Over the past 15 years many organizations have researched the use of Static-Random Access Memory (SRAM)-based Field-Programmable Gate Arrays (FPGAs) in space. Although the components can provide a performance improvement over radiation-hardened processing components, random soft errors can occur from the naturally occurring space radiation environment. Many organizations have been developing methods for characterizing, emulating, and simulating radiation-induced events; mitigating and removing radiation-induced computational errors; and designing fault-tolerant reconfigurable spacecraft. Los Alamos National Laboratory has fielded one of the longest space-based FPGAs experiments, called the Cibola Flight Experiment (CFE), using Xilinx Virtex FPGAs. CFE has successfully deployed commercial SRAM FPGAs into a low-Earth orbit with Single-Event Upset (SEU) mitigation and was able to exploit effectively the reconfigurability and customization of FPGAs in a harsh radiation environment. Although older than current state-of-the-art FPGAs, these same concepts are used to deploy newer FPGA-based space systems since the launch of the CFE satellite and will continue to be useful for newer systems. In this article, we present how the system was designed to be fault tolerant, prelaunch predictions of expected on-orbit behaviors, and on-orbit results.

Summary form only given. We describe novel methods of exploiting the partial, dynamic reconfiguration capabilities of Xilinx Virtex 1000 FPGAs to manage transient faults due to radiation in space environments. The on-orbit fault detection scheme uses a radiation-hardened reconfiguration controller to continuously monitor the configuration bit streams of 9 Virtex FPGAs and to correct errors by partial, dynamic reconfiguration of the FPGAs while they continue to execute. To study single event upset (SEU) impact on our signal processing applications, we use a novel fault injection technique to corrupt configuration bits, thereby simulating SEU faults. By using dynamic reconfiguration, we can run the corrupted designs directly on the FPGA hardware, giving many orders of magnitude speed-up over purely software techniques. The fault injection method has been validated against proton beam testing, showing 97.6% agreement. Our work highlights the benefits of dynamic reconfiguration for space-based reconfigurable computing.

The flexibility combined with the computational capabilities of FPGAs make them a very attractive solution for space-based computing platforms. However, SRAM-based FPGAs are susceptible to radiation effects, including Single Event Upsets. In order to increase the fault tolerance of FPGA designs, fault mitigation techniques, such as Triple Module Redundancy, can be applied. Such techniques, however, can be excessive in terms of hardware costs. This work investigates the tradeoffs between fault mitigation techniques for FPGA designs and the corresponding costs of such mitigation. A particular focus is placed upon identifying design components that serve to benefit most from the application of fault tolerance techniques, and investigating the tradeoffs associated with applying mitigation to these most sensitive design sections.

FPGA designers are becoming increasingly aware of fault tolerance issues in modern FPGA designs, especially designs destined for a radiation environment. We classify errors due to upsets within the configuration bitstream into two categories; namely, persistent and non-persistent. Persistent errors generally cannot be tolerated. However, non-persistent errors can be tolerated in certain types of designs as long as they are properly accounted for. We discuss situations in which nonpersistent errors are acceptable, and describe a technique for the detection of upsets causing persistent errors within the configuration memory of an SRAM-based FPGA.

The performance, in-system reprogrammability, flexibility, and reduced costs of SRAM-based FPGAs make them very interesting for high-speed, on-orbit data processing, but, because the current generation of radiation-tolerant SRAM-based FPGAs are derived directly from COTS versions of the chips, several issues must be dealt with for space, including SEU sensitivities, power consumption, thermal problems, and support logic. This paper will discuss Los Alamos National Laboratory's approach to using the Xilinx XQVR1000 FPGAs for on-orbit processing in the Cibola Flight Experiment (CFE) as well as the possibilities and challenges of using newer, system-on-a-reprogrammable-chip FPGAs, such as Virtex I1 Pro, in space-based reconfigurable computing. The reconfigurable computing payload for CFE includes three processing boards, each having three radiation-tolerant Xilinx XQVRl 000 FPGAs. The reconfigurable computing architecture for this project is intended for in-flight, real-time processing of two radio fi-equency channels, each producing 12-bit samples at 100 million samples/second. In this system, SEU disruptions in data path operations can be tolerated while disruptions in the control path are much less tolerable. With this system in mind, LANL has developed an SEU management scheme with strategies for handling upsets in all of the FPGA resources known to be sensitive to radiation-induced SEUs. While mitigation schemes for many resources will be discussed, the paper will concentrate on SEU management strategies and tools developed at LANL for the configuration bitstream and 'half latches'. To understand the behavior of specific designs under SEUs in the configuration bitstream, LANL and Brigham Young University have developed an SEU simulator using ISI's SLAACl-V reconfigurable computing board. The simulator can inject single-bit upsets into a design's configuration bitstream to simulate SEUs and observe how these simulated SEUs affect the design's operation. Using fast partial configuration, the simulator can cover the entire bitstream of a Xilinx XQVRl 000 FPGA, which has 6 million configuration bits, in about 30 minutes. Instead of using a combination of TMR and configuration scrubbing for bitstream SEU mitigation, the approach developed for CFE uses minimal logic redundancy along with an SEU detection and correction scheme to handle bitstream SEUs. Though this approach allows some SEUs to affect less critical user logic, it requires considerably fewer FPGA resources than TMR and allows bitstream SEU rates to be monitored. 'Half latches', another class of SEU sensitive FPGA state elements, are used to provide logic constants in user FPGA designs but are not explicitly controlled by the configuration bitstream. Upsets in half latches cannot be detected by readback nor corrected via configuration repair or scrubbing - only a full reconfiguration can reliably restore their state. We have created a tool, called RadDRC, which can replace all critical half latches with more visible and correctable constant sources. Lastly, in looking forward, this paper will briefly consider the possible benefits and risks of using reconfigurable system-on-a-chip FPGAs, such as the Virtex II Pro, for reconfigurable computing in space. The paper concludes with a summary of challenges for using reconfigurable computing in space and a summary of future research at LANL in this area.

