Power device voltage derating for heavy-ion effects

Methodology: the Heavy-Ion Power Derating priors (HIPD)

This page recommends how far below its voltage rating a power device should be operated so that a heavy ion does not destroy it. The recommendation comes from one machine-readable model file, hipd-2026-09.js (release 2026-09), which carries the fitted coefficients and the API the page calls. The model is an interval-censored fit to the 1,819 safe-operating points of 1,161 device records from published papers and reports and from proprietary test reports, grouped into 1,272 test conditions and split into 13 technology classes. A third-party vendor screen (856 points from 532 records, all at a single LET) is fitted alongside as a variant (1,672 conditions with it), which the tool uses only when its Add vendor screen switch is on; with it the corpus holds 2,675 points from 1,693 records. Two things distinguish the model from a flat derating rule: every test condition is treated as an interval rather than a value, so parts that survived count as evidence; and the dependence on LET is measured within parts rather than across them. Published sources are cited. Proprietary test reports and the vendor screen are identified only as such.

1. What the model answers

Two destructive heavy-ion mechanisms end the life of a power device. In single-event burnout a single ion turns on the parasitic bipolar transistor inherent in the vertical structure of a power MOSFET or the parasitic path in a rectifier, and the device sustains its own destructive current. In single-event gate rupture the ion track lets the gate dielectric see a field it cannot hold, and the oxide fails. Both depend strongly on the applied drain or reverse voltage, which is why the standard mitigation is not a hardened part but a derating: run the device far enough below its rating that the ion cannot start the process.

The question a designer asks is therefore "how far below". The usual answers are flat rules, most often 50 percent or 75 percent of the rating, applied without regard to technology or to the LET the mission requires. This model replaces the flat rule with a per-class distribution: for a stated technology class, LET requirement and accepted risk, the fraction of the rating at which that risk is met. It is a population prior for a part you have not tested. A part with its own heavy-ion qualification data should be used on that data.

2. Corpus and extraction

Every heavy-ion burnout and gate-rupture record on a power device was pulled from the combined test corpus that also underlies the SEL work: IEEE REDW and RADECS data-workshop papers, RADECS Proceedings and IEEE TNS papers, NASA Goddard radiation test reports, and proprietary test reports. A third-party vendor screen of commodity silicon MOSFETs, carried out entirely at a single LET, was added as a separate and clearly flagged source. Records were converted to structured safe-operating points under a written specification with explicit guard rules: never invent a number, never move a number between fields to complete a point, never treat a datasheet rating as a test voltage, and produce no point at all when the record states an outcome without the voltage at which it occurred. Roughly a quarter of records yielded no point for exactly that reason, most often because the source reports its voltage steps only in a figure.

3. Response and censoring

The modeled quantity is the fraction of the rating at which a part first shows an adverse response,

where V_adverse is the drain-source voltage, or the reverse voltage for a rectifier, and V_rated is the manufacturer maximum. Working in the fraction rather than in volts is what lets a 20 V trench MOSFET and a 1200 V silicon carbide MOSFET inform the same model.

Almost no test reports the adverse voltage exactly. What a test reports is a sweep: the part survived at some voltages and failed at another, or it survived everything, or it failed at the first step tried. Each condition is therefore an interval:

Points are grouped per record, LET and gate bias so that the two halves of one sweep become one interval rather than two independent observations, and the likelihood is the probability that the true adverse voltage falls inside each interval. Fitting only the observed failure voltages, which is what a naive average of published thresholds does, would bias the model low, because every part that survived its whole sweep would silently drop out.

4. The LET question

Parts are tested at whatever LET the facility and the program allowed. Some appear at a single LET, some at three or four, and the corpus spans LET 0.2 to about 110. Combining them requires a model of how the adverse voltage depends on LET, and the obvious approach fails.

Across parts the LET trend is invisible. Pooling every condition and regressing on ln(LET) gives a slope of -0.09 with a 90 percent interval of [-0.19, 0.01], indistinguishable from zero, and a deviance against zero slope of 0.8. That is not because LET does not matter. It is because LET varies mostly between parts rather than within them, and the part-to-part spread is several times the LET effect. A robust part that happened to be tested only at high LET looks, to the pooled regression, like evidence that high LET is harmless.

