How do you keep an FPGA from flipping bits in orbit?

On most small missions I've worked with, the actual baseline is a lot simpler than the papers make it sound: a watchdog timer plus periodic reconfiguration of the config memory, sometimes called scrubbing. That alone handles the biggest failure mode, where a radiation hit flips a bit in the bitstream and the logic slowly misbehaves. Full triple modular redundancy of the entire design is rare outside of high-reliability programs. It eats a huge chunk of your resources and complicates timing, and most cubesat teams only vote on the handful of flops that actually matter, like state machines that coud lock up or commands going to the payload. Everything else just gets reset when the refresh catches an error.

I actually think people overlook the physical layout aspect of soft error mitigation, wich is arguably as important as the software-based redundancy. Even if your configuration memory is perfectly scrubbed, a Single Event Upset in a flip-flop within a critical state machine can still cause a cascading failure before the next sweep occurs. Therefore, grouping all sensitive sequential logic into tightly coupled physical clusters on the chip significantly reduces the probability of a localized destructive event, even if you aren't running full TMR on every single register.

I've been working on a ground receiver for a similar setup and I'm kind of worried about how the physical grouping of logic impacts the timing, not just the radiation. If you are isolating those critical state machines into thier own area, do you find that the routing complexity explodes or that it becomes much harder to manage the clock domains across the chip? I read the part about focusing on critical paths, but I'm not sure how to implement that without creating a thermal hotspot somewhere on the board. It’s a bit of a headache to figure out how to actually lay everything out given our restricted space.

When we were running these systems back in the day, we often went for better voltage margins rather than trying to brute force redundancy into the design. You run the chips a little more loosely on the power, which gives you some inherent tolerance to those soft upsets. It's not perfect, but it was easier than wiring up three complete versions of your logic and still got the job done for low-power cubesats. Try looking at the device datasheet recommendations for operation under stress. Sometimes just managing the operational limits of the device itself saves you a huge headache later.