ESA - European Space Agency patch.
7 January 2013
Layout of the LEON2-FT chip, alias AT697
Just like home computers, the sophisticated capabilities of today’s space missions are made possible by the power of their processor chips. ESA’s coming Alphasat telecom satellite, the Proba-V microsatellite, the Earth-monitoring Sentinel family and the BepiColombo mission to Mercury are among the first missions to use an advanced 32-bit microprocessor – engineered and built in Europe.
All of them incorporate the new LEON2-FT chip, commercially known as the AT697. Engineered to operate within spacecraft computers, this microprocessor is manufactured by Atmel in France but originally designed by ESA.
To give an idea of the kind of complex factors involved in its design, the ‘FT’ in its name stands for ‘fault tolerant’, meaning it can withstand the random memory ‘bit flips’ due to space radiation (for more information, see the link: LEON: The making of a microprocessor for space).
Alphasat
This year's Proba-V microsatellite – surveying daily vegetation growth on a daily basis for a community of scientists previously served by the Spot satellites – will use the AT697 processor in its main flight computer.
And while Alphasat employs an older ERC32 chip in its main flight computer, LEON2-FT will be operating an experimental star tracker aboard the satellite as well as the payload computer.
Also with ERC32-based flight computers, ESA’s Sentinels, the first of which will also be launched in the coming year, will similarly harness LEON2-FT chips in their GPS receivers and startrackers for navigation.
BepiColombo heading towards Mercury
ESA’s 2014 IXV Intermediate eXperimental Vehicle for testing atmospheric reentry will control its avionics with a LEON2-FT chip. And 2015’s BepiColombo mission to Mercury and 2018’s Gaia star-mapper are both using the same design.
The underlying LEON design has also been made available to Europe’s space industry as the basis for company-owned ‘system-on-chip’ microprocessors optimised for dedicated tasks. For instance, Astrium is using it to create a space-based GPS/Galileo satnav receiver.
Innovating for Independence
LEON2-FT chip within Proba-2's computer
How did ESA end up designing computer chips in the first place? As one of the only bodies worldwide to deal with the entire range of space activities, the Agency is as concerned with the internal components used to put together missions as the design of the missions themselves.
“One of the main reasons for ESA to exist is to ensure the independence of Europe’s space industry,” said Roland Weigand of ESA’s microelectronics section.
“If we are too dependent on parts from outside Europe whose supply could be restricted at any time then the competitiveness, even the long-term viability, of our space sector comes into question. That’s become a real concern with foreign export controls and related regulations.
Proba-2
“ESA first became motivated to get involved with microprocessor development back in the 1990s as they became more central to the performance of space missions.
“Independence from non-European parts is also a driver of our European Components Initiative, in place for the last decade, which is working with European industry to bring new components to market.”
Leading up to LEON: ESA'S First Microprocessors
Computing performance of ESA's standard microprocessors
ESA engineers began by taking existing designs and adapting them for space use. This process began with the Agency’s MA31750 16-bit microprocessor, designed in the early 1990s.
Manufactured in the UK, this microprocessor is sold internationally and still in widespread use in the satellite telecommunications sector, as well as serving ESA missions, including comet-chaser Rosetta.
For its next attempt the Agency adopted the SPARC (Scalable Processor Architecture) open industry standard, resulting in the ERC32 design.
An initial three-chip set (each chip containing part of the microprocessor) was developed in the mid-1990s. Commercialised by Atmel as the TSC691/692/693, it was employed by several computers of the International Space Station, by the Automated Transfer Vehicle supply truck and by ESA’s highly automated Proba-1 Earth observation microsatellite.
Rosetta, running on ESA's MA31750 chip
Notable adopters include the inertial units guiding the flight of Ariane 5 launchers and the Herschel and Planck space observatories, among other ESA science missions.
“About 3500 ERC32 single-chip flight units have been sold, and it remains on sale to this day, valued in the space industry as a mature, reliable product,” Roland added.
Starting Over
Then, for ERC32’s follow-on microprocessor came the concept of starting over from scratch.
“The idea in the second half of the 1990s was not just to rely on this existing SPARC open architecture but to take full control of the functionality, which meant making our own design,” explained Roland.
Development of the LEON microprocessor was initiated by two then ESA staff André Pouponnot and Jiri Gaisler, in coordination with their division head, Richard Creasey.
