Radiation Testing

Radiation hardness assurance is the set of activities undertaken to ensure that the electronics and materials of a space system perform to design specification after exposure to the mission environment, iterated throughout the mission life rather than executed once [2]. It covers three effect classes with separate mechanisms, test methods and facilities: total ionizing dose, total non-ionizing dose (displacement damage dose), and single event effects [1]. Ground testing does not reproduce the space environment. It substitutes a convenient source that dominates the mechanism of interest, and the substitution is where the residual risk lives. Facility selection follows from the physics of the failure being sought, and the facilities used to simulate the environment are themselves a major source of uncertainty in the result.

Radiation design margin and part categorization

The piece-part method, derived from MIL-HDBK-814, categorizes every microelectronic part for each system application and each radiation environment by radiation design margin, defined as the part radiation failure level divided by the radiation specification level. Parts fall into three categories: unacceptable, hardness non-critical, and hardness critical. Hardness non-critical parts need no further testing or analysis. Hardness critical parts must be lot sample radiation tested for every purchased lot. An unacceptable part is either replaced or moved into one of the other categories by changing the specification level through shielding or more detailed transport analysis, changing the failure definition through circuit redesign, or changing the failure level through part substitution, hardening or lot selection [1].

Lot sample radiation testing under bias is the accepted practice because the alternative was tried and failed. A 1980 Air Force and Defense Nuclear Agency program searched the literature for a pre-irradiation electrical screen that would predict total dose response without irradiating a sample, tested every candidate parameter against the data of the time, hFE, IB, IEBO, 1/f noise and BVEBO among them, and found none that correlated with bipolar transistor total dose failure [10]. The same report records the Mariner Jupiter/Saturn flight parts program’s experience trying to reuse irradiated parts by annealing them, restricted to 150 C for 96 hours on reliability grounds, with erratic results that led to several linear circuits being rejected for flight, and concludes that a sample radiation test on packaged devices under bias was the only technique the community accepted as effective, which is why the piece-part method still requires one for every lot rather than a pre-irradiation screen [10].

Full piece-part testing is not affordable at NewSpace budgets, and current guidance argues for tying requirements to what the environment, the device technology and the available test data actually support rather than testing every part, with the Single Event Effects Criticality Analysis sorting parts by mission consequence so analysis can substitute for test where the consequence is tolerable [2]. That criticality analysis is the system-level counterpart to the piece-part categorization above, and it is what turns a part-level design margin into a decision about which parts need a test campaign at all: constellation architectures change the calculus for destructive single event effects, since a defined number of allowable spacecraft losses converts that risk into a schedule and cost question, but cumulative total ionizing dose and displacement damage effects are not reduced by the same trade because they degrade the whole fleet at once [2].

The argument is illustrated rather than proven against a real mission: the tutorial that makes it works from the Saint Louis University CubeSat mission outcome database and from example part degradation curves rather than from a case carried end to end on a flown robotic mission, so the fleet-level trade is a framing tool for writing requirements, not a validated number [2].

Dose is normally approximated by plotting dose or fluence against depth of shielding for a solid sphere equivalent, with ray tracing over the mechanical CAD model used when a more localized number is needed [2]. Failure has more than one definition, and the categorization is meaningless without stating whether failure means a data sheet specification violation for the specific application or loss of function [1]. Categorization data must come from a sample of adequate statistical size drawn at random from a population representative of the flight parts. The criticality analysis process itself mimics failure mode, effects and criticality analysis but is tailored to radiation effects, sorting parts into functional, vulnerable and critical classes against the mission, its environment, its applications and its lifetime [2].

Total ionizing dose

Gamma rays above 1 MeV from a radioisotope source remain the preferred TID source in the governing standards, ESCC Basic Specification 22900 and MIL-STD-883 Test Method 1019 for microcircuits, with MIL-STD-750 covering discrete semiconductors [1]. Lower energy gamma rays, protons at 50 MeV or above, electrons and 10 keV X-rays are admissible case by case, with attention to electron-hole pair yield and recombination at high particle density [1].

