Spacecraft electronics designers who are under pressure to deliver small packages at small prices are quickly learning about the relative benefits of specifying commercial-grade, upscreened, redesigned, or full-mil components
By John McHale
The steadily shrinking geometries of today`s commercial electronic components are usually good news - particularly for spacecraft avionics designers who must pack as much functionality as possible into exceedingly tight spaces. Unfortunately, as electronic components become smaller, they also become more susceptible to radiation that occurs naturally in space.
At the same time, however, spacecraft electronics designers are finding radiation-hardened integrated circuits increasingly expensive and difficult to find. Many commercial integrated circuit manufacturers are turning away from the rad-hard market because they find little profit in shielding their products to the ill effects of exposure to radiation, such as single-event upset and latchup, opting instead to produce commercial-grade ICs for the far more lucrative desktop and telecommunications markets.
NASA spacecraft designers have little influence with the IC suppliers because the sizes of their orders are tiny in comparison to large commercial orders. Of all radiation-hardened electronic components manufactured, in fact, only 10 to 15 percent go into NASA programs. Of the remainder, 60 percent goes into commercial initiatives, and 25 percent into military projects, says David Allen, manager of space level marketing for National Semiconductor in Santa Clara, Calif.
These trends leave spacecraft designers in NASA, the military, and the aerospace industry with few reliable and affordable sources for rad-hard components. They either must take risks by designing with products untried in space, or spend extra money to redesign or upscreen those products for space survivability.
To the surprise of some, they are finding that judicial use of commercial-grade components, combined with redesigning some commercial-grade parts to meet the requirements of the space environment is paying off. This approach is yielding spacecraft electronic systems that not only are reliable enough for the tough environment of space, but that also can be designed inexpensively enough to meet the requirements of ever-tightening NASA space budgets.
Last of the breed
The NASA Cassini spacecraft, which launched last year on its scientific rendezvous with Saturn, had virtually unlimited funding, and as such it may be the last of its breed. NASA officials by necessity are running the majority of today`s space missions, such as the Mars Pathfinder and the Lunar Prospector, on a shoestring budget. The Mars Pathfinder and Lunar Prospector, in fact, are examples of the imperative for NASA officials to find space-quality parts at commercial-level prices.
Finding space-quality parts at commercial-level prices, however, is easier said than done. In the culture of today`s electronics industry this task is a virtual contradiction in terms. To most engineers, buying at commercial-level prices means compromising in quality. For NASA space missions, that is simply unacceptable.
"NASA and the military cannot afford any failure, so they`re really not going to go with many commercial-grade products," points out Jim Martin an independent consultant on military procurement issues with National Semiconductor Corp. Although that approach is true with missions like Cassini, it is not so with programs such as Mars Pathfinder and the Lunar Prospector.
On Cassini, NASA engineers did not face choosing between commercial-grade and custom parts. The money was there, largely because Cassini is a 12-year mission and practically all its parts were custom designs and redundant, explains Rob Manning, chief engineer on Pathfinder. "Cassini has to succeed and it will," he says.
Pathfinder, however, was a different story. NASA engineers were forced to go with commercial grade-components because of a tight design budget. Since compromising on system reliability was not an option, engineers had to pick and choose the spacecraft functions carefully where they would implement commercial-grade components. "I didn`t want to fool with higher-grade class-S components" in areas such as the radar for the landing system and the motors on the rover, Manning explains.
When Pathfinder scientists were unable to find the components they needed off the shelf, they tried a new route, Manning explains. They would sign non-disclosure agreements with the component suppliers, reverse engineer the products to find out how they worked, and redesign them to meet their needs. "More often than not the redesigned product would replace the previous one in that company`s catalog," Manning points out.
Aerospace engineers fully tested the Lunar Prospector in a short time with little budget, says Tom Dougherty, chief design engineer at Prospector prime contractor Lockheed Martin Missiles and Space in Sunnyvale, Calif. The spacecraft has a basic hardware design, he says.
The Lunar Prospector - the third flight in NASA`s Discovery Program series of faster, better, cheaper space science missions - launched to the moon last January. Its one-year mission is to report on the Moon`s resources, structure, origins, and determine if ice exists in craters at the lunar poles. The entire mission, managed at the NASA Ames Research Center in Mountain View, Calif., costs $62.8 million. The project yielded a spacecraft built with reliable, but inexpensive parts. "If you can buy commercial that works, do it," Manning advises.
