Similar to home computers, the sophisticated capabilities of today’s space missions are made possible by the power of their processor chips. ESA’s coming Alphasat telecom satellite, the Proba-V microsatellite, the Earth-monitoring Sentinel family, and the BepiColombo mission to Mercury, are among the first missions to use an advanced 32-bit microprocessor—engineered and built in Europe. All of them incorporate the new LEON2-FT chip, commercially known as the AT697. Engineered to operate within spacecraft computers, this microprocessor is manufactured by Atmel in France but originally designed by ESA.

To give an idea of the kind of complex factors involved in its design, the ‘FT’ in its name stands for fault tolerant, meaning microprocessor can withstand the random memory bit flips due to space radiation.

This year’s Proba-V microsatellite—surveying daily vegetation growth on a daily basis for a community of scientists previously served by the Spot satellites—will use the AT697 processor in its main flight computer.

While Alphasat employs an older ERC32 chip in its main flight computer, LEON2-FT will be operating an experimental star tracker aboard the satellite as well as the payload computer.

Also with ERC32-based flight computers, ESA’s Sentinels, the first of which will also be launched in the coming year, will similarly harness LEON2-FT chips in their GPS receivers and startrackers for navigation.

ESA’s 2014 IXV Intermediate eXperimental Vehicle for testing atmospheric reentry will control its avionics with a LEON2-FT chip. 2015’s BepiColombo mission to Mercury and 2018’s Gaia star-mapper are using the same design.

The underlying LEON design has also been made available to Europe’s space industry as the basis for company-owned ‘system-on-chip’ microprocessors optimized for dedicated tasks. For instance, Astrium is using it to create a space-based GPS/Galileo satnav receiver.

Innovating For Independence
How did ESA end up designing computer chips in the first place? As one of the only worldwide bodies to deal with the entire range of space activities, the Agency is as concerned with the internal components used to put together missions as well as the design of the missions themselves.

“One of the main reasons for ESA to exist is to ensure the independence of Europe’s space industry,” said Roland Weigand of ESA’s microelectronics section.

“If we are too dependent on parts from outside Europe whose supply could be restricted at any time then the competitiveness, even the long-term viability, of our space sector comes into question. That’s become a real concern with foreign export controls and related regulations.

“ESA first became motivated to get involved with microprocessor development back in the 1990s as they became more central to the performance of space missions.

“Independence from non-European parts is also a driver of our European Components Initiative, in place for the last decade, which is working with European industry to bring new components to market.”

Leading Up To LEON: ESA’s First Microprocessors
ESA engineers began by taking existing designs and adapting them for use in space. This process began with the Agency’s MA31750 16-bit microprocessor, designed in the early 1990s.

Manufactured in the United Kingdom (U.K.), this microprocessor is sold internationally and is still in widespread use in the satellite telecommunications sector as well as serving ESA missions, including comet-chaser Rosetta.

For its next attempt, the Agency adopted the SPARC (Scalable Processor Architecture) open industry standard, resulting in the ERC32 design.

The initial three-chip set (each chip containing part of the microprocessor) was developed in the mid-1990s. Commercialized by Atmel as the TSC691/692/693, it was employed by several International Space Station computers, by the Automated Transfer Vehicle (ATV) supply truck, and by ESA’s highly automated Proba-1 Earth observation microsatellite.

The microprocessor’s second generation, developed in the late 1990s, merged these three chips into a single chip—the ERC32 ‘single chip’, subsequently commercialized by Atmel as the TSC695. This product has been at the heart of European space systems for more than a decade.

Notable adopters include the inertial units guiding the flight of Ariane 5 launchers and the Herschel and Planck space observatories, among other ESA science missions.

“About 3,500 ERC32 single-chip flight units have been sold, and it remains on sale to this day, valued in the space industry as a mature, reliable product,” Roland added.

Starting Over
Then, for ERC32’s follow-on microprocessor came the concept of starting over from scratch.