Within parts the LET trend is clear. Restricting to parts tested at more than one LET at the same gate bias and taking the ratio of their adverse voltages differences out the part-to-part term. That gives

Per class, where there are at least eight pairs: Si trench 0.169, Si planar VDMOS 0.141, integrated power IC 0.023. The wide-bandgap figure is worth watching but is not yet supported by enough pairs to publish as a separate slope, so a single global slope is used.

The mean model is therefore referenced to LET 37, the usual heavy-ion screening requirement:

so a_class is the log median adverse fraction at LET 37 and the reference point is the number designers already work to. Predictions are held flat above LET 60: published threshold-versus-LET curves saturate once an ion deposits more charge than the parasitic structure needs to trigger, and the corpus has too little data above 60 to fit the knee, so holding flat is the conservative reading. A saturating exponential form was tried first; its saturation length was not identified by this data and ran to infinity, which is why the reference form is used instead.

5. Technology classes

Enhancement-mode GaN is split into space-grade and commercial families, because the two behave as separate populations rather than as one spread: space-qualified parts survive their full rating to LET 85, while commercial parts fail between roughly 0.4 and 0.9 of rating. Fitting them together drove the scatter to the model bound and produced a tail quantile describing neither. Beyond that, structure matters more than material alone, so silicon MOSFETs are split by gate structure rather than lumped, gallium nitride is split by whether the part is a plain enhancement-mode HEMT or a cascode with a series silicon FET, and rectifiers are kept separate from transistors and split by material. Class intercepts are partially pooled toward the global mean by DerSimonian and Laird shrinkage (between-class spread tau = 0.4847), so thin classes are pulled toward the population rather than overfitted, and classes with fewer than ten conditions get no fit at all. Scatter is fitted per class where there are at least 25 conditions and is bounded; a class whose fitted scatter sits at the bound is flagged in the tool, because the data do not resolve it.

6. Time, and why there is no era term

The companion latchup model splits its populations at 2010, because latchup susceptibility turned out to depend on process generation. The same question was asked here three ways, and the answer is that this model carries no time term. The corpus is not short of history: 33 records from the 1990s, 294 from the 2000s, 677 from the 2010s and 157 from the 2020s.

A binary split is significant at every cut year, and the sign flips. Fitting a shared old-versus-new offset across the classes that have both sides gives, at a cut of 2005, newer parts tolerating 0.64 times the voltage; at 2010, 1.48 times; at 2015, 1.47; at 2018, 1.43. Every one of those is nominally significant by a likelihood-ratio test. A coefficient that changes sign depending on where the line is drawn is not measuring a trend in the devices.

Modeled continuously, the trend disappears. Replacing the binary split with publication year as a continuous covariate, over the six classes with at least 25 conditions and a decade of span, gives a trend of -0.12 per decade with a likelihood-ratio deviance of 3.8, which is not significant. If anything the point estimate leans very slightly the wrong way, toward newer parts tolerating less.

Where a per-class comparison is possible, the medians do not move; only the scatter does. Three classes have enough conditions on both sides of 2010. Silicon lateral: median 0.525 before against 0.526 after, which is no change at all, while s_ln falls from 0.56 to 0.20. Silicon planar VDMOS: median 0.561 against 0.498, very slightly worse, while s_ln falls from 1.57 to 1.18. Integrated power ICs go the other way on both counts, median 0.83 against 1.25 but s_ln rising from 0.66 to 1.67, so their tenth percentile actually drops by a factor 0.41. The apparent modern advantage in the binary fits was never a shift in central tendency. It was the older populations being more heterogeneous, which moves a tail quantile without moving the device physics.

Era is also largely aliased with technology. Silicon carbide MOSFETs, silicon carbide Schottky rectifiers, enhancement-mode GaN and silicon Schottky rectifiers have essentially no pre-2010 records in this corpus, and silicon trench has five. Those parts were not being heavy-ion tested for destructive effects before 2010 because, in flight-relevant form, they largely did not exist. A time term would therefore mostly re-encode the technology class the model already conditions on.

The practical consequence is that a designer should condition on technology, not on decade. Choosing a modern trench MOSFET over a 1990s planar one does not buy derating headroom; it changes which class applies, and the class numbers already say what that costs.