Dose rate is the principal fidelity problem. The total dose response is a strong function of dose rate, and linear bipolar devices exhibit enhanced low dose rate sensitivity, so a part that passes at the high dose rate convenient in a laboratory can fail at the low dose rate of the actual mission. An ELDRS characterization therefore runs high and low dose rate, biased and unbiased, with five samples per condition, twenty parts in total; finding no outliers across those twenty bounds any pathological subpopulation at under 11 percent [1]. Failure mechanisms also depend strongly on operating bias, operating mode (standby or active) and temperature, so the simulation of operating conditions is a second source of error alongside the source itself [1].

Where the mission rate cannot be run, the acceleration becomes part of the result. The optical front end of a Europa Lander life-detection instrument was qualified to 300 krad, being the 150 krad expected behind 100 mils of aluminum over a 20-day surface mission with an engineering factor of two, by Co-60 gamma at 13.5 Rad(Si)/s for 6.17 hours, roughly 75 times the 0.170 Rad/s peak operating dose rate the same requirement states; exposure at the mission rate would have taken the length of the mission, so the campaign establishes survival to the dose and says nothing about annealing or recovery at the rate Europa delivers [8]. A separate powered-on sweep at dose rates bracketing the 0.170 Rad/s design point, run on the instrument’s photomultipliers rather than the accelerated survival exposure, showed dark current recovering only partway between exposures, which is what let the campaign separate prompt radioluminescence from permanent dose damage on the same part [8]. It is also gamma only, with no proton and no heavy ion exposure, in an environment dominated by electrons and ions, so it bounds accumulated dose and neither single event effects nor displacement damage.

The same campaign compared detector window material under gamma directly: UV silica produced fewer parasitic photons than borosilicate on otherwise identical photomultiplier tubes, and, per unit photocathode area, a 3 mm2 microPMT beat a 324 mm2 tube both in absolute response and in sensitivity to dose rate [8].

Displacement damage

Displacement damage accumulates non-ionizing energy in bulk material and is generally not bias dependent, unlike TID. Damage against particle energy is uncertain in II-VI and III-V materials, so testing has to use energies representative of the flight environment rather than a single convenient energy. Common test energies are 50 to 60 MeV protons, reduced to 10 MeV where energy dependence must be resolved [1]. Displacement effects and the associated proton test issues for satellite designers were set out in the 1999 NSREC short course and the treatment there remains the reference for the mechanism, including the guidance that the goal in most cases is to identify a laboratory test that reproduces the flight damage mechanism closely enough to be useful rather than to reproduce the flight energy spectrum exactly; the scaling relies on non-ionizing energy loss rate, which tracks measured device damage factors closely enough that a factor measured at one proton energy can be scaled to the whole mission spectrum, though the correlation breaks down at low proton energies near the displacement threshold [4]. Detectors require subject matter expertise, because temperature, materials and annealing behavior are not straightforward calculations: for an imager the two damage signatures that matter, dark current increase from midgap generation centers and charge transfer efficiency loss from carrier trapping that releases charge after the signal packet has moved on, have to be told apart rather than lumped into one number [4].

Single event effects

A part’s heavy ion response is normally reduced to a Weibull cross section against LET, using the highest LET at which nothing is seen at an effective fluence of about 1e7 particles per square centimeter as the threshold LET, and the fit is then used to compute an on-orbit upset rate [7]. The standard heavy ion menu used to build that curve runs from lithium at an LET around 0.45 up to gold at 82.3 MeV-cm2/mg, and reading any facility’s reported cross section against a mission’s actual LET spectrum requires knowing where in that menu the test beam sat [7]. SEE testing is done with heavy ions and with protons, against the standards EIA/JESD57A, ASTM F1192, ESCC 25100, and MIL-STD-750E Method 1080 for single event burnout and single event gate rupture. Burnout and gate rupture testing is run as pass/fail to establish safe operating limits, at the worst-case angle of incidence [1].

