An FPGA Flies on Mars

Mars ain’t the kind of place to raise your kids.
In fact it’s cold as hell – Elton John, Rocketman

Mars is hard. Only 26 of 56 missions sent to Mars have been successful. Landing on Mars is especially hard. Even though Mars’s gravity is only a third of Earth’s, the planetary atmosphere is 100 times thinner, which makes a soft landing by parachute impossible for mission hardware of any significant weight. Design teams have had to invent Rube Goldberg landing schemes, including airbags that turned spacecraft into soccer balls and the sky crane technique that has now successfully landed the much larger and heavier nuclear-powered Curiosity and Perseverance rovers in 2012 and 2021, respectively.

A mission that successfully lands on Mars faces yet more challenges. It’s cold; temperatures on Mars average about -81° F, which is very unfriendly to both humans and equipment. It’s dusty, and the fine, red Martian dust finds its way onto every surface and into every tiny opening and joint. Finally, Mars has no magnetosphere to deflect incoming radiation from space, so there’s plenty of ambient radiation at ground level. The radiation environment on Mars’s surface is about equivalent to Earth’s at 45,000 feet. That last challenge isn’t just a problem for people. It’s also somewhat of a problem for electronic equipment.

Despite all of these challenges, NASA sent the Perseverance rover to Mars with an unusual passenger strapped to its belly: a helicopter (NASA formally calls it a rotorcraft) designed by NASA JPL. Sending a helicopter to Mars, where the atmosphere is so thin, may itself seem foolhardy. But Mars is so far away, varying between three and 22 light minutes from Earth depending on planetary orbits, that manual control of the helicopter is impossible. So this most unlikely aircraft must also fly autonomously, in atmospheric conditions never experienced on Earth.

The 4-pound Ingenuity Mars helicopter stands only half a meter tall. Image credit (artist conception): NASA

The Ingenuity Mars helicopter had to be light because every kilogram you send to Mars is precious; the launch vehicle can boost only a limited amount of mass to Mars, so adding weight is a zero-sum game. Ingenuity weighs four pounds, on Earth. Consequently, the heavy plutonium RTG (radioisotope thermal generator) that continuously supplies the Perseverance rover with about 100 watts of electricity is inappropriate for the helicopter. It weighs 83 pounds, on Earth. Perseverance’s RTG is fueled with 10.6 pounds of plutonium, which alone is more than double Ingenuity’s entire weight allocation.

Instead, a small bank of solar cells, perched atop Ingenuity’s rotor-blade mast, charges the lightweight, airborne vehicle’s lithium batteries between flights. The batteries power the helicopter’s propeller motors and actuators, its heaters that prevent Ingenuity from freezing to death during the cold, cold Martian nights, and its avionics package. Given Mars’s weak sunlight, about 44% that received by the Earth per square meter, Ingenuity requires several sols (Martian days) to charge its batteries before each flight.

The avionics package that allows the Ingenuity helicopter to fly autonomously consists of five printed circuit boards, which form five facets of a cube surrounding the helicopter’s 6-cell lithium-ion battery pack (shown wrapped in foil in the above image). The five boards are:

The FPGA/Flight Controller Board (FFB)
The NAV/Servo Controller Board (NSB)
The Telecom Board (TCB)
The Helicopter Power Board (HPB)
The battery interface board (BIB)

Here’s a diagram of the avionics package configuration:

The Ingenuity helicopter’s avionics package consists of five interconnected boards. Image credit: NASA

The FFB is at the heart of the Ingenuity helicopter’s avionics package. Two TI TMS570 Hercules microcontroller SoCs, originally aimed at automotive applications, operate as Ingenuity’s low-level flight controller (FC). Each TI microcontroller incorporates a dual-core, ARM Cortex-R5F processor operating in lockstep. The FFB also incorporates ECC-protected Flash memory and RAM. The dual-redundant lockstep processors and ECC memory provide some protection against radiation-induced soft errors such as SEUs (single event upsets).

An on-board FPGA interfaces to the helicopter’s sensors and servo actuators. The FPGA supplies the two TI microcontroller SoCs with the same clock and data and operates them in sync with each other. The built-in processor lockstep mechanism performs cycle-by-cycle error detection. If one dual-core, lockstep microcontroller processor detects a fault, it signals the error to the FPGA, which then switches control to the other microcontroller while cycling power to the faulty one to recover from the error. The FPGA also performs many flight control tasks including an attitude control loop operating at 500 Hz, an outer motor control loop, waypoint guidance, sensor I/O from the IMU (inertial measurement unit), altimeter and inclinometer, and analog telemetry for current and temperature sensing.

The inner motor-control loop operates the two brushless rotor motors and the six brushed motor servos, as well as implementing power management and thermal control. Six servo motors control the blade pitch of the helicopter’s two counter-rotating propellers. A swashplate controls each propeller’s pitch, and sets of three servo motors drive each of the two swashplates, for a total of six servos.

Most of the helicopter’s internal communications flow through the FPGA, which implements 25 separate serial data interfaces (SPI, I2C, UART, SENT) to interconnect the three processors, the guidance and navigation sensors (two IMUs, an altimeter, and an inclinometer), all eight motors, the battery monitor, and an external ADC.

The FPGA manages the helicopter’s power and its operational state, switching the other avionics elements on and off as needed to maximize power conservation. The FPGA also implements thermal control of the helicopter’s survival and operational heaters and monitors and balances the lithium battery’s cell voltages. Because it is only one of two continuously powered elements in the helicopter, the FPGA also maintains precise spacecraft time, implements alarm clock functions, and generates real-time interrupts for the rest of the system.