One caveat runs the other way and is not captured by any of the above. Within the wide-bandgap classes the technology genuinely did move fast, and the corpus is thin enough that a single early paper can dominate a class. The commercial GaN results here span 2016 to 2021 on roughly a dozen part types, and the earliest of them are devices that do not represent what is being bought today. At this sample size the model cannot separate that from ordinary part-to-part spread, so the GaN classes are flagged in the tool as thin and fast-moving, and they are the classes where part-specific test data should most strongly outrank the prior.

7. Results by class

Table 1 gives the fitted numbers at the reference LET. The median column is the part in the middle of the class: half of the class is predicted to fail below it, so it is not a design point. The 10 and 5 percent columns are the design numbers, the fraction of the rating at which the modeled probability of an adverse response is held at or below that value. Where the median exceeds 1.0 the class as a whole tolerates its full rating at this LET and the derating question is answered by the electrical rating rather than by radiation.

Table 1. Fitted derating at LET 37, published and proprietary corpus (the default)

Every recommendation is also checked against the observation floor, the lowest voltage fraction at which any part of that class was actually tested. A quantile below that floor is an extrapolation into a region the data do not cover, and the tool flags it rather than presenting it as an observation.

Table 2. How the 10 percent recommendation moves with the LET requirement

The LET dependence is real but modest compared with the class differences and with the within-class spread. Going from LET 10 to LET 60 costs about 25 percent of the tolerable voltage, whereas moving between technology classes moves it by factors of several.

8. Against the flat derating rules

Figure 5 puts the fitted recommendations next to the flat rules. The rules are not uniformly wrong, they are wrong in both directions at once. Section 7 gives the numbers this rests on. For commodity trench silicon MOSFETs and for silicon carbide the 50 percent rule is badly optimistic: the fitted median part is already adverse at or below half its rating, so a designer following the rule is operating a coin flip. For silicon rectifiers the same rule is unnecessarily harsh, costing voltage headroom the data do not require. A rule that does not know the technology cannot be right for both.

9. The vendor screen

One source is a third-party screen of 532 commodity silicon MOSFETs carried out entirely at a single LET, with a voltage sweep per part. It is by far the largest single contribution to the silicon trench class and its method has not been independently verified, so it is excluded from the default fit and offered as an option, with the tool reporting both answers whenever a class contains any of it.

Two features of that screen required care. First, more than half of its recorded failures are tagged as a protected, current-limited condition in which leakage or degradation was treated as the failure, rather than a confirmed destructive event. Second, and more consequentially, every sweep begins near 20 percent of the rating and 40 percent of its failures occur at that very first step. For those parts the adverse voltage is unresolved somewhere below the floor of the test, so the failure is not a measurement and it is excluded; retaining it would let the fitted lower tail be set by the floor of someone's test protocol rather than by the devices. Excluding the protected-condition rows instead, which sounds like the more obvious correction, makes matters worse: those rows carry the resolved higher-voltage failures, and what remains is dominated by the floor-pinned ones.

With the floor-pinned failures removed the two source variants agree far better than they did. For silicon trench at LET 37 and 10 percent risk the corpus alone gives 24% of rating and adding the screen gives 20%, against a factor of three disagreement before the correction.

Table 3. Sensitivity to the vendor screen, 10 percent recommendation at LET 37

Neither answer is obviously the right one. A screen run to a fixed protocol on many parts will find failures that a published paper on a hand-picked part would not report, so some of the difference is genuine population selection rather than method. The conservative course is to take the lower of the two numbers unless there is a reason to prefer one source, and that is what the tool advises when the two disagree by more than about a factor of 1.5.

10. Burnout, gate rupture and leakage

The model is fitted twice. The catastrophic definition counts only burnout and gate rupture. The any adverse definition also counts a reported leakage or degradation onset, meaning a permanent parametric shift attributed to the ion but short of destruction. Which definition applies is a system question rather than a device question: a converter that can tolerate a few microamps of extra gate leakage for the rest of the mission should use the catastrophic definition, whereas a precision current path or a part whose leakage will run away with temperature should use the other.

The gap between the two is largest exactly where it should be. For silicon carbide MOSFETs the any-adverse recommendation is 1.4 times lower than the catastrophic one, because permanent gate and drain leakage increases in silicon carbide occur well below any destructive voltage and are widely reported. For silicon rectifiers the two definitions nearly coincide.

