Back to top
The short answer: A radiation-tolerant adaptive SoC such as AMD’s space-grade Versal gives a satellite payload AI Engines and 26.5 Gbps transceivers, but your team designs the configuration scrubbing, functional-interrupt recovery and TMR. A flash-based rad-hard FPGA such as Microchip RTG4 or RT PolarFire has no configuration upsets and a lower compute ceiling. Scope the mitigation work before choosing.
Choosing a radiation-tolerant adaptive SoC over a flash-based rad-hard FPGA means your own team designs the recovery from radiation upsets into the payload, and that work should be scoped before the part goes on the parts list. AMD’s radiation team measured functional interrupts on a 7 nm Versal platform that translate to one to two events per year for the complete AI subsystem in a 500 km orbit. Its engineers describe them as “events that must be handled through system-level recovery strategies.” A flash part removes that class of work by construction and caps the compute you get in return.
Capella Space, which flies FPGAs and SoCs as both flight computer and payload processor, notes that a particle striking an SRAM part’s configuration memory can end up “turning, for example, an AND gate into an OR gate.” On that kind of part, repairing the circuit is the payload team’s job. Flash-based parts store their configuration in a technology that does not upset that way.
AMD publishes the radiation figures for its space-grade Versal XQR parts on its own space page, with single-event latch-up immunity listed at 80 MeV·cm²/mg. The upset rates aren’t zero. For geostationary orbit, AMD’s space-page table puts Versal’s configuration-RAM upset rate more than a thousand times below AMD’s earlier RT Kintex UltraScale. Its configuration-RAM functional interrupt rate is about 35 times lower, at fewer than one a century per device.
Size the recovery design for the higher of AMD’s two figures. AMD’s FPGA Horizons article gives a rate of 0.01 to 0.02 functional interrupts a day across the full AI Engine array, roughly four to seven a year. Its other figure, one to two a year, covers the complete AI subsystem in a 500 km orbit, and the article does not reconcile the two. The space-page figure is a different count, covering only interrupts that originate in configuration RAM, for one device in geostationary orbit. A hung processor takes the payload offline as surely as a configuration fault does.
On the tested Versal platform, AMD’s configuration scrubber ran at 320 MHz and completed a full configuration memory scan in about 13.6 ms. Under proton irradiation it corrected more than 2,000 upsets without disrupting operation. Scan time sets how long a flipped bit can sit in the logic before it is repaired. AMD’s FPGA Horizons article advises running scrubbing “at the highest feasible frequency to minimize exposure time for uncorrected upsets.” The scrub rate is a design parameter with a timing budget, set in the architecture before bring-up.
Scrubbing repairs configuration bits and leaves functional interrupts to the system: a processor hangs, configuration access is lost or a subsystem stops responding. In ground-level beam testing of the commercial Versal AI Edge Gen 2 processing system, AMD’s radiation team found processor traps were the largest single contributor at 27% of observed functional interrupts. It recommends trap handlers and watchdog timers in any high-reliability design. With a reset hierarchy, a safe state and a limit on recovery time, those make up the recovery architecture. It has to absorb the system interrupt rate.
STAR-Dundee characterized Versal transceivers under heavy ions in collaboration with AMD, and its paper notes that because the configuration RAM and fabric “are not inherently radiation-hardened”, triple modular redundancy may be necessary depending on the application’s error tolerance. In that campaign, AMD’s XilSEM scrubber took about 15 ms to recover from each configuration upset it caught, and data could still be lost inside that window. TMR triples the logic it protects and costs power and timing margin.
AI workloads add a failure that never shows up as a crash: during proton-beam testing of the AMD platform, classification confidence fell from near 95% to about 70% in some cases while the classification itself stayed correct. A payload that discards low-confidence results loses that data silently. Fault-aware training, which injects simulated faults while the network is trained, cut datapath errors by roughly a factor of four on identical hardware. This fix belongs to the model team. It only happens if output integrity is in the acceptance criteria.
STAR-Dundee also found the Versal transceiver blocks sensitive to radiation, and showed that running SpaceFibre over them produced a three order-of-magnitude reduction in the observed error rate without user intervention. The same campaign demonstrated the first 100 Gbps SpaceFibre link under radiation, so the interconnect protocol is a mitigation that also adds capability.
