MASTER'S THESIS. Design and Qualification of On-Board Computer for Aalto-1 CubeSat. Elyas Razzaghi

Transcription

1 MASTER'S THESIS Design and Qualification of On-Board Computer for Aalto-1 CubeSat Elyas Razzaghi Master of Science (120 credits) Space Engineering - Space Master Luleå University of Technology Department of Computer Science, Electrical and Space Engineering

2 Elyas Razzaghi Design and Qualification of On-Board Computer for Aalto-1 CubeSat School of Electrical Engineering Department of Automation and Systems Technology Thesis submitted in partial fulfillment of the requirements for the degree of Master of Science in Technology Espoo, August 25, 2012 Instructor: LAN Shengchang Aalto University School of Electrical Engineering Supervisors: Professor Emeritus Aarne Halme Professor Thomas Gustafsson Aalto University School of Electrical Engineering Luleå University of Technology

3 Acknowledgment The author would like to thank and acknowledge the following for their contribution towards this project: Jaan Praks, LAN Shengchang, Osama Khurshid Mirza, Adrian Yanes, Jussi Hemmo, Maria Komu, Antti Kestilä, Matti Vaaja, and Tomi Ylikorpi. Also, I would like to thank my wife and my family for their support and patience throughout writing this thesis. Espoo, August 25, 2012 Elyas Razzaghi ii

4 Aalto University School of Electrical Engineering Author: Elyas Razzaghi Abstract of the Master s Thesis Design and Qualification of On-Board Computer for Aalto-1 Title of the thesis: CubeSat Date: August 25, 2012 Number of pages: 66 Faculty: School of Electrical Engineering Department: Programme: Professorship: Supervisors: Automation and Systems Technology Master s Degree Programme in Space Science and Technology Automation Technology (AS-84) Professor Emeritus Aarne Halme (Aalto) Instructor: Professor Thomas Gustafsson (LTU) LAN Shengchang In this thesis an electrical model of On-Board Computer (OBC) using commercial-offthe-shelf (COTS) components for the first Finnish small satellite, Aalto-1, is designed and built for testing the on-board hardware and software. Both the theoretical and practical aspects of designing a reliable OBC are investigated in this work. The Aalto-1 OBC is designed to provide a platform for Command and Data Handling System (CDHS) that interfaces with other subsystems of the satellite and controls their operations. The Aalto-1 OBC is based on ATMEL ARM9 processors and runs a commercial operation system that is able to boot from several devices. When designing equipment to spacecraft, several aspects should be accounted for, and the design must be highly reliable. The methods for increasing the reliability of OBC are introduced, and the applicable methods are implemented in the OBC design. The components are selected and the electrical model of OBC is built. The functionality of the model is tested in thermal cycling chamber to qualify the design and the selected components to be used in the engineering model of OBC. Keywords: Aalto-1, CubeSat, OBC iii

5 Contents 1 Introduction Aims and Objectives Aalto-1 Mission Outline Development of Small Satellites Overview of Small Satellites Challenges in Small Satellites Design Overwiew of CubeSats OBC of Small Satellite OBC Properties OBC Architecture Centralised Architecture Distributed Architecture Bus Architecture OBC in Space Environment Launch Phase Vibration Thermal Conditions Radiation in LEO OBC Qualification Random Vibration Test iv

6 3.4.2 Thermal Vacuum Bakeout OBC Reliability Improvement Strategies Cold Redundancy Hot Redundancy TMR EDAC circuitry and Memory Scrubbing OBC Processors Aalto-1 satellite OBC Aalto-1 System Description OBC Requirements Mission Requirements System Requirements Mission Constraints Software Requirements Top level design decisions Technical justification for Linux as On-Board OS Technical justification for using ARM processors Related Works Processor Selection System Configuration OBC Architecture Redundancy Strategy Software Configuration Component screening and selection Volatile Memory Non-Volatile Memories LVDS I/O Capability v

7 4.8 Power Management Supervisory Circuit Layout Design Booting OBC Testing Test Software Test Procedures Test Results Summary and Conclusions Future Work References 61 vi

8 List of Tables 4.1 OBC Specifications of CubeSat Missions with Commercial Operating Systems Aalto-1 OBC Processor Candidates vii

9 List of Figures 2.1 Satellite Mass and Cost Classification, Adopted from (Barnhart, 2008) Centralized Architecture Ring Architecture Bus Architecture DNEPR High and Low Level Qualification Profile, Adopted from (Toorian et al., 2004) Bakeout Profile, Adopted from (Toorian et al., 2004) Mitigation Scheme Matrix, Adopted from (Xilinx, 2008) Aalto-1 Satellite Subsystems Aalto-1 System Block Diagram Aalto-1 OBC Block Diagram Aalto-1 Redundant OBC Block Diagram Physical Layer of I 2 C Bus Electrical Model of Aalto-1 OBC Internal First-Stage Bootloader Flow Diagram Weiss Thermal Cycling Profile HMT337 Temperature Transmitter Thermal Cycling Profile.. 58 viii