The costs of redesign
Despite the financial benefits that using commercial off-the-shelf (COTS) hardware represents to the spacecraft designer, there are still troublesome costs associated with redesigning commercially developed components to meet the rigors of space. Designers often must bear the costs of licensing, royalties, and sometimes-marginal technical support from integrated circuit manufacturers.
"The application of a commercial processor into space is complicated by the need to build it on a radiation tolerant IC process," explains Richard Elmhurst, business development manager at Honeywell Space Systems in Clearwater, Fla. "This translation of a commercial design to a space-qualified process usually encounters an issue of very costly licensing and royalty fees, which are associated with procuring rights to the commercial processor`s structural design. In addition," he continues, "the commercial market views space users as having very low volume, revenue, and profit potential. As a result, the space user can expect and receive little support from the commercial vendor, especially when technical design conversion or fabrication issues arise."
Elmhurst questions the ultimate value of redesigning commercially developed ICs with radiation hardening when designers add up these extra and sometimes-hidden costs. "These expensive license fees are a high price to pay for little support," he points out.
Elmhurst and his engineers produce the RH32 microprocessor chipset, a 32-bit radiation-hardened, fault-tolerant processor designed for spaceborne and avionics data processing systems. A distant cousin to the Mil-Std 1750A microprocessor, the RH32 is perhaps the last microprocessor that any U.S. chip company will build strictly to military and aerospace specifications. Honeywell officials believe they have amortized their development costs of the RH32 sufficiently to offer the device as a COTS product. The U.S. military bore most of the RH32`s development costs in the 1980s.
The RH32 is a Reduced Instruction Set Computer (RISC) architecture implemented in a sub-micron CMOS Very High-Speed Integrated Circuit technology. The high-reliability chipset has a 97 percent chance of lasting for 10 years in severe space environments. Designed-in testability and extensive fault-tolerance features provide fault coverage and support for automatic recovery from transient faults.
Fault-tolerance features include instruction retry, error detection and correction, and parity on internal buses. These features enable the chipset to recover from 78 percent of faults without additional hardware. The chipset also can be configured as self-checking pairs for those applications that require 100 percent fault coverage.
The RH32 was developed under the sponsorship of the former U.S. Air Force Rome Laboratory (now the Air Force Research Laboratory Information Directorate) in Rome, N.Y., as well as the Ballistic Missile Defense Organization in Arlington, Va. The RH32 can withstand 1 megarad total-dose radiation, supports 16- and 32-bit instructions, and has a non-recoverable single-event upset rate of once every 84 years.
Honeywell engineers are also under contract to design, develop, and provide the on-board spacecraft and payload processors for the five geosynchronous spacecraft for the high component of the U.S. Air Force`s Space-Based Infrared System (SBIRS) program. Honeywell is a member of the Lockheed Martin SBIRS team, which is the prime contractor on the $1.8 billion program. As subcontractor to Lockheed Martin, Honeywell designers will use the RH32 to provide the onboard processing and data handling for SBIRS.
SBIRS, which is designed to detect and track the plumes of long- and short-range ballistic missile launches, will replace the Defense Support Program satellites and ground stations.
Design tradeoffs
Making the right architectural decisions and carrying out the right design tradeoffs when implementing COTS parts on spacecraft can make the difference between success or failure, many experts believe. Commercial satellites, for example, may use more commercial-grade parts than the military, but not usually with systems that are designed to keep the spacecraft in orbit, notes National Semiconductor`s Allen.
Those who manage projects with numerous satellites such as Iridium, the global telecommunications satellite project from Motorola Corp. in Scottsdale, Ariz., can factor in that type of redundancy. Project managers weigh risk versus parts availability, Allen says.
Iridium designers also have redundancy in satellite deployment. By deploying nearly 60 satellites, Iridium officials can afford to have one or two fail or have "graceful degradation," Martin says. Motorola officials were not available for comment.
When commercial-grade electronic components, according to their specifications sheets, simply are inadequate for certain tasks, project managers also must choose carefully between redesigning a commercial part, or using the commercial part as-is after subjecting it to a rigorous - and sometimes damaging - battery of tests.
