Radiation Testing

Radiation hardness assurance is the set of activities undertaken to ensure that the electronics and materials of a space system perform to design specification after exposure to the mission environment, iterated throughout the mission life rather than executed once [2]. It covers three effect classes with separate mechanisms, test methods and facilities: total ionizing dose, total non-ionizing dose (displacement damage dose), and single event effects [1]. Ground testing does not reproduce the space environment. It substitutes a convenient source that dominates the mechanism of interest, and the substitution is where the residual risk lives. Facility selection follows from the physics of the failure being sought, and the facilities used to simulate the environment are themselves a major source of uncertainty in the result.

Radiation design margin and part categorization

The piece-part method, derived from MIL-HDBK-814, categorizes every microelectronic part for each system application and each radiation environment by radiation design margin, defined as the part radiation failure level divided by the radiation specification level. Parts fall into three categories: unacceptable, hardness non-critical, and hardness critical. Hardness non-critical parts need no further testing or analysis. Hardness critical parts must be lot sample radiation tested for every purchased lot. An unacceptable part is either replaced or moved into one of the other categories by changing the specification level through shielding or more detailed transport analysis, changing the failure definition through circuit redesign, or changing the failure level through part substitution, hardening or lot selection [1].

Dose is normally approximated by plotting dose or fluence against depth of shielding for a solid sphere equivalent, with ray tracing over the mechanical CAD model used when a more localized number is needed [2]. Failure has more than one definition, and the categorization is meaningless without stating whether failure means a data sheet specification violation for the specific application or loss of function [1]. Categorization data must come from a sample of adequate statistical size drawn at random from a population representative of the flight parts.

The Single Event Effect Criticality Analysis is the system-level counterpart, a process that mimics failure mode, effects and criticality analysis but is tailored to radiation effects, sorting parts into functional, vulnerable and critical classes against the mission, its environment, its applications and its lifetime.

Total ionizing dose

Gamma rays above 1 MeV from a radioisotope source remain the preferred TID source in the governing standards, ESCC Basic Specification 22900 and MIL-STD-883 Test Method 1019 for microcircuits, with MIL-STD-750 covering discrete semiconductors [1]. Lower energy gamma rays, protons at 50 MeV or above, electrons and 10 keV X-rays are admissible case by case, with attention to electron-hole pair yield and recombination at high particle density [1].

Dose rate is the principal fidelity problem. The total dose response is a strong function of dose rate, and linear bipolar devices exhibit enhanced low dose rate sensitivity, so a part that passes at the high dose rate convenient in a laboratory can fail at the low dose rate of the actual mission. An ELDRS characterization therefore runs high and low dose rate, biased and unbiased, with five samples per condition, twenty parts in total; finding no outliers across those twenty bounds any pathological subpopulation at under 11 percent [1]. Failure mechanisms also depend strongly on operating bias, operating mode (standby or active) and temperature, so the simulation of operating conditions is a second source of error alongside the source itself [1].

Where the mission rate cannot be run, the acceleration becomes part of the result. The optical front end of a Europa Lander life-detection instrument was qualified to 300 krad, being the 150 krad expected behind 100 mils of aluminum over a 20-day surface mission with an engineering factor of two, by Co-60 gamma at 13.5 Rad(Si)/s for 6.17 hours, roughly 75 times the 0.170 Rad/s peak operating dose rate the same requirement states [8]. Exposure at the mission rate would have taken the length of the mission, so the campaign establishes survival to the dose and says nothing about annealing or recovery at the rate Europa delivers [8]. It is also gamma only, with no proton and no heavy ion exposure, in an environment dominated by electrons and ions, so it bounds accumulated dose and neither single event effects nor displacement damage.

Displacement damage

Displacement damage accumulates non-ionizing energy in bulk material and is generally not bias dependent, unlike TID [1]. Damage against particle energy is uncertain in II-VI and III-V materials, so testing has to use energies representative of the flight environment rather than a single convenient energy. Common test energies are 50 to 60 MeV protons, reduced to 10 MeV where energy dependence must be resolved [1]. Displacement effects and the associated proton test issues for satellite designers were set out in the 1999 NSREC short course and the treatment there remains the reference for the mechanism [4]. Detectors require subject matter expertise, because temperature, materials and annealing behavior are not straightforward calculations.

