Low Temperature Operation

I am playing with developping autopilots... One of the issues I have is the requirement for low temperatures - 40 - 50°C.

I have found a couple of posts which state that Teensy 3.2 is basically good for -20 C (or -10 C), one issue being the crystal and the other possible contraction/expansion of the board for long term robustness.

With reference to Teensy 3.5, 3.6 and 4.0: what is the safe operational temperature? I need at least -40 C to +60 C...

I can make a small heater from a network of resistors (I do so for sevoes, basically, you poor epoxy with microbaloons around the case and embed 8-10 1/8 W resistors: 1 Watt heats a small servo to a delta of 20-25 C.

Is it safe to poor epoxy over the teensy boards? The temperature limitations are with reference to the processor, to the part of the board where the processor is soldered, or to the whole board? i.e. is it necessary to heat just the top of the processor, or the processor and the other side of the board? Heating the whole board evenly without enclosure is more complicated.

So far I have been using Arduine pro 2560 without any glitches and without heating...
 
So which kind of "autopilots" are you playing with? And for what purpose? Legal?
An anavionics engineer just knows the Teensy boards are not suitable because of several factors, beginning at the boards, the parts, the solder paste, whatever.
The soldering tends to grow whiskers for example, mechanical stress at low temperature weakens the joints, etc. google for apha tin and beta tin. An engineer would know that... and that is why avionics are made differently.
 
So which kind of "autopilots" are you playing with? And for what purpose? Legal?
An anavionics engineer just knows the Teensy boards are not suitable because of several factors, beginning at the boards, the parts, the solder paste, whatever.
The soldering tends to grow whiskers for example, mechanical stress at low temperature weakens the joints, etc. google for apha tin and beta tin. An engineer would know that... and that is why avionics are made differently.

I did not make it clear, it is for RPA autopilots; so the risk is not that high, but still it is present. That is why I am putting a question here about Teensy

"Playing" = developping for personal hobby use
 
I am still trying to get an answer to this question:

- What is minimum safe operational temperature for Teensy 3.5 /3.6?

- What would be the best way to heat the board to keep minimum operational temperature, i.e. partial heating?
 
- What is minimum safe operational temperature for Teensy 3.5 /3.6?

How "safe" is your "safe" requirement ??

You describe using a "Arduine pro 2560" with no issues.
Both the 2560 and the Teensy are constructed using similar grade parts so the behavior of either should be within the same ballpark.

As you know, there are at least two issues to consider 1) the actual part behavior and 2) the mechanical thermal stresses of the complete assembly as the unit is thermally cycled.

Item #1 - Part specifications
A complete audit of each part would require an exact billl of materials which is not readily available.

However, a few educated guesses can be made which provide a little insight as to what can be expected.

The main microprocessor is rated for -40 to +125 C
see https://www.pjrc.com/teensy/K66P144M180SF5V2.pdf

A typical Chip Capacitor is rated for -55 to +125 C
see https://www.murata.com/~/media/webr...og/products/capacitor/mlcc/c02e.ashx?la=en-us

The MKL02Z32VFG4 Bootloader Chip is rated for -40 to +85 C
see https://www.digikey.com/product-detail/en/nxp-usa-inc/MKL02Z32VFG4/MKL02Z32VFG4-ND/4234778

The main microprocessor crystal is probably rated for -20 to +70 C although other ranges can be ordered. see https://ecsxtal.com/store/pdf/ecx_53b.pdf

The Real Time Clock crystal is probably rated for -40 to +85 C
see https://support.epson.biz/td/api/doc_check.php?dl=brief_FC-255&lang=en

The TLV75733 voltage regulator is rated for -40 to +150 C
see http://www.ti.com/lit/ds/symlink/tlv757p.pdf

Item #2 - Mechanical Stresses
Your 2560 is constructed such that the mechanical stresses due to thermal cycling would be a little different from those experienced by the Teensy. In particular the BGA part may possibly not like large thermal gradients between the part and the pcb over several thermal cycles. Note that normal operation causes the microprocessor to heat faster than the PCB so some thermal cycling is usual in normal use.

