Avionics reverse-engineering: spacecraft equipment

[D Straney]

Also, here's a few bare dies inside the large DC-DC module from the power supply board.


Mystery symmetrical STMicro part (rotate the right-hand side 180 degrees in your head to see it):


Texas Instruments LT10009 2.5V shunt voltage reference:

Mystery mostly-symmetrical STMicro part that may or may not be a dual op-amp:

Another Texas Instruments LT10009 2.5V shunt voltage reference: probably one for input side, one for output side.


Gate driver transistors:



One of the two paralleled primary-side power MOSFETs - when you get close enough, you can see the hexagonal cells (it's essentially a few hundred tiny MOSFETs in parallel).  This is where the (IR) HEXFET series name comes from, if I remember correctly:

[quince]

Yep that's right!  Haven't gotten the die under a microscope yet so can't confirm 100% yet that it's LTC, but you sure can see the big-ass pass transistor.

What's the big ceramic chip with serrated edges and an L, a ceramic inductor?

[electr_peter]

That is a laser trimmed resistor.

[D Straney]

Broad Reach I/O Board
I don't know much about this board's function besides that it's made by Broad Reach, and the latest date codes I can see are from 2009 (with some going back to 2002).  Broad Reach, now part of Moog (no, not the synthesizer company), seems to make general-purpose spacecraft & satellite electronics.



This looks like an I/O board, judging by what's on it - the blue connector at one end looks like it goes to a common backplane, while the small D-sub connector at the other end seems like external I/O.
The board isn't conformal coated, but with a lot of tightly-packed components and most of the traces being internal, there's a limit to how much I was willing to figure out with continuity checks alone.  So sticking to a sanity-retaining number of strategically-placed continuity checking and applying a lot of educated guessing, this is my best guess at how things are connected.

Unlabeled ICs are all Linear Technology RH1014 quad op-amps, except the gold package which is an Intersil OP470 quad op-amp.
1. Power Supply: An isolated power supply, based on the classic UCx845 PWM controller series, creates the logic & analog supply voltages.  Input is probably from a 28VDC bus.  The metal box on the bottom side is the primary-side power MOSFET.  The vertical cylinder is the bobbin & core of a flyback inductor.  An ST RHFL4913 LDO on the bottom side probably provides a low FPGA core voltage or something like that.
2. Analog Outputs: 2x identical channels, each with an NPN Darlington & PNP Darlington pair for some class-B analog-output action; all in metal cans.  NPNs are 2N5667, PNPs are 2N5416.  Diodes on the bottom offset the NPN & PNP bases (with a substantial voltage gap for no idle current), and the 5th metal-can transistor per channel creates a current source for biasing.  Because of the inherent inaccuracy of a straight class-B emitter-follower, esp. with the large NPN/PNP conduction gap, I assume some of the op-amps wrap feedback loops around these.  There's current limiting and common biasing involving some smaller SMT transistors.
3. Push-Pull Digital Outputs: 3x identical channels, each with an IRHNM57110 N-MOSFET & IRHNM597110 P-MOSFET with their drains connected to each other, and to an output pin.  Outputs are clamped to ground & supply by diodes on the bottom and top.  Gate drive & level-shifting seems to be done by small transistors on top side.  The last un-paired P-MOSFET at one end gates the positive supply voltage to all the channels' P-FETs, as a global power enable.
4. Open-Drain Digital Outputs: 2x identical channels, each with an IRHNM57110 N-MOSFET on the bottom side (with its drain connected to an I/O pin) and gate drive circuitry on the top side.
5. Current Sense: 6x separate current sense channels, with Kelvin-connected current sense resistors & op-amps to differential-amplify the current sense voltages; these seem to measure the current draw on various supply voltages, probably ones that get used for driving outputs to monitor total output current.  These connect to analog mux inputs (discussed next) and so these current draw readings are probably read by the ADCs along with all the other analog input values.
6 & 7. Mystery: I have no idea what these do.  #6 has 2 NPN power transistors on the bottom, with 7 smaller transistors on the top.  #7 has a single NPN power transistor & 2 optoisolators, the Mii 66183.  The top-side 2N5339 only has connections to the input-power bus and has a zener to its base, so may be for something like fast discharge on power-down, or crowbarring the power supply's input voltage.

