Processors

Flight processors selected by flown planetary and orbital robotics programs, with the flight or ground result that establishes each one.

The governing tradeoff for the class is throughput against upset behavior, and it shows up in the duty cycle of autonomy rather than in a datasheet. On the Mars Exploration Rovers a single visual odometry step took an average of nearly three minutes on the 20 MHz RAD6000, so the technique was commanded only on short drives, on slopes above about 10 degrees, or when a wheel was being dragged [1].

Flight processors selected and flown

Part	Manufacturer	Used by	Source
RAD6000	BAE Systems	spirit, opportunity	[1]
RAD750	BAE Systems	curiosity, perseverance	[2][3][4]
LEON3FT	Cobham Gaisler	perseverance (SuperCam)	[5]
TMS320C6701	Texas Instruments	spheres	[6][7]
Snapdragon 801	Qualcomm	ingenuity	[8][9]
80386SX	Intel	ISS multiplexers	[10]
ThinkPad 760XD, T61p	IBM, Lenovo	ISS crew laptops	[10]

Ratings and qualification results

• RAD6000, BAE Systems: a radiation-hardened 32-bit POWER single-board computer [1]. Ratings: 20 MHz as flown on MER; single CPU shared with the camera bus [1]. Qualification: Flown from January 2004. Each visual odometry step averaged nearly three minutes of computation, restricting the technique to drives typically under 15 m and to steps of no more than 75 cm or 18 degrees of turn [1].
• RAD750, BAE Systems: a radiation-hardened PowerPC 750 single-board computer [2]. Ratings: MSL Rover Compute Element carries 512 MB RAM under VxWorks, two units in prime and hot backup [2][3]; measured 200 to 300 MIPS on the Mars 2020 vehicle, of which the onboard scheduler receives only a fraction [4]. Qualification: On Curiosity a failing region of RCE-A NAND flash forced a swap to RCE-B on sol 201. The RCE-B data product partition then failed to mount on sol 2173, forcing a return to RCE-A on sol 2188 until RCE-B was reformatted on sol 2342. RCE-B has carried 20,159.565 m of odometry against 1,158.793 m on RCE-A [2].
• LEON3FT, Cobham Gaisler. Fault-tolerant SPARC V8 processor with SpaceWire, in the SuperCam Body Unit. The source names the core designer; the vendor of the flight part is not named [5]. Ratings: 50 MHz; four SpaceWire interfaces, one of them mapped to the Mast Unit at 30 MHz [5]. Qualification: Flown since February 2021. Paired with a Cobham Aeroflex start-up PROM that can accept a limited command set from the rover compute element and rewrite corrupt program memory on Mars, so a memory corruption is recoverable rather than terminal [5].
• TMS320C6701, Texas Instruments, on a Sundance SMT375 carrier board. Floating-point DSP. Ratings: Carrier board also holds a Xilinx Spartan II XC2S200 and a MAX1294 converter [6]. Qualification: Three units launched to the ISS in 2006 and had conducted more than 70 test sessions by 2015 [7].
• Snapdragon 801, Qualcomm: a commercial smartphone system on chip, not radiation hardened [9]. Ratings: Commercial part, no radiation qualification claimed [9]. Qualification: Completed 72 flights on Mars between April 2021 and January 2024 [8]. Obsolescence rather than radiation ended its use: the part is no longer available in the condition and quantity required, so the Sample Recovery Helicopter design moved to a newer Snapdragon [9].
• 80386SX, Intel, in the Input/Output Control Unit card: a radiation-screened commercial microprocessor in an ISS Multiplexer/Demultiplexer, the command and data handling bus that hosts canadarm2 and dextre [10]. Ratings: Each IOCU card carries the processor, a 1553 bus interface and 33,554,432 bits of DRAM; Hamming single-error-correction double-error-detection runs inside the DRAM refresh cycle, holding bad-bit residence below 10 microseconds [10]. Qualification: Flown in a three-tier scheme: tier 1 two-fault tolerant on three identical computers, tier 2 one-fault tolerant on two, tier 3 zero-fault tolerant with redundancy obtained by allocating software across computers. Sixteen probable lock-up single event functional interrupts were logged across the fleet between 2001 and 2015, each costing ground controllers 12 to 24 hours to power cycle, reboot and resynchronize, and the rate per computer per year stayed well below the pre-flight prediction for the whole 14 years [10].
• ThinkPad 760XD, T61p, IBM and Lenovo: unmodified commercial laptops flown as the ISS Portable Computer System, the crew and payload interface [10]. Ratings: No radiation hardening; screened by high-energy proton testing before flight [10]. Qualification: In-flight single event functional interrupt rate measured at 0.023 +/- 0.012 per day for three 760XDs over 2001, against 0.04 per day predicted from proton testing, and 0.013 +/- 0.004 per day for seven T61p units over 2011 to 2014 against 0.13 per day predicted. Proton-beam prediction overestimated the flight rate by a factor of about two and about ten respectively. Two of the seven T61p units suffered hard failures that may or may not be radiation induced [10].