The bottom line is that most components can be operated a little ways beyond their datasheet specs. See the overclocking tests where everyone pushes their computer or microprocessor beyond the datasheet. If your push the boundaries, you just have to accept that you are in uncharted territory and be prepared the result.
 
-
Item #2 - Mechanical Stresses
Your 2560 is constructed such that the mechanical stresses due to thermal cycling would be a little different from those experienced by the Teensy. In particular the BGA part may possibly not like large thermal gradients between the part and the pcb over several thermal cycles. Note that normal operation causes the microprocessor to heat faster than the PCB so some thermal cycling is usual in normal use.

I was aware that most components are rated to -40 C
I am most worried about this part... The mechanical solder failure...


As far as how safe is safe... The guaranteed damage due to failure would be around 6.000 USD and up depending on the payload. The potential consequential damage is very difficult to estimate. But I would eyeball a total value of around 10.000 USD per event. So...a MTBF of 10.000-20.000 hours would seem acceptable for me.

On average, about 30 % of flights would experience a temperature change from -20 to +20 C, and about 10 % from -40 C to +30 C.

Would it be advisable to install low-power heaters under the board? (where the processor is located). Sealing with epoxy would not do much good? I do not like very much the idea of making a heated enclosure because of the cabling

To put it differently, if the system can survive 1000 cycles of -50 C to +50 C and operate for 20.000 hours, I would be more than satisfied...

There is a lot of redundancy in the overall design (everything is double, like power supplies, nav devices, actuators, etc. but it is virtually impossible to double the main processor - there are ways to do it, but switching over introduces different risk factors and complexities which are probably not worth it.
 
Last edited:
What about insulation? Styrofoam or PU could provide enough insulation to prevent the cold from reaching the electronics before the flight is over. With clever design, it could let heat out and keep cold out as well.
Keep it simple.
A flight controller could easily be designed with redundancy, preferrably with two or more completely different systems in different locations on the aircraft. It is a matter of watchdog protocol, bus redundancy,... not too complicated if done from the concept on, but harder to implement in an existing system.
To accept a crash or uncontrollable stray aircraft is not an option. Ever heard about fire from destroyed fuel tanks or batteries? From collisions? Unauthorized flight in controlled airspace? Have you considered some kind of abort strategy?
 
@chileflora
Whats the fun of a model airplane hobby without a few crashes :D

You might find this interesting.
https://forum.pjrc.com/threads/40638-Teensy-3-6-program-loader-and-I-O-glitches?p=126409&viewfull=1#post126409 The post is about an early manufacturing defect but the result and topic are the same.

No one can give you the answer you seek because it's like asking how long are you going to live. As in life, a mediterranean climate and not smoking will aid your Teensy.:cool:

I can sum up ~20 years of my previous electronic packaging work by stating the following facts:
1. If the stress in the solder joints is below about 200 psi the joints will never fail by solder fatigue stress.
2. You can almost always design leaded packages with leads thin enough to keep stresses below 200 psi. (that doesn't mean everybody does, or even realizes it)
3. It is very difficult to design useful bga packages with solder stresses below 200 psi. (and almost nobody does)
4. It is very difficult to predict within an order of magnitude when an overstressed joint will fail. (hence 1 year warranties, although that implies it might last 10 years! )
 
@chileflora
Whats the fun of a model airplane hobby without a few crashes :D

You might find this interesting.
https://forum.pjrc.com/threads/40638-Teensy-3-6-program-loader-and-I-O-glitches?p=126409&viewfull=1#post126409 The post is about an early manufacturing defect but the result and topic are the same.