ERC32-based ISS flight computer
Not that the small ESA team did everything themselves: by initially releasing a reduced version of the LEON design as open source code to a worldwide community of users, including many universities, they crowdsourced valuable debugging feedback ahead of manufacturing (for more information, see the link: LEON: The making of a microprocessor for space).
Boasting a five-fold performance improvement on the ERC-32, ESA’s LEON2-FT is once more manufactured by Atmel. Features are etched onto its underlying semiconductor at 180 nanometre scale, compared to the single-chip ERC32’s 500 nm. The smaller the scale, of course, the more computing power can be crammed onto an individual chip.
Ariane 5 runs on single version ERC32 chip
To give an idea of scale, an individual atom measures a few nanometres across while a typical human hair is about 60 000 nm to 100 000 nm wide. Manufacturing at such a scale sounds impressive but the commercial semiconductor industry is typically operating several generations ahead of the space industry.
LEON'S First Flights
The AT697 (LEON2-FT) flew for the first time in 2008, launched to ESA’s Columbus module on the Space Station within a prototype computer payload called the ERNObox.
Global ship traffic detection from ISS based on AIS signals
This served to gather data on the internal Station environment before being converted into an experimental system detecting Automatic Identification System (AIS) signals from orbit – the maritime equivalent of air traffic control signals – to build up a global picture of oceangoing traffic.
The following year a second LEON2-FT chip ran the flight computer of ESA’s Proba-2 microsatellite, a technology demonstration mission focused on solar and space weather monitoring.
LEON2-FT-based ERNObox
Both chips remain fully functional to this day, achieving the all-important flight heritage essential for broader market acceptance.
“About 400 flight units have been sold in the almost four years that the LEON has been on sale,” Roland added.
“It is a general-purpose microprocessor, so it can serve in a main computer to run the satellite platform, but can also be used for payload computers to oversee particular experiments.”
An Intangible Asset
And the LEON’s versatility extends beyond the physical microprocessor itself. ESA also has full rights to reuse its ‘IP core’ (Intellectual Property core), meaning the underlying code that describes the circuit, the key input needed, after several design steps, to embed the circuit onto a real chip.
Venus Express
Existing separately from the manufactured circuit, this LEON ‘source code’ therefore can be applied to various different platforms, such as becoming part of a dedicated ‘system on a chip’ with specialised peripheral functions, such as data compression or encoding and decoding.
“In fact, a LEON IP core actually was launched even before the AT697 into space,” said Roland. “A programmable chip based on a radiation-tolerant version of this IP core has been controlling a visual monitoring camera on ESA’s Venus Express mission since 2005.”
LEON's Next Steps
Not that the LEON story ends with the LEON2-FT. Alphasat and Europe’s Galileo navigation satellites both use next-generation LEON3-based reprogrammable chips within payload elements, embedding a new IP core evolved from the previous LEON design by Swedish company Aeroflex Gaisler.
LEON3 spacecraft controller on a chip
Aeroflex Gaisler’s LEON3 is also become the basis of the SCOC3 spacecraft-computer-on-a-chip. Developed by Astrium with ESA support for manufacture by Atmel, this single component has sufficient functionality to operate an entire satellite platform or payload in space.
The SCOC3 is already flying in orbit, an integral part of missions including France’s Spot-6 Earth observation satellite launched in September and the MISSE-7 materials experiment outside the Space Station.
Spot-6 satellite
And ESA has contracted with Göteborg-based Aeroflex Gaisler to develop the Next Generation Microprocessor (NGMP) for the decade to come, which will be based on the LEON4 microprocessor: four CPUs will serve a comprehensive set of peripherals to provide a further boost in processing performance, reflecting a similar move to multicore processors in terrestrial markets.
The chances are whatever hardware you are reading this on would not cope well with space. Assuming its mechanical structure survived the launch acceleration and vibration, it would then face sustained hard vacuum and temperature extremes. And within a matter of months or even weeks its central microprocessor would doubtless be fried by radiation exposure.
Space is awash with charged particles of various energy levels, either emitted directly from the Sun or the wider Cosmos beyond the Solar System or else confined within Earth’s magnetic field to help form the radiation belts.
Space radiation
When a high-energy particle strikes a computer chip, the consequences can include the random ‘flipping’ of microprocessor memory cells – known as a Single Event Upset – through to transistor gate ruptures up to a complete burn-out, called a ‘latch-up’.