There are two different approaches to buying equipment, explains Vic Scuderi, business area manager for processor product programs at Lockheed Martin Federal Systems in Manassas, Va. One is to redesign an existing part like Lockheed Martin engineers did with the IBM RISC 6000 32-bit RISC microprocessor. Lockheed Martin solid state engineers, before Lockheed Martin purchased their company from IBM, redesigned the commercial-grade RISC 6000 to make the RAD6000, a rad-hard version of the RISC 6000.
The second approach, Scuderi says, is to choose a line of products, screen them, and hope they work. This approach brings a lot of increased risk at the chance of saving money, he says "We`ve maintained the RISC architecture and our process only makes minor design changes," Scuderi says. "We don`t change one circuit; we operate at the transistor level. We`ve designed the RAD6000 so that it does not latch up."
Lockheed Federal Systems engineers have designed the Mars Surveyor program flight computer which uses the RAD6000 microprocessor on a 6U VME board that weighs 1150 grams, consumes 3.3 watts of power when running at 2.5 MHz. The board yields 21 million instructions per second throughput at 20 MHz, and has 128 Mbytes of DRAM and 3 Mbytes of EEPROM onboard memory.
Dual-use approach
Experts at TEMIC Semiconductor in Santa Clara, Calif., are using a dual-use approach. TEMIC`s standard integrated circuit technology, as listed in the catalog, is available to military and aerospace requirements as well as to commercial requirements, says Patrice Hamard, manager of avionics, military, and space marketing at TEMIC. TEMIC`s products for space applications include a solid state recorder and image-compression module for the Earth Observation Satellites.
Even in commercial satellites, however, there comes a time when only a military- or aerospace-grade device is practical, some experts insist. In mission- and life-critical subsystems such as orbit control, designers will not use commercial-grade parts, says Anthony Jordan, standard product line manager, at UTMC Microelectronic Systems in Colorado Springs, Colo. "Our products are available in catalog and are tweaked on a case by case basis," he explains.
UTMC engineers have developed the UT80CRH196KD, a radiation-hardened version of their commercial 16-bit microcontroller. The new device is targeted for satellite and launch vehicle applications. UTMC partnered with FirstPass Inc. of Castle Rock, Colo., in developing the UT80CRH196KD, which UTMC leaders guarantee to 100 kilorads.
The UT80CRH196KD is guaranteed to 100 kilorads (Si) "is ideal for space applications," Jordan says. "Customer feedback has been very positive on the UT80CRH196KD. Coupling the microcontrollers architecture with radiation-hardness makes the product very attractive to system designers building satellite systems requiring embedded control."
UTMC also has a commercial-grade rad-hard gate array family called the UT0.6mCRH. It is designed for high-reliability space applications that require single-event-upset immunity to 100 kilorads total-dose radiation. The UT0.6mCRH is fabricated in a commercial 0.6-micron silicon gate CMOS process. The application-specific integrated circuits (ASICs) produced from this family will be lower cost than their traditional rad-hard counterparts, Jordan says.
"The introduction of radiation-hardened products from a commercial fab is significant because it will allow commercial and military space products to take advantage of the rapid advances in commercial silicon technology," says Peter Milliken, ASIC Product Line Manager at UTMC.
For some small companies whose leaders serve niche markets, only custom IC designs are in their plans. Pico Systems in Toledo, Ohio,
produces no off-the-shelf equipment, says Pico President Jeff Banker. "We only do custom equipment such as multichip modules. The key to our business is providing custom quality with commercial-like development costs," he says.
Pico engineers produce programmable silicon circuit boards for multichip modules. They are able to achieve low development cost through the use of antifuses within their circuitry. The modules also are substrate programmable.
Keeping radiation out
The notion of radiation hardening for integrated circuits is much different today than it was during the Cold War, when the emphasis on this technology centered on protecting it from the effects of nuclear explosions, explains Lewis Cohn, a project manager at the Defense Special Weapons Agency in Alexandria, Va. This is also known as total-dose exposure.
In 1982, designers built systems to protect 16 kilobits of RAM, compared to a 256-kilobit military system today, explains Rod Nicas, a radiation hardening specialist at TRW in Redondo Beach, Calif. In today`s post-Cold-War world, the emphasis is on low power and high performance, he says.