No one can give you the answer you seek because it's like asking how long are you going to live. As in life, a mediterranean climate and not smoking will aid your Teensy.:cool:

I can sum up ~20 years of my previous electronic packaging work by stating the following facts:
1. If the stress in the solder joints is below about 200 psi the joints will never fail by solder fatigue stress.
2. You can almost always design leaded packages with leads thin enough to keep stresses below 200 psi. (that doesn't mean everybody does, or even realizes it)
3. It is very difficult to design useful bga packages with solder stresses below 200 psi. (and almost nobody does)
4. It is very difficult to predict within an order of magnitude when an overstressed joint will fail. (hence 1 year warranties, although that implies it might last 10 years! )

Thanks a lot for the answer... It left me quite disappointed. I had pretty good experience with the slow Atmega 2560 - the main problem is the low number of uarts. Teensy seemed to solve this issue, and running several times faster than atmega also would simplify that. And being compatible with arduino IDE also simplifies many things.

I also did not realize that teensy 4.0 is just for 0°C!!! Now, from the datasheet for the 3.5/3.6 I understand that -40°C is OK, except for the issue of the joints. I also looked at the link you gave and that is also very very worrysome... intermittent contact issues are the worst of a kind.

Crashing is no fun at all, I can tell you that.
 
Last edited:
What about insulation? Styrofoam or PU could provide enough insulation to prevent the cold from reaching the electronics before the flight is over. With clever design, it could let heat out and keep cold out as well.
Keep it simple.
A flight controller could easily be designed with redundancy, preferrably with two or more completely different systems in different locations on the aircraft. It is a matter of watchdog protocol, bus redundancy,... not too complicated if done from the concept on, but harder to implement in an existing system.
To accept a crash or uncontrollable stray aircraft is not an option. Ever heard about fire from destroyed fuel tanks or batteries? From collisions? Unauthorized flight in controlled airspace? Have you considered some kind of abort strategy?


Insulation does not work well unless it is complete. The AP board has dozens of cables, so one can not really insulate the whole AP board, but one could try insulate Teensy board and even heat it up (a couple of resistors plus a temperature sensor is pretty easy to implement).

"Keep it simple" is not really a good strategy because the average life of an FPV airplane with "Keep it simple" is not very long. The correct way to design AP system is to have an option to fall back on the simplest method to save the plane, but the system can be complex. One needs to have a multilayered approach and redundancy; redundancy correctly implemented is never simple...

As far as crashes go, it is acceptable. Boeing accepted the risks and went for it.

Fires - yes; basically when you estimate damage from a crashed RPA airplane, you get something like:
99 % - no ground damage
0,9 % - "minor" damage (parked car smashed, windows smashed) let put 5.000 USD limit =5000 * 0,9 % = 50 USD/per crash
0,09 % - "major" damage (house fire, forest fire). Maybe 500.000 USD * 0,009 % = 500 USD/ per crash
0,0009 % "catastrophy" - hitting something really delicate...
 
@chileflora,
I was trying to be humorous. As I pointed out everybody uses bga parts. Just don't expect the parts to last forever. On the bright side I should have mentioned above that the cold side of the temperature range is better than the hot for solder fatigue. This is because solder creep which causes accelerated damage doesn't occur as much at cold as at hot.

Also I'm coming from a military perspective where we were supposed to design and theoretically prove a 20 year life with some required statistical certainty. You don't need that.
 
From the discussion it seems that Teensy is not good for core AP; I am now thinking of using the 2560 for basic functionality and probably use Teensy for I/O (Uarts) and ADC. Before I used 2560 and RPi as companion, but only for higher ("intelligent") features. 2560 has only 16 ADC and only 4 UARTS and that is the most limiting factor.
 
@chileflora,
I was trying to be humorous. As I pointed out everybody uses bga parts. Just don't expect the parts to last forever. On the bright side I should have mentioned above that the cold side of the temperature range is better than the hot for solder fatigue. This is because solder creep which causes accelerated damage doesn't occur as much at cold as at hot.

Also I'm coming from a military perspective where we were supposed to design and theoretically prove a 20 year life with some required statistical certainty. You don't need that.

So from your experience, using BGA is not really a total No-no? There are not many alternatives if you want to have more advanced functionalities; it is surprising because I had quite good experience with raspberry pi, and it is suppposed to work very well in cold (probably because it consumes more energy and autoheats up). But RPi does not have any I/O capabilities. Also I checked out, the one I use is zero, with main processor with legs, so the newer one, RPi 4 will probably have the same issues as Teensy 4.0?