Reading the clock and rate figures

The RAD750 row covers three programs, and no single clock is published across them. The Mars 2020 build was measured at 200 to 300 MIPS [4]. The part is a family, and a clock figure is only meaningful against a specific board.

The ISS laptop rows are the only entries in the class with a matched pre-flight prediction and an in-flight measurement of the same assembled hardware.

Article and unit count	Period on orbit	Ground prediction	Flight measurement	Ratio
IBM 760XD ThinkPad, 3 units	March to December 2001	0.04 SEFI/day	0.023 +/- 0.012 SEFI/day	1.7x high
Lenovo T61p, 7 units	2011 to 2014, 877 to 1088 days each	0.13 SEFI/day	0.013 +/- 0.004 SEFI/day	10x high

Source: [10].

Both predictions came from 200 MeV proton testing of assembled articles [10]. Screening was conservative in both cases, and the two conservatism factors differ by a factor of six on the same method, so a redundancy scheme sized on a predicted rate is sized on an unknown margin. Non-radiation functional interrupts on the T61p campaign were comparable in number to the radiation ones and had to be screened out by judgment, and two of the seven units suffered hard failures of unknown cause [10]. The piece-part comparison from the same campaign, on DRAM, is on Memory and Storage, where the two predictions land within 2.7 and 2.9 times: predicting an assembled article buys coverage of the whole machine and costs the tightness the piece-part method keeps.

Parts characterized but not yet flown on a planetary robot

Radiation characterization of commercial and radiation-tolerant processors published by the NASA Electronic Parts and Packaging program and by mission avionics teams. These are test results against a named beam and facility, not flight heritage.

Part	Manufacturer	Facility and date	Source
RH-OBC-1	Vorago Technologies	Massachusetts General Hospital, June 2019	[11]
Ryzen 7 1700, Ryzen 3 1200, Ryzen 3 2200G	AMD	Massachusetts General Hospital, June 2019	[11]
Jetson TX2	NVIDIA	Massachusetts General Hospital, June 2019	[11]
Jetson TX2i	NVIDIA	Johns Hopkins Applied Physics Laboratory, 2021	[12]
MSP430	Texas Instruments	In-house dose testing, 2021	[12]
ISIS On-board Computer	Innovative Solutions in Space	No new testing	[12]
Coral USB accelerator	Google	No radiation testing	[13]