Sustained radiation exposure can also weaken the underlying quality and electrical conductivity of the chip’s semiconductor material, potentially leading to degraded performance or excessive power consumption.
Single Event Effect
“As microprocessor gates become smaller and the absolute levels of power go down, our circuits are becoming more vulnerable to Single Event Upsets,” said Roland Weigand of ESA’s microelectronics section.
“Even terrestrial chip manufacturers are growing more concerned about hardening against radiation – especially for products like network routers or medical applications where reliability needs are absolute.
“For the radiation-heavy space environment the problem is, of course, many orders of magnitudes worse.”
Robustness Through Redundancy
So dedicated microprocessors like ESA’s LEON family are essential for space missions and radiation-hardening is one of the main factors driving their design.
Physical shielding has a role to play, but can only extend so far. Heavy ions can still pass through an aluminium box, or else interact with it to produce a shower of secondary particles that could be almost as harmful.
South Atlantic Anomaly - heightened radiation in Earth orbit
“The key to designing for rad-hardening is really redundancy,” Roland added. “You might duplicate your bits at different sites around the microprocessor or use ‘parity coding’ to add on extra bits that help with detecting errors.
“Or you can triplicate your bits and then use a voting system to detect and correct errors: the result that comes up the most is likely to be right.
LEON2-FT– AT697
“Alternatively you can perform the same calculation multiple times – temporal instead of spatial redundancy.
“Whatever mode of fault tolerance is used, there is a price to pay for that redundancy. Your chip will be larger, run slower and consume more power – in return for its increased reliability.
“To limit these penalties requires a careful optimisation of the design, striving for compromises with the expected processor timing performance.
LEON2-FT within its container
“So before introducing radiation tolerance features, the chip designers should ideally have in-depth knowledge of how the processor works. This is a real problem with commercial processors – based on proprietary information – and it is difficult to add in such features after cores have already been designed.
“Instead for the LEON we decided to start from scratch, adding redundancy from the beginning.”
LEON: A New Recipe for Chips
How to go about designing a microprocessor? The first step is to think about what it needs to do, in this case serve as a general purpose processor for space-based computer systems.
The next, having selected the SPARC open standard to work within, was to code the instruction set defined by this standard into a text-based description suitable for translation into an electronic circuit.
Clean room for chip fabrication
“Coding is performed using a hardware description language called VHDL which resembles a software programming language but has specific features to describe an electronic circuit,” Roland explained.
The resulting description contained several thousand lines of code: the LEON2-FT VHDL IP core. This VHDL code could then be simulated on computers, to validate it was operating as intended in advance of producing any hardware. A reduced version of the LEON IP core was distributed to the user community to obtain crowdsourced debugging tips.
“The next stage was then to physically translate that code to create a test board hosting a programmable chip called a ‘field programmable gate array’ (FPGA) where the LEON design could be put to work and tested.”
The reprogrammable nature of the FPGA allowed different design configurations to be evaluated before deciding on a definitive version for the final (and expensive) chip manufacturing, when the microprocessor design is etched onto semiconductor chips.
LEON simulation
In the Nanoworld
Conservative space technology tends to lag behind its faster-moving terrestrial equivalent: the LEON2-FT is etched to a resolution of 180 nm, while the forthcoming Next Generation Microprocessor will go down to 90 nm or even 65 nm. For comparison, Intel’s latest CPU is around 32 nm.
These 90 nm and 65 nm technologies, while available in the commercial world for many years, are currently being validated for use in space through a pair of ESA activities called the Design Against Radiation Effects (DARE) and Deep Sub Micron (DSM) initiatives.
This descent into the nanoworld throws up fresh design challenges – such smaller technology is more sensitive to Single Event Upsets, for example – but success would mean that spacecraft designers can go on assuming enhanced processing performance for future missions for many years to come.
Related Links:
European Components Initiative (ECI): http://www.esa.int/Our_Activities/Technology/European_Component_Initiative_ECI
Microelectronics website: http://www.esa.int/TEC/Microelectronics/
Images, Text, Credits: ESA / AOES Medialab / P. Carril / J. Huart / Qinetiq Space Belgium / CNES / Arianespace / FFI / Astrium / SSA / NASA / STMicroelectronics.
Greetings, Orbiter.ch