The FPGA, an Actel part, likely provides an interface between a processor bus from a controller card elsewhere, and all the peripherals here.

Besides the digital outputs and various controls, the main peripherals here are 3 DACs (the 12-bit Analog Devices AD667S) and 3 ADCs (the 16-bit Maxwell, now DDC, 7809LP).

DACs: 2 of these likely create the setpoints for the analog output drivers (#2 in the list above).  The 3rd may drive a general-purpose low-power analog output.
ADCs: 3x Analog Devices MUX-16 16:1 muxes seem to feed up to 48 analog channels to the ADCs, such as this one on the bottom side with a thermistor attached to it:

Some of the muxed ADC channels are definitely used for power-supply current sensing (#5 in the list above), and the rest are probably for general-purpose analog inputs from the outside world.
Reference voltage: The "pattern-breaking" metal can near the analog outputs is a Linear Technology LT1021 5V voltage reference; I'm guessing this creates a common reference voltage for the ADCs & DACs.

The ADCs themselves are the ones in the interesting extra-thick packages:

From reading the 7809LP datasheet, it looks like the radiation-induced latchup protection is implemented by using a commercial ADC die, with a rad-hard power control circuit wrapped around it to detect fault conditions and cycle its power.  I considered opening one of the packages to see this hybrid construction inside, but decided to read up on the Rad-Pak packaging first, covered by US Patent # 6455864, and realized it would probably be full of goop and therefore not worth it.  The core of the Rad-Pak shielding method, if I'm reading the patent correctly, is a conformal coating consisting of tungsten particles held together by an adhesive binder.  The high density of tungsten helps block ionizing radiation, similar to lead shielding used with nuclear reactors, medical X-rays, etc.

Here's some better close-up views of...

The power supply:


...including the stack of ceramic caps, given a lead frame to trade vertical space for horizontal space, and to avoid some cracking issues created by mismatched thermal expansion between the ceramic & the PCB material.  The ADCs have some pretty large SMT ceramic caps too, but not quite as large (horizontally) as these.

The external-I/O connector:


...with a metal-can LM117 adjustable regulator next to it (I haven't figured out where the LM117's output voltage goes to: not to the I/O connector)

Current-sense circuitry, where you can see the Kelvin-sense terminals on the series resistors:



The LDO:


Misc. things on the bottom side:





You can see the impressive amount and quality of reworks applied, in some of these photos, which makes me wonder if this was a prototype of some kind.  There was also an impressive amount of polyimide tape applied to every single wire and "floating" component, to hold them all securely in place - I removed most of the tape though to see the board (& reworks) better.

Anyways, hope this was interesting - wish I could provide a schematic for this one.

[T3sl4co1l]

Mystery symmetrical STMicro part (rotate the right-hand side 180 degrees in your head to see it):

Wonder if LM319. Anyone got a comparison pic?

Tim

[D Straney]

Oh shit.  Good call!

[D Straney]

Meant to mention, in the context of the ADCs:
Ionizing radiation, which there's a lot of in space in the form of cosmic rays etc., causes havoc with electronics and ICs in particular by ionizing things that shouldn't be ionized, creating carriers in what's supposed to be an insulator, and therefore creating leakage currents where they're not supposed to be.  This means that sometimes you'll get unexpected spikes of current - but also has a secondary effect called "latchup", which essentially crowbars the IC's power supply when this leakage happens to turn on a parasitic transistor that's inherent to how the transistors are constructed on a shared conductive silicon substrate.  The high current draw resulting from a supply-to-ground short then generates a ton of heat and destroys the IC, if you're not careful.  Radiation damage also accumulates over time, permanently adding leakage, but that's a separate issue.

The ways to deal with all radiation-induced effects are:
Suck it up: With a cheap cubesat that's only expected to work for a couple days, this is a common option.  Use normal commercial parts, it's fine, hope you don't get unlucky.
Shielding: Add dense materials, such as steel, lead, or tungsten to block/attenuate the ionizing radiation.  Nobody enjoys doing this on space equipment though, considering how expensive per pound it is to put something in space.

