Protocol-aware approach for mitigating radiation-induced errors in free-space optical downlinks

1218 Vol. 16, No. 12 / December 2024 / Journal of Optical Communications and Networking Research Article Protocol-aware approach for mitigating radiation-induced errors in free-space optical downlinks Jorge Pacheco-Labrador,1Carmen Misa Moreira,1,2Julio Ramírez Molina,1 AND Hipolito Guzman-Miranda3,* 1Institute of Communications and Navigation, Optical Satellite Links Department, German Aerospace Center (DLR), Oberpfaffenhofen, Germany 2Electronic Technology Department, University of Vigo, Vigo, Spain 3Department of Electronic Engineering, Universidad de Sevilla, Sevilla, Spain *[email protected] Received 20 June 2024; revised 8 September 2024; accepted 13 October 2024; published 15 November 2024 Multigigabit per second satellite-to-ground communications are evolving owing to free-space optical (FSO) communications. They benefit greatly from the use of commercial off-the-shelf field-programmable gate arrays, which offer higher performance than their space-grade counterparts. However, these capabilities are severely diminished in the case of improper implementation of radiation mitigation schemes not being properly assessed. Although these schemes have been improved over the years, they can be further optimized. Therefore, this study proposes, to our knowledge, a new protocol-aware approach, tailored for FSO satellite downlinks, to classify the criticality of radiation-induced errors. This approach can achieve a reduction in overhead by nearly an order of magnitude compared to current protection schemes. Published by Optica Publishing Group under the terms of the Creative Commons Attribution 4.0 License. Further distribution of this work must maintain attribution to the author(s) and the published article’s title, journal citation, and DOI. https://doi.org/10.1364/JOCN.533374 1. INTRODUCTION The current state of maturity in the field of free-space optical (FSO) communications has facilitated the development and integration of FSO terminals into satellites [1–4] because of their advantageous characteristics. Such characteristics include lower mass, lower power requirement per transmitted bit, and the use of a license-free spectrum. These terminals are integrated into satellites—CubeSats [4–6], as well as other satellite types [1,7,8]—providing data rates ranging from hundreds of megabits per second to hundreds of gigabits per second. In addition, the increasing use of FSO terminals is driven by the New Space industry [9]. However, FSO communications necessitate a direct line of sight, which imposes additional challenges associated with this technology. Such challenges can be present in the form of transmission outages caused by atmospheric turbulence, errors in pointing and tracking systems [10], and/or the FSO path being directly blocked by temporary sources such as clouds. The Consultative Committee for Space Data Systems (CCSDS) is working on the definition of a new standard for FSO [11] to standardize the coding and synchronization and physical layers. Other studies have explored more specific techniques, such as the use of hybrid radio frequency (RF)/FSO links in combination with raptor codes [12], to improve transmission reliability. In [2,13], the use of constellations of satellites or ground stations was explored to ensure link availability against cloud coverage. Figure 1presents the main sources of errors in the FSO downlinks. Although sources [Figs. 1(a)–1(c)] inevitably affect all high-altitude FSO systems, space satellites are vulnerable to radiation effects [Fig. 1(d)]. Radiation affects all devices in orbit, particularly digital devices in FSO terminals such as commercial off-the-shelf (COTS) field-programmable gate arrays (FPGAs). COTS FPGAs offer the capability to process data on the order of gigabits per second while performing real-time error detection and correction. Both capabilities are key to high-speed FSO communications. In addition, COTS FPGAs provide faster, and more power-efficient processing capabilities than their space-grade counterpart. However, COTS FPGAs do not have radiation protection by design and are more sensitive to high-energy particles [14] such as those present in the space environment. When one of these particles affects a logic memory unit, it may result in an unintended state change such as a bit flip, also referred to as a single-event upset (SEU). Furthermore, when a single particle affects a group of adjacent logic memory elements by changing multiple state 1943-0620/24/121218-11 Journal © 2024 Optica Publishing Group Research Article Vol. 16, No. 12 / December 2024 / Journal of Optical Communications and Networking 1219 Fig. 1. Different sources of errors for FSO. (a) Pointing inaccuracy, (b) atmospheric turbulence, (c) clouds, and (d) radiation. bits, the event is referred to as a multiple-bit upset (MBU). Therefore, the use of high-level fault-tolerance techniques and redundancy methodologies is required to mitigate the risks of SEUs and MBUs. These SEUs and MBUs affect the normal operation of FPGAs, causing different types of damage: those filtered by the system; those corrupting the transmitted data; and those causing the system to misbehave, thereby resulting in the loss of functionality. These effects and their impacts can vary between different protocols and applications. Consequently, space systems are being designed to consider these effects and implement techniques and methodologies to protect them against radiation and its effects. Triple modular redundancy (TMR) is the most widely used technique for mitigating the effects of radiation on user logic. TMR offers protection by triplicating the processing elements and/or memory elements and then voting on their three values to correct possible SEUs on its protected elements. This technique can be applied at coarse grain (by triplicating the modules), fine grain (by triplicating the logical elements), or a combination of both during the design phase [15,16]. This