This work describes the radiation testing of a fault simulation tool used to study the behavior of FPGA circuits in the presence of configuration memory upsets . There is increasing interest in the use of Field Programmable Gate Arrays (FPGAs) in space-based applications such as remote sensing[1] . The use of reconfigurable Field Programmable Gate Arrays (FPGAs) within a spacecraft allows the use of digital circuits that are both application-specific and reprogrammable. Unlike application-specific integrated circuits (ASICs), FPGAs can be configured after the spacecraft has been launched . This flexibility allows the same FPGA resources to be used for multiple instruments, missions, or changing spacecraft objectives . Errors in an FPGA design can be resolved by fixing the incorrect design and reconfiguring the FPGA with an updated configuration bitstream . Further, custom circuit designs can be created to avoid FPGA resources that have failed during the course of the spacecraft mission .

An accelerator test was used to validate the performance of an FPGA single event upset (SEU) simulator. The Crocker Nuclear Laboratory cyclotron proton accelerator was used to irradiate the SLAAC1-V, a Xilinx-Virtex FPGA board. We also used the SLAAC1-V as the platform for a configuration bitstream SEU simulator. The simulator was used to probe the "sensitive bits" in various logic designs. The objective of the accelerator experiment was to characterize the simulator's ability to predict the behavior of a test design in the pro ton beam during a dynamic test. The test utilized protons at 63.3 MeV, well above the saturation cross-section for the Virtex part. Protons were chosen because, due to their lower interaction rate, we can achieve the desired upset rate of about one configuration bitstream upset per second. The design output errors and configuration upsets Were recorded during the experiment and compared to results from the simulator. In summary, for an extensively tested design, the simulator predicted 97 % of the output errors observed during radiation testing. The SEU simulator can now be used with confidence to quickly and affordably examine logic designs to 'map' sensitive bits, to provide assurance that incorporated mitigation techniques perform correctly, and to evaluate the costs and benefits of various mitigation strategies. The simulator provides an excellent test environment that accurately represents radiation induced configuration bitstream upsets.

Understanding the SEU induced failure modes specific to the Virtex SRAM FPGA is needed to evaluate the applicability of various mitigation schemes since many mitigation approaches were originally intended for ASICs and may not be effective or efficient within FPGAs due to the unique failure modes and architectures found in SRAM-based FPGAs. Through this work, we have shown that SEUs in FPGAs’ programming data may result in five main categories of design modifications, specifically, changes in: mux select lines, programmable interconnect point states, buffer enables, LUT values, and control bit values. These effects are fairly unique to SRAM FPGAs and occur in addition to SEUs in a design’s memory elements. Through analyzing and classifying the bitstream-SEU-induced circuit failures for some test designs, we have been able to confirm and/or discover the following for the test designs: (1) failures in routing structures account for most of the design failures (78% to 84.8% of the failures); (2) the remaining 20% (approximately) were due to upsets in control bits and LUT value changes; (3) of the failure modes, routing mux changes have the most significant impact on bitstream SEU reliability, accounting for as many as 73% of the test designs’ sensitive programming bits; and, (4) the elimination of any single failure mode will not result in a 10x improvement in SEU reliability.

Field Programmable Gate Arrays (FPGAs) are indisputably useful for space missions where system schedule and cost are critical but production quantity is low. SRAM-based FPGAs are uniquely suited for remote missions because of the ability to change function in situ and because they offer substantial signal processing performance. Single Event Upsets (SEUs) are of utmost concern for SRAM FPGAs because the logic functions themselves are sensitive to unintended change. This paper discusses our work with the Xilinx Virtex FPGA and the current understanding of the device's sensitive cross-section. Also discussed are considerations for SEU detection, and methods for reducing SEU sensitivity and increasing SEU observability.