Specifying MCUs for satellites and spacecraft

There is not a single group of standards but a continuum of qualification criteria for the components and systems used in satellites and spacecraft (Figure 1). With the growth of low earth orbit (LEO) satellites where the environment is less demanding and where some satellites are expected to be replaced regularly with upgraded designs, the use of fully space-qualified components is often not necessary or cost-effective. Enhanced Product (EP) devices can provide higher quality and reliability than standard commercial off-the-shelf (COTS) components in those applications. These EP devices are typically plastic-encapsulated, compared with fully space-rated devices’ more rugged and more expensive hermetic packaging. Designers must understand the (physical and business) environment where the satellite will operate and specify components accordingly. Overspecification will be costly, but under specification can result in low reliability and shortened lifetimes.

EP devices can be certified to Government Electronics and Information Technology Association (GEIA)-STD-0002-1 for Aerospace Qualified Electronic Component (AQEC). They can also meet the qualification and processing requirements of MIL-PRF 38535 for QML Class N (non-hermetic) components. Several things can be involved in converting a COTS device into an EP device:

• COTS devices are often produced in multiple facilities; the related EP devices may all be produced in a single facility with a controlled process flow and the same test and material sets, reducing device variability.
• COTS devices typically are specified for operation from 0°C to 70°C or -40° to 85°C. EP devices operate from -55°C to 125°C. In addition, EP devices may experience temperature cycling from -65°C to 150°C for 500 cycles during qualification.
• EP devices typically use gold bond wires, while COTS devices have less expensive and less reliable copper bond wires.
• Depending on the packaging design, EP devices use tin-silver-copper solder or nickel-palladium-gold for improved reliability compared with COTs and AEC Q100 components.
• Highly accelerated stress testing (HAST) to evaluate moisture sensitivity and capability for long-term storage for EP devices can last 250 hours compared with 196 hours for AEC Q100 and 96 hours for COTS devices.

Sometimes EP devices are not rugged enough for the needs of a specific application, and to use devices fully qualified to MIL-STD-883 is overkill. That’s when the use of EP+ (also called Space EP) devices can be beneficial. Moving from EP devices to EP+ devices incurs a significantly higher cost, but not as high as fully-space rated devices. EP+ devices undergo more comprehensive parametric testing at temperature extremes, more comprehensive lot testing, including wafer lot acceptance using MIL-PRF-38535 QML when required, and various levels of radiation tolerance testing.

Rad tolerant vs. hard MCUs

Radiation-tolerant (rad-tolerant) EP+ components are specified as reliable up to some limit below 100-kilo radiation (krad) absorbed doses, while radiation-hard (rad-hard) components are tested to much higher levels. One rad is defined as a dose of 100 ergs of energy per gram of the given material. Internationally, the rad has been replaced by the gray (Gy), equal to 100 rads, in the International System of Units (SI), only the U.S. still refers to rads of radiation. Radiation tolerant components are appropriate for lower altitude systems that will receive lower doses of radiation. This also helps satisfy the drive for lower-cost military and aerospace systems. Rad-tolerant devices are used in cost-sensitive designs such as CubeSats and satellites that are expected to be replaced every five years with upgraded designs.

Like most semiconductor devices, MCUs are susceptible to radiation damage. Rad-tolerant and rad-hard MCUs are often based on their non-hardened counterparts, with design and manufacturing changes that reduce susceptibility to radiation damage (Figure 2). Rad-hard devices are tested to so-called resultant-effects tests such as total ionizing dose (TID), enhanced low dose rate effects (ELDRS), neutron and proton displacement damage, and single event effects (SEEs).

There are a variety of forms of radiation, from fairly innocuous alpha particles to high-energy gamma rays and neutrons (Figure 3). So-called galactic cosmic rays consist of electrons, protons, and neutrons that originate outside the solar system. Solar radiation occurs in a broad spectrum from visible light to the ionizing radiation released during solar flares such as x-rays and gamma rays. The Van Allen radiation belt is a zone of energetic charged particles, most of which originate from the solar wind, captured by and held by the Earth’s magnetosphere. Rad-hard MCUs and other electronics have extremely low failure rates even after years of operation in harsh radioactive environments.

Making chips rad-hard

Rad-hard chips are often fabricated on insulating substrates such as silicon-on-insulator (SOI) and silicon-on-sapphire (SOS). Compared with COTS devices that can handle between 50 and 100 Gy (5 and 10 krad in the U.S.), SOI and SOS chips can survive 1000 to 3000 Gy (100 to 300 krad). SOI processes eliminate latch-up events but are not guaranteed to improve TID and SEE hardness. A shielding layer of depleted boron can be added to improve rad hardness. But that is usually not enough, and system design changes are needed.