addition of redundancy produces an area overhead with an increase in power consumption and might cause a reduction in FPGA performance with respect to the maximum achievable frequency [17,18]. This study proposes a novel methodology for optimizing the implementation of fine-grained TMR. This methodology uses a protocol-aware approach to focus on the different effects that SEUs can induce in the system, thereby cataloguing them to achieve optimization via selective triplication of the desired memory elements. This methodology is based on the universal VHDL verification methodology [19] (UVVM) simulations using fault injection to analyze the behavior of the design from a functional perspective; thus, radiation testing falls outside the scope of this study. Fault injection was performed on the memory elements (memory bits and registers) because, as explained previously, they are susceptible to suffering from an SEU and cause an erroneous output. In addition, the errors triggered during this process were automatically classified depending on the impact, duration, and effect in the context of a complete communication chain involving the transceiver and receiver. This methodology focused on a specific FSO communication protocol that follows a feed-forward design. Classification was conducted considering that the data stream was processed linearly and that the data at the output should match the data at the input at system level. These characteristics, combined with the proposed methodology, facilitate a more efficient comparison. In contrast to existing techniques, data matching with the reference model did not occur for the same instant or, at most, during a short interval around it. The data were sequentially compared with all previously processed data that had not yet been flagged as received during the injection campaign. This facilitated the system in detecting gaps in missing data at the receiving end. This expansion of the analysis facilitated us in distinguishing between an error that corrupted the complete transmission and one wherein certain data had been lost although the system kept operating after a defined amount of time without external intervention. Such a distinction is key for communication systems, as losing data for a short period of time is a common issue owing to channel disturbances, whereas complete corruption of the transmission blocks the communication channel. This novel methodology aims at helping design teams understand the behavior of a system in a hazardous environment. The methodology focuses on the effect of SEUs on the complete communication system and sorts errors into different categories depending on their perceived effect at the protocol level. This focus enables a more refined utilization of selective TMR, minimizing its cost while maintaining the reliability of the system. Thus, design teams can focus their efforts only on the memory elements defined as critical for their scenario. An FSO communication protocol that will fly into space as part of the OSIRISv3 terminal [8] was selected as a case study for this work. A. State of the Art Since the late 1950s [20], TMR has been used in space exploration and has evolved and improved. The most noticeable feature of this study is selective TMR, which focuses on protecting a subset of memory elements as per a design to minimize overhead and loss of performance effects. However, to the best of our knowledge, no study has combined the effects of radiation with a system-level view of FSO communication. Therefore, this study proposes a methodology that addresses this research gap. Reference [21] proposed a system for selecting the critical memory elements to be hardened by defining a sensitivity threshold. Although this system facilitates the exploration of selective protection, no error classification was introduced to evaluate the severity of the induced errors. In [22], different layers in different neural networks were protected depending on the effects of the errors injected into them. However, protection was performed at the completelayer level and error classification was divided into tolerable and critical errors. The label “tolerable errors” was assigned to errors that did not produce a deviation in the output of the system. 1220 Vol. 16, No. 12 / December 2024 / Journal of Optical Communications and Networking Research Article Another study, [23], analyzed the SEU sensitivity of the physical layer of a Zigbee transceiver and found that the presence of SEU functioned as a noise floor that impeded the reduction of the frame error rate (FER) when the signal-to- noise ratio was increased, which resulted in a useful design consideration for engineers at the communications system design level; [23] also explored the inherent resilience of the protocol against SEU. This resilience was attributed to modulations of the physical layer, whereas the FSO protocol in this study is reliant on simple on-off keying. Therefore, in this study, inherent resilience to radiation effects is not expected at the physical level. The aforementioned studies proposed ideas to introduce selective TMR, allowing a certain margin of error, as in [21], or for classifying errors as critical at the system level, as in [22]. Reference [23] studied transceiver and physical layers to determine the existence of a noise floor level in communication. However, no study on higher intermediate layers has tackled a wider error-sensitivity classification, particularly tailored to FSO communications. In addition, the lack of such a sensitivity classification deprives designers of comprehensive guidelines for the application of fine-grain selective TMR attuned to the particularities of their systems. The remainder of this paper is organized as follows. Section 2describes the simulation environment and presents the automatic error classification procedure. An overview of the tested protocol and an example scenario are presented in Section 3. In Section 4, the results of the simulation are presented and explained. A more in-depth analysis of the implications of the proposed methodology and its relevance for FSO space-to-ground communications is conducted in Section 5. Finally, Section 6concludes the paper and suggests future research topics. 