FPGAs in Space: an unlikely but successful fit illustrated by the Xilinx Virtex-4QV

There are lots of good reasons why you would never want to use an SRAM-based FPGA in an environment with high levels of ionizing radiation. Single-event upset (SEU) in a large memory is a nuisance that can be mitigated by error-correction or scrubbing. SEU in the configuration memory of an FPGA can invisibly alter the netlist and be catastrophic. FPGAs are typically built in the most advanced process available, and hence have very fine geometries subject to all sorts of issues including physical damage and latch-up. The list goes on.

But the reality is that FPGAs have a prominent role in Space applications. Perhaps the most notable headlines came from the FPGAs used in the wheel-motor controllers in the wildly successful Mars Rover vehicle. But there have been many more applications. At least one company, SEAKR, is contemplating an IP-based network between satellites, based on FPGAs reconfigured in orbit to handle traffic management.

So how do you employ a chip that has known—and serious—sensitivities to ionizing radiation in a Space environment? The announcement by Xilinx today of their new 4QV family—Virtex-4 FPGAs for rad-tolerant applications—offers an inside view of the answer.

Part of the answer, as you would expect, is physical. Ian Land, senior marketing manager for the aerospace and defense business unit at Xilinx, says that the Virtex 4QV parts are processed with relatively standard masks. But there is an additional epi layer to control latch-up problems, and some process steps—Land understandably chose not to be specific—are controlled more tightly than for the industrial-grade devices. This may have more to do with the much wider temperature corners required for Space operation. In addition, the QV parts receive a mil-temperature ceramic package.

Then there is characterization. Xilinx and the Single-Event Effects (SEE) Consortium have spent a lot of time watching the devices under the beam at radiation testing facilities. Lacking verified models for this area, we don’t really know how a given device will behave with a given dose of radiation until we’ve tried it.

But after all these steps, the Virtex 4QV is still an SRAM-based FPGA with a lot of dense memory on it. Additional steps are necessary, and these come not from the hardware but from the tool chain. Xilinx provides reference designs for error-correction blocks, scrubbing blocks to remove errors from configuration PROMs, and so forth. The company also has techniques for generating triple module redundancy (TMR) from a standard netlist. At the end of the day, TMR, in which three identical circuits vote on the correct output from the same inputs, is the strongest proof against upsets, especially configuration upsets. But it is costly in power and gates, of course.

Intellectual Property is another important part of the story. Xilinx is gradually migrating some key IP to TMR for the QV. There is a plan to have a fully TMR MicroBlaze processor core as part of this effort.

With all of this, it is possible to use SRAM FPGAs in Space applications successfully. But there are still some limitations. One is speed, which primarily due to the temperature constraints has to be scaled back. Xilinx is offering the 4QV devices with 400 MHz memory speed and 500 MHz logic fabric and DSP core clock speeds—still highly respectable. The main victim of the broader temperature range is the high-speed SerDes blocks, which will be specified for a lower maximum frequency than on the industrial devices. Land says that Xilinx has a 1 Gbit Ethernet MAC working in the parts, but there is as yet no PHY layer to go with it. Still, as the IP library expands, we get more information about controlling upset in the configuration SRAM cells, and designers get more comfortable with TMR design techniques, the new devices offer a new level of speed and density—an intermediate step between hardened CPLDs and hardened ASICs.