Ratings and campaign results

• RH-OBC-1, Vorago Technologies. Radiation-hardened CubeSat Kit single-board computer built on the VA10820 ARM Cortex-M0 core, with regulators, ADC, watchdog and CAN controller. Tested at the Francis Burr Proton Therapy Center at Massachusetts General Hospital [11]. Ratings: Core memory carries EDAC; board carries two Cypress FRAM devices as boot and user memory. Qualification: 200 MeV proton testing at board and component level [11]. SRAM single-bit upset cross section 3e-8 cm2/device, ROM 1.3e-7 cm2/device, no multi-bit upsets. 3e11 p/cm2 and about 12.2 krad(Si) accumulated with no parametric degradation [11]. Both FRAM devices took functional interrupts, and the board has no way to gate their power, so a boot FRAM SEFI leaves the microcontroller unable to reload boot code until an external power cycle [11]. The failure was not visible in piece-part testing.
• Ryzen 7 1700, Ryzen 3 1200, Ryzen 3 2200G, AMD: commercial multi-core x86 processors, the Ryzen 7 part tested being the YD1700BBM88AE [11]. Ratings: Not radiation hardened. Qualification: 200 MeV protons [11]. Single event functional interrupts and upsets observed with no failures to 1.55e11, 8.92e10 and 4.66e10 p/cm2 respectively; a power cycle recovered every event.
• Jetson TX2, NVIDIA. Commercial GPU single-board computer. Ratings: Not radiation hardened. Qualification: 200 MeV protons, two devices [11]. One saw no failures to 1.89e9 p/cm2; the second failed at 1.61e9 p/cm2. A power cycle recovered every non-destructive event.
• Jetson TX2i, NVIDIA, on a Connect Tech Spacely carrier. Commercial GPGPU carried as a rover central computer, proton and cobalt-60 tested. Ratings: Selected for MoonRanger, a mission of 6 to 9 days in transit and under 15 days on the surface, with avionics powered down through the Van Allen belts [12]. Qualification: Independent testing established survival to 45 krad(Si) unpowered and 10 krad(Si) powered, with proton testing giving at least 90 percent probability of survival at an average of 4 resets in a flux equivalent to a six month lunar mission [12]. Computer, cameras and interface board were also tested powered to 4 krad(Si) against a predicted mission dose under 1 krad(Si).
• MSP430, Texas Instruments. Microcontroller used across the MoonRanger power, thermal and motor control boards. Ratings: Ferroelectric program memory, which is immune to the radiation effects that afflict flash program store. Qualification: CubeSat flight heritage on BasicLEO, RAX-1, RAX-2 and LMRSat [12]. In-house total ionizing dose testing was levied on the in-house boards that carry it.
• ISIS On-board Computer, Innovative Solutions in Space. ARM9 CubeSat peripheral computer. Ratings: Carried as the MoonRanger peripheral computer on CubeSat space heritage rather than on a new campaign [12]. Qualification: No new testing performed; heritage accepted.
• Coral USB accelerator, Google: a commercial edge TPU inference ASIC for 8-bit quantized neural networks [13]. Ratings: Paired with an ARM Cortex-A72 at 1.5 GHz and 4 GB of RAM as a candidate flight-representative host. Qualification: No radiation campaign published. Ground benchmark only: YOLOv3-tiny sample tube detection ran in 33.46 ms on the Cortex-A72 with the accelerator against 2808.62 ms without it, 84 times faster at lower power than the CPU alone [13].

A total ionizing dose or proton number is a screening result, not a qualification. None of the commercial parts above carries a latch-up immunity claim, and the Vorago board result shows that a part-level pass does not predict the board-level recovery path.

Compute benchmarked at one task

Four devices in seven configurations were run on the same workload, a Mars HiRISE image classifier over a 1793 image test set at 227x227 grayscale with an AlexNet transfer-learning model [14]:

Processor or unit	Inference time	Energy per inference
Snapdragon 855 DSP	7.6 ms	0.016 J
Snapdragon 855 NPU	not given	0.014 J
Snapdragon 855 GPU	16.3 ms	0.051 J
Intel Movidius Myriad X	16.2 ms	0.032 J
Snapdragon 855 CPU	87.8 ms	0.5 J
MacBook reference	56.9 ms	not given
Jetson Nano CPU	1069 ms	5.3 to 10.7 J

The Snapdragon 855 DSP was the fastest and near the lowest energy of the set, profiled with the Snapdragon Profiler as runtime times power; the NPU on the same part took the lowest energy per inference, with no inference time published; the GPU took three times the DSP energy at twice the time; and the CPU is the baseline those on-part accelerators were measured against [14]. The Intel Movidius Myriad X was compiled to 12 vector cores and metered over USB, so its time includes host transfer, and the MacBook is a laptop reference point for the same model and test set, with no energy published. The Jetson Nano was slowest by two orders of magnitude, and its energy is estimated from a 5 to 10 W device range rather than measured [14].

The energy spread runs over three orders of magnitude and does not track the time spread. Across the standard classifiers in the same study the DSP and NPU ran 3 to 48 times faster than the Snapdragon CPU, with the speedup rising with parameter count and single-pixel models running slower on the accelerators than on the CPU [14]. The RAD750 could not be entered at all: no common deep learning framework supports it, so the flight processor of curiosity and perseverance has no figure in this comparison [14]. These are performance numbers, not qualification results. No facility, beam or dose appears against any of them. The same two units were run on the ISS, where nine iterations of the classifier and a set of memory checks over 540 minutes returned no output difference from the ground runs and no memory error [14], but that exposure is too short to bound an upset rate and the study derives no cross section from it.

Processors and support chips in the radiation compendia

The NASA Electronic Parts and Packaging compendia carry heavy-ion and proton results for processors that no planetary robot has flown. In every commercial part below the unprotected cache sets the sensitivity [16][17].

