Over 200 billion ARM cores have been shipped many of which are being used in safety-critical applications such as ISO 26262, IEC 61508, DO-254, DO-178, IEC 62304, IEC 61511/13, IEC 62061 and ISO 13849, i.e., the braking systems of a car, automobile power steering, self-driving vehicles, aircraft, medical, railway and industrial control sub-systems etc…
Given our lives are dependent on the reliability of ARM-based fail-safe systems every day, the space industry has been flying ARM cores for almost a decade, either as IP within an FPGA or ASIC, or as small, low-power, discrete, radiation-hardened MCUs. There is a huge tried and tested eco-system available to enable you to develop reliable control and DSP embedded applications, e.g., toolchains certified to TÜV SÜD. For safety-critical applications, exception handling is very short and deterministic, and two cores can be lock-stepped to provide redundancy. Further risk mitigation can be implemented at a system level.
In this post, I will discuss two space-grade, rad-hard ARM MCUs to provide a small, low-cost, discrete processor for localised control and processing functions. VORAGO’s VA10805 implements a 50 MHz, ARM Cortex®-M0 core with JTAG-based debug connected to 32 kB and 128 kB of on-chip data and program memories respectively via an AHB-LITE bus as illustrated below in Figure 1. A lower-speed peripheral bridge allows access to two UART, two I2C, and three SPI interfaces, as well as 56 configurable GPIO and control registers.
Figure 1 Image and block diagram of the VORAGO VA10805 radiation-tolerant, ARM, Cortex®-M0 MCU. Source: VORAGO Technologies
The VA10805 is a rad-tolerant, 60 mW (typical core consumption, 40 mA at 1.5 V), -55°C to +125°C, 50 MHz, ARM, Cortex®-M0 MCU fabricated using VORAGO’s patented latch-up immune HARDSIL® technology. The device also contains 24 configurable counters and a watchdog timer, is powered using a 1V5 supply voltage as well as 3V3 for I/O, all packaged in a small 14 x 14 mm, 128-pin, ceramic LQFP as shown above.
The Cortex®-M0 processor is ARM’s smallest processor containing a three-stage pipeline capable of executing both 16- and 32-bit instructions to optimise code density for embedded applications. It has an exceptionally low gate count and very low power consumption, i.e., on a 40 nm commercial process, the floor-planned area occupies 0.007 mm2, consuming 5.1 µW/MHz. Its performance is specified as a maximum of 1.27 Dhrystone MIPS per MHz (CoreMark of 2.33).
The VA10805’s specified SEL, SEE and TID immunities are 110 MeV/(mg/cm2), <1e-15 errors/bit-day (with EDAC enabled) and >300 krad (Si) respectively. Process reliability and radiation test reports are available from the vendor as well as an evaluation kit for representative prototyping as shown below in Figure 2.
Figure 2 The VA108X0, Cortex®-M0 development board that provides sufficient hardware to evaluate all facets of the MCU at room temperature. Source: VORAGO Technologies
If you need more performance, VORAGO also offers the rad-hard VA416xx family of 100 MHz, ARM Cortex®-M4 cores offering latch-up immunity, operation from -55°C to +125°C and powered using a 1V5 supply voltage as well as 3V3 for I/O (Figure 3).
Figure 3 Images of select VA416xx, radiation-hardened, ARM, Cortex®-M4 MCUs as well as a functional block diagram. Source: VORAGO Technologies
The VA41628 comprises a 100 MHz, ARM Cortex®-M4 core with software-based debug connected to 64 kB and 256 kB of on-chip data and program memories respectively via an AHB-LITE bus. A lower-speed peripheral bridge allows access to three UART, three I2C and three SPI interfaces, 75 configurable GPIO, 24 configurable counters and a watchdog timer. The device is available in both 14 x 14 mm, 128-pin CQFP and 12 x 12 mm, 196-pin BGA packages.
The VA41629 implements a 100 MHz, ARM Cortex®-M4 core with software-based debug connected to 64 kB and 256 kB of on-chip, EDAC data and program memories respectively via an AHB-LITE bus. A lower-speed peripheral bridge allows access to three UART, three I2C, and three SPI interfaces, as well as 104 configurable GPIO and control registers. The VA41629 also contains an eight-channel, 12-bit, 600 ksps ADC and a two-channel, 12-bit, 1 MHz DAC. The device is available in both 20 x 20 mm, 176-pin PQFP and 12 x 12 mm, 196-pin BGA packages.
The VA41620 comprises a 100 MHz, ARM Cortex®-M4 core with software-based debug connected to 64 kB and 256 kB of on-chip, EDAC data and program memories respectively via an AHB-LITE bus. A lower-speed peripheral bridge allows access to three UART, three I2C, and three SPI interfaces, as well as one full-duplex SpaceWire, one Ethernet, two CAN interfaces, and 104 configurable GPIO. The VA41620 also contains an eight-channel, 12-bit, 600 ksps ADC and a two-channel, 12-bit, 1 MHz DAC. The device is available in 20 x 20 mm, 176-pin PQFP and CQFP packages, as well as a smaller 12 x 12 mm, 196-pin BGA.
The VA41630 implements a 100 MHz, ARM Cortex®-M4 core with software-based debug connected to 64 kB and 256 kB of on-chip, EDAC data and program memories respectively via an AHB-LITE bus. A total of 256 kB of non-volatile, internal boot memory is also provided. A lower-speed peripheral bridge allows access to three UART, three I2C, and three SPI interfaces, as well as one full-duplex SpaceWire, one Ethernet and two CAN interfaces, and 104 configurable GPIO. The VA41630 also contains an eight-channel, 12-bit, 600 ksps ADC and a two-channel, 12-bit, 1 MHz DAC. The device is available in 20 x 20 mm, 176-pin PQFP and CQFP packages, as well as a smaller 12 x 12 mm, 196-pin BGA.