2. SIMULATION ENVIRONMENT This section presents the implementation of the simulation environment and verification platform based on UVVM. This platform aims to simulate and analyze the behavior of the system within the radiation space environment and the SEUs induced by it. The verification platform is a transaction-level model defined by a command interpreter, command queue, and command executor. UVVM is an open-source methodology and library designed for the efficient VHDL verification of FPGA designs. Figure 2illustrates the verification platform architecture implemented for the presented system. The platform has a modular architecture that encapsulates the components and modules of a system in a hierarchical structure. In our system, each module was encapsulated within a test harness (green bottom-top gradient), which included the necessary interconnections (orange top-bottom gradient) and bus functional models (blue radial gradient). A test harness was defined for each component and interconnected through the main test bench by a test sequencer that incorporated functions and commands to link the components between them. Because the test sequencer had complete access to the entire system, it was responsible for injecting errors into the system for the SEU effect analysis. A. Simulation Procedure To understand the performance of the entire system, fault injection simulations were performed considering the entire data processing chain, as shown in Fig. 3. Therefore, the environment simulated the data generation module, transmitter [this is the device under test (DUT)], and receiver. The DUT is the only component subjected to space radiation; thus, faults were only injected into it. An SEU-free receiver on the ground segment was assumed owing to the low incidence of space radiation on the Earth’s surface. The data generation module produced data frames that functioned as data sources for the system. These frames were stored in a temporary file, which was later processed by the Tcl scripts of the error-classifier module. The DUT encompassed the VHDL components designed to convert data frames into frames that were transmitted via an FSO channel, whereas the data frames were extracted at the ground segment by the Deframer. Data analysis and error classification were performed using the error classifier module, which was part of the test sequencer described in the previous subsection. Finally, the results produced were saved in files for postprocessing. Faults were injected by using the internal capabilities of the QuestaSim simulator, thereby facilitating the temporarily forcing of the values of memory elements inside the simulation, thus emulating the effect of an SEU. To ensure that the fault Fig. 2. Verification platform architecture. Research Article Vol. 16, No. 12 / December 2024 / Journal of Optical Communications and Networking 1221 Fig. 3. Logic diagram of the simulation environment. injection campaign was statistically significant, the guidelines provided in [24] were followed. In this study, a confidence level of 99% and an error margin below 1% were selected as the target values. However, there was a small deviation from the proposed methodology presented in [24], namely, in the randomization approach for selecting elements of the total population (number of memory elements times the length of the injection window). In this study, the randomization occurs only for the exact injection time within the injection window forcing that all memory elements are tested a fixed number of times. Considering the random selection of elements in the population, this small deviation should not hinder the obtained results because a proper random selection should have a uniform distribution among the intended memory elements. Each injection began from a power-on reset state after which a setup period of 16 µs was granted to ensure that data transmission has started. Following this initialization, fault injection occurred within a 10.5 µs window. Such a window aims to ensure that multiple injections of the same signal have different starting conditions and lead to possible different results. The injection is performed by force-inverting the binary value of the targeted memory element during the clock cycle. This injection emulates the effect of an SEU into a memory element where a particle changes the state until a new clock cycle enables this memory element to update its state to a new value. The simulation was then run until a predefined number of frames was received or a timeout was triggered. Since the DUT is a communication data chain, injections at different submodules require less time and frames to produce a possible corrupted output the farther down they are in the data chain. Therefore, the values of the predefined frames and timeouts varied depending on each submodule of the DUT. Upon reception of each frame, the Deframer extracted the data from the frames and presented them at the output of the module. Thereafter, the received data were compared with the transmitted data to determine if the injected fault triggered an error at the end of the transmission chain storing the results. If a timeout was triggered due to the lack of frames, the information was recorded for further analysis in the next step. Finally, during postprocessing, the recorded comparison results and timeouts were analyzed to properly classify the detected errors. B. Error Classification An automatic procedure was implemented to recognize and classify the errors that occurred owing to injected faults. This analysis was performed concurrently during the simulation to facilitate a comparison of the actual and the expected output data. In addition, the analysis was performed using the current output datum, and the system maintained a track of the previously sent data. Such