The helicopter’s FPGA implements most of Ingenuity’s fault protection. It collects telemetry and health status from a variety of sources and responds to faults as required. The FPGA manages the pair of redundant FC microcontrollers as one primary processor and one hot spare. Based on fault indicators, the FPGA determines if it needs to switch from one microcontroller to the other. If it decides to switch, the FPGA turns flight control over to the processor operating as the hot spare and then cuts power to the microcontroller formerly designated as the primary processor. The FPGA then reapplies power to the processor, powers it back up, restores critical status data to the processor, and designates it as the new hot spare. The FPGA stores the critical data used by any of the processors in case the need to swap microcontrollers arises.

Because there’s only one FPGA on the FFB, it must operate continuously. It must also tolerate the ambient radiation on Mars for the mission’s duration. Designers chose a Microchip (formerly Microsemi) ProASIC3 with a military temperature grade (-55 C to 125 C) and -1 speed grade to mitigate propagation delay degradation caused by the expected amount of total dose radiation that the helicopter receives from the Martian ambient. They mitigated FPGA susceptibility to SEUs using a design regimen based on triple module redundancy (TMR).

The NSB carries a Qualcomm quad-core Snapdragon 801 CPU on a now-discontinued Qualcomm Snapdragon Flight System on Module (SOM). The Snapdragon 801 CPU was originally designed as a smartphone processor, and Qualcomm’s engineers developed the Snapdragon Flight SOM and its autonomous flight software specifically for airborne vehicle control. It’s not likely that the engineers originally envisioned Mars as a likely venue for an autonomous aircraft, but that’s what happened.

The Snapdragon Flight SOM operates as Ingenuity’s main flight processor. It runs a Linux OS and provides data management, command processing, telemetry generation, and radio communications. It also implements several I/O interfaces including three UARTs, one SPI port, and a few discrete GPIOs, and it operates the helicopter’s two on-board video cameras: a 4208-by-3120-pixel (13-Mpixel), high-resolution color camera and a 0.3-Mpixel, black-and-white Video Graphics Array (VGA) navigation camera. Ingenuity navigates visually during flight by allowing the flight-control software to estimate the helicopter’s velocity from surface features that appear in successive images taken from the navigation camera’s video stream.

In addition to the Snapdragon FLIGHT SOM, the NSB hosts the drive circuitry for the helicopter’s six DC servo motors. The Snapdragon 801 CPU communicates with the rest of the avionics through a UART to the two redundant TI TMS570 microcontrollers, which receive and process identical sensor data and perform the real-time flight-control functions needed to keep Ingenuity flying. The microcontrollers communicate with the FPGA through an SPI port.

The Ingenuity helicopter lacks sufficient RF power to communicate directly with Earth. Instead, it uses the Perseverance rover as a relay station. The communications link between the Ingenuity helicopter and the Perseverance rover is implemented using a dual-redundant pair of standard, commercial, off-the-shelf 802:15:4 (Zig-Bee), 914-MHz SiFlex-02 RF transceiver modules, manufactured by LS Research. The communications data rate between Ingenuity and the Perseverance rover is 250 kbps with a 1000-meter range.

The helicopter’s Zig-Bee modules are mounted on the TCB along with some additional analog circuitry: a 16-bit, 8-channel ADC used for making sensor measurements, the temperature sensor interface, and heater control switches. To save power, the TCB’s ADC monitors battery-charging current and temperature, eliminating the need to keep the rest of the avionics boards switched on during the long periods between flights when the helicopter is on the ground and is simply charging its batteries in preparation for the next flight.

Of the two remaining boards in the avionics package, the HPB incorporates two DC/DC converters that generate the 3.3 and 5 volt power buses from the battery voltage, and the BIB hosts the battery-monitoring circuitry, motor power switches, and motor current monitors. The boards form a five-sided box around the helicopter’s heaters and batteries, with the BIB sitting at the bottom of the box.

Because NASA classified the Ingenuity helicopter as a technology demonstrator, many of the helicopter’s semiconductor components and sensors are either military- or automotive-grade devices. Selecting these commercial devices allowed JPL to pack far more processing power into Ingenuity than would otherwise be possible.

Ingenuity became the first human-designed aircraft to fly in another planet’s atmosphere on April 4, 2021, when it was 287 million kilometers from Earth. Although it was designed for only five test flights on Mars to prove the design, by the end of 2021, Ingenuity had made 18 flights, of increasing duration and distance, for a total flight time of almost 33 minutes and covering a total distance of 3.82 km. That’s more than half an hour of autonomous flight on a planet that we thought might not permit flight at all, until Ingenuity lifted off the ground, flew, and then safely landed. Again and again. For longer and longer flights.

Following the first five test flights, NASA upgraded Ingenuity’s designation from technology demonstrator to operational demonstrator and tasked the Ingenuity team with scouting and reconnaissance to directly support the Perseverance rover’s exploration of Jezero Crater. Perseverance’s science team has found that aerial images helped when selecting the most worthy geologic features and locations for the rover to explore, and rover drivers are using Ingenuity’s aerial images to map out safe land routes to these new locations of interest.

Beyond proving the viability of flight on Mars, the Ingenuity technology demonstrator greatly expanded the types of high-end processors that NASA has now flown to include the Qualcomm 801 smartphone SOCs and TI automotive microcontrollers. These parts have now been proven to work beyond expectations in the harsh Martian environment, including radiation effects. As long as Ingenuity continues to fly, the expected operating envelopes for these devices used in space missions will only expand.

Ingenuity is unlikely to be the last helicopter on Mars. The first Martian rotorcraft’s continued success has prompted NASA to start developing a larger, six-rotor design for future missions. In all likelihood, there will eventually be autonomous drones flying in the Martian atmosphere. I hope the Martians, if there are any, or their thoats and calots, aren’t annoyed by the noise.