###### Abstract  
With the growth of the nano-satellites market, the usage of commercial off-the-shelf FPGAs for payload applications is also increasing. Due to the fact that these commercial devices are not radiation-tolerant, it is necessary to enhance them with fault mitigation mechanisms against Single Event Upsets (SEU). Several mechanisms such as memory scrubbing, triple modular redundancy (TMR) and Dynamic and Partial Reconfiguration (DPR), can help to detect, isolate and recover from SEU faults. In this paper, we introduce a dynamically reconfigurable platform equipped with configuration memory scrubbing and TMR mechanisms. We study their impacts when combined with DPR, providing three different execution modes: low-power, safe and high-performance mode. The fault detection mechanism permits the system to measure the radiation level and to estimate the risk of future faults. This enables the possibility of dynamically selecting the appropriate execution mode in order to adopt the best trade-off between performance and reliability. The relevance of the platform is demonstrated in a nano-satellite cryptographic application running on a Zynq UltraScale+ MPSoC device. A fault injection campaign has been performed to evaluate the impact of faulty configuration bits and to assess the efficiency of the proposed mitigation and the overall system reliability. EPGA; fault-tolerance; SEU; TMR; nano-satellite; dynamic and partial reconfiguration 20212102148103390/2021214810390/20212  
memory cell content. An SEU can affect both the design state or the design routing, leading to data corruption, unusable functionalities, or even a complete system failure. The case study in [7] details the implementation of radiation-error mitigation techniques on a Xilinx Kintex 7 FPGA device, especially Triple Modular Redundancy (TMR). TMR consists in triplicating a function that needs to be protected against radiations. The output of each function or module is compared with the two others and a voter selects the output that is identical for at least two of the modules [8; 9]. Another solution against SEE is memory scrubbing. A memory scrubber is a module which periodically checks the FPGA configuration memory in order to detect bit flip caused by SEE. The aim is to detect and correct, avoiding a complete failure of the device operations. An external memory scrubber using a rad-hard FPGA to check the configuration memory of the SRAM payload FPGA is described in [10]. Considering the importance of this mechanism to detect and be able to correct radiation-induced errors, Xilinx provides a hardware IP core to rapidly and seamlessly include this mitigation technique in a design [11]. This IP allows internal checking of the FPGA configuration memory with low development cost, with the drawback that, being implemented in the FPGA logic, it requires an upper layer to protect this scrubber against an SEU. A third method to handle the radiation issue is to take advantage of dynamic and partial reconfiguration (DPR). This feature provided in Xilinx and Intel FPGAs allows reconfiguration of a partition of the FPGA without disturbing the rest of the design. Thus, it can be used to reload a damaged partition, load a new partial configuration avoiding the permanently damaged areas or reconfigure a partition with a more robust implementation. In the latter case, the implementation could use TMR or another fault correction mechanism to tackle the radiation effects more efficiently. It has the benefit of reducing FPGA resources usage, which in turn reduces the size of the area vulnerable to SEEs. It also decreases power consumption and allows for faster and easier transfer of a new applications to a device. An example is the work presented in [12], where they used TMR and dynamic reconfiguration for rewriting faulty frames after comparing them to identically routed redundant blocks. A more sophisticated fault mitigation technique is presented in [13].