10 Abbreviations ADCS Attitude Determination and Control System BGA Ball Grid Array CDHS Command and Data Handling System CDH Command and Data Handling COM Communication Subsystem COTS commercial-off-the-shelf DSP Digital Signal Processor EDAC Error Detection And Correction EEPROM Electrically Erasable Programmable Read-Only Memory EPB Electrostatic Plasma Brake EPS Electrical Power System FPGA Field-Programmable Gate Array GPS Global Positioning System I 2 C Inter-Integrated Circuit IR Infrared LEO Low Earth Orbit LVDS Low-Voltage Differential Signaling MMU Memory Management Unit OBC On-Board Computer ix

11 OBSW On-Board Software PCB Printed Circuit Board P-POD Poly Picosatellite Orbital Deployer PQFP Plastic Quad Flat Pack RADMON Radiation Monitor RTC Real-Time Clock SAA South Atlantic Anomaly SCL Serial Clock SCV Spacecraft Configuration Vector SDA Serial Data SDRAM Synchronous Dynamic Random-Access Memory SEE Single-Event Effects SEL Single-Event Latch-up SEU Single-Event Upsets SoC System on Chip SPE Spectral Imager SPI Serial Peripheral Interface SRAM Static Random-Access Memory TID Total Ionizing Dose TMR Triple Modular Redundancy UART Universal Asynchronous Receiver/Transmitter x

12 Chapter 1 Introduction In order to achieve more reliability and functionality in space, the size of satellites has been increased over time. However, the increase in size of satellites results in a long development time and a high development cost and especially very high launch costs. On the other hand, rapidly developing technology and tight budgets have created the need for shorter and cheaper developments of space missions. The need for low cost and fast developing satellites has led to the formation of a new generation of small satellites. The small satellites provide cheaper alternatives to bigger satellites by reducing the requirements significantly and taking the advantages of commercial technologies. The competitive market in microelectronics industry continues to decrease the cost, size, and power consumption of state-of-the-art COTS components, while conversely, increases the performance of these components. 1.1 Aims and Objectives The aims of this thesis are to design and qualify the main OBC to meet the system and mission requirements of Aalto-1. Designing hardware for space application requires considerations that would not normally be considered while designing hardware for other applications. This is due to the extreme environmental conditions in space such as wide temperature range and high radiation exposure. The space equipment demands highly robust electronic components and higher level of redundancy to survive in such environment. The objectives

13 1.2 Aalto-1 Mission 2 in designing a computer system for space applications are to optimize the availability, capability, flexibility, and reliability of system while optimizing cost and risk (Wertz and Larson, 1999). 1.2 Aalto-1 Mission Aalto-1 is a student satellite mission initiated and coordinated by Aalto University, Department of Radio Science and Engineering. The mission is to build, launch and operate a functional remote sensing satellite, mainly with student workforce. The satellite mission should promote space technology education, domestic and international networking in space sciences and latest advances in space technology (Praks et al., 2011). The mission concept and main configuration was developed by students during the Aalto-1 preliminary study in The Aalto-1 mission is built around three innovative payloads, and the main goal of the mission is to demonstrate the functionality of these payloads in orbit and measure their performance parameters. All three payloads are built by different institutions in order to facilitate cooperation inside space R&D segment in Finland (Praks et al., 2011). The Aalto-1 satellite will be built as a three unit (3U) CubeSat according to the CubeSat design specifications (CalPoly, 2009). The CubeSat design has been widely used in many university satellite projects, and currently there are several CubeSats orbiting the Earth. CubeSat design was chosen for Aalto-1 because the concept has been proven in space, off-the-shelf subsystems can be procured if necessary, and commercial launches for CubeSats are available. In addition to this, using CubeSat standard also makes it possible that the new systems designed for Aalto-1 to be easily available for others in the CubeSat community (Näsilä et al., 2011a). 1.3 Outline The thesis is organized as follows: Chapter 1 defines the aims for the thesis work and it introduces the Aalto-1

14 1.3 Outline 3 mission. Chapter 2 explores existing and emerging very small satellite technologies. It gives an overview of small satellites for carrying out various scientific and technological research activities, and it focuses on a short survey of the challenges in the development of small satellites. It also presents a short summary of current CubeSat technology status as an important category of small satellites. Chapter 3 investigates the theoretical background considerations for designing an OBC for CubeSat in Low Earth Orbit (LEO). This chapter introduces the typical of satellite OBC and architecture. It investigates the space environment that Aalto-1 CubeSat will experience during the mission and explains the effects of space environment on OBC. According to CubeSat standards and mission scenario, the qualification requirements of Aalto-1 are then inferred. This chapter investigates the methods for increasing the reliability of OBC when using COTS components. Finally, it proposes different options in selecting the processor for OBC. Chapter 4 presents the work done for the development of an electrical model of OBC. It discusses the design and development process in terms of the techniques and the methodologies incorporated for the whole process. This chapter describes the system specifications of Aalto-1. Based on the OBC system requirements, it proposes the hardware and software schemes. This chapter also derives the detailed system configuration and components of OBC and their interfaces. It explains the booting sequence of the on-board software. Then, it presents the test software and testing procedures for the preliminary thermal qualification of OBC. Consequently, it explores the potential weaknesses of the design based on the test results. Chapter 5 concludes and summarizes the work done in development of OBC. Eventually, it proposes the considerations for development of an engineering model of OBC.

