Commercial off the shelf parts are how most new spacecraft get built. They are cheaper, faster, better performing and easier to buy than radiation hardened parts, and most of them work in space most of the time. The job of a radiation risk assessment is to find the ones that will not, before launch, without testing everything. This checklist is the sequence a working radiation engineer applies to a commercial parts list. It is written to be run by someone who is not one.
1. Start from the function, not the part
Before assessing a part, know what happens to the mission if it misbehaves. A part whose upset is masked by error correction, whose reset is caught by a watchdog, or whose loss is covered by a spare needs far less evidence than a part whose single failure ends the mission. The criticality classes of a single event effect criticality analysis (Error-Critical, Error-Vulnerable, Error-Functional) are the vocabulary for this, and the SEECA workbench is the place to record it. Doing this first means the rest of the checklist is applied hardest where it matters and lightly where it does not.
2. Technology red flags
Radiation response follows process and technology more than part number. These are the flags that should move a part up the list.
| Technology | Effect to worry about | Why |
|---|---|---|
| Bulk CMOS (most digital and mixed signal ICs) | Single event latchup | Parasitic well to substrate structures; destructive unless current limited and power cycled. Worst at high voltage and temperature. |
| Bipolar and BiCMOS linear (op amps, comparators, references, regulators) | Enhanced low dose rate sensitivity (ELDRS), analog transients | Some bipolar processes degrade far more at space dose rates than in a standard high rate test; transients propagate to loads. |
| Power MOSFETs, especially high voltage vertical devices | Burnout and gate rupture | Destructive at a fraction of rated voltage under heavy ions; needs derating from measured data. |
| SRAM based FPGAs | Configuration upsets, functional interrupts | The design itself is stored in upsettable memory; needs scrubbing and, for critical logic, triplication. |
| DRAM and DDR memory | Upsets, functional interrupts, row and column errors | High density plus control logic; error correction must handle bursts confined to one die. |
| NAND flash, managed storage, SD and eMMC | Controller functional interrupts, data loss | The controller is a commercial processor with firmware; recovery may need a power cycle. |
| Optocouplers, LEDs, CCD and CMOS imagers, photodiodes | Displacement damage, transients | Proton damage degrades current transfer ratio and dark current; sensitive to fluence more than dose. |
| DC-DC converter modules, point of load regulators | Latchup in the controller, output transients, burnout in the switch | Several vulnerable technologies in one package with little visibility inside. |
| Advanced nodes below about 28 nm, FinFET | Multiple cell upsets, proton direct ionization | Small cells and low critical charge; angular response no longer follows the cosine law. |
Silicon on insulator, epitaxial CMOS and processes with buried guard structures are much less prone to latchup; gallium nitride and silicon carbide power devices have their own destructive modes and their own derating curves. The technology line of the datasheet, or a decapped die photograph, is often the single most informative thing you can learn about a commercial part.
3. Look for data before you test
Someone may already have tested your part, or its die family, or its predecessor. Search in this order.
- Open agency databases. NASA Goddard's radiation database and NEPP reports, JPL's public reports, ESA's radiation databases, JAXA's data, and the IEEE Radiation Effects Data Workshop record. The data source catalogue lists each with its access terms.
- Conference proceedings. NSREC, RADECS and REDW papers report thousands of parts. A part number search in the IEEE library is worth ten minutes.
- Manufacturer statements. A few commercial vendors publish radiation reports or offer radiation tolerant grades of commercial die; many will say informally whether a part is epitaxial or SOI. Ask.
- Heritage. Flight history on another spacecraft is evidence of a kind, if the orbit, duration and application were comparable and the anomaly record is honest. Ask what was actually observed, not whether the mission succeeded.
Then apply the two rules of borrowed data. Data from a different fabrication lot transfers well for single event effects, which depend on design and process, and poorly for total dose in bipolar parts, which can vary by a factor of several between lots and date codes. And data taken in a different application condition (bias, temperature, mode) may not transfer at all for latchup and transients; check the conditions in the report against yours.