improvements facilitated the error classifier system in detecting and differentiating between spurious data loss of a number of data packets and permanent corruption in the data stream, which delivered faulty data until an action was taken to recover the system. However, this classification and the impact of the errors may differ between protocols; hence each analyzed protocol shall define its error classification. Figure 4shows a flow diagram of the automatic error classification procedure as well as the different categories for a specific FSO protocol described later in Section 3:undamaged,error recovered,missing packets (stream recovered),blocking error, and corrupted system. The label undamaged was assigned to all errors injected that showed no divergence from the expected result at the output. Notably, this label covered both the errors that the system filtered out by design and those that did not cause any harm to the system. The error recovered label was assigned to faults that caused an error from which the system, despite receiving erroneous data, could recover without dropping any packets. In contrast, the missing packets (stream recovered) label was applied when the data stream suffered a short interruption. The difference between these two errors was the amount of data affected; therefore, protection was needed at higher levels. The error recovered label identified a continuous data stream that included at least a corrupted datum, wherein a forward error correction (FEC) scheme could mitigate the problem. Missing packets (stream recovered) is a data stream gap that requires the use of retransmission algorithms or FEC schemes that can completely recover lost packets to receive all data. In these two scenarios, the overhead introduced for the retransmission and FEC schemes was proportional to the error triggered by the SEU. The label corrupted system was applied when the injected faults resulted in an error in the system; herein, from a certain point in time, all packets contained corrupted data. For this error category, the analysis did not indicate whether corruption affected all data, a single datum, multiple data per packet, or even if the distribution was periodic. However, this effect may hinder the performance of the upper-layer FEC systems by creating an artificial error floor. Finally, the label blocking error was assigned to all errors that caused a complete stop in communication. When this error occurred, an external action was required to restart communication. Considering that the analyzed system was part of a communication protocol, the error classification could be further sorted as recoverable and non-recoverable. As evident, nonrecoverable errors combine both the corrupted system and blocking error occurrences. These are critical because each 1222 Vol. 16, No. 12 / December 2024 / Journal of Optical Communications and Networking Research Article can block data reception, either by stopping the system or transmitting information that is received as erroneous data continuously. All other error categories, error recovered and missing packets (stream recovered), can be grouped under the label recoverable. The errors grouped under this label corrupt the data for a short time—a couple of packets in the case of missing packets (stream recovered)—but the transmission continues. Moreover, the effect of recoverable errors on the upper FEC layers is limited in time, and the loss of data is limited in the absence of such upper-layer FECs or retransmission algorithms. 3. TESTED FSO PROTOCOL To test the presented methodology, a submodule of the complete communication protocol for the OSIRISv3 terminal was selected. OSIRISv3 is an FSO communications terminal that follows a COTS approach for a low Earth orbit (LEO) satellite capable of transmitting data at 10 Gbps towards Earth. Such use of COTS components, particularly a system-on-chip (SoC) FPGA, in the OSIRISv3 terminal presents an opportunity to analyze the presented methodology. In addition, the terminal is a technological demonstrator and prototype for the upcoming CCSDS standard for “Optical communications coding and synchronization” [11]. Notably, the analyzed protocol functions at a higher layer of the system and is therefore not part of the current standardization efforts. The protocol is an implementation of the laser Ethernet transceiver (LET) [25] implemented in VHDL on an SoC-FPGA. LET was selected as the testing platform because of its design, accessibility, and internal knowledge of the protocol. It is relevant to briefly present the mission scenario because it provides useful information for understanding the results of the error classification presented later in this paper. The FSO scenario can be simplified as an on-off transmission channel wherein, assuming perfect pointing, the coherent time of the channel typically ranges between 1 and 5 ms [26]. Therefore, any communication protocol designed to operate though FSO should provide protection against channel-induced errors. This protection, which is designed to cope with the loss of data caused by outages, can also be useful for overcoming certain effects of SEUs in the system. Thus, SEU considerations are important to this Fig. 4. Flow diagram of the automatic logic for the error classification procedure. scenario, since the OSIRISv3 terminal will be in LEO orbit, subject to radiation. In the OSIRISv3 terminal, the LET protocol continuously processes scientific data generated at lower data rates for transmission via FSO. These data are buffered into memory prior to being downloaded at high speed; therefore, the stored data are susceptible to SEUs caused by radiation during the complete orbit rather than only during downlink windows. Therefore, the FPGA implementation of the LET protocol is subject to constant SEUs, and not only during the approximately 10 min required to perform a downlink. A. LET Protocol Description LET is a media converter between Ethernet and a proprietary communication protocol developed at the German