Would you expect a considerable decrease in reliability between a Teensy 3.2 and 3.5 for instance?
 
@chileflora
I think manufactures have pushed the limits as described above to the point where the failure rate is acceptable to the general public. People expect their electronics to last a few years and aren't too surprised if it fails after 5 or 6. The question is whether the 0°C makes this much better or worse. I think the stress of just turning the part on is worse than the stress of going to 0°C.

Attached is a plot of the T4 warming up from room temperature (20°C) using it's internal temp sensor and heated only by its internal dissipation and driving an ILI9341 display.

Each horizontal line is 60 seconds, then a color change and the next line ect. So in the 1st 60 seconds the die has gone from 20 to 35C. The pcb certainly hasn't heated up that fast. So the stress is high because the die has grown but the pcb hasn't. Each line is flatter than the last as the pcb slowly heats up and the die stabilizes at around 47C a 26°C rise above ambient. So at 0°C ambient the die is about 26°C.

I think the stress rise from startup is worse. A 15°C rise for the part only vs something less than a 26°C rise for both parts.

startup 15 * TCE part - 0 * TCE board = 15 * TCE part

running 26 * TCE part - ~17 * TCE board = ~10 * TCE parts

This isn't exactly correct but in the ball park. So solder joint wise it should be just about as good. It also indicates you probably don't need to insulate the assy as that may cause more problems and solder joint wise colder is better.

IMG_0035.jpg
 
Last edited:
@chileflora
"keep it simple" means adding complexity adds also chance of failure. The more complex a system is, the more likely it will fail.

Why develop an expensive Space Pen that works in low gravity, if a pencil could serve the same job?

You may add heating, but then need a safety for that. And you have more weight, more power consuption, etc.
Or you can use the heat that is generated by the system to keep it warm, calculate the expected amounts of heat and balance that against the properties of an insulation. If you leave enough headroom in system performance to be able to underclock or reduce power consumption, you
have a way to keep the system cool enough in a hot environment while being able to compensate for heat loss in the cold by running at higher power.

And again: A system failure is not acceptable. Nobody wants to encounter your aircraft mid air at Ma.8 and find it punching a hole through the fuselage, and nobody wants to be hit by your aircraft falling from the sky... so why do you want to accept failure?
At least consider a BRS or something similar together with a watchdog procedure and independent geofencing, to keep the aircraft at least partially safe. I consider your plans as reckless endangerment!
 
@chileflora
I think manufactures have pushed the limits as described above to the point where the failure rate is acceptable to the general public. People expect their electronics to last a few years and aren't too surprised if it fails after 5 or 6. The question is whether the 0°C makes this much better or worse. I think the stress of just turning the part on is worse than the stress of going to 0°C.

Attached is a plot of the T4 warming up from room temperature (20°C) using it's internal temp sensor and heated only by its internal dissipation and driving an ILI9341 display.

Each horizontal line is 60 seconds, then a color change and the next line ect. So in the 1st 60 seconds the die has gone from 20 to 35C. The pcb certainly hasn't heated up that fast. So the stress is high because the die has grown but the pcb hasn't. Each line is flatter than the last as the pcb slowly heats up and the die stabilizes at around 47C a 26°C rise above ambient. So at 0°C ambient the die is about 26°C.

I think the stress rise from startup is worse. A 15°C rise for the part only vs something less than a 26°C rise for both parts.

startup 15 * TCE part - 0 * TCE board = 15 * TCE part

running 26 * TCE part - ~17 * TCE board = ~10 * TCE parts

This isn't exactly correct but in the ball park. So solder joint wise it should be just about as good. It also indicates you probably don't need to insulate the assy as that may cause more problems and solder joint wise colder is better.

View attachment 18960

That graph was very enlightening. If I understand it correctly, the main issue is then the uneven expansion between the chip and the board and not so much the contraction of solder joints from cold. So... if I understood it correctly, to reduce significantly the failure rate and to improve reliability, placing a small network of resistors (3-4) fed through a mosfet switch and providing around 0.5 W of power on the board below the main processor, embedded in thermal paste, but not epoxied and two temperature sensors, something like DB18S20, one glued on top of the processor and the other embedded in the thermal paste together with the resistors could be a solution...