Device class changes what has to be measured. For an FPGA a single cross-section is not the useful output; the response decomposes into probabilities of configuration upset, functional logic upset and single event functional interrupt, each with its own test, using windowed shift register test structures to isolate each contribution rather than reporting one aggregate number [3]. The direction the cross section moves against clock frequency and added logic delay is itself diagnostic: flip-flop capture falls with both while transient capture rises with both, so which one dominates and whether a mitigation scheme such as local triple modular redundancy is actually working can be read off the trend rather than a single number [3].

The exercising program is a test condition, not a detail of the setup. A part is de-lidded and irradiated in vacuum because the heavy ion range is tens of microns, and the cross section is then errors divided by fluence at each LET; for complex VLSI the bias and the exercise state dominate that count in a way they do not for a memory array, whose internal state is easy to define. Microprocessor cross sections at a fixed LET have been seen to rise by an order of magnitude when the exercising program uses cache, compared with a non-cache program run on the same device [7]. A microprocessor cross section quoted without the program that produced it therefore does not transfer to another application; the parts also have to be de-lidded and irradiated in vacuum because the heavy ion range is only tens of microns, which is why exercise state and packaging both have to be stated alongside the cross section rather than assumed from the part number [7].

Latchup sets the hardest penetration requirement. The sensitive volume for single event latchup is tens of microns deep, much deeper than for non-destructive effects, so the ion must deposit charge to the bottom of that volume or susceptibility is underestimated; above 80 microns of range in silicon is usually adequate [1]. Roughly 50 percent of commercial CMOS parts are susceptible to latchup at some level, and roughly 50 percent of those fail catastrophically from latchup-induced overcurrent.

A destructive event’s apparent cause can be wrong. Heavy ion testing of the Analog Devices RH3845 step-down controller for Europa Clipper’s power subsystem attributed an early destructive event to single event burnout in the input ESD bipolar transistors. Laser testing at the JPL Picosecond Single Event Laser Facility, with 2.5 ps pulses focused to a 1 micron waist, mapped the failure site on the die, and further heavy ion testing at the LBNL 88-Inch Cyclotron confirmed the mechanism was instead transient-induced cross conduction in the external synchronous MOSFETs, which raising the in-line gate resistance from 2 to 10 ohms removed entirely up to 100 V input at an LET of 79 MeV-cm2/mg [11]. The mitigation that followed is a board-level choice, gate drive resistance and converter pre-load against a separate non-destructive stuck-at SEFI, not a part derating; a safe operating area built on the original burnout hypothesis would have specified the wrong requirement. The same campaign also qualified the part to 300 krad(Si) total dose at 42 mrad(Si)/s, a rate chosen as below the rate at which 90 percent of the Europa Clipper mission dose arrives, with no bias dependency [11]. The cross-conduction Weibull behind that safe operating area rests on only two fully characterized devices, and the authors say the effect can occur electrically at near-random instances independent of the beam, so the heavy ion cross section reported for it may be measuring an electrical instability the beam merely triggers rather than a purely radiation-induced rate [11].

The effective LET concept, which treats an angled ion as an equivalent normal-incidence ion of higher LET, is inadequate for some modern devices, and risk avoidance rather than angular extrapolation is then the only option.

Commercial parts in flip-chip and lead-on-chip packaging drove the move to higher-energy beams in the first place: the test methods that make such parts testable at low beam energy are expensive, slow, and can themselves alter the radiation response of the part [6].

