FPGAs and Logic

Programmable logic selected by flown and qualified planetary and orbital robotics programs. Two families dominate: Actel and Microsemi flash or antifuse parts where the configuration must survive without scrubbing, and Xilinx SRAM parts where throughput matters and the configuration can be managed.

The mitigation cost is the number worth carrying forward. On SuperCam the flight design consumed about 90 percent of the 75k available gates after every D-type flip-flop was triplicated, and the unmitigated non-destructive failure rate was calculated at about one event for the nominal mission and accepted rather than designed out [1]. A radiation-tolerant part is not a part that needs no mitigation; it is a part where the mitigation fits.

Programmable logic parts selected and flown

Part	Manufacturer	Used by	Source
RT3PE3000L	Microsemi	perseverance (SuperCam Mast Unit)	[1]
RT3PE600L	Microsemi	hayabusa2-landers (MASCOT MasMag)	[2][3]
ProASIC3	Microsemi	mmx-rover (miniRAD)	[4]
RTSX	Actel	curiosity (MAHLI), perseverance (Mastcam-Z)	[5][6]
Virtex-II	Xilinx	curiosity (MAHLI), perseverance (Mastcam-Z)	[5][6]
Virtex-4	Xilinx	restore-l-osam1, Raven, RRM	[7]
Spartan II XC2S200	Xilinx	spheres	[8][9]

Ratings and qualification results

• RT3PE3000L, Microsemi, in a CCGA484 package. Reprogrammable non-volatile flash FPGA, radiation tolerant, in the SuperCam Mast Unit data processing unit. Ratings: 75k usable gates; hosts an embedded 8051 soft microprocessor and a 20 MHz +/- 50 ppm clock domain [1]. Qualification: Free of single event latch-up to 68 MeV cm2/mg. Configuration cells are inherently protected, but D-type flip-flops, SDRAM, clocks and I/O banks are not, so all flip-flops were triplicated using the Synplify triple-module-redundancy option. The unmitigated non-destructive failure rate was analyzed at about one event for the nominal mission and accepted. After triplication the design uses about 90 percent of the 75k gates, 37 percent of block RAM and 57 percent of I/O [1].
• RT3PE600L, Microsemi. Reprogrammable non-volatile flash FPGA, radiation tolerant. Ratings: Sole controller for a triaxial fluxgate magnetometer: field computation, feedback current control, mode switching, synchronous detection and integration on a 9.6 kHz excitation [2]. Qualification: Operated through descent and the full 17 h of MASCOT surface operations on Ryugu in October 2018, returning magnetic field data from the start of the descent onward [3].
• ProASIC3, Microsemi. Radiation-tolerant flash FPGA carrying a soft processor. Ratings: 1.5 V core derived by a linear regulator from the instrument 3.3 V rail; controls two internal heaters, three ADCs and the rover interface [4]. Qualification: Flight instrument built and characterized; the optical efficiency of the six infrared channels is published as a curve against wavelength, Fig. 6, not as a single number [4]. No flight result, MMX has not launched.
• RTSX, Actel. Antifuse FPGA used as camera head supervisor. Ratings: One device per camera head. Generates CCD clocks, reads the ADC, performs digital correlated double sampling, and also drives the mechanism motors: focus and dust cover on MAHLI, focus, zoom and filter wheel on Mastcam-Z [5][6]. Qualification: Flown on two rovers from August 2012 and February 2021. Camera head qualified to a nominal Mars operating range of -40 to +40 C, with the board sandwiched between housings acting as radiation shielding and the flex cables enclosed in metal covers [6].
• Virtex-II, Xilinx, called Virtex-2 in the later paper. SRAM FPGA hosting a MicroBlaze soft processor, in the MAHLI and Mastcam-Z Digital Electronics Assemblies. Ratings: Carries all interface, compression and timing functions as logic peripherals of the soft core; runs an 11 to 8 bit companding pipeline with sub-framing and lossless predictive or lossy compression at full camera head input rate [5][6]. Mastcam-Z clocks the camera head link at a selectable 30, 60 or 120 Mb/s aggregate [6]. Qualification: Flown on both rovers. The two programs describe the same part differently, MAHLI as Virtex-II and Mastcam-Z as Virtex-2, and neither paper gives a device speed grade or radiation number [5][6].
• Virtex-4, Xilinx, on the SpaceCube processor slice. SRAM FPGA with embedded hard PowerPC 405 cores, flown on Restore-L/OSAM-1 and its Raven and Robotic Refueling Mission precursors [7]. Ratings: Four devices on a 4 by 4 inch board, two PowerPC 405 cores each, eight cores total. The Relative Navigation Sensor build used three of the four devices and three of the eight cores; the Optical Pose Processing build uses all four devices and at least seven cores, handling nine sensors comprising five cameras, two lidars, a star tracker and an IMU [7]. Qualification: Two flights before this application: Hubble servicing mission SM4 and MISSE7 on the ISS [7].
• Spartan II XC2S200, Xilinx. SRAM FPGA on the Sundance carrier. Ratings: Interfaces the C6701 DSP to the propulsion and navigation subsystems; carrier also holds an ECS-3953C-250 oscillator and a MAX1294 converter [8]. Qualification: Three units launched to the ISS in 2006 and had conducted more than 70 test sessions by 2015 [9].

