection against the charge carriers that are created in the substrate. The Xilinx Virtex-5QV FPGA technology augments this protection with a thin epitaxial layer in the wafer manufacturing process to provide greater latchup immunity.
Radiation-tolerant options
Radiation-tolerant FPGAs provide another, lower-cost option. The difference between radiation-hardened and radiation-tolerant FPGAs lies in their tested resistance to SEUs and other problems caused by ionising radiation. Radiation-tolerant devices offer a lower level of protection as they are based on commercial off-the-shelf (COTS) parts though they can offer higher density as they are often made on more advanced processes than actively radiation-hardened parts. The result is access to devices with very high gate counts. Using examples from the Xilinx catalogue, the radiation-tolerant Kintex UltraScale made on a 20nm process can deliver four times more logic cells than a radiation-hardened FPGA based on SRAM technology such as the 65nm-node Virtex-5QV. In comparison with the 65nm devices, the Kintex reduces power by around 30 per cent and enables the implementation of communications transceivers that are 12 times faster.
To implement radiation tolerance, Xilinx altered the layout of the configuration memory cells using design rules intended to deliver better protection against multiple-bit upsets, alongside other circuit techniques intended to reduce soft-error rates.
To demonstrate their resistance to SEUs and related issues, parts are designed and characterised to meet the requirements of a standard such as MIL-PRF-38535. This standard defines a number of performance classes that vary in terms of radiation hardness, with specifications that cover parameters such as the TID that a device needs to be able to resist without failure. In the case of the Virtex-5QV family, the devices have been tested in accordance with QML Class V for radiation-hardened products to withstand an accumulated dose of more than 1000krad. The radiation-tolerant FPGA devices in the Kintex family are designed and qualified to QML Class Q and QML Class Y requirements.
On top of the built-in SEU-mitigation features, users can improve resilience in key logic circuits by using triple-modular redundancy and voting logic, and also by employing error detection and correction to protect the data stored in block SRAMs. These design methods are supported by industry-standard tools supplied by Siemens or Synopsys. Xilinx also provides its SEM IP to deliver further mitigation. This IP can be used to detect, correct, and classify SEUs in configuration memory, using the readback-CRC feature in the logic fabric to locate and correct errors. Another option is to use the IP to classify errors, which can be used to drive algorithms that manage system-level responses. For example, scrubbing can also be used to improve reliability. This can range from periodic device reconfiguration during each orbit for LEO spacecraft to transparently checking and rewriting individual frames in the background throughout FPGA operation on GEO missions.
The future of FPGAs
In order to support changing mission needs, on-orbit reconfigurability is likely to become increasingly important in FPGA space applications. Xilinx has implemented mechanisms to support secure reconfiguration and allow over-the-air upgrades to be communicated from a ground station or other satellites in the constellation. In combination with the high logic and memory density available in radiation-tolerant FPGAs, it will be possible to implement highly sophisticated satellite services at low relative cost.
Follow Avnet Silica on LinkedIn
About Author
Paul Leys
Paul Leys is the Market Segment Manager for the Aerospace and Commercial Avionics business at Avnet ...
silica content library/articles/fpgas-fit-for-space
FPGAs fit for space | Avnet Silica