15 Chapter 2 Development of Small Satellites 2.1 Overview of Small Satellites The mission requirements were increasing from the beginning of space age in 1957 in order to have more capable and more reliable spacecraft in the hostile space environment. These requirements have increased the mass of spacecraft from 84 kg Sputnik to over 6,000 kg for some missions today. When, the mass increases, the cost and complexity and developing time of the mission also increase significantly. Conversely to this trend, the emergence of small satellites, originated mostly in universities, has provided many low cost and capable space missions to the space community. The capabilities of small satellites are continuously increasing and the main reason is based on reducing the qualification requirements significantly and taking the advantages of commercial technologies (Barnhart, 2008). Satellites below 500 kg are known as small satellites and they are classified usually according to their mass. These classifications can be seen in Figure 2.1. The launch cost makes up a big portion of any satellite project, and the small size of satellite leads to the much lower launch cost. Some Nano-satellites have been launched as secondary payloads of Dnepr and Eurocket launch vehicles for around $40K per kilogram (Flagg et al., 2004). Since the end of the cold war, former Soviet InterContinental Ballistic Missile (ICBM)s have been refurbished by the Russians for use as launch vehicles. These launch vehicles provide dedicated launches to small satellites as primary payloads. The small size of

16 2.1 Overview of Small Satellites 5 Figure 2.1: Satellite Mass and Cost Classification, Adopted from 2008) (Barnhart, the satellite using commercial technology is achievable because of the advances in microelectronics. The new microelectronic components consume less power while they are more powerful and more efficient. The short development time of the small satellites is because they are less complicated and demand simpler qualification requirements. The low cost introduces new concepts in the space. A system where two or more satellites function collectively to perform a task is defined as a distributed satellite system. Because of the low cost a distributed satellite system, with a reasonable price, could be built and launched. A distributed satellite system like GPS satellites is beneficial since we can have distributed sensors which provide real-time observations and coverage around the world. Space sensor networks could provide an unprecedented capability to investigate widespread phenomena. Distributed sensors will provide more information about the space as well as the Earth environment. There will be more samples at an instant of time, so a better simulation and evaluation of the environment could be performed. The distributed satellite system also increases the reliability of the overall system. For a single, conventional satellite, if there is a failure in one module then the entire mission might be lost. Whereas for a collection of smaller satellites, there would still be other operative satellites that could continue the mission even if one fails. Higher quantity mitigates the risk of failure and this also

17 2.2 Challenges in Small Satellites Design 6 brings the higher reliability to the whole system. There is always a need for real-time coverage of the Earth for weather forecasting, military applications, natural phenomena studies, disaster avoidance and treatment, civilian applications, navigation, and hobbyists. One interesting vision for small satellites is that, they can be used as service spot for bigger satellites, e.g., had there been a full coverage system of small satellites around the earth, the recently lost Envisat (ESA, 2012) could be inspected for maintenance and recovery purposes. The risky and not fully proven scientific experiments usually do not get the chance to go to the space with conventional satellites because of high costs and high level of risks involved. Due the low cost of small satellites, such experiments could be performed. The high cost of conventional satellites puts up the requirement for higher quality control practices to ensure the satellite will work for the aimed lifetime. These quality assurance procedures are usually very costly, time consuming, and need a lot of facilities. In the development of low cost small satellites there are less stringent qualification and quality assurance requirements, and a compromise in project management and quality assurance roles is acceptable. The development of small satellite technology is often open source. Thus, having an easy access to the space technology, the hobbyists and researchers can make more contributions to this area. Consequently, small companies and individuals can have the access to the space. Through the CubeSat standard, many universities have got the chance to develop a real satellite at their own laboratories or workshops. CubeSats can be developed in, comparatively, short time that is suitable for universities where the main workforce comprises of students. 2.2 Challenges in Small Satellites Design The small dimensions of a satellite bring forward a lot of restrictions and challenges. The first limitation is in small solar panels that produce only a couple of watts of electrical energy. In fact, 15 to 20 years ago, it was almost impossible to have any reasonable mission with such a small power generation because the electronic components were not that efficient as today. Thus, they could not be used for on-board processing in such a small satellite. The advances in mobile