The algorythm would be something like this: on power on, the processor switches the heating resistors for 60-120 seconds (the exact time would have to be determined experimentally, but to achieve a temperture rise of about 20°C in that amount of time). From there, it starts taking readings from the temperature sensors (on top of the processor and below the board) and tries to maintain smallest temperature difference between the two.

I am thinking more about teensy 3.5 and not 4.0.

The start-up temperature would usually be in the range of -10° to +40°C
 
@chileflora
"keep it simple" means adding complexity adds also chance of failure. The more complex a system is, the more likely it will fail.

Why develop an expensive Space Pen that works in low gravity, if a pencil could serve the same job?

You may add heating, but then need a safety for that. And you have more weight, more power consuption, etc.
Or you can use the heat that is generated by the system to keep it warm, calculate the expected amounts of heat and balance that against the properties of an insulation. If you leave enough headroom in system performance to be able to underclock or reduce power consumption, you
have a way to keep the system cool enough in a hot environment while being able to compensate for heat loss in the cold by running at higher power.

And again: A system failure is not acceptable. Nobody wants to encounter your aircraft mid air at Ma.8 and find it punching a hole through the fuselage, and nobody wants to be hit by your aircraft falling from the sky... so why do you want to accept failure?
At least consider a BRS or something similar together with a watchdog procedure and independent geofencing, to keep the aircraft at least partially safe. I consider your plans as reckless endangerment!
A system failure is UNAVOIDABLE by definition, from the simplest pen to the space shuttle. It is all about probabilities and mitigating the effects of that failure.

I can give you a very cruel recomendation: if you do not want to die, do not live... also do not drive, do not fly, do nothing, you will be safe, and people around you as well.

And if we talk about aircraft industry, the ones who did reckless endangerement were those who designed and approved MAX 737 - Take a look at their design philosophy, and botched up technical decisions - cost of two aircrafts /350 people. Criminal hiding of the design flaws - second aircraft / 150 people. By the way, the main devil (Muilenburg) who supervised the whole process walked away with dozens of millons of USD of severeance compensation, for him, not for the crash victims.
 
Yes, failure is unavoidable, you are absolutely right. But still every chance to reduce it shall be considered.
The MAX story is something different. The race between american and european industry has reached a point where there can only be losers, and aviation authorities close eyes in favour for their country and possibly thier own bank account. But this definitely is not part of this forum.
I am against letting autopiloted aircraft into the wild without proper safety and without regarding existing rules. If you ever had an encounter with such a f*cking drone, you'd totally agree.
 
I think I got a partial answer here:

https://nepp.nasa.gov/DocUploads/99810235-C28A-4A8D-BD52223A33EF7CDF/ASME-Hawaii993-lockeed.pdf

Especially the graph:

temperature.jpg

There is also another extrapolation graph, and the two seem to indicate several things:
- The lower temperatures are less damaging than the higher temperatures for the same Delta T (by a factor of 2)
- The faster temperature change is more damaging than slow temperature change (also by a factor of 2)
- The failure rate is extremely low for the first cycles, in fact, the first failure occured ; then when it gets to a certain point, there is a linear rise of failures which quickly reach total failure, i.e. you may have 3% failure at 250 cycles, but you will get 90 % failure at 350 cycles.
- The failure rate is proportional to temperature difference of each cycle.

From that I would conclude that one should make a "counter" of extreme cycles stored in EEPROM during operation which would be used to indicate end of life.

Gentle heating of the board from below probably would also significantly increase the life span.

However, there is another interesting point coming from the data: even a moderate delta cycling (20°C), which happens when the board sits on ground results in a maximum 8000-10000 cycles before failure. So if you leave the board sitting for 15 years, the chances that it will fail are quite high...