The normal way to deal with the transient current-spike events (especially in digital circuits, memory in particular) known as "single-event upsets" is:
Circuit design: Add redundancy (to logic circuits) & error-check bits (to memory; really just another form of redundancy).  The cross section of a cosmic ray is pretty small and so it's not going to affect half your IC at once - the unaffected majority of the circuitry can correct for the affected minority.

The normal way to deal with latchup in particular is:
IC process: Get rid of the shared silicon substrate that enables latchup in the first place, and replace it with an insulator, in a Silicon-on-Insulator (SOI) process.  Sapphire is a popular option; this is expensive.

I thought it was interesting though that the rad-hard ADC here explicitly takes a "tolerate and reset" approach to latchup, quickly shutting off the power before the high supply current can do any damage, and resetting the chip.  It makes a lot of sense for an ADC - this approach wouldn't work for something like a processor, where there's a whole lot of "state" associated with it (the contents of all the registers, progress of the instruction currently being executed, etc.) that can't be recovered if it's randomly reset.  With an ADC though, you're likely taking continuous readings anyways, and so the worst that can happen is that you miss one measurement due to a latchup-induced reset, and have to wait until the next reading cycle to get that measurement.  If you can plan your circuit & system design around that, then that's an easy constraint to deal with!  This means it's easier if all the ADC settings are done with voltages on external pins, rather than having a serial interface (SPI or I2C) to set up internal settings registers, but that's a small price to pay for not having to use an expensive special-purpose SOI part.

[T3sl4co1l]

FYI, SoS used to be used, but oxygen ion implantation is the common method today AFAIK.

Might well still be using it for space applications, heh, I have no idea.

Tim

[coppice]

There is a whole section of the military electronics business concerned with ensuring that the in flight energy in all the inductors and capacitors in a system is incapable of damaging any silicon that goes into heavy conduction due to EMP. If it isn't actually damaged, it might do unfortunate things in the moment, but Microsoft knows how to recover the situation - turn it off and turn it on again.

[D Straney]

Interesting, bet that drives a lot of power supply design decisions!  I'd always thought of the (now-long-passed) move from voltage-mode to current-mode control of power converters as a less directly visible thing from the system level, but can see how that would be a huge help for that criteria: go with minimal energy storage directly on the power rails, have fast-responding peak-current-controlled buck(s), and lump all the bulk capacitance on the buck's input where it's safely behind that cycle-by-cycle current limit.

FYI, SoS used to be used, but oxygen ion implantation is the common method today AFAIK.

Huh cool, my knowledge is not particularly up-to-date - for anyone else who doesn't know oxygen ion implantation (SIMOX) already, looks like they implant oxygen ions in the surface of a wafer to create an insulating SiO2 layer (sand, essentially) and then grow an epitaxial silicon layer on top of that to use for the transistors.

[T3sl4co1l]

These modules are also wrapped in several layers of shielding (the craft, perhaps; outer module, PCB, inner module), so we can quite safely assume any surge is conducted in on device pins alone.

Current mode also minimizes component size by decoupling the LC resonance; DCM is perfectly reasonable, and the control pole can be above 1/sqrt(LC). Quite handy here, as well as the inherent current limiting, which can be rolled into a limit detect and fault signal, or automatic (hiccup mode, etc.), further avoiding damage.

SIMOX is even cleverer than that: the trick with implantation is, ions are deposited at a range of depths, depending on ion mass and energy.  Si can be cleaved into very thin wafers by implanting H+ (annealing --> coalesces into a boundary layer of Si-H bonds and free gas --> tape and peel), or basically the same thing but bonded by SiO2 still (this way).  The top layer is crystal-aligned with the substrate and subsequent epitaxy, diffusion, etc. will remain coherent with it.  Thus very small transistors (in terms of depth as well as width and height) can be made, without any yield loss due to random crystal orientation.