18 2.3 Overwiew of CubeSats 7 technology made it possible to have very efficient radios and processors that could operate with a very little power. The area available for antenna is also a challenge where there is not enough gain available for radio communication. The frequency range is also restricted for small antennas. Future on-board processing will allow even greater data collection, but the overall downlink rate is still somewhat limited (Flagg et al., 2004). Communication is by far the bottle neck for Nano-satellites. Using COTS components which are much cheaper compared to space qualified components is one approach commonly used in small satellites. The other benefits of using COTS may include: higher gate densities, increased speed/performance, little or no need for spacial software, easier system development path using COTS development and test equipment, and decreased lead times in comparison to rad hard (RH) devices. Microelectronic manufacturers are being driven by a commercial market of which the space community is a very small portion (LaBel et al., 2011). However, most of COTS components have never been used in any of the satellite missions; and the systems using these components require going through the qualification procedures to be tested for their tolerance to destructive effects of radiation. During these procedures, the COTS components might not pass the tests and they must be discarded and the whole subsystem might need to be redesigned. The COTS components are not radiation hardened, and they are usually available only in plastic packages which are vulnerable to outgassing. The lack of radiation protection and high outgassing rate limit the lifetime of small satellites using COTS components. The orbit selection is another challenge for small satellites at the moment. Currently, the very small satellites are launched together with the conventional satellites on piggyback launches. Since, the conventional satellite holds the major share of the launch cost, it determines the orbit. So, the very small satellite mission designers are not free in orbit selection. 2.3 Overwiew of CubeSats Two major categories of very small satellites are the Nano-satellites with the mass between 1kg to 10kg, and Pico-satellites in the range of 0.1kg to 1kg. CubeSat is a popular open standard in Nano and Pico-satellites. The CubeSat

19 2.3 Overwiew of CubeSats 8 standard defines the dimensions of satellites. It also defines some test procedures and interfaces with launchers. The size of one unit (1U) CubeSat is 10cm x 10cm x 10cm, and the weight is about 1kg. CubeSat standard was developed mainly for simplification of satellite infrastructure in order to reduce build and launch costs for space science so more universities and organizations worldwide could participate in space exploration. There is already a big CubeSat community that provides conferences, workshops, and launcher arrangements for CubeSat developers. The subsystems of CubeSats could be designed as modules, and the modules are integrated in a stacked architecture. Standard launch adapter like Poly Picosatellite Orbital Deployer (P-POD) greatly simplifies getting launch opportunities as opposed to a traditional satellite that has to be designed from the ground up to fit to the launch vehicle. Throughout years of designing for various missions, developers have realized that maximizing potential payload volume is crucial as missions become more complex (Fitzsimmons, 2012). There are some core hardware platform or the avionics systems like Pumpkin s CubeSat Kit or Tyvak s Intrepid provided by different suppliers to support various missions. This allows developers to reuse previously designed systems, and focus more on innovative payloads development. CubeSat mission goals are: Technology Demonstration (56%), Communication (32%). Within a decade more than 50 missions were flown. Currently 250 missions (at least) are in operation/planning (Bridges, 2012). After February 2012, 6 CubeSats were launched to space, by then 74 CubeSats project had been designed, and 55 had been launched, and 36 are still orbiting, 19 naturally deorbited, 14 not operative, and in next 10 years at least 100 CubeSats will be launched. Some interesting derivations of CubeSats are: PhoneSat is an example of rapid development which uses mobile phone as a platform for CubeSat, this platform reduces the costs significantly, this platform already has most of satellite subsystems, it needs low power, and it has accelerometers, GPS, radios, etc. CubeFlow developed by Operationally Responsive Space (ORS) and Air Force Research Laboratory (AFRL) is a kind of plug and play modular Nano-satellite approach where hardware and software Black-box elements can be combined very quickly (possibly less than an hour) to form simple, but functional spacecraft (Kief et al., 2010).

20 2.3 Overwiew of CubeSats 9 Tyvak which is a spin-off company is leading in producing very thin modules which fully conform to the CubeSat specification, and solves many of the design challenges developers face by including the Electrical Power System (EPS), CDHS, a custom Embedded Linux OS with device drivers already in place, and post-deployment power-up interfaces. Tyvak provides a module for CubeSats which is only 1cm thick, and does the vital functions of satellite and the rest of CubeSat volume is left for the developers, and they can put whatever payloads they like to this satellite (Tyvak, 2012). KickSat satellites are a swarm of PCBs fitted in a CubeSat which have radio and communicate with each other and also to a main satellite, and the main satellite has the link down to the Earth (Manchester, 2011).

21 Chapter 3 OBC of Small Satellite The OBC is a computer or a system of computers that processes various information transmitted to the satellite or from other on-board subsystems. The purpose of main OBC is to provide a platform for CDHS that interfaces with other subsystems of satellite and controls their operations. The other standard subsystems of a satellite are EPS, Communication Subsystem (COM), Attitude Determination and Control System (ADCS) and the payloads. There are several interactions that can adversely affect the performance of OBC. Percentage of failure in OBCs are, design 24.8 %, not fully understood environment 21.4 %, operations (bad commands) 4.7 %, Random (parts 16.3 %, quality 7.7 %, other 6.3%, unknown 18.9 %), based on about 2500 failures between ) (Bridges, 2012). In order to reduce the failures, the common techniques for increasing the reliability of OBC in space environment will be presented in this chapter. 3.1 OBC Properties The OBC compared to standard industry embedded controllers or automotive controllers have to provide the following characteristics (Eickhoff, 2012): mechanical robustness to withstand launcher induced loads with respect to sinusoidal vibration and release shock(subsection 3.3.1).

