Space and high-reliability FPGAs
What radiation does to an FPGA, how triple modular redundancy, ECC and configuration scrubbing mitigate it, which radiation-tolerant parts exist, and how qualification standards fit in.
Overview
Outside the atmosphere, and in some places inside it (avionics, particle accelerators, nuclear plants, high-altitude data centres), charged particles pass through silicon and deposit charge where it is not wanted. In an SRAM-based FPGA that charge can flip a configuration bit, which rewires the design until something rewrites it. This hub is for engineers designing for those environments. It explains the effects, the mitigation techniques, the device families built for the job and the paperwork that goes with them. Much of it also applies to safety-critical ground designs, where the same techniques guard against random faults.
The field has a vocabulary that is worth learning precisely, because every datasheet uses it. The glossary entries for SEU, TMR and TID are the starting points.
Key ideas
Total dose versus single events
Total ionising dose (TID) is the cumulative effect. Charge trapped in oxides shifts transistor thresholds and raises leakage until the device drifts out of specification. It is measured in rad or gray (100 rad is 1 Gy) and a part is rated for a dose, typically 100 krad to 300 krad for radiation-tolerant FPGAs. Single-event effects (SEE) are instantaneous. A single-event upset (SEU) flips a memory bit, including a configuration bit. A single-event transient (SET) is a glitch on a combinational net that becomes an upset if a register samples it. A single-event functional interrupt (SEFI) is an upset in control logic (the configuration engine, a PLL, a JTAG state machine) that takes down a whole function. Single-event latch-up (SEL) is a parasitic thyristor turning on, which draws destructive current until power is cycled. Vendors characterise each with heavy-ion and proton beams and publish cross-sections in square centimetres per bit against linear energy transfer. Your mission’s orbit and duration turn those into an expected upset rate.
Mitigation: redundancy, correction and scrubbing
Triple modular redundancy runs three copies of the logic and votes on the outputs. Done at the register level with distributed voters and feedback, it masks any single upset, at a cost of over three times the area and some speed. Tools from Synopsys (Synplify Premier) and the open-source TMRG and SpyDrNet projects automate it, and doing it by hand in RTL is error-prone because synthesis will optimise the redundancy away unless you stop it. ECC on block RAM and external memory corrects data upsets. Configuration scrubbing deals with the FPGA-specific problem: a dedicated engine reads the configuration memory continuously, compares against a golden copy or CRC, and rewrites corrupted frames. AMD’s Soft Error Mitigation core does this from inside the device, and an external radiation-hardened microcontroller or anti-fuse FPGA can do it from outside. TMR masks the upset, and scrubbing removes it before a second one accumulates, so the two are used together. Flash-based FPGAs (RTG4, RT PolarFire) and anti-fuse parts (RTAX) have configuration cells immune to upset, which removes the scrubbing problem and leaves only the user registers and memories to protect.
Qualified parts and the standards behind them
A radiation-tolerant FPGA is a commercial die with a characterised radiation response, a ceramic or hermetic package, an extended temperature range and a screening flow. In the United States MIL-PRF-38535 defines the QML classes (Q, V and the newer Y for non-hermetic packages) that govern screening and lot acceptance. In Europe ECSS-Q-ST-60 series standards and the ESA European Preferred Parts List play the same role, and ESCC qualification is the European equivalent of QML. NASA and ESA also publish their own radiation test guidelines and results. Test methods for single events follow JEDEC JESD57 and ASTM F1192. The practical effect: a space-grade part costs ten to a hundred times its commercial twin, has a lead time measured in quarters, and arrives with a data package you are expected to read. New-space missions with short lives often fly commercial parts with mitigation and accept the risk, and that is an engineering decision rather than a mistake, as long as it is made with the numbers.
Where to start
Mitigation is applied to ordinary RTL, so the foundation is the ordinary beginner track: /learn/beginner/04-registers-clocks-and-state/ for the registers that TMR triplicates, /learn/beginner/07-finite-state-machines/ because an unprotected state machine with an illegal state is the classic SEU failure, and /learn/beginner/09-memories-block-ram-and-fifos/ for the memories ECC protects. A first exercise on any board is fault injection: use the vendor’s SEM core or a JTAG script to flip configuration bits and watch which ones break your design. An advanced track on reliability engineering is coming.
Tools and vendors
| Device | Vendor | Technology | TID rating | Notes |
|---|---|---|---|---|
| RTG4 | Microchip | 65 nm flash | 100 krad | SEU-immune configuration, TMR flip-flops built in, SEL immune, QML V |
| RT PolarFire | Microchip | 28 nm flash | 100 krad+ | Larger, lower power, SerDes, QML qualification in progress at the time of writing |
| RTAX-S | Microchip | anti-fuse | 300 krad | One-time programmable, long heritage |
| XQR Kintex UltraScale (XQRKU060) | AMD | 20 nm SRAM | 100 krad+ | Scrubbing required, Class B and Y, large logic capacity |
| XQR Versal | AMD | 7 nm SRAM | 100 krad+ | Adaptive SoC in space grade, announced 2022 |
| NG-Medium, NG-Large, NG-Ultra | NanoXplore | 65 nm and 28 nm SRAM, hardened by design | 100 krad+ | European, ESCC qualified, built-in SEU hardening in the cells |
| Any commercial part | all | various | unrated | New-space with mitigation, after your own testing |
Synplify Premier, the Mentor (Siemens) Precision Rad-Tolerant flow and Libero SoC provide TMR and safe state machine encoding. The open-source TMRG from CERN and SpyDrNet from BYU do the same for Yosys-based flows.
Common mistakes
- Applying TMR to the datapath and leaving the clock tree, reset and scrubber unprotected.
- Letting synthesis merge the three copies. You must use the vendor’s keep and preserve attributes or the TMR tool’s flow.
- Forgetting SETs. A voter on registers does not help if the three copies sample the same transient on a shared input.
- Scrubbing without a golden copy that is itself protected. The external memory holding the bitstream needs ECC or redundancy.
- Designing for the beam test and not for the mission. Cross-section data must be folded with the orbit’s particle spectrum to get a rate.
- Underestimating the documentation. Qualification evidence is most of the schedule.
Going deeper
- AMD PG036, Soft Error Mitigation Controller, the in-device scrubber.
- Microchip radiation-tolerant FPGAs, covering RTG4 and RT PolarFire.
- NanoXplore, for the NG family data.
- ECSS standards, with the Q-ST-60 series on EEE components free to download after registration.
- NASA Goddard Radiation Effects and Analysis, with decades of test reports on commercial and space-grade parts.
- ESCIES, the ESA components information system with the European Preferred Parts List and radiation data.