“The idea in the second half of the 1990s was not just to rely on this existing SPARC open architecture but to take full control of the functionality, which meant making our own design,” explained Roland.

Development of the LEON microprocessor was initiated by two, then ESA staff, André Pouponnot and Jiri Gaisler, in coordination with their division head, Richard Creasey.

Not that the small ESA team did everything themselves: By initially releasing a reduced version of the LEON design as open source code to a worldwide community of users, including many universities, they crowdsourced valuable debugging feedback ahead of manufacturing.

Boasting a five-fold performance improvement on the ERC-32, ESA’s LEON2-FT is once more manufactured by Atmel. Features are etched onto its underlying semiconductor at 180 nanometre (nm) scale, compared to the single-chip ERC32’s 500nm scale. The smaller the scale, of course, the more computing power can be crammed onto an individual chip.

To give an idea of scale, an individual atom measures a few nanometres across, while a typical human hair is about 60,000 to 100,000nm wide. Manufacturing at such a scale sounds impressive, but the commercial semiconductor industry is typically operating several generations ahead of the space industry.

LEON’s First Flights
The AT697 (LEON2-FT) flew for the first time in 2008, launched to ESA’s Columbus module on the Space Station within a prototype computer payload called the ERNObox.

This served to gather data on the internal Station environment before being converted into an experimental system detecting Automatic Identification System (AIS) signals from orbit—the maritime equivalent of air traffic control signals—to build up a global picture of oceangoing traffic.

The following year, a second LEON2-FT chip ran the flight computer of ESA’s Proba-2 microsatellite, a technology demonstration mission focused on solar and space weather monitoring.

Both chips remain fully functional to this day, achieving the all-important flight heritage essential for broader market acceptance.

“About 400 flight units have been sold in the almost four years that the LEON has been on sale,” Roland said. “It is a general-purpose microprocessor, so it can serve in a main computer to run the satellite platform, but can also be used for payload computers to oversee particular experiments.”

An Intangible Asset
The LEON’s versatility extends beyond the physical microprocessor itself. ESA also has full rights to reuse its IP core (Intellectual Property core), meaning the underlying code that describes the circuit, the key input needed, after several design steps, to embed the circuit onto a real chip.

Existing separately from the manufactured circuit, this LEON source code can be applied to various different platforms, such as becoming part of a dedicated system on a chip with specialized peripheral functions, such as data compression or encoding and decoding.

“In fact, a LEON IP core actually was launched even before the AT697 into space,” said Roland. “A programmable chip based on a radiation-tolerant version of this IP core has been controlling a visual monitoring camera on ESA’s Venus Express mission since 2005.”

LEON’s Next Steps
Not that the LEON story ends with the LEON2-FT. Alphasat and Europe’s Galileo navigation satellites use next-generation LEON3-based reprogrammable chips within payload elements, embedding a new IP core evolved from the previous LEON design by Swedish company Aeroflex Gaisler.

Aeroflex Gaisler’s LEON3 has also become the basis of the SCOC3 spacecraft-computer-on-a-chip. Developed by Astrium with ESA support, for manufacture by Atmel, this single component has sufficient functionality to operate an entire satellite platform or payload in space.

The SCOC3 is already flying in orbit as an integral part of missions that include France’s Spot-6 Earth observation satellite that was launched in September 2012.

öteborg-based Aeroflex Gaisler to develop the Next Generation Microprocessor (NGMP) for the decade to come, which will be based on the LEON4 microprocessor: Four CPUs will serve a comprehensive set of peripherals to provide a further boost in processing performance, reflecting a similar move to multicore processors in terrestrial markets.

The chances are that whatever hardware you are reading this article on would not cope well with space. Assuming its mechanical structure survived the launch acceleration and vibration, it would then face sustained hard vacuum and temperature extremes. Within a matter of months or even weeks, its central microprocessor would doubtless be fried by radiation exposure.

Space is awash with charged particles of various energy levels, either emitted directly from the Sun or the wider Cosmos beyond the Solar System, or else confined within Earth’s magnetic field to help form the radiation belts.