22 3.1 OBC Properties 11 resistance to extreme thermal change (Subsection 3.3.2). radiation robustness against high energetic particles (Subsection 3.3.3). significant failure robustness (Section 3.5). low power consumption (Section 3.6). All of the above items are explained in their referred sections. OBC main elements are processor, boot memory, safeguard memory, work memory, mass memory for science and housekeeping data, data buses and bus controllers, debug and service interface, power supplies, and clock (Eickhoff, 2012). Processors will be discussed in more detail in section 3.6. Boot memory is a non-volatile memory which is persistent even after a power reset. It holds bootloader for On-Board Software (OBSW) and the reference image of OBSW. Safeguard Memory holds the OBC configuration and satellite status information when OBC is being power cycled. The bootloader has a memory area where it can find the latest satellite status and health information. This memory area is called (Spacecraft Configuration Vector (SCV)). SCV has two part of information (Eickhoff, 2012): 1. Actual satellite configuration with its subsystems: Nominal settings, Safe mode settings, Health status parameters. 2. Actual satellite status with its subsystems: Powered subsystems, Subsystems telemetry acquisition, Subsystems operational status. The status part of SCV is continuously updated during operations and the configuration part is directly affected in case a payload was identified to have failure. Work memory (RAM) is used for runtime storage of the executed OBSW which includes both OS and the control software. The OBSW is copied by the bootloader from boot memory into RAM and then OBC is started up. Also, all configuration parameters are loaded into RAM. Two types of RAM are available: Static RAM (SRAM) and Dynamic RAM (DRAM), usually Synchronous DRAM (SDRAM). The difference is that DRAM needs to be periodically refreshed which requires extra circuitry, but it offers higher memory density (Eickhoff, 2012).

23 3.1 OBC Properties 12 Mass memory is a storage area for housekeeping and payload science data acquired during flight phases without ground contact. Data buses and bus controllers are for connecting different subsystems to OBC. Missions are becoming more diverse and complex, thus satellites should be able to accommodate various payloads. Consequently, the OBC should demonstrate high flexibility in term of available peripherals. There are two connection types (Eickhoff, 2012): 1. Point-to-point connection; it needs separate pair of wires for each subsystem, and the data rate is usually higher: UART/USART, MIL-STD- 1553B, SpaceWire, HotLink, GigaLink. 2. Data bus; the OBC hosts a bus controller which connects to the bus lines shared by other subsystems, and the data rate is usually slower: I 2 C, CAN, SPI. Debug interface is an interface that allows debugging of OBSW code on the OBC. Service interface makes it possible to monitor OBSW execution via debugger and in most cases also can be used for fast OBSW upload to RAM while the OBC is not booted. Power supplies needed by OBC are usually 1.8, 3.3V, or 5V. EPS sometimes does not provide these supplies and voltage regulators must be employed to provide these voltages. Clock and synchronization concerns the on-board time generation and the coherent synchronization of all OBSW processes and the on-board subsystems which require timing information or time progress information. Availability of time information is an essential function for OBSW task control and for time stamping of telemetry packets. The main elements for time producing are (Eickhoff, 2012): internal Real-Time Clock (RTC) of the processor. the physical quartz based oscillator clock modules. a GPS atomic clock time reference which provides more exact time and better stability concerning clock drifts compared to the quartz based clock modules.

24 3.2 OBC Architecture OBC Architecture Architecture is a framework for developing a computer system. The architecture shows the system s parts and how they interact through a block diagram. Data architecture addresses the physical structure of the data network or bus, as well as the protocol or logical interaction across the bus (Wertz and Larson, 1999). The OBC architecture has to be flexible and general-purpose to increase its reusability (Yashiro and Fujiwara, 2002). Three different data architectures are used to connect the board computer with external components or subsystems: Centralised Architecture A Centralized Architecture has Point-to-Point interfaces between OBC and other satellite subsystems. It is also refered as Star Architecture (Wertz and Larson, 1999) as seen in Figure 3.1. Advantages: Failure of a component or line does not cause system loss. Individual interfaces are possible for secure data. Disadvantages: High wiring effort is necessary which may also cause electromagnetic compatibility (EMC) problems. Adding a new node requires both hardware and software changes in the central node Distributed Architecture Often called ring architecture, it establishes a way to arbitrate information flow control as the data are passed in a circular pattern (Wertz and Larson, 1999). See Figure 3.2. Advantages:

25 3.2 OBC Architecture 14 Figure 3.1: Centralized Architecture Figure 3.2: Ring Architecture