Aerospace Center (DLR) for FSO terminals, which transmits data at up to 1 Gbps through the atmosphere in ground, air, and space scenarios. Specifically, LET processes standard Ethernet frames at the media access control (MAC) level and encapsulates them in LET frames. The LET frames are numbered to recognize possible losses owing to typical outages of the FSO channel. A cyclic redundancy check (CRC) is added following generation to detect errors in the frame upon reception. In FSO scenarios, it is normally recommended that the protocol maintains an active channel, even when in the absence of user data transmission. Although the LET protocol was originally designed to implement such a functionality, the tested version does not include it because this function has been offloaded into the CCSDS standard. Figure 5shows a high-level block diagram of the LET. LET wrapper contained all the other modules and handles data management to ensure that each generated LET frame was filled with user data such that no empty frames were propagated further down the communication chain. This control was performed using data-flow control flags. Ethernet collector is responsible for collecting the incoming data and writing them to a circular buffer instantiated as Ethernet buffer. Further, the Ethernet collector calculated the location of the first datum of the packet stored in the circular buffer and the length of the packet. These addresses and lengths were stored together in the first in, first out (FIFO) memory, Control FIFO. Memory control of the Ethernet buffer was performed by buffer controller, which calculated the occupancy level of this memory. The Buffer controller was also responsible for signaling when new data could be stored in memory or when data collection was required to wait. Signaling was performed before a new user data frame was collected; thus, no frame was split during Fig. 5. Architecture of the device under test. Research Article Vol. 16, No. 12 / December 2024 / Journal of Optical Communications and Networking 1223 the collection. Finally, the data were packed and framed in framer. This framing was conducted following a ping-pong buffer style, where only control information was handled. This was undertaken to control the data flow and ensure that framer could fit data from single or multiple Ethernet frames into a single LET frame without processing delays. Finally, the CRC generator computed the CRC words appended at the end of each frame. 4. RESULTS Figure 6presents the global results of the fault injection campaign, which integrated data from all the different modules. The figure indicates that more than four out of five injected faults did not trigger errors. Moreover, in the case of nonrecoverable errors, over 98% of the injected faults did not cause permanent errors that blocked communication. Thus, the protocol by itself, without the need for any extra protection, already exhibited significant resilience against SEUs. Both the robustness of the LET protocol and its implementation facilitated this resilience. This design relies on multiple configuration and protocol-specific control flags. These flags exhibit a peculiarity that they are not constantly read, and the majority of them are constantly refreshed. Thus, faults during off times can be recovered without causing any error in the system. Moreover, multiple control flags are interdependent with other control flags; thus, simultaneous activation of both signals is required to trigger an error. Nonetheless, in a communication protocol, the probability of approximately 2% loss of the entire channel is unacceptable in most scenarios. Therefore, SEU-mitigation techniques must be used in this design. Through the addition of selective fine-grain TMR protection, the impact on the design area and power requirements can be significantly diminished compared with standard TMR or even selective TMR, wherein all errors are accounted for. A more in-depth analysis of the results is required to understand which submodules and specific memory elements are more susceptible to SEU to provide the desired efficient protection. Table 1presents a detailed report on each of the studied submodules. The LET wrapper module exhibited significant resilience against injected faults, where approximately 17% caused an error in the system. These errors occurred when an injected fault occurred in a limited subset of control signals that deal with data reception. The corruption of these control signals may cause the system to reject or discard a part of the new data collection. In the majority of errors, only a part of the data was discarded; therefore, the system could recover after a limited amount of time. The remaining injected faults did not trigger any errors in the system because they affected signals that were overwritten following the injection albeit before their changed values could propagate through the system. However, the Ethernet collector submodule exhibited a higher sensitivity to error-causing injections, where 5.87% of them caused a non-recoverable error in the system. Specifically, 80% of these non-recoverable errors caused persistent corruption of the incoming data, whereas a fifth stopped the data collection and stalled the system. This sensitivity can be explained by understanding the tasks performed by the Ethernet collector, which received the user data before sending them for buffering. The module also controlled the position at which the data were stored inside the circular buffer and the data length stored in the FIFO. These control data are sensitive to errors that can propagate through the system, thereby causing corruption. In addition, when an injection occurs in one datum itself, it triggers data corruption that the system flags as error recovered. In 2.8% of the injections, the fault triggered a greater data corruption, where at least one packet was not received at the end of the transmission chain. Normally, these errors are triggered when a control signal alters the size of the data frame corrupting