Facilities

Facility	Capability	Consequence for the test
LBNL BASE 88-Inch Cyclotron	Species to bismuth, energies to 30 MeV/u; irradiation in vacuum; fast species changes [1]	5 to 50 MeV beam energies require the part to be depackaged and often the die thinned
TAMU K500 cyclotron	Species to gold, energies to 40 MeV/u; gold available at 15 MeV/u; testing possible in air; slower species changes	Preferred for parts with thick active regions such as power MOSFETs
MSU NSCL SEETF	Coupled K500 and K1200 cyclotrons; 9574 MeV Kr and 15048 MeV Bi delivered on the inaugural post-upgrade runs; beam attenuated upstream of the accelerators to avoid detuning at the target [6]	Reproduces 99 percent of the space radiation spectrum in LET and energy for LET above 3, and allows most commercial parts to be tested without delidding; a run uses a single ion species because switching ions requires 24 hours of tuning [6]
BNL NASA Space Radiation Laboratory	Heavy ions to Au at 400 MeV/u, penetration ranges to centimeters in silicon [1]	Allows testing without de-lidding, including flip-chips and whole circuit card assemblies; beam extracted in 0.3 to 0.4 s spills followed by about 3.6 s of beam-off time
JPL Radiation Effects Group Co-60 rooms	Two separate irradiators spanning more than five orders of magnitude of dose rate, a high dose rate source from 0.1 to 500 rad(Si)/s and a low dose rate source from 0.001 to 1 rad(Si)/s, plus a Dynamitron electron beam, run to MIL-STD-883 Method 1019.7 [9]	The low dose rate source is what makes enhanced low dose rate sensitivity testing possible in house rather than sent out; isotopic source activities are withheld and available only on request [9]

Cross sections measured at MSU on a Matra HM65656 SRAM agreed with results from Brookhaven and TAASC across beam energies spanning a factor of forty, validating the facility against established ones; a plastic-packaged IDT71256 on a degraded Kr beam nonetheless read two orders of magnitude below the delidded part, because the plastic was denser than a pure polymer and the ions ranged out before reaching the sensitive volume [6]. The retune cost is part of the facility’s economics: available beam time there is under 600 hours per year at 2300 to 2700 dollars per hour, several times the lower-energy facilities, so a full cross section versus LET curve is bought at a premium rather than assumed to be affordable [6].

For heavy ions and off-site protons the same group names, for each facility it uses, what that facility is for: Texas A&M for heavy ions to 40 MeV per nucleon, the LBNL BASE cocktails at 4.5 to 30 MeV per nucleon, Brookhaven where ion energy is immediately tunable with no degrader straggling, RADEF for low flux dosimetry, and Crocker Nuclear Laboratory for protons tunable from 2 to 65 MeV [9]. The facility description is the group’s own account of its capability with no independent verification, and it is dated 2013, so partnerships and beam access at those off-site facilities may have moved on since [9].

Testing a whole circuit card at NSRL introduces its own error: the LET at each part’s sensitive volume depends on the potting, lid and board material acting as a degrader ahead of it, so parts on the same board see different LETs, which is a problem for destructive-effect screening and for full cross-section characterization. Sectioning a part may be required to measure the depth.

High-energy proton access above 200 MeV in the United States now depends on medical proton therapy centers, following the shutdown of the Indiana University Cyclotron Facility [1]. Access models vary by site and include weekend blocks, time after patient treatments end for the day, and interleaving during treatment hours at lowest priority, and the business models at those facilities are volatile. Medical physics reports dose and dose rate in tissue or water while SEE testing needs dose in a semiconductor and particle flux and fluence normalized to area, so unit conversion is part of the test setup at a therapy facility [1].

The worked example of that route is a board-level campaign at the Massachusetts General Hospital Francis H. Burr Proton Therapy Center. A Vorago RH-OBC-1 single board computer took 3e11 protons/cm2 at 200 MeV, accumulating about 12.2 krad(Si), with no noticeable degradation [5]. Single bit upset cross sections on the same board were 3e-8 cm2/device in SRAM and 1.3e-7 cm2/device in ROM, and a functional interrupt in the Cypress boot FRAM required an external power cycle to recover, the vendor’s mitigation being to power the boot FRAM down when it is not in use. Commercial parts run in the same 200 MeV beam bound the other end of the range: an AMD Ryzen 7 1700 took 1.55e11 protons/cm2 with no failures and an AMD Radeon e9173 reached non-destructive latchup at 6.24e9, while one of two nVidia Jetson TX2 boards failed at 1.61e9 protons/cm2 and the other survived 1.89e9 [5]. Every event on the commercial parts cleared with a power cycle. The same compendium period reports single event burnout safe operating data for an SSDI GaN HEMT, showing that burnout voltage depends on ion track orientation relative to the device’s two-dimensional electron channel, a device-geometry dependency that a piece-part cross section reported without the incidence angle would hide [5].