Single event effects

SEE testing is done with heavy ions and with protons, against the standards EIA/JESD57A, ASTM F1192, ESCC 25100, and MIL-STD-750E Method 1080 for single event burnout and single event gate rupture [1]. Burnout and gate rupture testing is run as pass/fail to establish safe operating limits, at the worst-case angle of incidence [1].

Device class changes what has to be measured. For an FPGA a single cross-section is not the useful output; the response decomposes into probabilities of configuration upset, functional logic upset and single event functional interrupt, each with its own test [3].

The exercising program is a test condition, not a detail of the setup. A part is de-lidded and irradiated in vacuum because the heavy ion range is tens of microns, and the cross section is then errors divided by fluence at each LET; for complex VLSI the bias and the exercise state dominate that count in a way they do not for a memory array, whose internal state is easy to define. Microprocessor cross sections at a fixed LET have been seen to rise by an order of magnitude when the exercising program uses cache, compared with a non-cache program run on the same device [7]. A microprocessor cross section quoted without the program that produced it therefore does not transfer to another application.

Latchup sets the hardest penetration requirement. The sensitive volume for single event latchup is tens of microns deep, much deeper than for non-destructive effects, so the ion must deposit charge to the bottom of that volume or susceptibility is underestimated; above 80 microns of range in silicon is usually adequate [1]. Roughly 50 percent of commercial CMOS parts are susceptible to latchup at some level, and roughly 50 percent of those fail catastrophically from latchup-induced overcurrent.

The effective LET concept, which treats an angled ion as an equivalent normal-incidence ion of higher LET, is inadequate for some modern devices, and risk avoidance rather than angular extrapolation is then the only option.

Commercial parts in flip-chip and lead-on-chip packaging drove the move to higher-energy beams in the first place: the test methods that make such parts testable at low beam energy are expensive, slow, and can themselves alter the radiation response of the part [6].

Facilities

Facility	Capability	Consequence for the test
LBNL BASE 88-Inch Cyclotron	Species to bismuth, energies to 30 MeV/u; irradiation in vacuum; fast species changes [1]	5 to 50 MeV beam energies require the part to be depackaged and often the die thinned [1]
TAMU K500 cyclotron	Species to gold, energies to 40 MeV/u; gold available at 15 MeV/u; testing possible in air; slower species changes	Preferred for parts with thick active regions such as power MOSFETs
MSU NSCL SEETF	Coupled K500 and K1200 cyclotrons; 9574 MeV Kr and 15048 MeV Bi delivered on the inaugural post-upgrade runs; beam attenuated upstream of the accelerators to avoid detuning at the target [6]	Reproduces 99 percent of the space radiation spectrum in LET and energy for LET above 3, and allows most commercial parts to be tested without delidding; a run uses a single ion species because switching ions requires 24 hours of tuning [6]
BNL NASA Space Radiation Laboratory	Heavy ions to Au at 400 MeV/u, penetration ranges to centimeters in silicon [1]	Allows testing without de-lidding, including flip-chips and whole circuit card assemblies; beam extracted in 0.3 to 0.4 s spills followed by about 3.6 s of beam-off time [1]

Testing a whole circuit card at NSRL introduces its own error: the LET at each part’s sensitive volume depends on the potting, lid and board material acting as a degrader ahead of it, so parts on the same board see different LETs, which is a problem for destructive-effect screening and for full cross-section characterization. Sectioning a part may be required to measure the depth [1].

High-energy proton access above 200 MeV in the United States now depends on medical proton therapy centers, following the shutdown of the Indiana University Cyclotron Facility [1]. Access models vary by site and include weekend blocks, time after patient treatments end for the day, and interleaving during treatment hours at lowest priority, and the business models at those facilities are volatile. Medical physics reports dose and dose rate in tissue or water while SEE testing needs dose in a semiconductor and particle flux and fluence normalized to area, so unit conversion is part of the test setup at a therapy facility [1].