Where logic replaced a processor

Three of the rows above are instruments whose only digital controller is an FPGA: MasMag, miniRAD and the MAHLI and Mastcam-Z camera heads [2][4][5]. The alternative architecture appears on ChemCam, whose data processing unit pairs a UTMC 80C196 microcontroller with two Actel devices, one carrying the microcontroller logic and interfaces and one handling the six megabyte data memory bank and the high-speed serial links [10]. The ChemCam design stores program memory in two EEPROM banks, one with its write line tied off in hardware so it cannot be corrupted in flight and one reprogrammable from the ground. An FPGA-only instrument has no equivalent recovery path unless the part is flash based and reloadable.

Programmable logic characterized against radiation, not yet flown on a planetary robot

Part	Manufacturer	Facility and date	Source
MPF300T-FCG1152 PolarFire	Microsemi	Lawrence Berkeley 88-Inch Cyclotron, November 2019	[11]
XCKU040-2FFVA1156E Kintex UltraScale	Xilinx	Lawrence Berkeley 88-Inch Cyclotron, November 2019	[11]

Ratings and campaign results

• MPF300T-FCG1152 PolarFire, Microsemi. 28 nm flash-configured FPGA, configuration held in SONOS flash [11]. Tested at the Lawrence Berkeley National Laboratory 88-Inch Cyclotron with N, O and Ne at 16 MeV. Ratings: Configuration is non-volatile, so no configuration scrubbing is required. Qualification: First-look heavy ion testing on shift registers, counters and embedded LSRAM, die thinned to 100 to 120 um [11]. Upset threshold linear energy transfer below 1.16 MeV-cm2/mg with a cross section of about 3.0e-7 cm2/design. A functional interrupt appeared at every tested linear energy transfer: core current dropped from about 2.75 A to below 100 mA for about 1.7 ms, once for 177 s, always requiring a reset but never losing configuration [11]. The vendor attributes it to a mode setting.
• XCKU040-2FFVA1156E Kintex UltraScale, Xilinx. SRAM-configured FPGA, tested in the same Lawrence Berkeley National Laboratory 88-Inch Cyclotron campaign [11]. Ratings: Configuration is volatile and must be scrubbed. Qualification: Configuration memory, block RAM and dynamic fluence-to-failure testing. Upset threshold linear energy transfer below 7.0e-2 MeV-cm2/mg with a threshold configuration cross section of about 1.0e-6 cm2/device [11]. Upset cross sections are design dependent, and configuration scrubbing was not performed during the test.

The two rows are the two ends of the class tradeoff measured on the same beam in the same month. The flash-configured part holds its configuration through an upset and its worst observed event is a recoverable current excursion; the SRAM-configured part has an upset threshold two orders of magnitude lower and a configuration that has to be actively maintained.

Space-grade and commercial FPGAs characterized against radiation

Heavy-ion results for parts of the same two families as the flown rows above, none of them yet carried by a planetary robot. Latchup immunity and upset immunity are independent properties here, and every part below has one without the other [12][14].