The heavy ion counterparts to these facilities each have a page: Berkeley, Texas A&M, Michigan State and the Brookhaven Tandem Van de Graaff.

What the ground test does not reproduce

Beam spectrum against flight spectrum. A heavy ion beam is monoenergetic and single-species. The galactic cosmic ray spectrum is neither. Where a part is shown immune to a species as heavy as bromine, immunity to more penetrating and damaging species can be argued, but the argument is a bound rather than a measurement [1].

Ion range against packaging. Below the NSRL energy class, testing requires physically opening the part, which changes it. Destructive physical analysis of the device materials and cross section is recommended before heavy ion testing so that ion penetration through the overlayers can be verified rather than assumed [1]. Test instrumentation, facility calibration and beam dosimetry have to return accurate event counts, LET and fluence before a result can be interpreted.

Environment model uncertainty. For TID the uncertainty is confined to trapped radiation and solar particle events, since galactic cosmic rays contribute little absorbed dose. The reference models are AE8 and AP8 for trapped particles, and ESP and PSYCHIC for solar proton and solar heavy ion fluences, as invoked by the Cross-Program Design Specification for Natural Environments. Space climate has large spatiotemporal variation, so model uncertainty is not removable and is instead absorbed into design margin and confidence level [1].

COTS parts. Archival radiation data for a commercial part may not apply to the part purchased: a die revision can completely invalidate previous radiation testing, which is acute for NAND flash. A radiation-hardened designator may cover only TID and possibly displacement damage; parts intentionally hardened against TID, displacement damage and SEE together are rare and may be specific to a fabrication or packaging lot [1]. Published compendium results carry the same caveat: they depend on the operational conditions of the test and each device has its own detailed test report that states them [5].

Standards applied

Standards invoked by the NASA avionics radiation hardness assurance guideline:

Standard	Scope
MIL-STD-883 Test Method 1019	Ionizing dose (total dose) test procedure, microcircuits
MIL-STD-750, Test Method 1080	Semiconductor device test methods; single event burnout and gate rupture
ESCC Basic Specification 22900	Total dose steady-state irradiation test method
ASTM F1892	Ionizing radiation (total dose) effects testing of semiconductor devices
ASTM F1263	Analysis of overtest data in radiation testing of electronic parts
ASTM F1192	Measurement of single event phenomena from heavy ion irradiation
EIA/JESD57A	Test procedures for measurement of single-event effects in semiconductor devices
ESCC 25100	Single event effects test method and guidelines
ECSS-Q-ST-60-15C	Radiation hardness assurance, EEE components
MIL-HDBK-814	Ionizing dose and neutron hardness assurance guidelines
MIL-PRF-19500	General specification for semiconductor devices
EEE-INST-002	NASA instructions for EEE parts selection, screening, qualification and derating

Device-class methods sit above these. The NASA Goddard Radiation Effects and Analysis Group analyzes FPGA single event upset data by decomposing the device response into probabilities of configuration upset, functional logic upset and single event functional interrupt rather than reporting a single cross-section, and uses windowed shift register test structures to separate those contributions [3]. Aggregated results are published in the Goddard compendium series of TID, displacement damage dose and SEE test results, covering FETs, flash memory, FPGAs, optoelectronics, and digital, analog and bipolar devices, with a per-device test report published for each [5]. Those results depend on operational conditions and are not transferable without checking them.