The Slowest Computer in the Solar System

A rover descending toward the surface of Mars has to choose its landing site during the fall. It is looking at the ground with a camera, matching what it sees against an onboard map, and picking a spot clear enough to touch down on. The whole decision takes tens of seconds. A radio message to Earth takes between four and twenty-four minutes each way, depending on where the two planets happen to be. There is no operator. There is no second attempt. The machine is on its own in the strictest sense available in engineering.

The processor making that call is a radiation hardened PowerPC clocked in the low hundreds of megahertz, with a few hundred megabytes of memory. A mid-range phone from 2010 would beat it on every axis. This is not an oversight, and it is not a procurement failure. It is the visible end of a chain of physics, manufacturing economics and qualification procedure that has kept flight computers roughly two decades behind consumer silicon for as long as there have been flight computers. Understanding why is more interesting than complaining about it, because the constraint is now colliding with a demand for onboard autonomy that it was never sized for.

What a charged particle actually does to a chip

Space is full of ionizing particles from three sources with three different personalities. There are protons and electrons trapped in the planetary magnetic field, dense in specific regions such as the South Atlantic Anomaly. There are solar particle events, which are bursty and can raise the flux by orders of magnitude for hours. And there are galactic cosmic rays, a thin, permanent rain of nuclei up to iron, arriving at energies high enough that no practical amount of matter stops them.

Their effects sort into two families. The first is cumulative. Total ionizing dose traps charge in the gate and isolation oxides of every transistor, shifting threshold voltages and leakage until the part drifts out of specification and eventually stops working. Displacement damage knocks silicon atoms out of the lattice, which matters most for image sensors and optocouplers. Both are slow poisons, and both are handled by budgeting: you estimate the mission dose, add margin, and buy parts qualified above it.

The second family is where the interesting failures live. A single particle crossing the die deposits charge along its track, and the standard measure of how much is linear energy transfer, quoted in MeV per square centimetre per milligram of material. If that charge lands in the wrong place, it changes the machine’s mind.

The mechanism is easier to see through the physics of stored state. A memory cell or a flip-flop holds a bit as charge on a small capacitance, so the stored quantity is Q equal to C times V. There is a threshold, the critical charge, above which a collected pulse overwhelms the cell’s feedback and the bit settles into the opposite state. In plain terms, a bit is a bucket holding a certain number of electrons, and a heavy ion is a splash. If the splash is bigger than the margin between the bucket’s level and the tipping point, the bit changes value, and nothing anywhere reports an error.

That single mechanism produces a family of outcomes. An upset is a flipped bit sitting in storage. A transient is a voltage glitch in combinational logic that does nothing at all unless a clock edge happens to latch it, which turns error rate into a function of clock frequency. A functional interrupt is a controller wedged in an illegal state, requiring a reset. And latchup is the ugly one: the parasitic structure formed by the layers of a bulk CMOS transistor can behave as a thyristor, switch on, and conduct until the part is power cycled or destroyed.

Scaling makes this worse in a counterintuitive way. Shrinking a transistor lowers both its capacitance and its supply voltage, so the critical charge falls, and each individual bit becomes easier to flip. At the same time the sensitive volume shrinks, so the chance that any given particle hits that particular bit falls too. The two effects partly cancel per bit. They do not cancel per chip, because a modern die holds billions of bits instead of millions, and because faster logic latches shorter glitches. A denser chip is not obviously more fragile per cell and is reliably more fragile as a whole.

The hardening stack, and what each layer costs

Defence is layered, and every layer is paid for in something the mission would rather spend elsewhere.

At the device level, building the transistors on a silicon-on-insulator substrate removes the conductive path that makes latchup possible, which eliminates an entire failure mode outright rather than mitigating it. Enclosed layout geometries and guard rings reduce dose-induced leakage. At the circuit level, storage cells can be redesigned so that a bit is held redundantly across nodes far enough apart that one track cannot hit both.

At the architecture level sit the familiar techniques. Error correcting codes on memory catch and repair single-bit errors, but only if the memory is scrubbed periodically, that is, read and rewritten on a schedule, so that a second error does not accumulate on top of the first and produce an uncorrectable pair. Triple modular redundancy runs three copies of a computation and takes a majority vote, which makes any single upset invisible. Lockstep pairs run two cores in step and halt on divergence. Above all of it sit watchdog timers and a safe mode, which is the admission that the last line of defence is turning the machine off and back on.

