Radiation Hardness Assurance for Commercial Space: Where to Start

Radiation hardness assurance (RHA) is the set of activities that gives a project a defensible answer to one question: will the electronics do what the mission needs, for as long as the mission needs, in the radiation environment the mission will see? Large agency missions answer it with a radiation engineering group, a parts programme and a test budget. A commercial team usually answers it with one engineer who has other jobs. This guide is for that engineer. It lays out what the job is, which parts of it matter most for a commercial mission, and how far you can get with public data and free tools before you have to buy beam time.

1. What RHA is, in one paragraph

Define the environment the mission will fly through. Translate it into requirements on the parts and the design: how much total dose each part must survive, how much displacement damage, and how often single event effects may interrupt or damage each function. Screen the parts list against those requirements using existing data. Test the parts for which no data exists and the risk is real. Where a part falls short, mitigate in the design, derate, shield, substitute, or accept the risk with the reasoning written down. Verify that the flight design meets the requirements and keep the record. That is the whole discipline; everything else is detail on one of those steps. The steps are the same for a flagship and for a three unit CubeSat; what changes is how much evidence each step needs and how much of the evidence can be borrowed instead of bought.

2. The three effect families and which one will hurt you

Radiation damages electronics in three distinct ways, and they need different evidence.

Total ionizing dose (TID) is the slow accumulation of trapped charge in oxides. It shifts thresholds, raises leakage, degrades gain in bipolar parts, and eventually causes functional failure. It is measured in rad(Si) or gray and it accumulates with time, so a mission's TID requirement scales with orbit and duration. Shielding works against it, because the electrons and low energy protons that deposit most of the dose in Earth orbit are stopped by a few millimetres of aluminium. A low Earth orbit below 600 km behind a typical 100 mil (2.5 mm) aluminium enclosure accumulates on the order of a kilorad per year; an 800 km polar orbit several times that; geostationary orbit tens of kilorads per year, mostly from electrons; medium Earth orbits inside the proton belt are the worst by a wide margin. These are orders of magnitude, not design numbers. Run the mission's own orbit in an environment model before you write a requirement.

Displacement damage is the structural damage protons and neutrons do to the crystal lattice. It matters for optoelectronics, image sensors, solar cells, precision bipolar references and anything whose performance depends on minority carrier lifetime. It is measured as a fluence of particles at a reference energy, or as displacement damage dose. Most digital electronics do not care about it. If your mission has a camera, a star tracker, an optocoupler or a LED based link, it does. The NIEL tool converts between energies and computes the dose.

Single event effects (SEE) are the consequences of one particle, a heavy ion of the galactic cosmic ray background or a proton, depositing enough charge in one place to flip a bit, produce a transient, hang a device, or trigger a destructive condition. They do not accumulate and they are not stopped by shielding, because the heavy ions that cause them penetrate any practical enclosure. They are described by rates, events per device per day, and by probabilities over a mission for the ones that only happen once. For a commercial mission built from commercial parts, this is the family that will hurt you, for two reasons. Commercial CMOS is often susceptible to single event latchup (SEL), a parasitic short circuit that destroys the part unless the supply current is limited and the power cycled within milliseconds. And commercial processors, FPGAs and memories upset and hang at rates that a design without watchdogs, error correction and scrubbing cannot live with. The SEE guide covers each effect.

3. A minimum credible RHA programme for a smallsat

The following is not a standard. It is what a competent reviewer would expect to see from a commercial team that took the problem seriously with a small budget, in the order the work should happen.