The worked example of that route is a board-level campaign at the Massachusetts General Hospital Francis H. Burr Proton Therapy Center. A Vorago RH-OBC-1 single board computer took 3e11 protons/cm2 at 200 MeV, accumulating about 12.2 krad(Si), with no noticeable degradation [5]. Single bit upset cross sections on the same board were 3e-8 cm2/device in SRAM and 1.3e-7 cm2/device in ROM, and a functional interrupt in the Cypress boot FRAM required an external power cycle to recover, the vendor’s mitigation being to power the boot FRAM down when it is not in use. Commercial parts run in the same 200 MeV beam bound the other end of the range: an AMD Ryzen 7 1700 took 1.55e11 protons/cm2 with no failures and an AMD Radeon e9173 reached non-destructive latchup at 6.24e9, while one of two nVidia Jetson TX2 boards failed at 1.61e9 protons/cm2 and the other survived 1.89e9 [5]. Every event on the commercial parts cleared with a power cycle.

The heavy ion counterparts to these facilities each have a page: Berkeley, Texas A&M, Michigan State and the Brookhaven Tandem Van de Graaff.

What the ground test does not reproduce

Beam spectrum against flight spectrum. A heavy ion beam is monoenergetic and single-species. The galactic cosmic ray spectrum is neither. Where a part is shown immune to a species as heavy as bromine, immunity to more penetrating and damaging species can be argued, but the argument is a bound rather than a measurement [1].

Ion range against packaging. Below the NSRL energy class, testing requires physically opening the part, which changes it. Destructive physical analysis of the device materials and cross section is recommended before heavy ion testing so that ion penetration through the overlayers can be verified rather than assumed [1]. Test instrumentation, facility calibration and beam dosimetry have to return accurate event counts, LET and fluence before a result can be interpreted.

Environment model uncertainty. For TID the uncertainty is confined to trapped radiation and solar particle events, since galactic cosmic rays contribute little absorbed dose. The reference models are AE8 and AP8 for trapped particles, and ESP and PSYCHIC for solar proton and solar heavy ion fluences, as invoked by the Cross-Program Design Specification for Natural Environments. Space climate has large spatiotemporal variation, so model uncertainty is not removable and is instead absorbed into design margin and confidence level [1].

COTS parts. Archival radiation data for a commercial part may not apply to the part purchased: a die revision can completely invalidate previous radiation testing, which is acute for NAND flash. A radiation-hardened designator may cover only TID and possibly displacement damage; parts intentionally hardened against TID, displacement damage and SEE together are rare and may be specific to a fabrication or packaging lot [1]. Published compendium results carry the same caveat: they depend on the operational conditions of the test and each device has its own detailed test report that states them [5].

Standards applied

Standards invoked by the NASA avionics radiation hardness assurance guideline [1]:

Standard	Scope
MIL-STD-883 Test Method 1019	Ionizing dose (total dose) test procedure, microcircuits
MIL-STD-750, Test Method 1080	Semiconductor device test methods; single event burnout and gate rupture
ESCC Basic Specification 22900	Total dose steady-state irradiation test method
ASTM F1892	Ionizing radiation (total dose) effects testing of semiconductor devices
ASTM F1263	Analysis of overtest data in radiation testing of electronic parts
ASTM F1192	Measurement of single event phenomena from heavy ion irradiation
EIA/JESD57A	Test procedures for measurement of single-event effects in semiconductor devices
ESCC 25100	Single event effects test method and guidelines
ECSS-Q-ST-60-15C	Radiation hardness assurance, EEE components
MIL-HDBK-814	Ionizing dose and neutron hardness assurance guidelines
MIL-PRF-19500	General specification for semiconductor devices
EEE-INST-002	NASA instructions for EEE parts selection, screening, qualification and derating

Device-class methods sit above these. The NASA Goddard Radiation Effects and Analysis Group analyzes FPGA single event upset data by decomposing the device response into probabilities of configuration upset, functional logic upset and single event functional interrupt rather than reporting a single cross-section, and uses windowed shift register test structures to separate those contributions [3]. Aggregated results are published in the Goddard compendium series of TID, displacement damage dose and SEE test results, covering FETs, flash memory, FPGAs, optoelectronics, and digital, analog and bipolar devices, with a per-device test report published for each [5]. Those results depend on operational conditions and are not transferable without checking them.