Mechanism screening carried over from the SEL work matters here in the opposite direction. Records where a voltage-swept destructive event in a smart-power or BCD part is burnout of an embedded DMOS device rather than latchup were adjudicated separately; the same signature that removes a part from the latchup statistics puts it into these. Post-irradiation gate-stress failures, where nothing happens in the beam but the part fails a subsequent stress, are recorded as degradation rather than as an in-beam failure unless the source itself calls them failures.

11. How the tool uses the model

The tool evaluates the fitted lognormal at your LET and risk level:

and multiplies by your voltage rating. Four guards apply. The recommendation is never allowed above the manufacturer rating, since the output is a maximum operating voltage and the electrical rating governs; when the risk quantile lands above the rating the tool says that no heavy-ion derating is indicated rather than inventing headroom. LET requests above 60 are held at 60 and flagged. A class whose fitted scatter sits at the model bound is flagged, because its tail quantile is then driven by the bound rather than by data. A recommendation below 5 percent of rating is flagged as effectively unusable, because at that point the honest engineering answer is a qualified part, a different technology, or protection that survives the event, not a derating.

The risk figure is the fraction of the tested part types in that class that were adverse at that voltage and LET, read as a probability for a part of the class whose own data are not in hand. It is a planning prior from a test archive, not a market sample: parts get tested because someone was concerned about them, and the archive is weighted accordingly. It is a per-part probability, not a mission rate. Converting to a mission rate needs the ion fluence the part will see, which is what the SEE Rate Assessment Tool does, and the number of such parts in the system, which is what the SEL Test-LET Tool does for latchup.

12. Limitations

Ion energy and range are not yet covariates. Burnout and gate rupture both depend on how deep the charge track runs, not only on surface LET. The corpus contains explicit counterexamples in which the same LET at different beam energies gave different threshold voltages. Energy, energy per nucleon and range in silicon are recorded per point where the source gave them, and will become covariates when the phase-two extraction fills them in for more records. Until then a recommendation based on low-energy beam data may be optimistic for the deep tracks of a real cosmic-ray environment.

Gate bias is recorded but not fitted. Gate rupture thresholds move strongly with the off-state gate voltage, and the corpus shows it clearly within individual sweeps. There are not yet enough conditions carrying both a gate bias and a bracketed threshold to fit it per class, so the model averages over the gate biases that were tested. A part run with a strongly negative gate bias sits at the pessimistic end of that average.

Angle and temperature are not covariates. Effective LET absorbs some of the angle effect where the source reported it that way. Temperature is recorded and is known to matter, but too few conditions carry it.

Class scatter is large and in several classes not resolved. The spread within a technology class is wider than the difference between classes for some pairs. That is a statement about commodity power devices rather than about the model: two parts with the same voltage rating from the same vendor in the same package can differ by an order of magnitude in burnout voltage. It is also why the recommendation sits in the lower tail rather than at the median.

Thin classes. SiC JFET, GaN cascode and IGBT have too few conditions to fit, and SiC Schottky and GaN classes rest on small samples whose intercepts are pulled substantially toward the population. Treat those numbers as indicative and weight any part-specific data heavily.

The voltage rating is the denominator, and it is not always verifiable. Every number here is a fraction of the manufacturer maximum rating, so the rating matters as much as the failure voltage. Where a source quotes a rating that has already been derated for space rather than the datasheet maximum, the fractions computed from it are biased and there is no way to tell from the record. For the corpus the ratings come from the part database and can be checked against datasheets. For the third-party vendor screen they cannot: only one of its 532 parts also appears in the corpus, so its ratings are unverifiable against any independent source. Their values do look like datasheet maxima rather than derated ones, since they include the odd but real figures a datasheet carries, but that is an impression rather than a check, and it is a further reason the screen is not the default.

This is a prior, not a qualification. It describes the historical population of tested power devices. It does not know about your lot, your bias conditions, your thermal design or your protection circuit, and it cannot substitute for testing a part you intend to fly.

13. Files and reproducibility

The site publishes one file for this model, hipd-2026-09.js. It carries the fitted coefficients for both response definitions and both source variants, the DeratingModel API the page calls, and the anonymized point cloud the charts draw, reduced to class, LET, voltage fraction, outcome and source category. To check the tool against the model in a browser console, DeratingModel(HIPD_MODEL).selftest() should report zero mismatches. No source data files are published: a substantial part of the corpus is proprietary, the vendor screen belongs to a third party, and the numbers quoted in this section are baked into the page at build time rather than served as a dataset.

14. References