Industries · Space

Space

Chips that keep working through radiation and temperature extremes, years from the nearest repair.

GR740 total-dose tolerance
300 krad(Si)
GR740: development start to QML-V tests done
2009 → 2020
HPSC target vs current space processors
Over 100× compute
U.S. export-control threshold for rad-hard ICs (total dose)
5 × 10³ Gy(Si)

At a glance

Where the flow bends

  1. 01Specification

    The spec lists how much radiation the chip must survive, how hot and cold it gets, and how many years it must run with no repair.

    Add radiation requirements (total dose in krad(Si), latch-up immunity, acceptable upset rate), the temperature range, mission life and the qualification level (for example QML-V).

    Write the environment as numbers: TID target, SEL LET threshold, SEU/SEFI rate per device-day for the orbit, junction temperature range, and the qualification flow (MIL-PRF-38535 class, ESCC). Check whether the hardness level triggers export control under ECCN 3A001.a.1.

  2. 02Architecture

    The chip is built with spare copies and self-checking memory so one hit from a particle doesn’t cause a failure.

    Memories get error detection and correction (EDAC) and background scrubbing; watchdogs and redundancy catch hangs. Some blocks are triplicated.

    Decide where to harden selectively versus globally, what EDAC code each memory gets (SECDED, Reed-Solomon), scrub rates against upset rates, and how the system recovers from SEFIs (watchdog, reset domains, power cycling).

  3. 03RTL design

    Important storage is kept in three copies, and a vote picks the answer two of them agree on.

    Triple modular redundancy (TMR) replaces a flip-flop with three plus a majority voter. RTL also adds EDAC encoders/decoders and scrubbing logic.

    Choose between flip-flop-level TMR, TMR with triplicated voters and logic (full TMR), or hardened DICE cells from the library. Self-correcting TMR variants write the voted value back so errors don’t accumulate.

  4. 04Verification

    Engineers fake particle hits in simulation, then shoot real particle beams at the finished chips.

    Fault-injection simulation checks that TMR and EDAC catch injected upsets. After silicon, heavy-ion and proton beam tests measure the real rates.

    Inject SEUs and SETs at RTL and gate level, including in clock, reset and test logic. Plan beam testing early and keep test logic observable, because SEFIs and latch-up can look alike on a tester.

  5. 05Logic synthesis

    The design is built from special hardened building blocks.

    Synthesis maps to a radiation-hardened cell library and must keep the redundant copies that a normal optimizer would merge.

    Use the hardened library’s DICE or TMR flip-flops and SET-filtered cells where needed, and constrain the tool so triplicated registers and voters are preserved and not shared.

  6. 09Placement

    The three copies are placed apart, so one particle can’t hit all of them.

    TMR copies and DICE nodes need spacing; one particle can upset several neighboring cells at once (a multi-bit upset).

    Add placement constraints that separate redundant flip-flops and sensitive node pairs. Charge sharing grows at small geometries, which is why plain DICE loses effectiveness at advanced nodes.

  7. 12Signoff

    Timing is checked across a wider range of hot and cold than a phone chip sees.

    Corners extend to the full mission temperature range, and the library models reflect the hardened cells and their slower, larger layouts.

    Sign off over the qualified junction range with aging and dose-induced drift in mind, and include the delay of voters and SET filters on critical paths.

  8. 13GDS & tapeout

    After the chip is made, it goes through months of testing before it is approved to fly.

    Parts are screened and qualified, for example to MIL-PRF-38535 QML-V in the U.S. or ESCC in Europe, including radiation tests.

    Plan for qualification groups (electrical, mechanical/environmental, life, package, radiation), lot acceptance, and the package development that space flows need (hermetic ceramic, column grid arrays). Budget years for this step.

The big idea

Space is full of fast-moving particles from the Sun and from deep space. When one passes through a chip it can flip a stored bit, cause a brief glitch, or even switch on a hidden short circuit. Over years, the steady exposure also wears the transistors down. And once a spacecraft launches, nobody can open it up to swap a part.

So space chips are designed to take hits and keep going. They store important values in several copies, check their memory constantly, and are tested by firing real particle beams at them before they fly. Engineers describe the slow wear as and the sudden hits as .

Radiation effects fall into two groups. Cumulative effects are total ionizing dose (TID), “measured in krad,” which causes “parametric or functional degradation,” and displacement damage. Single-event effects happen “when a single radiation particle strike deposits enough charge to cause an effect.” The main ones:

  • : a non-destructive change in the state of a memory cell or flip-flop.
  • : a glitch in logic that becomes an error if a flip-flop captures it at a clock edge.
  • : a destructive event in which parasitic structures in CMOS cause a high-current state.
  • : a functional “hiccup” that clears with a reset (soft) or needs a power cycle (hard).

There are two ways to harden a chip: build it in a special radiation-hardened process, or use , which modifies “the transistors, gates, and physical layouts” in a commercial process with hardened cell libraries and radiation-aware layout.