Microchip lists a “complete absence of configuration upsets” for RT PolarFire, a nonvolatile FPGA with 481,000 logic elements. RTG4 carries configuration memory upset immunity above an LET of 103 MeV·cm²/mg, registers with built-in TMR, QML Class V qualification and flight heritage on Mission Extension Vehicles 1 and 2, CAS-500 and Artemis II. On those parts there is no scrubber to integrate and no configuration recovery path to design or test.
STAR-Dundee’s paper with AMD lists up to 44 transceivers at 26.5 Gbps on the space-grade Versal, which also carries an AI engine array. RT PolarFire tops out at 12.7 Gbps per lane and has no AI engine array. A synthetic aperture radar or Earth observation payload that has to run inference or wideband processing on board may find no flash part that closes its throughput. For that program, the sensor has already chosen the device family.
The flash choice leaves the rest of the board untouched. A Microchip blog on a PolarFire SoC onboard computer, written from experience across several LEO programs, names the usual sources of unrecoverable radiation events as volatile memory, non-volatile memory, power management ICs and high-speed interface PHYs. It calls the power subsystem the highest-risk element. None of those is the FPGA. On the SAR-XL satellite’s on-board processor, built on Microchip PolarFire SoC, Fidus’s scope included the DDR memory routing and the signal and power integrity as well as the FPGA firmware.
AMD positions the space-grade XQRVE2302 for “command and control functions, AI inferencing, and edge compute,” and Microchip offers RT PolarFire SoC engineering samples for payload and avionics development, so function does not settle the choice. Blended architectures are now common. Microchip’s Bill Dillard told Military & Aerospace Electronics that “blended strategies … are becoming mainstream” and that “the question isn’t performance level so much as functionality against a mission profile.” For each function, ask which mitigation burden the program would rather carry.
The scope each device family puts into the payload design:
| Scope item | Radiation-tolerant adaptive SoC (SRAM) | Rad-hard FPGA (flash-based) |
|---|---|---|
| Configuration upsets | Present at characterized rates; scrubber integration and timing budget | Absent by construction |
| Functional interrupt recovery | Watchdogs, trap handlers, reset hierarchy, golden image, safe state | Still needed for processors and memories; no configuration recovery path |
| Fabric redundancy | TMR budget on the logic that justified the device | Smaller TMR budget; RTG4 registers carry built-in TMR |
| Board-level radiation FMEA | Memories, power, PHYs | Memories, power, PHYs |
| Compute and interface ceiling | AI engines; up to 26.5 Gbps transceivers on XQRVC1902 | No AI engine array; up to 12.7 Gbps on RT PolarFire |
| AI output integrity | Confidence monitoring and fault-aware training | Not applicable where no inference runs |
A program with a first flight before 2029 picks from a short list on each side, and the qualification class the program office names narrows it again. Status below is from the vendors’ most recent announcements, March 2025 to March 2026:
| Part | Status | Date |
|---|---|---|
| AMD Versal AI Core XQRVC1902 | Class B qualified, per AMD’s space page | Qualified now |
| AMD Versal AI Edge XQRVE2302 | Class B qualified, production data sheet published | Orders opened March 2025; AMD’s announcement then said first shipments were expected in fall 2025 |
| AMD Versal AI Core XQRVC1902, new lidless package | Seeking Class Y, for missions of up to 15 years | AMD expects sampling in 2026, flight-qualified units in 2027 |
| AMD Versal AI Edge Gen 2 and Versal RF, space-grade | Seeking Class B and Class Y | Expected 2029 |
| Microchip RT PolarFire RTPF500ZT | QML Class Q qualified | Qualified now |
| Microchip RT PolarFire SoC | Engineering samples for payload and avionics development | Samples now; no qualification date published |
| Microchip RTG4 | QML Class V; lower-cost Mil-Plastic version has its first flight heritage | Qualified now |
The XQRVE2302 puts the same processor system as the larger XQRVC1902 into a 23 × 23 mm package, in less than 30% of the XQRVC1902’s board area. For AI throughput, AMD quotes up to 184 TOPS for the commercial Versal AI Edge Gen 2 family and notes that space performance may be lower. The space-grade Gen 2 parts are expected in 2029.
