Proton Proxy Risk Tool

Preliminary analysis aid. Check the result against your own analysis and, where needed, a test on the intended part. Full disclaimer.

1. What Question Does This Tool Answer?

Many programs test parts or boards with protons only, protons are cheap, penetrating, and don't require delidding. A null proton result is then offered as evidence the hardware is safe against heavy ions. This tool puts a model conditional bound on how much that evidence is worth, and what risk remains, for missions whose heavy-ion exposure matters (anything beyond a benign LEO). It implements the coverage and rate-bounding framework of Ladbury & Lauenstein (IEEE TNS 2016) with the site's CREME96 mission environments.

2. How It Works

• Recoil coverage. The test's recoil population is expressed as an integral fluence vs. equivalent LET, LET_EQ = E_dep/ρd. Because a short-range recoil cannot sustain its LET across a deep sensitive volume, this distribution collapses toward low LET as the sensitive-volume depth d (the tool's "assumed effective charge-collection depth") grows, at 10 µm depth it dies near 8–9 MeV·cm²/mg; at 25–30 µm (power MOSFET SEB/SEGR) almost nothing survives above ~3. This is the range/SV-depth effect and it is why destructive modes are weakly covered by protons at any fluence.
• Model-grid bounding. For each candidate Weibull σ(LET_EQ) on the published grid (onset 0.5–6.5, width 5–25, shape 0.5–2.5), the expected test event count per unit cross section is computed; the Poisson upper limit on your observed count (2.30 for zero events at 90%) bounds σ_sat for that model. Models whose bound is tighter than the τ criterion are "meaningfully bounded"; the rest are unconstrained by the test.
• Mission rates. Every model, bounded at its σ limit, unbounded at the die-area geometric cap, is run through full CREME96 spectral integration for your mission environment and duration (episodic flare handling identical to the SEL Test-LET tool). The worst bounded model gives the demonstrated bound; the worst overall gives the residual risk.

3. Reading the Results

The hero number is the residual worst case: expected SEE over the mission if the part's true behavior is one the proton test could not constrain, capped only by die geometry. The verdict separates what the test demonstrated (the bounded fraction of susceptibility behaviors and their worst-case mission events) from what it did not (the unbounded fraction and its geometric worst case). The coverage chart is useful for identifying gaps in test coverage: wherever the orange mission curve lies above the cyan test-recoil curve, flight will probe LET the test never reached.

4. Practical Guidance

• Shallow, nondestructive SEE (SEU/SET): protons work. At ≥10¹¹ p/cm² and 200+ MeV, nearly all candidate behaviors with onset < ~6.5 MeV·cm²/mg are bounded. Onsets above ~6–7 are never probed, but for soft errors the un-probed region often contributes acceptably low rate. Run the numbers.
• SEL in bulk CMOS: marginal at the published 10 µm reference depth, and weaker at the 20 µm the tool assumes when the process is unknown (see Choosing the assumed depth). At 10 µm and the standard 10¹⁰ fluence of 200 MeV protons roughly 70% of behaviors are unbounded; even 3×10¹¹ leaves ~40%. At 20 µm the same two tests leave about 89% and 67% unbounded (GCR solar minimum, 0.1 cm² die, 5 years). Use the highest available proton energy (400–500 MeV roughly halves the unbounded fraction), read the depth sensitivity table, and treat the result as a screen, not a bound.
• SEB/SEGR in power devices (SV ≥ 20 µm): protons place almost no constraint, at any fluence or energy. The residual risk is essentially the untested geometric worst case. Heavy-ion testing at proper range/angle (per the site's beam calculator) is the only meaningful path.
• Gold-plated lids / W near die: the high-Z option adds p+Au fission recoils (LET_EQ to ~38 shallow), which genuinely extends shallow coverage, and is also a reminder that such packages can suffer proton-induced destructive events in flight (the OP470 lesson).
• Board-level tests: the bound scales with the number of parts, each part could hide a different susceptibility, so the summed limiting cross section (and the bounding rate) grows linearly with part count. Set the parts input accordingly.
• Retiring the residual: the unbounded fraction can only be closed with heavy-ion data, technology-based arguments (e.g. SOI, epi thickness), or explicit Bayesian priors, the same options the source paper recommends. The SEL Test-LET tool's historical priors are one defensible source.

