A Fault-Tolerant MPSoC For CubeSats

We present the implementation of a fault-tolerant MP-SoC for very small satellites (<100kg) based upon commercial components and library IP. This MPSoC is the result of a codesign process and is designed as an ideal platform for software-implemented fault-tolerance measures. It enforces strong isolation between processors, and combines fault-tolerance measures across the embedded stack within an FPGA. This allows us to assure robustness for a satellite on-board computer consisting of modern semiconductors manufactured in fine technology nodes, for which traditional fault-tolerance concepts are ineffective. We successfully implemented this design on several Xilinx UltraScale and UltraScale+ FPGAs with modest utilization. We show that a 4-core implementation is possible with just 1.93 $W$ of total power consumption, which for the first time enables true fault-tolerance for very small spacecraft such as CubeSats. For critical space missions aboard heavier satellites, we implemented an MPSoC-variant for the space-grade XQRKU060 part together with the Xilinx Radiation Testing Consortium. The MPSoC was developed for a 4-year ESA project. It can satisfy the high performance requirements of future scientific and commercial space missions at low cost while offering the strong fault-coverage necessary for platform control for missions with a long duration.