All VA416xx flip-flops have been implemented using DICE, where select registers and bits include TMR with voting, and the device SEL, SEE and TID immunities are 110 MeV/(mg/cm2), <1e-15 errors/bit-day (with EDAC and scrub-engine enabled, geosynchronous orbit, solar min and 100 mils of aluminium shielding) and >300 krad (Si) respectively. Process reliability and radiation test reports are available from the vendor as well as an evaluation kit for representative prototyping as shown in Figure 4.
Figure 4 The VA416X0, Cortex®-M4 evaluation kit with two daughter cards: a GPIO board and a EBI/Ethernet board. Source: VORAGO Technologies
Both the Cortex®-M0 and M4 product ranges are also radiation hard fabricated using VORAGO’s patented, radiation-hardened, HARDSIL® technology. This exploits the benefits of a conductive buried guard ring to eliminate latch-up, reduce circuit noise and enable high-temperature operation of standard CMOS as illustrated in Figure 5. The process enhancement does not require any change to the existing fabrication and simply adds several masks to the overall manufacture. The resultant technology inherits all the scaling benefits of the original commercial process such as higher performance and low power consumption in contrast to older, custom radiation-hardened processes.
Figure 5 The cross-sectional view of CMOS doping profiles with buried guard rings (BGR), the parasitics are depicted schematically. Source: VORAGO Technologies
The buried guard ring increases the holding voltage of parasitic thyristors making it less likely for a latch-up state to exist. If it were to occur, the highly conductive layer underneath the devices prevents trigger by pinning the substrate potential to VSS. HARDSIL® substantially reduces the total charge collection initiated by radiation strikes lowering the occurrence of all types of SEEs. For mission-critical applications, VORAGO also offers a single-chip, rad-hard, latch-up monitor capable of independently sensing the supply current from four devices. All the parts listed above are compared in the on-line product table.
The Cortex®-M0 and M4 devices are typically used when some localised control or digital processing is required, and/or to provide peripheral interfaces to other spacecraft sub-systems. Not every application needs a cumbersome FPGA requiring multiple power rails to implement logic! At the component level, small, low-power MCUs are progressively being used to control DC-DC converters and similar functions.
The Cortex®-M0 and M4 devices are increasingly being used to re-configure space-grade FPGAs in-orbit as illustrated in Figure 6. The time taken to re-program the internal configuration memory depends on MCU clock frequency and whether a serial or parallel interface is used.
Figure 6 The AMD/Xilinx slave serial and NanoXplore configuration modes where Cortex®-M0 and M4 devices are increasingly being used to re-configure space-grade FPGAs in-orbit. Source: Xilinx and NanoXplore
For the Microchip ProASIC®3, RTG4™ and RTPolarFire™ flash-based FPGAs, an external MCU controls the JTAG interface to re-configure devices in-orbit. Microchip’s DirectC software manages the handshaking between the MPU and the target FPGA, as well as the transfer of the configuration data. DirectC can be freely downloaded and requires 256 bytes of storage on the host MCU (Figure 7).
Figure 7 DirectC software enables in-orbit re-configurability by managing handshaking between the MPU and the target FPGA, as well as the configuration of data. Source: Microchip Technology
Similarly, the M0 and M4 devices can also be used to scrub space-grade, SRAM-based FPGAs such as the KU060 or Versal-based ACAPs. As an example, the XQRKU060 FPGA allows access to its configuration memory using its SelectMap, ICAP and JTAG interfaces. During normal operation, the MPU accesses the SelectMAP or JTAG ports in the background to either refresh the XQRKU060’s complete configuration (Blind Scrubbing), or to readback its contents, compare this with the original golden image stored in the external flash memory and correct it if required to prevent the accumulation of SEUs. The former is quicker as individual frames are simply re-written and you decide the scrub rate based on your mission’s reliability needs. The speed of the latter depends on whether the interface to the external flash memory is parallel or serial, the external configuration clock frequency and the number of upsets detected (Figure 8).
Figure 8 The AMD/Xilinx slave parallel configuration mode, the speed of the scrubbing of space-grade, SRAM-based FPGAs depends on on whether the interface to the external flash memory is parallel or serial. Source: Xilinx
The VA10805 and VA416xx devices have significant space heritage having flown on multiple missions since 2017. All parts can be ordered in industrial grade from -55°C to +125°C, MIL-PRF-38534 Class K and very soon, MIL-PRF-38535 Class V. Mouser and Trendsetter are world-wide distributors, and parts can also be procured from Arrow in the US and Europe. In terms of a future roadmap, VORAGO plans to offer radiation-hardened versions of the dual-core, ARM Cortex®-M55 (200 MHz) and multi-core A5 (900 MHz) MCUs for space applications.
For software development, the Keil, IAR and Eclipse IDEs are recommended with the Segger J-Link Base debugger. Linux and RTOS are also supported.
Dr. Rajan Bedi is the CEO and founder of Spacechips, which designs and builds a range of advanced, L- to Ku-band, ultra-high-throughput transponders, on-board processors and edge-based OBCs for telecommunication, earth-observation, navigation, internet and M2M/IoT satellites. The company also offers Space-Electronics Design-Consultancy, Technical-Marketing, Business-Intelligence, Avionics Testing and Training Services. You can also contact Rajan on LinkedIn and Twitter.
Spacechips’ Design-Consultancy Services develop bespoke satellite and spacecraft sub-systems, as well as advising customers how to use and select the right components, how to design, test, assemble and manufacture space electronics.
Related Content