The costs are blunt. Triple redundancy roughly triples area and power and inserts the voter into the timing path. Hardened cells are larger and slower than commercial ones. Silicon-on-insulator wafers cost more. And the qualification campaign, beam testing at a cyclotron, dose testing, worst-case analysis, takes years and has to be repeated whenever anything changes.

Then the economics finish the argument. A rad-hard processor sells in quantities of thousands, at thousands of dollars each. A commercial mobile chip sells in the hundreds of millions. Nobody amortises a leading-edge mask set over a space programme, so the flight parts stay on a process node that was current when the design started and is frozen for the fifteen years the part remains orderable. The lag is not conservatism. It is arithmetic.

Where this stands in 2026

The pressure to break the lag comes from autonomy. Light delay rules out ground control for anything time-critical, downlink bandwidth is far smaller than what modern instruments produce, so science data has to be triaged onboard, and the algorithms people now want to run, terrain-relative navigation and neural inference, are exactly the ones that need throughput.

NASA’s answer is the High Performance Spaceflight Computer, developed with Microchip around RISC-V cores from SiFive, with vector-capable cores in two clusters alongside general-purpose ones. JPL quotes 500 times the performance of the processors on current missions; independent presentations put the scalar figure closer to 100 times, with 500 reached on vector and AI workloads. The chip is still in qualification rather than flight certified, and the schedule is tied to Artemis.

A second approach borrows the commercial supply chain instead of replacing it. BAE Systems has validated a hardened 45 nm design built on GlobalFoundries’ commercial silicon-on-insulator platform, leaning on a substrate that a mainstream fab already offers and that happens to remove the latchup path.

The loudest move is the least conservative. Starcloud put a commercial datacentre GPU into low Earth orbit in November 2025 and ran model training on it the following month, with a larger platform planned for late 2026. Google’s Project Suncatcher proposes constellations of solar-powered satellites carrying tensor accelerators linked optically, with prototype flights targeted for early 2027 and radiation, thermal control and link reliability named as the open questions.

What this does not settle

The two worlds are not solving the same problem, and it is worth resisting the conclusion that commercial parts have quietly won. Low Earth orbit at moderate inclination sits under the protection of the magnetic field, and a GPU surviving there for months says very little about a Jupiter orbit, a lunar surface during a solar event, or a fifteen-year geostationary life. Published upset rates vary by orders of magnitude across orbits and parts, so any single headline number is a claim about one environment and one device, not a property of silicon.

The performance figures deserve the same scepticism. A hundredfold scalar gain and a five-hundredfold vector gain are both true and describe different machines; a control loop bounded by latency gets the smaller number.

Orbital compute has a thermal problem that no amount of hardening touches. In vacuum the only way to shed heat is to radiate it, and radiated power scales with area and the fourth power of temperature, which means a megawatt-class cluster needs radiator surfaces substantially larger than the solar arrays feeding it. The economic case also assumes launch costs and cadences not yet demonstrated, and assumes hardware that never needs servicing, which is in tension with the fact that hardware fails.

There is one genuinely promising idea in the newer work, which is that not all bits deserve equal protection. A flipped weight deep in a neural network is usually absorbed by the network itself, while a flipped pointer in the control path is fatal. Spending the redundancy budget where it changes outcomes, rather than uniformly, is a better use of mass and power than hardening everything. It is also not a safety argument on its own, because “usually absorbed” is not a property you want underneath a landing.

Which is the real shape of the problem. Nobody is going to build a chip that particles cannot touch. The engineering question, on a machine that must act before anyone on Earth even learns it has a decision to make, is how much internal wrongness a system can carry and still be trusted to move.

Further reading

• A Case for Application-Aware Space Radiation Tolerance in Orbital Computing, on spending redundancy selectively rather than uniformly.
• High-End Space Electronics: Active Shielding to Mitigate Catastrophic Single-Event Effects, on why passive mass runs out of usefulness.
• NASA’s HPSC white paper, the architecture and the autonomy case behind it.
• When the Cloud Leaves Earth, an overview of the orbital datacentre proposals and their stated open problems.