that frame and the immediately consecutive one. However, these errors are self-recoverable because, following the transmission of two data frames, the error is flushed out of the system. Control FIFO exhibited a high resilience against SEUs, where less than 1% of these triggered an error. This behavior was supported by the fact that such FIFO was over-dimensioned. This submodule shall never force the protocol to reject incoming data, even when multiple minimum-size packets were being processed. However, its positions were refreshed at a low rate each time Fig. 6. Breakdown of SEU sensitivity into different categories for the complete design. Table 1. Breakdown of SEU Sensitivity into Different Categories and Area Requirements per Module Module Area Required Undamaged Error Recovered Missing Packets (Stream Recovered) Corrupted System Blocking Error LET wrapper 4.80% 82.28% 0.00% 15.87% 0.00% 1.86% Ethernet collector 8.10% 77.44% 13.89% 2.80% 4.73% 1.14% Control FIFO 13.80% 99.03% 0.03% 0.53% 0.32% 0.09% Framer 14.54% 75.71% 7.85% 14.73% 1.01% 0.69% Buffer collector 2.32% 100% 0.00% 0.00% 0.00% 0.00% Ethernet buffer 34.57% 88.69% 11.21% 0.09% 0.00% 0.00% CRC generator 21.87% 71.59% 0.01% 28.40% 0.00% 0.00% 1224 Vol. 16, No. 12 / December 2024 / Journal of Optical Communications and Networking Research Article a new Ethernet frame was stored or read from the Ethernet buffer. This low ratio of used-to-unused registers explained the achieved resilience against SEUs, which can trigger the error recovered. Other errors were triggered when faults affected the FIFO control signals. However, these memory elements were clearly a minority compared to the memory elements used for storing data in FIFO; thus, the SEUs affecting them exhibited low rates of appearance. The framer module exhibited high sensitivity (14.73%) for faults that triggered a missing packets error. These errors occurred when faults were injected into one of the several control signals that define the remaining duration of the Ethernet frame or determine which ping-pong buffer was being used for the framing. In other cases, when the error affected a datum or the address of the datum, which occurred in 7.85% of the injected cases, the system triggered the error recovered. Finally, detected non-recoverable errors occurred when the injected fault affected specific control signals. The modules Ethernet buffer,buffer controller, and CRC generator exhibited a complete immunity against non-recoverable errors, as all injected faults produced either recoverable errors or no error at all. The buffer controller deserves special mention because its information was constantly refreshed but only used spuriously. This combination of spurious use and constant refresh resulted in an implementation that was virtually free of non-recoverable errors. Because Ethernet buffer is a buffer memory, the injected errors were distributed between the stored data and read and write control signals, causing only recoverable errors. A fault in a control signal can facilitate the storage or retrieval of an erroneous datum, as well as an error in a memory location. Moreover, this buffer may have multiple positions that do not store useful data at the moment of the injection; thus, these faults will not trigger an error. In specific cases, an injected fault can cause the missing packets error. This is indicated by a low probability of occurrence of 0.09% of the injected faults. This is because it depends on other signals to be activated simultaneously by the design itself. Finally, the resilience of the CRC generator was attributed to its role in calculating the CRC of each data frame. Therefore, this module cannot produce non-recoverable errors. However, most of the errors registered resulted in the loss of one packet, marked missing packets, because corruptions in the CRC computation flagged the frame as erroneous on the receiver side and were discarded upon reception. The error recovered occurred when a datum was affected by the radiation-induced upset before it is processed by the CRC algorithm. In this case, the receiver module produced the same CRC when checking the integrity of the frame on the receiver side; thus, it could not correct the upset in the data. However, the number of memory elements that can fulfil these criteria is low, which explains the low incidence of the error recovered category in the CRC generator. Understanding how the SEUs in the DUT affect the communication system as a whole provides key information for analysis of the trade-off between protection overhead and reliability in the design. In this regard, Table 2presents a detailed analysis of the effects of removing different errors from the system. This shows the importance of the proposed methodology in optimizing the resource utilization for the studied design. In the analysis, a fully unprotected design was selected as reference design. The different TMR schemes and methodologies scaled their estimated required area by assigning a typical factor of 3.2 to each TMR-protected memory element. This factor is fractional owing that it also includes additional logic to perform the voting required by the TMR scheme as well as the triplicated memory element. Moreover, both the protection and increase in area were theoretically calculated. Because this study analyzed the effects of SEUs on memory elements, triplicating one of these elements would eliminate the error. Because triplicating a memory element increases the required resources, there are more memory elements susceptible to SEU. Therefore, this increase was considered in the calculation of the error probabilities in the table. Further, because a single memory element can trigger different types of errors depending on the instantaneous operation conditions, protecting such memory elements against a particular category of errors may result in an improvement in other categories. This effect can be observed when removing corrupted system errors: in the mitigated design, the incidence of blocking errors