Start with what the mission can tolerate: how long the payload may be unavailable after a functional interrupt, how often that is acceptable, and what counts as degraded output for the application. AMD’s guidance is to define acceptance criteria early, before testing begins. For an inference payload, that means a confidence threshold and a policy for results that fall below it, because a correct answer under the threshold is still a discarded frame.
Then design recovery against that tolerance, using the system interrupt rate as the input rather than the configuration-RAM figure. Give reset authority to a supervisor that does not depend on the device that has just failed. Decide where the golden configuration image lives, how it is protected and how long a full reconfiguration takes, and check that time against the outage the mission allows. On a flash part the scrubber and the configuration image drop out, and processor and memory recovery remain. AMD’s Versal XQR parts can also be reprogrammed in flight without limit. The recovery plan should cover that update path too. Test the recovery path on the ground, since it is the only part of the payload that has to work after something else has already gone wrong.
Next, decide which logic is critical enough for TMR, estimate its size, and check that the device still closes timing and power with it applied. If it doesn’t, the options are moving up a device size or pushing a function into hardened logic elsewhere, and both are cheap to discover at architecture and expensive at bring-up.
Run the radiation failure modes and effects analysis across the whole board, regardless of the fabric, and place radiation-tolerant memories, regulators and PHYs where an upset would be unrecoverable. A flash FPGA leaves this work in place, and it spans FPGA design, hardware, power integrity and firmware.
Finish with the calendar by mapping each candidate part’s qualification status against the program’s flight date and the qualification level the customer requires. A device that wins every other row and cannot fly on schedule is the wrong device for the program.
The device choice decides how much of the radiation work lands in your own design, and the board around it carries the rest either way. Fidus works on both sides of the trade, AMD adaptive SoCs and Microchip PolarFire, across FPGA, embedded software, hardware, signal and power integrity, and thermal design. Its First Time Right approach relies on simulation and verification to catch design issues before deployment.
Contact Fidus while the mitigation scope is still a line in the trade study.
An SRAM adaptive SoC such as AMD Versal XQR stores its configuration in memory that radiation can upset, so the payload design needs scrubbing, interrupt recovery and possibly TMR. A flash-based rad-hard FPGA such as Microchip RTG4 or RT PolarFire has no configuration upsets by construction. The adaptive SoC gives more compute and faster transceivers in return.
AMD’s radiation team estimates one to two functional interrupts a year for the complete AI subsystem in a 500 km orbit. For the full AI Engine array it gives 0.01 to 0.02 a day, roughly four to seven a year.
Yes, but less of it. A flash-based rad-hard FPGA removes configuration scrubbing and recovery, but processors, volatile and non-volatile memories, power management ICs and high-speed PHYs can still have unrecoverable events. Microchip calls the power subsystem the highest-risk element on a LEO onboard computer.
It depends on the application’s error tolerance. STAR-Dundee notes that Versal’s configuration RAM and fabric are not inherently radiation-hardened, so critical logic may need TMR. TMR triples the logic it protects and costs power and timing margin, so size it at the architecture stage.
AMD Versal AI Core XQRVC1902 and AI Edge XQRVE2302 are Class B qualified, Microchip RT PolarFire RTPF500ZT is QML Class Q, and RTG4 is QML Class V. Class Y Versal units are expected in 2027, and space-grade Versal AI Edge Gen 2 and Versal RF in 2029.
Technical hires take 5.4 months to recruit and 4.8 more to ramp, so a January requisition reaches full load around November. Sourced embedded engineering hiring statistics for 2027 capacity planning.
Verified numbers on satellite payload processing, from EO launch growth to space-grade silicon and thermal limits, each traced to the institution that published it. Plus six widely quoted figures that failed the check.
Engineering is the hardest role in aerospace and defense to fill. Three questions show whether your FPGA or RF gap needs a new hire or FPGA engineering services.
Trust us to deliver on time. That’s why 95% of our customers come back.