Going back to Teensy, I see that there are many power and ground contacts in the schematics (about 7 for each). The probability for them to fail at the same time are zero, so the chances for the processor to stop is close to zero.
The other critical connections are the crystal: an intermittent contact there would bring the processor to a halt.
The failure of a single output pin (like the servo driver) is obviously higher, but due to design redundancy (a failure of a single servo would never bring the aircraft down) it is not absolutely critical.


Still, I do not understand why using such unreliable technology for Teensy 3.5 - 4.0? Teensy 3.2 seems to be much more robust...
 
Last edited:
@chileflora,
Thats some good data you refer to and your conclusions are reasonable. One thing to note is that the graph is for CeramicBallGridArray's. The package is actually made of ceramic because hermetic packages are required for the military. So this is a much worse TCE mismatch than on a Teensy with its plastic package. Thats why the board sitting on the ground looks so bad compared to your usual experience.

So many details... here's some random thoughts.

My graph was for the T4 @ 600Mhz ~100mA. The T4 could be run at 150Mz at around 50mA or 24Mz, about 33mA.

The T3.5 and T3.6 don't dissipate as much. However stresses are approx. proportional to the (corner to corner distance)^3 and the T3,s are much larger packages.
If you must use a 3.5 or 3.6 consider not using the corner pads on the chip. Or even better monitor them for opens because temperature cycling failures ALWAYS start at the corners and work their way in.

Since BGA solder joints are not inspectable, (a mil requirement) an accelerated temp screening is required to weed out the loosers. Of course this uses up some life:(

Forget about the 2560, the T3.2 is way better in almost every way.
 
@chileflora,
Thats some good data you refer to and your conclusions are reasonable. One thing to note is that the graph is for CeramicBallGridArray's. The package is actually made of ceramic because hermetic packages are required for the military. So this is a much worse TCE mismatch than on a Teensy with its plastic package. Thats why the board sitting on the ground looks so bad compared to your usual experience.

So many details... here's some random thoughts.

My graph was for the T4 @ 600Mhz ~100mA. The T4 could be run at 150Mz at around 50mA or 24Mz, about 33mA.

The T3.5 and T3.6 don't dissipate as much. However stresses are approx. proportional to the (corner to corner distance)^3 and the T3,s are much larger packages.
If you must use a 3.5 or 3.6 consider not using the corner pads on the chip. Or even better monitor them for opens because temperature cycling failures ALWAYS start at the corners and work their way in.

Since BGA solder joints are not inspectable, (a mil requirement) an accelerated temp screening is required to weed out the loosers. Of course this uses up some life:(

Forget about the 2560, the T3.2 is way better in almost every way.

One of the major problems with T3.2 versus 2560 is the reduced number of pins and the lack of UARTs. In fact, for my design I need more than 60 pins, of which 20 are ADC, 18 are PWM, 14 are RX/TX pins, 4 I2C pins, and a few digital output pins.

The number of ADC needed is mostly due to power management (there are 4 voltage levels, 5 V, 6 V, 6-8.4 (2S Liion), 4S-6S Liion); the service voltages have 2 sources each plus common rail, so in total I have more than 10 voltage and 2 current inputs (plus motor power current inputs).

2560 is better than 3.2 in that it has: 16 ADC and 4 UARTs. But it can drive smoothly up to 12 servoes (using OCR A,B,C x 4 timers); all other implementations may have occasional jerking when there many interrupts.

Now even with Teensy 3.5 I was thinking of putting two of them, one being the main AP, and the secondary would be pin expander slave...

In terms of speed obviously Teensies 3.2 or 3.5 are faster.

Due to servo and ADC limitations I would have used 2 x 2560.

If I use Teensy 3.2 I would still need probably more than one T3.5 or 2560.

From what I can gather a Teensy 3.2 is as safe as Atmel 2560 based board.

But, if you compare Teensy 3.2 with 3.5, by how much is Teensy 3.2 "safer" compared to 3.5, i.e. for one failure of 3.2 how many failures of 3.5 would you expect? 2? 3? 5? 10?
 
Last edited:
Also, the processor of Teensy 3.5 has PTA19 and PTA18 pins which connect to the crystal in the extreme corner... So that means they would be first to go...
 
Back
Top