was reduced from 0.51% to 0.31%. Figure 7shows the trade-off offered by this methodology between resource utilization and system sensitivity to SEUs. These sensitivities represent the statistical probability for an SEU to cause an error for each category; thus they shall be Table 2. Area Requirements and Remaining Error Types for Different Fine-Grain TMR Protection Levelsa Protection Estimated Required Area Undamaged Error Recovered Missing Packets (Stream Recovered) Corrupted System Blocking Errors Unprotected 100% 84.20% 5.08% 9.34% 0.87% 0.51% Full TMR 320% 100.00% 0.00% 0.00% 0.00% 0.00% Remove blocking errors 103.14% 85.06% 5.03% 9.25% 0.66% 0.00% Remove corrupted system 105.46% 86.02% 4.72% 8.95% 0.00% 0.31% Remove missing packets (stream recovered) 142.37% 94.64% 4.42% 0.00% 0.48% 0.46% Remove error recovered 121.41% 89.77% 0.00% 9.01% 0.72% 0.50% Remove non-recoverable errors 107.52% 86.46% 4.66% 6.93% 0.00% 0.00% Remove all errors except error recovered 146.49% 95.76% 4.24% 0.00% 0.00% 0.00% Remove all errors (full selective TMR) 165.03% 100.00% 0.00% 0.00% 0.00% 0.00% aEstimated areas are numerically calculated adding a factor of 3.2 per triplicated memory element. Research Article Vol. 16, No. 12 / December 2024 / Journal of Optical Communications and Networking 1225 Fig. 7. Remaining errors and the expected required area comparison for different fine-grain TMR protection levels. interpreted as a scaling factor for calculating the SEU rate in a given radiation scenario. The unprotected design, which had all the errors and did not require overhead, occupies 100% of the resources of the reference design. Minimum protection, which was achieved by protecting the parts vulnerable to blocking errors, was achieved by increasing the required area by up to 103.14%. When all non-recoverable errors were removed, the percentage of remaining errors decreased by approximately 2%, whereas the overhead increased to 107.52%. Removing all errors that caused the loss of at least one complete package (error recovered) resulted in only 4.24% of the errors being left, whereas the overhead was 146.5% with respect to the unprotected version. Finally, if all errors were removed via a fully selective TMR, the required area overhead was 165.03%. However, the severity of the different errors presented is not equivalent and there were more recoverable errors than nonrecoverable ones. Therefore, a large reduction in the number of errors did not directly correlate with a higher stability and performance of the system. Both Table 2and Fig. 7show the gain of this methodology compared to current selective TMR methodologies that focus on removing all possible errors. In the present study, a further reduction in the required overhead resources was achieved without hindering the complete stability of the system, allowing designers to have a more comprehensive understanding of the severity of the errors that are not being protected. This resulted in a qualitative improvement compared to selective TMR approaches that set a threshold of an acceptable number of errors, regardless of their criticality. 5. DISCUSSION Communication systems, particularly FSO systems, must be protected against the adverse effects induced by the channel. Such protection is normally achieved by adding FEC and/or retransmission mechanisms to ensure the correct reception of data. In the FSO scenario, these losses can encompass significant amounts of data owing to an outage duration of milliseconds combined with data rates in the range of gigabits per second. In addition, space systems must be protected against radiation effects, normally via TMR. This study relied on combining both protection schemes to achieve a significant improvement in resource utilization in the implementation of communication protocols for space COTS FPGAs. The discussed results showed that the majority of SEUs that affected a communication protocol, such as the one used in this study, did not result in an error. However, there was a small and non-negligible subsection of these errors, that is, blocking errors, that caused a loss of communication, whereas corrupted data errors increased the error floor of the system. This subsection is important from the perspective of FSO communication from a satellite because downlink opportunities may be severely limited. This limitation arises from the fact that the satellite requires a visual line with the ground station; thus, the low number of ground stations and the satellite’s orbit define the maximum number of downlink opportunities. In addition, external effects such as cloud coverage [13], power budget, and availability of ground stations reduce the number of available opportunities. Because errors in the communication chain can be difficult to detect, particularly corrupted system errors, unless the data are processed via the receiver counterpart in real time, these SEUs can cause the loss of one or more downlink windows until the error is detected and corrective actions are taken. Such corrective measures may need to be presented through a telecommand, a process that requires extra planning and can delay the operation by up to several days, depending on the criticality of the mission. Therefore, these non-recoverable errors should be avoided by taking protective actions, such as including TMR. Hence, this indicates the strength of the presented methodology that can provide an equivalent protection level with a fraction of the required resource overhead in the system. To demonstrate the relevance of this methodology in a satellite-to-ground FSO scenario, publicly available information on an FPGA was used in combination with the orbital parameters of different satellites to obtain the first calculation of SEU error rates using the SPENVIS tool [27]. The selected FPGA was the XQRKU060 from AMD Xilinx because its SEU Weibull fit parameters are available in [28]. Several satellites were selected for analysis of the orbital parameters. They are a generic geostationary satellite, the International Space