When a high-energy particle strikes a computer chip, the consequences can include the random flipping of microprocessor memory cells—known as a Single Event Upset—through to transistor gate ruptures up to a complete burn-out, called a latch-up.

Sustained radiation exposure can also weaken the underlying quality and electrical conductivity of the chip’s semiconductor material, potentially leading to degraded performance or excessive power consumption.

“As microprocessor gates become smaller and the absolute levels of power go down, our circuits are becoming more vulnerable to Single Event Upsets,” said Weigand.

“Even terrestrial chip manufacturers are growing more concerned about hardening against radiation—especially for products like network routers or medical applications where reliability needs are absolute.

“For the radiation-heavy space environment the problem is, of course, many orders of magnitudes worse.”

Robustness Through Redundancy
Dedicated microprocessors such as ESA’s LEON family are essential for space missions—radiation-hardening is one of the main factors driving their design.

Physical shielding has a role to play, but can only extend so far. Heavy ions can still pass through an aluminium box, or else interact with it to produce a shower of secondary particles that could be almost as harmful.

“The key to designing for rad-hardening is really redundancy,” Roland added. “You might duplicate your bits at different sites around the microprocessor or use parity coding to add on extra bits that help with detecting errors.

“Or you can triplicate your bits and then use a voting system to detect and correct errors: The result that comes up the most is likely to be right.

“Alternatively you can perform the same calculation multiple times—temporal instead of spatial redundancy.

“Whatever mode of fault tolerance is used, there is a price to pay for that redundancy. Your chip will be larger, run slower and consume more power— in return for its increased reliability.

“To limit these penalties requires a careful optimization of the design, striving for compromises with the expected processor timing performance.

“Before introducing radiation tolerance features, the chip designers should ideally have in-depth knowledge of how the processor works. This is a real problem with commercial processors—based on proprietary information—and it is difficult to add in such features after cores have already been designed.

“Instead, for the LEON, we decided to start from scratch, adding redundancy from the beginning.”

LEON: A New Recipe For Chips
How to go about designing a microprocessor? The first step is to think about what it needs to do. In this case, serve as a general purpose processor for space-based computer systems.

The next step, having selected the SPARC open standard to work within, was to code the instruction set defined by this standard into a text-based description suitable for translation into an electronic circuit.

“Coding is performed using a hardware description language called VHDL which resembles a software programming language, but has specific features to describe an electronic circuit,” Roland explained.

The resulting description contained several thousand lines of code: The LEON2-FT VHDL IP core. This VHDL code could then be simulated on computers to validate it was operating as intended in advance of producing any hardware. A reduced version of the LEON IP core was distributed to the user community to obtain crowdsourced debugging tips.

“The next stage was then to physically translate that code to create a test board hosting a programmable chip called a field programmable gate array (FPGA) where the LEON design could be put to work and tested.”

The reprogrammable nature of the FPGA allowed different design configurations to be evaluated before deciding on a definitive version for the final (and expensive) chip manufacturing, when the microprocessor design is etched onto semiconductor chips.

Into the Nanoworld
Conservative space technology tends to lag behind its faster-moving terrestrial equivalent: The LEON2-FT is etched to a resolution of 180nm, while the forthcoming Next Generation Microprocessor will go down to 90nm or even 65nm. For comparison, Intel’s latest CPU is around 32nm.

These 90 and 65nm technologies, while available in the commercial world for many years, are currently being validated for use in space through a pair of ESA activities called the Design Against Radiation Effects (DARE) and Deep Sub Micron (DSM) initiatives.
This descent into the nanoworld throws up fresh design challenges—such smaller technology is more sensitive to Single Event Upsets, for example—but success would mean that spacecraft designers can go on assuming enhanced processing performance for future missions for many years to come.

For additional information on ESA Space Engineering activities, please visit
http://www.esa.int/Our_Activities/Space_Engineering