These shrinking wafer geometries are transformation the notion of systems on a chip into reality, says David Stroebel, president of Space Electronics in San Diego, Calif. But as feature sizes increase in density and as devices run faster, they are increasingly vulnerable to single-event upsets (SEU), Elmhurst says.
SEUs happen as ionized particles pass through ICs and corrupt data by flipping one bits to zero bits, or vice versa. An SEU in the form of a soft- or a micro-latchup merely contaminates the system`s memory. A complete-latchup SEU can completely burn out the circuit.
Engineers at Space Electronics attempt to circumvent the SEU problem economically with their RADPAK technology, which makes radiation shielding a part of chip packaging. RADPAK protects chips from radiation at a cost between commercial and traditional rad-hard parts, Stroebel says. Space Electronics engineers are also providing an 8-megabit multichip module for the NASA Mars 98 orbiter and lander.
Rad-hard packaging
Some commercial satellites, such as the Motorola Iridium, use plastic-packaged integrated circuits, Stroebel explains. This, he claims, causes a moisture problem, which can affect the circuitry. All of Space Electronics` products are ceramic- or metal packaged and hermetically sealed. Shielding works well against total dose radiation, but still will not protect against a single event upset, Elmhurst says. "The only way to really do that is to surround it with lead a foot thick."
The materials that designers most commonly use to radiation harden circuitry are silicon on sapphire, bulk CMOS, and silicon on insulator, explains Ronald Smeltzer, a member of the technical staff at the David Sarnoff Research Center in Princeton, N.J.
Sarnoff engineers work mostly with silicon on sapphire and bulk CMOS. Currently, Sarnoff works on radiation hardening obsolete government equipment. "It`s become very profitable for us," he says.
Sapphire is best at preventing SEUs because it is inert to radiation, Smeltzer explains. Latchup not happen with sapphire, he says. Silicon on sapphire, meanwhile, is difficult to produce, says Lockheed Martin`s Scuderi. Bulk CMOS and silicon on insulator are much more stable, he says.
Silicon on insulator is also becoming more popular due to its low voltage, Cohn says. Whether to use SOI or Bulk CMOS depends on the project requirements explains Gail Walters, vice president of CPU Technologies in Pleasanton, Calif.
Software issues
The spacecraft hardware design is not the only area in which engineers seek to use commercial-grade products to reduce overall system costs. Software also offers a substantial opportunity to trim costs, boost capability, and maintain high reliability levels.
"The majority of the cost for deploying on-board spacecraft processing solutions resides in the development of the payload software," explains Richard Elmhurst, business development manager at Honeywell Space Systems in Clearwater, Fla.
Driving today`s spacecraft software development costs, Elmhurst goes on, are commercial off-the-shelf (COTS) code development environments and associated tools. Rarely, if ever, do spacecraft software engineers "roll their own" compilers and utilities, as they did routinely in the past.
Similarly, software experts measure reliability and the time it takes to integrate and test their code by the maturity and robustness of their software development environment and tools, Elmhurst says. "To minimize the cost and improve the reliability of spacecraft processing solutions, we need to take advantage of the mature, supported, and affordable software development environment and Tools associated with commercial processors," he says.
Finding errors
Error detection and correction is one way to handle micro-latchup with materials that are not radiation hardened. When the device detects a cosmic ray inside the circuit, coded chips within the system check to see if the ray flipped any bits. If a bit is flipped, the system will either switch to a backup bit or reset the contaminated bit.
On the Mars Pathfinder mission, designers used single- and double-bit error correction and detection on the Pathfinder lander.
The actual algorithm behind the method has been around for almost 30 years, says Pathfinder`s chief engineer, Rob Manning. The key now is being able to check as many bits as possible for errors, he says. "On the lander we had a 64 bits being analyzed at once with seven extra redundant bits used in the RAD6000 processor from Lockheed Martin Federal Systems."
While systems designers code most error detection and correction solutions into the hardware, Pathfinder engineers did create one for software on the Pathfinder lander. "The modem we had on the lander was vulnerable to latchup, so we had a software program check it for errors," Manning says. The idea is to contain the error in the circuit and not let it contaminate the system, Elmhurst explains.
Error detection and correction is mostly used when you cannot afford to radiation-harden your circuits, Elmhurst explains. It can work to a point, but when a solar flare or other cosmic event sends a heavy ion the circuit could rupture and error detection and correction methods are rendered useless.