Part	Manufacturer	Facility	Source
XQR5VFX130 Virtex-5QV	Xilinx	Texas A and M cyclotron	[12]
XQR4VSX55 Virtex-4	Xilinx	Heavy ion at 120 C in vacuum	[13]
XQ2V1000 Virtex-II	Xilinx	Texas A and M cyclotron	[14]
EP4SGX230KF40 Stratix IV	Altera	Texas A and M cyclotron	[12]
iCE65L04	SiliconBlue	Texas A and M cyclotron	[12]

Ratings and campaign results

• XQR5VFX130 Virtex-5QV, Xilinx. Radiation-hardened SRAM FPGA with hardened configuration cells. Ratings: the space-qualified member of the SRAM family whose commercial cousins appear on the table above. Qualification: no latchup to 145 MeV-cm2/mg at 125 C, a functional interrupt threshold below 1 MeV-cm2/mg at about 1e-6 cm2 per device, and a block RAM upset threshold below 1.38 MeV-cm2/mg at about 2e-8 cm2 per bit [12]. Hardening the configuration cells did not raise the functional-interrupt threshold, which stays where the commercial parts sit.
• XQR4VSX55 Virtex-4, Xilinx. Radiation-hardened SRAM FPGA, the qualified version of the part flown on the SpaceCube slice above [7]. Ratings: 90 nm CMOS on a flip-chip package with a 2 micrometer epitaxial layer. Qualification: no latchup to 109 MeV-cm2/mg at 120 C in vacuum over a fluence of 1e8 ions/cm2 [13]. Reaching the die needed the silicon thinned from 780 to 100 micrometers, so this result exists only because the package was destroyed to get it.
• XQ2V1000 Virtex-II, Xilinx. Radiation-tolerant SRAM FPGA, bulk CMOS, the same family as the flown MAHLI and Mastcam-Z part. Ratings: 4.1 million configuration bits and 40 block RAMs on the device [14]. Qualification: static configuration-memory upset saturation cross section 5.5e-8 cm2/bit at an L1/e of 8.5 MeV-cm2/mg, block RAM 5e-8 cm2/bit at an L1/e of 5, and a power-on-reset functional interrupt at 6e-6 cm2/device [14]. A power-on-reset event resets the device and erases every configuration bitstream already loaded, so it is a mission-level event and not a correctable upset. Enabling the power-on-reset bypass setting cut those events by 16 percent and SelectMap errors by 27 percent, which is a configuration setting rather than a design change [14].
• EP4SGX230KF40 Stratix IV, Altera. Commercial 40 nm SRAM FPGA [12]. Ratings: not radiation hardened. Qualification: no latchup above 112 MeV-cm2/mg at 85 C [12]. The campaign reports no upset threshold for this part, so latchup immunity is all it establishes.
• iCE65L04, SiliconBlue. Commercial low-power SRAM FPGA. Ratings: not radiation hardened. Qualification: no latchup above 83 MeV-cm2/mg at 25 C, again with no upset threshold reported [12].

An upset cross section published for one design on an SRAM FPGA does not transfer to another design on the same part, because the sensitive area is the configuration the user loaded [12]. The rate predicted from the Virtex-II cross sections, 4.4e-7 upsets per configuration bit-day in interplanetary space behind 100 mils of aluminum at solar minimum, is a rectangular-parallelepiped model output with no proton contribution and no flight measurement behind it [14].

Vision pipelines put into logic

Two published stereo and navigation pipelines were moved onto a Xilinx Virtex-4 LX160 to buy frame rate a flight processor cannot reach. The disparity pipeline runs 1024 by 768 RGB stereo pairs at 15 Hz on a 66 MHz FPGA clock, limited by on-chip memory preventing rectification and filtering from being interleaved rather than by the 30 Hz Camera Link input [15]. On the same device the VISINAV descent-image front end is estimated at 25 ms per frame for 500 tracked features against about 650 ms in software for 75 features, a timing estimate taken before integration was complete and not an end-to-end measurement [16]. Neither result carries a beam, a dose or a facility.