1. Write the environment down. Orbit, altitude, inclination, duration, launch date relative to the solar cycle, and the shielding you can credibly claim. Run a trapped particle model and a cosmic ray model for that orbit and record the total dose versus shielding depth curve, the trapped proton spectrum, the galactic cosmic ray LET spectrum at solar minimum, and a solar particle event case. Half of all later arguments are settled by this document.
2. Set requirements per effect, not one number for everything. A TID level with a margin factor, a displacement damage fluence for the parts that care, and for single event effects a statement of what each function may tolerate. The SEECA workbench exists to turn "what the function may tolerate" into a rate or a probability you can test against, and to keep the reasoning.
3. Screen the parts list before you buy anything. For every active part, ask three questions. Is there public radiation data on this part or its die family? The data source catalogue lists where to look, including what is behind registration or paywalls. Is the technology one with a known problem, bulk CMOS for latchup, bipolar linear for low dose rate sensitivity, power MOSFETs for burnout, SRAM based FPGAs for configuration upsets? And does the function it performs matter, in the sense of the criticality classes? A part with no data, a risky technology and a critical function is a test candidate. A part with no data in a function that can be reset is a design candidate.
4. Design for the effects you cannot afford to test away. Current limiting with autonomous power cycling on every commercial CMOS supply rail. Independent watchdogs on every processor. Error correction with scrubbing on every memory that holds code or long lived data; the EDAC tool shows what the scrub period buys. Configuration scrubbing on SRAM based FPGAs. Voltage derating on power transistors; the derating advisor gives the number by technology. These are cheap on paper and expensive after layout, so this step belongs before the schematic is frozen.
5. Test where the bound is not good enough. A part whose risk you cannot bound from data, and whose failure you cannot design around, is the one to spend beam time on. Latchup and other destructive effects come first, because they are the ones a test can rule out. The test planning guide covers what to ask for. Total dose testing is cheaper and slower; do it on the parts whose data is old, absent or from a different fabrication lot.
6. Close every open item in writing. A list of parts, each with the requirement, the evidence, the margin and the decision. Where the decision is to accept a risk, say so and say why. This document is what a customer, an insurer or a launch provider will ask for, and it is what you will need when the first anomaly happens on orbit.

4. What you can borrow instead of buy

A commercial team's real advantage is that most of the hard work has been published. Decades of NASA, ESA, JAXA and university test data sit in open databases and conference proceedings. The distribution data on this site shows how tested parts spread in total dose hardness, latchup immunity and burnout by part class, which tells you before any test how likely a class of part is to be a problem. The SEL threshold predictor turns a single public measurement or a null result into a threshold estimate with bounds. The analog transient guideline bounds transients in linear parts you have no data on. The proton proxy tool says what a cheap proton test does and does not prove about heavy ion behaviour, which is the right question to ask before choosing between a proton and a heavy ion campaign.

Two things cannot be borrowed. The first is lot to lot variability in total dose response, particularly for bipolar linear parts, where data from another lot is a hint and not a guarantee. The second is application specific single event response: a transient that is harmless in one circuit is a reset in another, and only your circuit knows which.

5. Mistakes that are easy to avoid

• Treating "automotive grade" or "industrial grade" as radiation tolerant. Those qualifications cover temperature, humidity and lifetime. They say nothing about radiation, and automotive parts are as likely to latch up as any other commercial CMOS.
• Shielding against single event effects. Adding aluminium reduces total dose and does very little to the heavy ion rate. The fix for SEE is in the design, not the enclosure.
• One radiation requirement for the whole vehicle. A single LET threshold stamped on every part forces either expensive parts everywhere or waivers everywhere. Requirements belong to functions.
• Proton testing as a substitute for heavy ion testing without checking what it covers. A clean proton result bounds the heavy ion response only over the LET range that proton recoils reach, which is roughly 15 MeV cm2/mg. Parts that latch up above that are invisible to a proton test.
• Testing at the wrong bias or temperature. Latchup is worst at the highest supply voltage and the highest temperature the part will see. A room temperature, nominal voltage test can miss it.
• Ignoring solar particle events. The mean environment sets the average rate. The worst day of a large event can raise heavy ion rates by orders of magnitude for a day, and that is when a marginal design fails.

Frequently asked questions

Related tools and pages

• SEECA workbench: turn mission requirements into per function single event requirements and track the evidence.
• Parts radiation advisor: first pass risk by part number and technology.
• SEE rate tool and SEL threshold predictor: rates and thresholds from data or bounds.
• Power derating advisor and EDAC tool: design mitigation sized to the effect.
• Standards, facilities and data sources: what the requirements say, why, and where the data lives.
• Glossary: the vocabulary, briefly.

References