26 3.2 OBC Architecture 15 Low cabling effort is needed and can be distributed throughout the satellite structure. Components can be tested independently. Adding new nodes will have limited impact on OBC. Disadvantages: It is less reliable, since each node is in-line and thus required to achieve transmission to the next node (e.g. short circuit can cause loss of system). Adress decoder in each node is required Bus Architecture This architecture utilizes a common data bus with all subsystems sharing the bus. It uses standard protocols and communication schemes for all nodes (Wertz and Larson, 1999). See Figure 3.3. Advantages: The system realization is simple. Data transmissions are deterministic which reduces test and troubleshooting time while increases reliability. Disadvantages: Figure 3.3: Bus Architecture

27 3.3 OBC in Space Environment 16 All components must be developed with a specific interface - physically as well as electrically. Failure (e.g. short-circuit) of a component or line may cause loss of system. 3.3 OBC in Space Environment Space is a hazardous environment for electronic equipment and it poses a risk to all Earth-orbiting satellites. The following subsections will highlight the major challenges when designing electronic equipment, such as OBC, for space applications Launch Phase Vibration The launch environment that spans from ground to the altitude of about 80km, known as Karman Line, is one of the most hostile environments that a satellite experience during its mission. There are a lot of vibrations in launch phase. The launch vehicle reaches to an acceleration of about 20g in 90 second in order to gain the escape velocity needed to break free from the Earth gravitational field (Tribble, 1995). During this time, the payloads must withstand multi-axial forces and pressures exerted by launch vehicle. In the presence of air pressure, these forces are produced from violent behavior of air molecules at high speeds. Rocket motors are not designed for the comfort and safety of the equipment they are transporting to space; they are designed to achieve the escape velocity. The energy required to achieve this velocity is violent, and the satellites must be built in such a way that they do not crush under the pressure or rattle apart during the launch. Vibration requirements are dictated by the launch vehicle and given usually in launch vehicle manual Thermal Conditions There are different thermal contributors i.e. sources of heating and cooling in the space environment that cause the wide changes in the temperature of

28 3.3 OBC in Space Environment 17 satellites. The main contributors are direct solar radiation, heat radiation from earth and heat from internal components of the satellite. These contributors are briefly described here. Direct solar radiation Solar radiation is the main source of heat on LEO. Due to Earth s elliptic orbit around the sun, the intensity of sunlight at Earth s distance varies from the minimum of 1322 W/m 2 to 1414 W/m 2. Earth s mean distance from the sun is 149,597,870 km, at which the sunlight intensity is 1367 W/m 2 (Gilmore, 2002). Radiation Reflected from Earth The reflected radiation from earth is defined by Albedo which is the fraction of sunlight reflected off Earth. Generally clouds, snow and ice increase reflectivity as does a lower solar-elevation angle, which leads to higher albedo factor when latitude increases. Usually oceanic regions have lower reflectivity, than continental ones. The local incident solar energy per unit area at Earth s surface decreases with cosine law when moving away from the subsolar point, which leads to decreasing satellite albedo heat flux although albedo fraction increases with latitude. Albedo is highly variable because of the multiple factors affecting it (Gilmore, 2002). Earth Infrared Earth itself emits Infrared (IR) radiation as a thermal body with average temperature around 18 C (Gilmore, 2002) E.g. local temperature at Earth s surface and clouds affect the amount of Earth IR received by the satellite. Generally Earth-emitted IR decreases with latitude. The variability of Earth IR is smaller than that of albedo loads. Since satellite s temperature is closer to that of the Earth than that of the sun, i.e. IR wavelengths are closer, there is no way of selecting thermal coatings that would effectively reflect Earth-emitted IR, but still dissipate heat as IR radiation with high emissivity.

29 3.3 OBC in Space Environment 18 Internal contributors The main satellite internal heat contributor is waste heat from electrical components. For approximate worst case calculations it is often assumed that 100% of electrical power used by the satellite subsystems and payloads is converted to heat Radiation in LEO During the fusion process, the stars emanate a lot of radiations that contain various forms of charged particles. The Sun dominates the sources of radiation in space near the Earth. Encircling the Earth, the Van Allen belt radiation that forms the Earth s magnetic field can divert most of the radiations from space, and shields the Earth. The satellites in LEO are also protected by the magnetic field most of the times, except in South Atlantic Anomaly (SAA) region where the trapped charged particles in Van Allen belt and the radiation from Van Allen belts enter the atmosphere. These radiations cause in the electronic equipment, especially semiconductor devices undesired effects (Botma, 2011). The main sources of energetic particles that contribute to undesired radiation effects to electronic components are: 1. protons and electrons trapped in the Van Allen belts, 2. cosmic ray protons and heavy ions, 3. protons and heavy ions from solar flares. Ionizing radiation has enough energy to remove tightly bound electrons from their orbits while interacting with an atom, and causes the atom to become charged or ionized. The effects of space radiation on the microscopic IC world are not benign. The effects are caused by protons, heavy ions & galactic or solar cosmic rays (GCR/SCRs) > 10 MeV. The effects of radiation in brief are damage of crystal structure, bit flips, and latch up (always on). These effects can be generally classified into two fundamental mechanisms: lattice displacement and ionizing effects. When high energy particles collide with electronics, the arrangement of atoms