Choosing the assumed charge-collection depth

The depth d is the input that most changes how much a passed proton test is worth, and it is rarely known for a given part, so the tool labels it an assumption and the SEE mode presets no longer imply that it is known. For a recoil that deposits a given energy, LET_EQ = E_dep/ρd: doubling d from 10 to 20 µm halves the recoil's equivalent LET, the test probes lower LET, and fewer candidate heavy-ion behaviors are bounded. A depth shallower than the part's generally gives a null test credit it has not earned.

• 10 µm, the published reference case. Ladbury and co-workers built the proxy analysis on sensitive volumes from 1 to 10 µm cubes and describe the 10 µm cube as “a fairly shallow charge collection depth d for DSEE” [2, p. 2507]. The later analysis of SEL uses volumes 10 µm deep, notes that “for deeper SV, proton testing will be even less effective in bounding on SEL rates” [1, p. 305], and calls 30 µm “not uncommon for SEL in bulk Si CMOS” [1, p. 307]. Their advice: “Assuming a conservative depth, perhaps guided by similarity data, is essential to avoid underestimating SEE risk” [2, p. 2509].
• 20 µm, the default for bulk CMOS of unknown process. JPL device simulations found that “for lightly doped bulk substrates, typical of bulk CMOS, the particle range must be 35-40 µm even though the effective charge collection depth is only about 20 µm” [6, p. 2370], and the same paper lists heavy-ion collection depths of 15 to 18 µm for three bulk CMOS parts [6, Table 2]. The sentence also shows that the depth a part collects from and the range a test ion needs are different quantities: the ion has to reach well past the collection depth.
• 5 µm, a thin-epi case, for use when process information supports it. In the same paper a part on a 2.5 µm epitaxial layer collected from about 3.5 µm and one on a 13 µm layer from about 13 µm [6, Table 2]; for short-range particles “the epitaxial thickness is an effective cutoff for charge collection” [6, p. 2371].
• 30 µm, a deep bulk case, the depth [1] describes as not uncommon for SEL in bulk CMOS.

There is a counterpoint in Section 7. Predicting the measured proton cross sections of the paired parts from their heavy-ion curves, the emulator matched best at 5 µm (median predicted/measured ×1.05) and underpredicted at 10 µm (×0.26). That does not establish the true depths of those parts, and for a null result the bounding check (no missed escapes at 2, 5 and 10 µm) is the one that matters; but it means the deeper default is a precaution for judging residual risk, not a claim of better predictive accuracy. The emulator's recoil spectra are digitized at 1, 2, 5, 10 and 30 µm, so 20 µm is interpolated between 10 and 30. Every run shows the depth sensitivity table under the result; where the conclusion generally changes between 10 and 30 µm, the proton test alone cannot support it, and heavy-ion data, process information on the substrate, or an explicit prior are needed.

5. Proton-Informed Monte Carlo (Bayesian Flow)

The worst-case bounds of Sections 2–3 answer "how bad could it be?" The Monte Carlo card answers the complementary question: "given what we historically know about parts like this, how likely is trouble?" Each trial draws a hypothetical part from the same historical prior as the SEL Test-LET tool, technology susceptibility fraction (Extended Historical SEL Priors, EHSP 2026-09, posteriors, selectable by population stratum: modern, all eras, mission-candidate, Space-RHA campaigns), onset-LET CDF, lognormal limiting cross section, CERN Weibull shapes, weights that draw by the Poisson likelihood of your actual proton result, and evaluates its mission rate by CREME96 spectral integration. The reported quantities are the prior (untested) and posterior (post-test) mission SEL probabilities, the posterior probability the part is susceptible at all, and the posterior onset LET, the "rough demonstrated LET threshold": what a passed proton test entitles you to believe about LET₀, given the historical population.

• A null result shifts belief rather than proving safety: it suppresses low-onset, large-σ behaviors (which the recoils would have found) and leaves high-onset behaviors untouched, so the posterior onset median moves up and mission risk drops by a factor that depends strongly on SV depth and fluence.
• Observed events collapse the posterior the other way: susceptibility confirmed, onset localized to the low-LET region consistent with the event count.
• For deep SV (SEB/SEGR) the update is honest about its weakness: the likelihood barely discriminates, so posterior ≈ prior, protons taught you little, and the card flags that the SEL-derived prior is qualitative for those modes.