While trends in IC design point toward ever-shrinking geometries and power consumption, as well as ever-quickening performance, the job of spacecraft designers is expected to become even tougher than it is today. "Voltage technology will approach one volt by the year 2010, product market life will be less than five years, improved performance will require higher chip-level integration, and manufacturers will have less flexibility in selecting for non-datasheet parameters," predicts Allen of National Semiconductor.
Some chip suppliers, nevertheless, are looking toward providing radiation-hardened ICs smaller, efficient, more powerful versions for the future. While National`s current technology has military and aerospace circuitry working with .65 micron and .35 micron for commercial, for example, "in the lab right now we`re working with .25 micron, and the next step would be .18," Allen says. TEMIC engineers also plan to get their radiation-tolerant technology down to .35 microns, Hamard says.
At Honeywell, officials are planning to maintain and produce products for control applications and expand into the payload arena, Elmhurst explains. Honeywell`s Mongoose processor is the company`s first foray into this area.
The Mars Pathfinder, pictured above, was designed on a shoestring budget, which drove engineers to make heavy use of COTS components.
The RH32 military-standard 32-bit radiation-hardened microprocessor, pictured above, is perhaps the last CPU that any U.S. chip company will build strictly to military and aerospace specifications.
A radiation-hardened version of the UTMC Microelectronics 16-bit microcontroller, pictured above, is being designed into satellite and space launch vehicles.
Space COTS: what`s in a name?
"The goal of COTS is to simplify acquisition," says David Allen, manager of space-level marketing for National Semiconductor in Santa Clara, Calif. Once experts understand that, their next step is defining COTS.
According to Jim Martin an independent consultant on military procurement issues with National Semiconductor, a commercial IC is:
- included in a manufacturer`s list or price log;
- available to all potential customers and applications;
- identified by a standard part all users can recognize;
- fabricated using a standard process common to a family of products;
- assembled and tested using standard methods and equipment;
- offered with a standard;
- documented with set of performance characteristics and limits;
- interchangeable with all other parts bearing the same part number; and
- downward compatible with lesser grades of the same product.
"If I were to give you all ICs for free you would save 3 to 5 percent of your total cost," Allen says.
A lot of talk about COTS refers to it as consumer plastic grade stuff is not true, COTS can be just as rigorous as some custom parts, Allen says.
Pathfinder flew with COTS parts
Scientists at the NASA Jet Propulsion Laboratory in Pasadena, Calif., successfully saved money using commercial-off-the -shelf (COTS) equipment on the Pathfinder mission to Mars.
The COTS quality issue is not always a factor, says Rob Manning, NASA`s chief engineer for the Pathfinder. "We were able to use a few outstanding COTS products. The Pathfinder used very little redundancy, because we didn`t have the room."
The COTS items used aboard the Mars Rover included the system`s UHF modem from Motorola in Scottsdale, Ariz., and its radar altimeter, developed by the Honeywell Solid State Electronics Center in Plymouth, Minn., which acquired the Martian surface at about 32 seconds prior to landing.
The Honeywell radar`s contribution to the entry descent and landing phase of the Pathfinder mission "met all our expectations," Manning says.
Manning also touted the power converters on the Lander and the Rover, developed by Modular Devices Inc. in Shirley, N.Y., and by Pico Systems in Toledo, Ohio, respectively; and the Sojurnor Rover`s REO16DC motors from Maxon Precision Motors Inc. in Burlingame, Calif.
The Maxon motor was the only device NASA engineers could find that extended its life through arc reduction and low inductance, says Howard Eisen, NASA`s subsystem leader for the Mars Pathfinder team.
Eleven DC miniature motors are located in one of each of the six drive wheels of the rover: four steer the vehicle, and one deploys scientific instruments.
After extensive testing under extreme temperature ranges and other environmental factors, JPL scientists performed some modifications on the motors as well as on other products so they could function on the Mars terrain, Manning says.
If NASA scientists were not happy with the initial design of a product, they would go to the company in question and work with them to redesign it, Manning explains. "We would sign a non-disclosure agreement to get them to spill their guts about the product`s design. We provided quality assurance to help them upgrade their lines."
When experts redesigned the product to meet specific NASA requirements, "it would then become part of their catalog," Manning says. NASA has a history of breaking in new products, he says. - J.M.