4. Bound what you cannot find
For a part with no data, the question is whether it can be bounded well enough from its class. The distribution data shows how tested parts of each class spread in total dose hardness, latchup immunity and burnout, so you can say how likely a random member of the class is to be a problem. The SEL threshold predictor turns any single latchup observation, including a null result at a low LET, into a threshold estimate with bounds. The analog transient guideline bounds transient amplitude and width by device family. The parts advisor gives a first pass by part number and technology. None of these replaces a test; each tells you whether a test is needed and what it would have to show.
5. Screening tests that are worth their cost
When a part is critical, has a red flag technology and has no usable data, test it. In rough order of value for money:
- A latchup screen with heavy ions at high LET, maximum voltage and elevated temperature, with current limiting so the part survives to be examined. A day of beam time can screen several parts. The test planning guide covers the details.
- A total dose test to at least twice the mission requirement, with parametric measurements at steps, on samples from the flight lot. For bipolar linear parts, follow a low dose rate or a qualified accelerated method for ELDRS. Cheaper than heavy ions and needs no delidding; slow.
- A proton test as a partial substitute for heavy ions when delidding is impossible or the budget is small, with the understanding that it covers latchup only up to about LET 15 and says nothing about heavy ion thresholds above that (proton proxy tool).
- A displacement damage test with protons for optoelectronics and sensors, measured as a fluence at a stated energy and converted with the NIEL tool.
- A board or system level irradiation to verify a mitigation, once the parts are chosen.
6. Mitigation you should have anyway
Most commercial part risk is retired in the schematic, not in the beam room. Current limiting with autonomous power cycling on every commercial CMOS rail. An independent watchdog on every processor. Error correction with scrubbing on memories that hold code and long lived data, sized with the EDAC tool. Configuration scrubbing and, for critical logic, triplication in SRAM based FPGAs. Voltage derating on power transistors to the measured safe operating area, not to a rule of thumb. Filtering and hold off on the outputs of linear parts feeding decision circuits. Redundancy where a single loss would end the mission. Each of these changes a part's criticality class, and the workbench records the change with what must be verified for the credit to stand.
7. Write the acceptance down
The output of a risk assessment is a record, not a feeling. For every active part: the function and its criticality class, the technology, the requirement it must meet, the evidence (with a reference, a grade and the conditions it was taken under), the margin, any mitigation credited and how it will be verified, and the decision: accepted, accepted with mitigation, to be tested, or replaced. A part accepted on risk should say whose risk and why it is acceptable. This record is what a customer or a launch provider asks for; it is also the document you will open first when something happens on orbit.
Frequently asked questions
Are automotive grade parts radiation tolerant?
No. Automotive qualification covers temperature range, humidity, vibration and long life under those stresses. It does not include radiation, and automotive parts are built on the same bulk CMOS processes as consumer parts. They are often well made and well documented, which helps, but their radiation response is unknown until someone tests it.
Can I use data from a different lot or date code?
For single event effects, usually yes, because the response is set by design and process. For total dose in bipolar and BiCMOS linear parts, treat other lot data as a hint: lot to lot variation of a factor of several is documented, and a flight lot sample is the standard practice for critical parts.
Does a plastic package matter?
Not for radiation response directly. It matters for test access (the die has to be exposed for heavy ions) and for the other environmental qualifications, which are outside this checklist.
What if a part is critical, has no data and cannot be tested in time?
Change the design so it is not critical: add a spare, protect the rail, add a watchdog, or substitute a part with data. Accepting an unbounded destructive risk on a critical function is the one thing the checklist does not allow.
How much margin should total dose data have?
A demonstrated level of at least twice the mission requirement is the conventional radiation design margin for parts with well characterised response; more for bipolar linear parts, for data from another lot, and for missions that cannot be repaired. The standards page gives the origin of the factor of two.
Related tools and pages
- Parts radiation advisor, distribution data, data source catalogue.
- SEL threshold predictor, proton proxy tool, analog transient guideline.
- EDAC tool, power derating advisor, SEECA workbench.
- Heavy ion test planning guide.
References
More guides: Heavy Ion SEE Test Planning · Radiation Hardness Assurance for Commercial Space · How to Calculate a Single Event Effect Rate from Heavy Ion Test Data · Single Event Effects Explained · Total Dose, Displacement Damage and Single Event Effects Compared · Glossary · All guides
Questions, corrections or a case you would like written up: the community forum or contact.