Radiation-hardened spacecraft computers

Why does a probe worth a billion dollars fly a processor slower than a cheap phone's?

A flagship planetary mission costs more than a hospital and flies a processor a mid-range phone would beat comfortably. The usual explanations do not survive contact: it is not the budget, which is enormous; not ignorance of newer parts; and not simply that the design was frozen long ago, though that is a real contributor we will come back to.

The interesting possibility is that the slow part is not a compromise at all — that where the probe has to work, the fast part would be worse, in a way unrelated to how many instructions it can retire. What could make speed itself a liability?

Ask what a transistor is doing when it holds a bit. It holds a small quantity of charge on a node, and the circuit reads that charge as a one or a zero. So there is a threshold: the charge that must be added or removed to flip the reading. Engineers call it the critical charge, and to a first approximation it is capacitance times voltage, Q_crit ≈ C·V.

That number has been falling for fifty years, and not by accident — it is what everyone was optimising. Smaller geometry means less node capacitance; lower supply voltage means less charge per volt. A 1980s part might hold a node at 5 volts on tens of femtofarads, so hundreds of femtocoulombs. A modern node runs under a volt on capacitance of order a femtofarad, so Q_crit is of order one femtocoulomb. Every generation made the switch lighter, which is what made it faster and cheaper.

Now the environment. Outside the magnetosphere a spacecraft sits in galactic cosmic rays — of order a few charged particles per square centimetre per second, mostly protons but with a tail of heavy nuclei up to iron. What does one of those do to silicon?

Work it out. A heavy ion's stopping power is quoted as linear energy transfer; take 30 MeV·cm²/mg, within the range an iron nucleus reaches. Silicon's density is 2.33 g/cm³, that is 2330 mg/cm³, so the energy lost per centimetre is 30 x 2330 ≈ 7.0 x 10^4 MeV/cm — about 7 MeV per micron of track. It takes roughly 3.6 eV to make one electron-hole pair in silicon (a recalled material constant), so about 1.9 x 10^6 pairs per micron. Multiply by the electron charge: about 300 femtocoulombs per micron of track.

Set that beside the threshold. Three hundred femtocoulombs against a critical charge of one: the particle does not nudge the bit, it overwhelms it by more than two orders of magnitude. And notice which way both trends ran: Q_crit fell a hundredfold while the number of nodes on a die rose by far more than a millionfold. Two multipliers, both pointing the wrong way.

So the fast part is not merely as vulnerable as the slow one. It is vulnerable because it is fast — the same light trigger buys both properties.

The refuting observation: parts are tested in a heavy-ion beam at a cyclotron, plotting upset cross-section against linear energy transfer. A hardened part should show a threshold an order of magnitude higher than a commercial one, and in flight the upset rate should rise sharply in the South Atlantic Anomaly and during solar particle events. If a modern commercial processor showed the same threshold as a hardened one, or if flight upsets were uncorrelated with the radiation environment, the justification for flying the slow part would collapse.

Three things join the steps above.

First, "radiation damage" is at least three distinct problems, and only one is a bit flip. A single-event upset is transient: the state is wrong, the hardware fine, rewriting fixes it. Single-event latchup is destructive — the strike turns on a parasitic thyristor structure and the device cooks itself unless power is cut within milliseconds. Total ionising dose is cumulative, a slow poisoning of the oxides giving every part a lifetime budget. They want different remedies: layout and voltage for upsets, guard rings for latchup, process chemistry for dose.

Second, hardening is not only silicon. Above the chip sits triple redundancy with voting, error-correcting codes on memory, background scrubbing, and watchdog timers that reset a wedged processor. That reframes the goal: the aim was never a computer that is never struck, which at these fluxes is unachievable, but one whose every plausible failure is detectable and survivable without a human in the loop.

Third — and here the story about frozen designs becomes true rather than merely plausible — qualification takes the years. Beam campaigns, dose testing and flight heritage cannot be rushed, the market is a few hundred units a year rather than a few hundred million, and the design must be finalised long before launch and work for decades after. Add the power budget, since every watt burned must be radiated away rather than fanned off, and the pressure toward a modest part compounds.

The honest caveat: this is shifting. Small satellites and some newer missions fly fast commercial processors in redundant, watchdog-protected clusters, accepting frequent resets as the price. That is no refutation of the physics — the upsets happen exactly as predicted — but a different answer, available when a reset costs a second rather than a mission.

• How the same trade appears in ground computing as memory error-correction, and why data-centre operators started caring about it.
• What changed to make redundant commercial processors a defensible choice for some missions but not others.

Every term the collection defines is gathered in the glossary.