The design response is layered. At the cell level: hardened flip-flops such as , and layout measures like guard rings, well contact arrays and spacing between critical transistors. At RTL: and . At system level: , watchdog timers, selective power cycling and software fault isolation. High-performance processors increasingly harden only the most vulnerable blocks and add architectural redundancy where needed, to avoid excessive area and power.

Hardness has legal weight too. ICs designed or rated to withstand a total dose of 5 × 10³ Gy(Si) or more, a dose-rate upset of 5 × 10⁶ Gy(Si)/s, or a neutron fluence of 5 × 10¹³ n/cm² are controlled under ECCN 3A001.a.1. A spec target can decide where a part may be sold.

What drives the design

  • Radiation, which flips bits and wears out transistors.
  • Temperature swings between sunlight and shadow.
  • No repair: the chip has to last the whole mission.
  • Cost versus risk: a big science mission pays for proven, toughened parts; a small, cheap satellite may use ordinary chips and accept more risk.

COTS or rad-hard. COTS parts “offer superior performance, energy efficiency, and affordability” but “tend to be highly susceptible to radiation.” A common small-satellite pattern is COTS processor and memory first, surrounded by rad-hardened supporting electronics: ECC, watchdog timers, scrubbing and redundancy. For harsher environments or longer missions, flight heritage and demonstrated radiation performance become the main selection criteria.

Qualification. In the U.S., MIL-PRF-38535 has offered hermetic classes Q and V (corresponding to class levels B and S) for military and space parts; for space microcircuits, DLA, NASA/JPL and the Aerospace Corporation form the qualifying activity. In Europe, the ESCC system provides the specification system and the ESCC , with ESA as qualification authority. NASA’s NEPP program publishes parts performance, failure modes and test methods for the community.

Compute demand. Long communication delays force spacecraft to run autonomy, AI, image processing and fault recovery onboard, and NASA notes that “radiation and extreme temperatures can affect electronic components.”

FPGAs. NASA engineers note that FPGAs are used in every space application. Radiation-hardened FPGAs come with SEE- and TID-hardened elements built in, at high cost; commercial reprogrammable FPGAs must be mitigated by the designer. In cyclotron tests on a reprogrammable FPGA, distributed TMR (triplicating everything except global clocks, resets and enables) reduced SEEs more than localized TMR (triplicating only flip-flops).

Test data needs care. LaBel and Berg describe a beam test in which supply current stepped up and configuration changed, which looked like latch-up but was an upset in the JTAG TAP controller. Design-for-test logic is part of the sensitive area, so hold it in a safe state in flight and make device state visible to the test set.

How the flow changes

The radiation and temperature targets go into the spec first. The architecture adds memory that checks itself and copies of important circuits. The design is built from special hardened building blocks, and the copies are placed apart so one particle can’t hit them all. Simulations fake particle hits to check the protections work. After manufacturing, sample chips are taken to particle accelerators and tested, then go through a long qualification before they are approved to fly.

StageSpace addition
SpecTID, SEL threshold, upset rate, temperature, mission life, qualification class
ArchitectureEDAC on memories, scrubbing, watchdogs, redundancy
RTL / synthesisTMR or hardened flip-flops; keep redundant copies
PlacementSpacing between redundant cells
VerificationFault injection; beam testing after silicon
SignoffFull mission temperature range
TapeoutScreening and qualification (QML, ESCC)

TMR at flip-flop level replaces one flip-flop with three and a voter, which masks an error in any one of them. The DICE cell is one of the most used custom rad-hard flip-flops; it applies dual redundancy inside the cell.

Flip-flop choice. DICE gives good hardness in older technologies but is less effective at highly scaled nodes (for example 45 nm), and standard DICE is not robust to multi-bit upsets, which motivated variants such as T-DICE, F-DICE and LEAP-DICE. Basic TMR flip-flops fail when an SET on the data path arrives at the clock edge, because all three copies capture it; full TMR triplicates voters and logic at a large area cost. Schrape et al. build five TMR variants (baseline, latch-based, TSPC, scannable, self-correcting) from standard non-hardened cells, handle multi-bit upsets with placement constraints, and mitigate SETs with SET filters and sizing of clock and reset tree inverters; their test chips reached threshold LETs from 32.4 to 62.5 MeV·cm²/mg depending on variant.

Implementation constraints. Synthesis and physical optimization see triplicated registers as redundant, so the flow must be told to preserve them and not share logic between copies. Placement rules keep redundant cells apart, and timing signoff includes voter and filter delay on critical paths.

Package and qualification. Space parts often use hermetic ceramic packages and column grid arrays, which bring their own bonding and board-reliability qualification, as the case study shows.