6. What the Paired Data Say

The combined SEL test corpus contains 95 parts with both heavy-ion and proton SEL records (92 from published REDW, RADECS and NASA GSFC sources; internal reports enter the counts only). Heavy-ion onset is the uniform LET@10⁻⁸ from the Poisson-Weibull fit where a fit exists, else the author-stated threshold. The tool page shows these numbers live; the case-study page lists every public part.

• Proton SEL tracks low onset. Parts that latched under protons have a median heavy-ion onset of 3.0 MeV·cm²/mg (16 of 20 below LET 10). No part with onset above 20 has produced a proton SEL anywhere in the corpus.
• A null is not a threshold. Of the 30 parts with an adequate null proton test (≥ 50 MeV, ≥ 10¹⁰ p/cm²) and heavy-ion data, 7 (23%, 90% interval 13–38%) were heavy-ion susceptible at LET ≤ 37, and 5 (17%) at LET ≤ 15 the population this tool exists to quantify. Detection probability by onset bin (events vs. adequate nulls): <5: 82%, 5–10: 33% (n=3), 10–20: 71%, ≥ 20: no events.
• Cross-section ratio. Where both cross sections are measured, σ_p (≥ 100 MeV) / σ_HI has a median of 10^-7.09 (range 10^-10.37–10^-6.05, n=5), one to two decades below the 1-in-289,000 recoil-count ceiling: most recoils that do occur deposit less than the part's onset.
• Energy thresholds are real. XCZU9EG: no SEL at 30 MeV, SEL at 50 MeV rising ×16 to 200 MeV; BU65170G1: none at 80 MeV, SEL at 190 MeV; K6R4016V1D: fitted proton threshold 51 MeV; ADS1271: σ_p grows >40× from 100 MeV to 24 GeV (tungsten vias). Test at the highest energy you can get.

7. Validation Against Paired Data

The engine was run on the paired parts with a known heavy-ion Weibull (11 parts, 16 proton tests) using the tool's default settings.

• Bounding (null results). For the 4 heavy-ion-susceptible parts with an adequate null proton test, the tool called out residual risk (models left unbounded) in every case at 2, 5 and 10 µm SV depth, 0 missed escapes, 0 bound violations. Small n, but it is the falsification test that matters: the tool never declared a susceptible part safe.
• Forward prediction. Predicting the measured proton cross section from the heavy-ion curve (12 measurements): median predicted/measured ×1.05 at 5 µm (58% within ×10, 33% within ×3); ×2.69 at 2 µm and ×0.26 at 10 µm. Treat the emulator as an order-of-magnitude instrument whose main uncertainty is the depth you assume. The validation has not been run at 20 or 30 µm.
• Known failure modes. Parts with onset ≥ 10 that still show rare proton SEL (GP2021 micro-latch at 4×10⁻¹³ cm²; ADS1271 at 4×10⁻¹² cm² through tungsten vias): the silicon-recoil emulator predicts essentially zero at ≥ 5 µm; switching on the high-Z option brings ADS1271 to within ×1.71. Multi-die hybrids (BU65170G1) are over-predicted ×30–350 because the package geometry is not represented.

8. Accuracy and Limitations

• The recoil fluence-vs-LET_EQ family is an emulator of the published CRÈME-MC results, not a transport calculation. Validation: worst-case bounded rate at ISS / 10 µm / 10¹⁰ 200-MeV reproduced the published power-law within ×1.04 with the site's earlier ISS table; with the September 2026 CREME96 ISS run, 5 to 37 percent higher at the relevant onsets, the tool sits about ×1.2 above the published curve, which is the environment rather than the emulator; the %-unbounded matrix matches 2016 Fig. 9 within about ±8 points across 50–400 MeV; bounds drift conservative (up to ~×4) at 10¹² p/cm².
• The τ = 0.003 cm² "meaningful bound" criterion is calibrated to reproduce the paper's bounded/unbounded classification; it is editable under Advanced.
• LET_EQ treats deposited energy as if uniform across the SV; real charge-collection efficiency profiles, angular effects, and SEGR's gate-oxide field dependence are not modeled the 2015 poster shows these make proton tests underestimate destructive risk, so treat destructive-mode results as optimistic.
• In-flight proton-induced SEE (trapped/solar protons causing events by the same recoil mechanism) is a separate calculation, use the SEE Rate Assessment Tool's proton rates; a null ground test at adequate fluence bounds that too.
• Facility energies are limited to the 50–500 MeV range of the underlying data.

9. References