30 3.3 OBC in Space Environment 19 changes in the crystal lattice, as a result, lasting damage occurs and the number of recombination centers increases, the minority carriers deplete and the analog properties of the affected semiconductor junctions become worse. This type of problem is particularly significant in bipolar transistors, which are dependent on minority carriers in their base regions; increased losses caused by recombination cause loss of the transistor gain (Wikipedia, 2012). Ionizing radiation effects in space vehicle electronics can be separated into two areas: 1. Total Ionizing Dose (TID) 2. Single-Event Effects (SEE) The two effects are distinct, as are the requirements and mitigation techniques. TID TID is long-term degradation of electronics due to the cumulative energy deposited in a material. TID effects include functional failures and parametric failures (variations in device parameters such as leakage current, threshold voltage, etc.). Accumulation of charge on transistors used in semiconductor circuits affects their current-voltage characteristics. In order to operate correctly, as the gate voltage passes through a threshold, a transistor must be able to switch from a low conductance (off) state to a high conductance (on) state. When being exposed to radiation for long time, the threshold voltage is shifted and this causes an easier or harder switching of the transistors. The leakage current may also increase and it causes the on and off states of the transistors to become less distinguishable. Any of these effects can ultimately cause circuit failure. The dominant sources of TID exposure in the space environment include trapped electrons, trapped protons, and solar flare protons. Possible countermeasures are qualification by tests (Cobalt 60), shielding, and redundancy. The TID tolerance can be seen as a measure for determining the life expectancy of an electronic device. Some electronic devices have a radiation-hardened version which has a greater TID tolerance, but they are considerably more expensive. COTS components usually have a TID tolerance large enough to justify their use on a satellite with a short mission in LEO.

31 3.3 OBC in Space Environment 20 SEE SEEs on the other hand are nearly instantaneous effects. They are induced by the impact of a single energetic particle at a sensitive point in a device. SEEs occur when a single ion strikes the material, depositing sufficient energy in the device to leave an ionized track behind. The many types of SEE may be divided into two main categories: Soft Errors and Hard Errors. In general, a soft error occurs when a transient pulse or bitflip in the device causes an error detectable at the device output. Therefore, soft errors are entirely device specific, and are best categorized by their impact on the device. The most common soft error is Single-Event Upsets (SEU). SEU is generally a transient pulse or bitflip. In combinatorial logic or an analog-to-digital converter, a transient or spike on the device output would be a potential SEU; in a memory cell or latch, a bitflip would be an SEU. SEUs occurring in the device s control circuitry may also cause other effects. In general, SEUs are corrected by resetting the device or rewriting the data. These upsets usually do not damage a device, but it could cause undesired effects within the operation of a device or system. Possible countermeasures are Error Detection And Correction (EDAC) for memory and busses, redundancy of software or data, and reset (LaBel et al., 2011). Hard errors may be, but are not necessarily, physically destructive to the device, and cause permanent functional effects and change to the operation of the device. A common example would be a stuck bit in a memory device. Like SEUs, this is also device dependent. The most common hard error is Single-Event Latch-up (SEL). SEL is a potentially destructive condition involving parasitic circuit elements. During a traditional or destructive SEL, the device current exceeds the maximum specified for the device. Unless power is removed, the device will eventually be destroyed. Latch up is the most common source of problem in 90nm technology, depending on their power and technology used and materials, they can cause permanent damages. Particle hit causes a power-to-ground short within device. This excessive current flow may damage the device, due to the heat generated locally, if the latchup is not removed by means of power cycling (switching power on and off to device). A combination of hardware and software error detection methods serve as effective mitigation. Possible countermeasures are current limiters, power cycling, and cold redundancy (LaBel et al., 2011).

32 3.4 OBC Qualification OBC Qualification Many factors including launch vehicle vibrations, extreme temperatures, radiation and the vacuum environment contribute to the harsh environment that any satellite will experience during its mission. Satellite hardware must be designed and tested to resist each of the above environmental factors so that a satellite will be able to operate nominally with a little or ideally no faults. Qualification testing shall be performed to meet all launch provider requirements as well as any additional testing requirements deemed necessary to ensure the safety of CubeSats and P-POD. If launch vehicle environment is unknown, GSFC-STD shall be used to derive testing requirements. All flight hardware shall undergo protoflight and acceptance testing. If a part does not have test results to prove that it met this requirement, then it needs to have flight history onboard a satellite in a similar low-earth orbit. Finally, if a part could not be justified using either of the above mentioned methods, then at the very least, it needed to be in the same family as a known radiation tolerance levels. At the very minimum, all CubeSats shall undergo the following test (CalPoly, 2009): Random Vibration Thermal Vacuum Bakeout Random Vibration Test Vibration test is done to qualify the robustness of satellite systems in launch phase. The displacement of the components could happen due to weak solders joint or loose contacts when there are high internal and external forces to the satellite structure. The vibration test is performed by inserting sine and random forces to the satellite using a shaker machine. The following vibration testing requirements will ensure that the hardware will not damage any satellites under the worst-case environmental conditions expected during launch. As an example, the test procedures for DNEPR are the following: Setup Test Pod so that the X axis is the test axis of the shake table. Then run the High Level DNEPR qualification test for 35 seconds, then the