Station (ISS), and three satellites taken from the emerging megaconstellations Starlink, Kuiper, and OneWeb whose orbital parameters were obtained from [3]. These satellites were selected because the new mega-constellations will rely on FSO communication for either intersatellite links or communication with the backbone ground stations. In addition, geostationary satellites and ISS are important examples of FSO communication. The geostationary orbit is interesting for the purpose of permanently covering a region, whereas the ISS is an example of an LEO orbit and it is also a long-term in-orbit laboratory. Table 3presents the key orbital parameters and a numerical approximation of the SEU rates that the FPGA experiences in each of the analyzed orbits provided by the SPENVIS tool. 1226 Vol. 16, No. 12 / December 2024 / Journal of Optical Communications and Networking Research Article Table 3. Orbital Parameters and SEU Rates per Bit and Day for Different Satellites/Orbits Satellite Altitude in km Inclination SEU/Bit/Day without Protection ISS 400 51.64◦3.3039 E-7 Starlink 560 97.6◦1.9936 E-4 Kuiper 590 33◦1.0532 E-8 OneWeb 1200 55◦2.7879 E-5 Geostationary 36,000 0◦9.7786 E-4 With this information, we can exemplify the advantage of the presented methodology in reducing the data loss in an FSO scenario under the following premises. A single downlink per day was assumed, during which the analyzed module was continuously operating. A throughput of 10 Gbps and a downlink of 10 min were assumed. Moreover, losses owing to the channel were ignored in this example. Lost bit calculations were performed without considering the effects of higher-level FEC systems. In the case of blocking errors, we assumed that half of the transmitted data were marked as lost, and the system was only recovered after the downlink. However, in the corrupted system error category, it was assumed that the error corrupted a quarter of the data and affected the second half of the downlink. This error was also recovered after the transmission concluded. In the case of missing packets (stream recovered), we assumed that the stream was recovered after the maximum number of packets in the simulation were lost. This number varied, depending on the affected module and its position on the processing chain, from four to seven. Exceeding these values implied that the injected fault triggered a non-recoverable error. Finally, it was assumed that any error recovered occurrence caused the loss of certain bits, which is equivalent to 20% of the data in a single packet. Based on these assumptions, the SEU probability from Table 3, and the results from Table 2, Fig. 8displays the performance of the proposed scheme. Figure 8depicts in a logarithmic manner the number of bits lost with different protection schemes at different orbits. The dashed-line red bar represents the unprotected system, while the green-dotted bar shows the optimal protection against SEUs according to the studied protocol, which removed all non-recoverable errors. The effects of removing all blocking errors (purple grid bar) and all errors that can cause the loss of multiple packets (plain yellow bar) are also shown. Notably, protection against nonrecoverable errors represented an increase of required resources below 8%, compared to an increase of 220% for the traditional TMR scheme or 65% for the currently existing fully selective TMR schemes. Moreover, the remaining errors could typically be addressed in the higher layers of the communication protocol. Examples include FEC schemes with interleaving or automatic repeat request (ARQ). Removing only the blocking errors incurred in the lowest area overhead presented in this scenario, that is, 3.14%, also provided close to negligible protection against data corruption by SEUs, below one order of magnitude. If only the error recovered category was allowed, the resource overhead increased to 46.49%. In this scenario, SEUs only introduced spurious errors in the data that a higher basic FEC layer could correct because no complete data packet Fig. 8. Comparison of data loss owing to SEU effects for different orbits with different levels of protection. was lost. This increase in the area overhead by a factor of six provided a gain of approximately two orders of magnitude in the corrupted data when compared with non-recoverable protection. In the case of a combination of orbit and technology that would render the uncorrected errors as excessively frequent for the higher layers to correct, extra FPGA resources could be invested in removing one or both recoverable error categories, as presented in Table 2. Furthermore, the results provided by the methodology were calculated using statistical analyses; therefore, SEUs could still cause errors that have not been detected. However, the presented results have a confidence level of 99% while maintaining a margin of error below 1%. Such uncertainty limits the use of this methodology to noncritical systems; however, as presented, it can introduce significant benefits to different systems, such as communication schemes, devices, and systems. Additionally, the effect on the maximum frequency of the system has not been analyzed in the proposed methodology. This is owing to that such analysis depends on multiple variables, namely, the target FPGA, the compiler used to produce the placing and routing towards the target FPGA, the design itself, and the occupancy of the design in the target FPGA. Despite that reducing the number of triplicated memory elements will ease these parameters with respect to traditional TMR schemes, such reduction is not a guarantee of improvement in the performance. Moreover, the addition of TMR does not have to affect the operation of a given design since the desired operation frequency might be lower than the maximum achievable one. 6. CONCLUSIONS AND FUTURE WORK This study proposed a methodology for performing automatic error classification in an FSO communication system. This shows that combining a protocol-aware error classification