For example, error correcting code (ECC) memory includes redundant bits to check for corrupted data. Radiation can damage memory content even when the memory is inactive. ECC memory designs include a circuit that continuously sweeps the RAM, reads out the data, checks the redundant bits for errors, and then writes back any corrections. Various forms of redundancy are common in rad-hard systems.

At the circuit level, a single bit can be replaced with three bits and “voting” logic for each bit to determine its result continuously. This increases the size of the system but results in “fail-safe” operation. Whether or not a single-bit failure is caused by radiation, the voting logic will continue to produce correct results.

At a higher level, voting can be extended to multiple MCUs. Redundant MCUs can be implemented with three separate circuit boards that independently compute a result and compare answers. Any board that does not produce a matching result will recalculate. If a specific board consistently has non-matching results, it will be shut down to save system resources.

General criteria for space qualification

Space qualification extends beyond radiation hardening and includes extreme temperature operation. Even getting into orbit is fraught with dangers in the form of very high levels of acoustic noise, vibrations, and acceleration forces during launch. Some of the main space-grade certifications include:

• MIL-STD-883 sets uniform methods, controls, and procedures for testing microelectronic devices
• MIL-PRF-38534 for hybrid microcircuits
• MIL-PRF-38535 for single die microcircuits such as MCUs
• AS9100 is the standardized quality management system for the aerospace industry.
• JESD22 establishes the physical, electrical, mechanical, and environmental conditions and a series of uniform methods and procedures for evaluating the reliability of packaged solid-state devices.

Those are just the main certifications; there are many more, some regionally promogulated, including:

• ESCC 9000 European standard for ceramic, hermetically sealed microcircuits for space applications.
• QML-V A quality standard for hermetically sealed microcircuits.
• QML-Q DLA class for hermetically sealed devices for military aeronautic applications.
• QML-Y DLA class for non-hermetic ceramic devices for space applications.
• NASA Levels A NASA quality standard for Plastic Encapsulated Microcircuits (PEM).
• ECSS Class A class standard from the European Cooperation for Space Standardization.

One thing all of these standards have in common is extensive testing requirements. Examples include:

Burn-in is performed at the extreme thermal, electrical, and environmental operating specifications of components over a period of time.

Non-Destructive Bond Pull, for example, as defined in MIL-STD-883, is performed to identify faulty wire bonds without affecting any acceptable wire bonds.

Temperature Cycling specifications include MIL-STD-202, Method 107, Thermal Shock; MIL-STD-810, Method 503, Temperature Shock; MIL-STD-883, Method 1010, Temperature Cycling and; JESD22-A104D, Temperature Cycling.

Mechanical Shock and Vibration tests simulate the application of sudden force or abrupt change in motion, such as occur during a rocket launch.

Constant Acceleration testing can use a centrifuge to identity mechanical and structural weaknesses not necessarily detected in mechanical shock and vibration testing. MIL-883 acceleration testing specifically applies to microelectronic devices. Electrodynamic shakers can also be used for dynamic load testing and rocket launch simulations.

System Testing and James Webb – putting it all together

The James Webb telescope is a recent example of the extended systems testing required to prove flight worthiness. NASA worked with its international partners to match Webb’s testing environment precisely to what would be experienced both on launch day and when operating in orbit. For example, the compete flight hardware had to pass a simulated launch environment performed in two stages for “acoustic” and “sine-vibration” testing (Figure 4).

In the first test, the flight hardware was exposed to sound pressure levels above 140 decibels, with a spectrum tuned to the specific signature of the Ariane 5 rocket it would ride to space. During the tests, nearly 600 individual channels of motion data were carefully observed and recorded. Typical acoustic and vibration tests measure about 100 channels of data, but the unusually complex size and shape of the observatory required more measurements.

Next, Webb was taken to a second facility where it was placed on a purpose-built shaker table capable of precise vertical and horizontal acceleration. The initial acoustic testing simulated the high-frequency launch dynamics, and the vibration testing on the shaker table covered the lower frequencies.

Summary

Specifying MCUs for satellites and spacecraft is a complex process. There’s a continuum of qualification standards beyond COTS, including EP, EP+, and MIL-STD-883, before arriving at full space-rated MCUs. In addition, designers need to consider if radiation-tolerant performance is adequate or if a fully rad-hard device is required. Depending on the necessary level of performance, there is a wide range of qualification testing for components and full systems before they can be launched into space.

References

Challenges for Electronic Circuits in Space Applications, Analog Devices
Developing Radiation Hardened Electronics for Space Environments, Tempo Automation
MIL-STD-883 Microcircuits Compliance Testing, Keystone Compliance
NASA’s James Webb Space Telescope Completes Environmental Testing, NASA
Radiation hardening, Wikipedia
Radiation Tolerant Cortex M3 MCU, Microchip
Understanding Quality Levels for HiRel-rated Components, Texas Instruments