33 3.5 OBC Reliability Improvement Strategies 22 Low Level DNEPR qualification test for 831 seconds, see Figure 3.4. Repeat the test for Y and Z axis (Toorian et al., 2004) Thermal Vacuum Bakeout Thermal vacuum bakeout is a simple procedure that secondary payload like CubeSat is required to perform in order to remove excess contaminations that may be harmful to the launch vehicle or primary payload. Thermal vacuum bakeout shall be performed to ensure proper outgassing of components. A minimum vacuum level of 5 x 10 4 Torr must be attained to observe the outgassing of components, Figure 3.5 (Toorian et al., 2004). 3.5 OBC Reliability Improvement Strategies Protection from radiation is mostly not achievable in CubeSat because of its fundamental limitations in size and budget, but it is possible to mitigate the radiation effects to some degree. The common countermeasures for radiation effects are avoiding, shielding, redundancy, error correction, reset, scrubbing memories (used more in Field-Programmable Gate Array (FPGA)). The are different strategies to improve the reliability. Fault avoidance strategies Figure 3.4: from (Toorian et al., 2004) DNEPR High and Low Level Qualification Profile, Adopted

34 3.5 OBC Reliability Improvement Strategies 23 Figure 3.5: Bakeout Profile, Adopted from (Toorian et al., 2004) are usually used in conventional satellites: Using more reliable hardware and proven solutions (heritage). Applying radiation hardened solutions (rad-hard). The fault avoidance strategies are not very common in CubeSat community, since the CubeSat project nature is to use state-of-the-art COTS components that have never been to space. Fault tolerance strategies enables the OBC to continue operation when some part of OBC fails. These strategies include: module redundancy mitigation of radiation effects Triple Modular Redundancy (TMR) EDAC circuitry Memory Scrubbing The module redundancy and mitigation of radiation effects could be implemented both by hardware and software methods. Only the hardware methods will be explained here.

35 3.5 OBC Reliability Improvement Strategies Cold Redundancy Cold redundancy between circuits, boxes, systems, etc. provides a potential means of recovery from a SEE on a system. Autonomous or ground controlled switching from a prime system to a redundant spare may provide system designers an option, depending on satellite size and weight restrictions. An advantage of this method is that the power consumption will not increase very much. Switching control is very important in this method since it causes a single point failure, and in case the switching is autonomous, it should be highly reliable Hot Redundancy Alternately, hot redundancy known also as lockstep operation uses two identical circuits performing identical operations with synchronized clocking, a technique often used with microprocessors. Errors are detected when the processor outputs do not agree, implying that a potential SEU has occurred. The system then has the option of reinitializing, etc. However, for longer satellite mission time frames, lockstep circuits using commercial devices may cause TID-induced problems; clock skew with increasing dosage may cause false triggers when the lockstep devices respond to the dosage differently TMR Triple modular redundancy, better known as TMR, is a widely used method of protecting a system from both hard and soft failures. Voting takes lockstep systems one step further; the implementation involves using three identical subsystems that are each carrying out the same functions simultaneously. The output from each subsystem is then processed by a voter circuit which outputs the majority of the three inputs. As long as two of the subsystems are functioning properly, the output will be valid (Moore and Pisacane, 1994). TMR results in more than tripling the amount of logic required to implement the design large overhead. TMR approach is mostly used in FPGA based systems. FPGAs provide higher gate counts and device logic densities than other large-scale integration circuits. While high gate count reduces the IC count

36 3.6 OBC Processors 25 for satellite electrical designs, with the TMR scheme essentially over two thirds of the available FPGAs gates are lost. There is a scheme by Xilinx for SEU mitigation selection in Figure 3.6. As long as the high energy flux is not sufficient to cause SEUs to two of the three modules simultaneously (multiple bit errors), the mitigation of SEUs are effectively done by TMR EDAC circuitry and Memory Scrubbing EDAC codes are usually implemented in hardware using extra memory bits and encoding/decoding circuitry. EDAC codes can only correct one bit error and to avoid the accumulation of errors, the contents of memory are read periodically and all the correctable errors are corrected. This operation is called periodic scrubbing and thereby reducing the probability of multiple errors that might not be correctable. 3.6 OBC Processors There are many options for the selection of a processor for OBC. Selecting the appropriate processor is important for the design, because it directly and indirectly affects the whole OBC and satellite design. Commonly used processors are: Microprocessors, Microcontrollers, SoCs, FPGAs. Microprocessors are much simpler processing units than processors, mainly Figure 3.6: Mitigation Scheme Matrix, Adopted from (Xilinx, 2008)