Part	Manufacturer	Facility	Source
UT699 LEON3FT	Cobham Gaisler	Texas A and M cyclotron	[15]
MC7447A PowerPC	Freescale	Texas A and M cyclotron	[16]
P2020, P5020	Freescale	Texas A and M cyclotron	[17]
MV64460 bridge chip	Marvell	Texas A and M, Indiana	[16]
Maestro many-core	Boeing	Texas A and M cyclotron	[17]
Radeon e9173 GPU	AMD	Massachusetts General Hospital	[11]
GR740 LEON4	Gaisler	No radiation result published	[18]
TILE64	Tilera	No radiation result published	[19]
IFC6501 module	Inforce	No radiation result published	[20]

Ratings and campaign results

• UT699 LEON3FT, Cobham Gaisler. Radiation-hardened fault-tolerant SPARC V8 processor, the space-grade member of the core family flown in the SuperCam Body Unit [5]. Ratings: hardened by design rather than by shielding. Qualification: heavy ion over a 9 to 60 MeV-cm2/mg range at 0 and 60 degree incidence, giving an upset threshold of 8 MeV-cm2/mg in the internal SRAM cells against 54 MeV-cm2/mg in the flip flops [15]. The SRAM threshold is under a sixth of the flip-flop threshold on the same die, so the memory and not the logic sets the scrub requirement.
• MC7447A PowerPC, Freescale. Commercial PowerPC G4 processor. Ratings: not radiation hardened. Qualification: upset threshold below 1.7 MeV-cm2/mg with no latchup observed under heavy ion at the Texas A and M cyclotron [16].
• P2020, P5020, Freescale. Commercial dual-core Power Architecture communications processors. Ratings: no effects are expected below 100 krad(Si), which the guideline records as an engineering expectation and not a measured qualification [15]. Qualification: unprotected cache upset threshold below 1.8 MeV-cm2/mg on both parts, with a saturated cross section of about 2e-9 cm2 per bit on the P2020 and about 1e-10 on the P5020 [17]. The effective sensitivity of the P2020 test setup was limited to 1e-6 cm2/device by the fluence at which cores crashed from double-bit cache errors [15], so the reported floor belongs to the setup rather than to the part.
• MV64460 bridge chip, Marvell. System bridge and memory controller, the part between a flight processor and its memory. Ratings: commercial. Qualification: upset threshold below 1.7 MeV-cm2/mg under heavy ion with high-current functional interrupts also observed, and a proton upset threshold below 21 MeV at the Indiana University Cyclotron Facility [16]. A bridge chip upsetting at the same threshold as the processor it serves removes the benefit of hardening only the processor.
• Maestro many-core, Boeing. Radiation-hardened 49-core derivative of the Tilera architecture [19]. Ratings: projected at 300 MHz with an IEEE-754 floating point unit per core, in test at the time of the source and quoted as 2.5 times the TILE64 throughput [19]. Qualification: unprotected cache upset threshold below 2 MeV-cm2/mg, saturated cross section about 8e-8 cm2 per bit [17].
• Radeon e9173 GPU, AMD. Commercial embedded GPU. Ratings: not radiation hardened. Qualification: non-destructive latchup at a 200 MeV proton fluence of 6.24e9 protons/cm2, cleared by a power cycle [11].
• GR740 LEON4, Gaisler. Radiation-hardened quad-core SPARC V8. Ratings: 1836 DMIPS at 250 MHz over four cores, about 1.2 W, quoted as a reference value rather than measured by the citing work [18]. Qualification: no radiation campaign is published in the corpus for this part. A flight autonomy component scaled onto it meets the Enceladus orbiter and Europa Lander use cases and fails the terrestrial field case by an order of magnitude, which is a scaled projection and not a benchmark [21].
• TILE64, Tilera. Commercial 64-core mesh processor at 750 MHz, three-way VLIW, with no floating point hardware [19]. Ratings: 8 kB of L1 instruction and data cache and 64 kB of L2 per core [19]. Qualification: no radiation campaign published. Rock detection over a 116-image MER navcam set ran in 2.9 s per image on one core and 0.3 s on 32, a 9.7-fold speedup that asymptotes near ten rather than scaling with core count [19]. Converting the same code from floating point to integer cut single-core runtime by a factor of five, because software floating point emulation had been taking nearly three quarters of it.
• IFC6501 module, Inforce. Commercial Snapdragon 805 module carried as the Astrobee flight processor [20]. Ratings: four cores at 2.5 GHz, shared between autonomy software and concurrent processes [20]. Qualification: no radiation campaign published. Operated on the International Space Station, where a single core measures about ten times slower than a 2.4 GHz Intel i9-9980HK [22].

A compendium entry is two or three parts tested to a threshold, not a qualification. None of the commercial processors above carries a published upset rate for any orbit, and the three parts with no campaign at all are listed because they were selected and run, not because a beam was pointed at them.