Tim

[AnalogTodd]

Meant to mention, in the context of the ADCs:
Ionizing radiation, which there's a lot of in space in the form of cosmic rays etc., causes havoc with electronics and ICs in particular by ionizing things that shouldn't be ionized, creating carriers in what's supposed to be an insulator, and therefore creating leakage currents where they're not supposed to be.  This means that sometimes you'll get unexpected spikes of current - but also has a secondary effect called "latchup", which essentially crowbars the IC's power supply when this leakage happens to turn on a parasitic transistor that's inherent to how the transistors are constructed on a shared conductive silicon substrate.  The high current draw resulting from a supply-to-ground short then generates a ton of heat and destroys the IC, if you're not careful.  Radiation damage also accumulates over time, permanently adding leakage, but that's a separate issue.

The ways to deal with all radiation-induced effects are:
Suck it up: With a cheap cubesat that's only expected to work for a couple days, this is a common option.  Use normal commercial parts, it's fine, hope you don't get unlucky.
Shielding: Add dense materials, such as steel, lead, or tungsten to block/attenuate the ionizing radiation.  Nobody enjoys doing this on space equipment though, considering how expensive per pound it is to put something in space.

The normal way to deal with the transient current-spike events (especially in digital circuits, memory in particular) known as "single-event upsets" is:
Circuit design: Add redundancy (to logic circuits) & error-check bits (to memory; really just another form of redundancy).  The cross section of a cosmic ray is pretty small and so it's not going to affect half your IC at once - the unaffected majority of the circuitry can correct for the affected minority.

The normal way to deal with latchup in particular is:
IC process: Get rid of the shared silicon substrate that enables latchup in the first place, and replace it with an insulator, in a Silicon-on-Insulator (SOI) process.  Sapphire is a popular option; this is expensive.

I thought it was interesting though that the rad-hard ADC here explicitly takes a "tolerate and reset" approach to latchup, quickly shutting off the power before the high supply current can do any damage, and resetting the chip.  It makes a lot of sense for an ADC - this approach wouldn't work for something like a processor, where there's a whole lot of "state" associated with it (the contents of all the registers, progress of the instruction currently being executed, etc.) that can't be recovered if it's randomly reset.  With an ADC though, you're likely taking continuous readings anyways, and so the worst that can happen is that you miss one measurement due to a latchup-induced reset, and have to wait until the next reading cycle to get that measurement.  If you can plan your circuit & system design around that, then that's an easy constraint to deal with!  This means it's easier if all the ADC settings are done with voltages on external pins, rather than having a serial interface (SPI or I2C) to set up internal settings registers, but that's a small price to pay for not having to use an expensive special-purpose SOI part.

Fortunately when designing chips for spacecraft a lot of these effects are known. Ionizing radiation tends to shift MOSFET thresholds lower (charge buildup in the oxide) meaning NMOS devices are easier to turn on and PMOS devices take more voltage to turn on. It also can do crystal damage over time, causing leakage currents that can change biasing or other operating conditions in an IC.

There's a whole slew of effects that occur from a number of different things happening. Ionizing radiation is actually one of the easier things to deal with, whereas Single Event Effects (SEE) items are one of the tougher things to design for. Redundancy is great since, as you pointed out, you're not likely to get multiple heavy ion/cosmic rays hitting your chip at once. It's easy to do in digital, not so much in analog. Process of course can help with a number of things as well, such as avoiding gate rupture on large MOS devices.

There's a lot of things to think about when designing for these environments, and very few IC designers that understand them enough to develop devices for them.

[D Straney]

SIMOX is even cleverer than that: the trick with implantation is, ions are deposited at a range of depths, depending on ion mass and energy.  Si can be cleaved into very thin wafers by implanting H+ (annealing --> coalesces into a boundary layer of Si-H bonds and free gas --> tape and peel), or basically the same thing but bonded by SiO2 still (this way).  The top layer is crystal-aligned with the substrate and subsequent epitaxy, diffusion, etc. will remain coherent with it.  Thus very small transistors (in terms of depth as well as width and height) can be made, without any yield loss due to random crystal orientation.

Now that's a good trick!
And yes with the voltage-mode control, I distinctly remember doing my first voltage-mode buck compensation (as an exercise, learning how to use a TI DSP-MCU dev kit), seeing the giant Lbuck & Cout resonant peak, and getting a sinking feeling as I realized I was going to have to give my loop a super-slow crossover just to squash that - one of those "how did people get anything done before this?" moments.