Case study

ESA wanted a faster processor for European spacecraft. The result is the GR740, a chip with four processor cores built for radiation. Development started in 2009. Flight chips were made and radiation-tested in 2018, and the full space-grade qualification tests finished in 2020. That is more than a decade from start to a part you can fly.

It belongs to a family of LEON processors that began at ESA in the late 1990s. NASA’s next step is HPSC, a new space processor designed to give more than 100 times the computing power of current space processors.

The GR740 has four fault-tolerant LEON4 SPARC V8 cores at 250 MHz, a 2 MiB L2 cache, an SDRAM interface protected by Reed-Solomon EDAC, EDAC on the PROM/IO interface, and a SpaceWire router, all in a 65 nm space-qualified CMOS process with a dedicated space cell library. The goal was a European alternative to the RAD750 with higher performance than earlier European space processors.

Published results:

  • TID tolerance of 300 krad(Si).
  • SEL immunity above 125 MeV·cm²/mg, tested above 85 °C at maximum supply.
  • Overall SEE rate below 1 × 10⁻⁵ events per device per day in geostationary orbit.
  • −40 °C to +125 °C junction temperature in ceramic packages; under 2 W at 40 °C.

The timeline shows where space projects spend time: VHDL design and FPGA-based verification from 2009, implementation in the space process in 2014, engineering models in 2016, flight silicon validated including radiation in 2018, QML-V qualification tests complete in 2020, and ESCC delta-evaluation in early 2021. Qualification followed the QML-V flow: Groups A (electrical), B (mechanical and environmental), C (life), D (package) and E (radiation).

Many hurdles were physical. Flip-chip packaging was not available to the project, so the team developed 625-pin ceramic land and column grid array packages with gold wire bonding at 20 µm diameter across four bond decks, plus an over-pad metallisation layer for the gold-wire to aluminum-pad interface. The revision-1 die fixed L2 cache fault tolerance, extended logging, corrected a ring oscillator and the on-chip temperature sensor, and added pipelining to ease back-end work. The team’s lessons: release prototypes early for functional validation and radiation characterization, and keep software compatibility with earlier LEON parts.

HPSC shows the next generation: an SoC built on an open-source ISA, with fault tolerance, radiation tolerance, a security suite, granular power control and Ethernet connectivity, aimed at mission needs through 2040.

Sources

  1. 8.0 Small Spacecraft Avionics (State-of-the-Art of Small Spacecraft Technology)NASA Small Spacecraft Systems Virtual Institute · NASATID, SEE, SEU, SEL definitions; COTS trade-offs; RHBD trend.
  2. NASA Electronic Parts and Packaging (NEPP) ProgramNASAWhat NEPP does; home of GSFC radiation test data tools.
  3. Complex Parts, Complex Data: Why You Need to Understand What Radiation Single Event Testing Data Does and Doesn’t Show and the Implications ThereofKenneth A. LaBel and Melanie D. Berg · NASA Technical Reports Server (GOMACTech 2015) · 2015SEFI definition; JTAG TAP upset that looked like latch-up.
  4. Design and Evaluation of Radiation-Hardened Standard Cell Flip-FlopsOliver Schrape, Marko Andjelkovic, Anselm Breitenreiter, Steffen Zeidler, Alexey Balashov and Miloš Krstić · IEEE Transactions on Circuits and Systems I (open access via TIB) · 2021RHBD, DICE limits at scaled nodes, TMR flip-flop variants, MBU placement, SET filters.
  5. Localized Triple Modular Redundancy vs. Distributed Triple Modular Redundancy on a ProASIC3E Reprogrammable FPGAAlex McGuffey, Melanie Berg and Jonathan Pellish · NASA Technical Reports Server · 2010FPGAs in space; RH vs COTS FPGAs; DTMR beat LTMR in beam test.
  6. MIL-PRF-38535 Standard Microcircuits: Hermetic and Non-hermeticShri G. Agarwal (NASA JPL) · NASA Electronic Parts and Packaging Program, Electronic Technology Workshop · 2021QML classes Q and V; qualifying activity for space microcircuits.
  7. European Space Components CoordinationEuropean Space AgencyESCC specification system, Qualified Parts List, ESA as qualification authority.
  8. GR740 next-generation microprocessorEuropean Space Agency · 2016Quad LEON4, LEON lineage from ESA’s LEON2-FT.
  9. GR740 Next Generation Microprocessor Flight Models (TEC-ED & TEC-SW Final Presentation Day)Cobham Gaisler, for ESA · ESA (nebula.esa.int study deliverable) · 2021GR740 timeline, features, EDAC, radiation and qualification results, design changes.
  10. High Performance Spaceflight Computing (HPSC)NASA Game Changing Development Program · NASAWhy space computing is hard; HPSC goals and >100× compute.
  11. 15 CFR Part 774, Supplement No. 1: The Commerce Control List (ECCN 3A001.a.1)Electronic Code of Federal Regulations (eCFR)Radiation-hardened IC thresholds for export control.