Proton Proxy Risk Tool

1. What Question Does This Tool Answer?

Many programs test parts or boards with protons only, protons are cheap, penetrating, and don't require delidding. A null proton result is then offered as evidence the hardware is safe against heavy ions. This tool quantifies exactly how much that evidence is worth, and what risk remains, for missions whose heavy-ion exposure matters (anything beyond a benign LEO). It implements the coverage and rate-bounding framework of Ladbury & Lauenstein (IEEE TNS 2016) with the site's CREME96 mission environments.

2. How It Works

• Recoil coverage. The test's recoil population is expressed as an integral fluence vs. equivalent LET, LET_EQ = E_dep/ρd. Because a short-range recoil cannot sustain its LET across a deep sensitive volume, this distribution collapses toward low LET as SV depth grows, at 10 µm depth it dies near 8–9 MeV·cm²/mg; at 25–30 µm (power MOSFET SEB/SEGR) almost nothing survives above ~3. This is the range/SV-depth effect and it is why destructive modes are weakly covered by protons at any fluence.
• Model-grid bounding. For each candidate Weibull σ(LET_EQ) on the published grid (onset 0.5–6.5, width 5–25, shape 0.5–2.5), the expected test event count per unit cross section is computed; the Poisson upper limit on your observed count (2.30 for zero events at 90%) bounds σ_sat for that model. Models whose bound is tighter than the τ criterion are "meaningfully bounded"; the rest are unconstrained by the test.
• Mission rates. Every model, bounded at its σ limit, unbounded at the die-area geometric cap, is run through full CREME96 spectral integration for your mission environment and duration (episodic flare handling identical to the SEL Test-LET tool). The worst bounded model gives the demonstrated bound; the worst overall gives the residual risk.

3. Reading the Results

The hero number is the residual worst case: expected SEE over the mission if the part's true behavior is one the proton test could not constrain, capped only by die geometry. The verdict separates what the test demonstrated (the bounded fraction of susceptibility behaviors and their worst-case mission events) from what it did not (the unbounded fraction and its geometric worst case). The coverage chart is the picture worth keeping: wherever the orange mission curve lies above the cyan test-recoil curve, flight will probe LET the test never reached.

4. Practical Guidance

• Shallow, nondestructive SEE (SEU/SET): protons work. At ≥10¹¹ p/cm² and 200+ MeV, nearly all candidate behaviors with onset < ~6.5 MeV·cm²/mg are bounded. Onsets above ~6–7 are never probed, but for soft errors the un-probed region often contributes acceptably low rate. Run the numbers.
• SEL in bulk CMOS (SV ~10 µm): marginal. At the standard 10¹⁰ fluence roughly 70% of behaviors are unbounded; even 3×10¹¹ leaves ~40%. Use the highest available proton energy (400–500 MeV roughly halves the unbounded fraction) and treat the result as a screen, not a bound.
• SEB/SEGR in power devices (SV ≥ 20 µm): protons place almost no constraint, at any fluence or energy. The residual risk is essentially the untested geometric worst case. Heavy-ion testing at proper range/angle (per the site's beam calculator) is the only meaningful path.
• Gold-plated lids / W near die: the high-Z option adds p+Au fission recoils (LET_EQ to ~38 shallow), which genuinely extends shallow coverage, and is also a reminder that such packages can suffer proton-induced destructive events in flight (the OP470 lesson).
• Board-level tests: the bound scales with the number of parts, each part could hide a different susceptibility, so the summed limiting cross section (and the bounding rate) grows linearly with part count. Set the parts input accordingly.
• Retiring the residual: the unbounded fraction can only be closed with heavy-ion data, technology-based arguments (e.g. SOI, epi thickness), or explicit Bayesian priors, the same options the source paper recommends. The SEL Test-LET tool's historical priors are one defensible source.

5. Proton-Informed Monte Carlo (Bayesian Flow)

The worst-case bounds of Sections 2–3 answer "how bad could it be?" The Monte Carlo card answers the complementary question: "given what we historically know about parts like this, how likely is trouble?" Each trial draws a hypothetical part from the same historical prior as the SEL Test-LET tool, technology susceptibility fraction (Extended Historical SEL Priors, EHSP 2026-09, posteriors, selectable by population stratum: modern, all eras, mission-candidate, Space-RHA campaigns), onset-LET CDF, lognormal limiting cross section, CERN Weibull shapes, weights that draw by the Poisson likelihood of your actual proton result, and evaluates its mission rate by CREME96 spectral integration. The reported quantities are the prior (untested) and posterior (post-test) mission SEL probabilities, the posterior probability the part is susceptible at all, and the posterior onset LET, the "rough demonstrated LET threshold": what a passed proton test entitles you to believe about LET₀, given the historical population.

• A null result shifts belief rather than proving safety: it suppresses low-onset, large-σ behaviors (which the recoils would have found) and leaves high-onset behaviors untouched, so the posterior onset median moves up and mission risk drops by a factor that depends strongly on SV depth and fluence.
• Observed events collapse the posterior the other way: susceptibility confirmed, onset localized to the low-LET region consistent with the event count.
• For deep SV (SEB/SEGR) the update is honest about its weakness: the likelihood barely discriminates, so posterior ≈ prior, protons taught you little, and the card flags that the SEL-derived prior is qualitative for those modes.

6. What the Paired Data Say

The combined SEL test corpus contains 95 parts with both heavy-ion and proton SEL records (92 from published REDW, RADECS and NASA GSFC sources; internal reports enter the counts only). Heavy-ion onset is the uniform LET@10⁻⁸ from the Poisson-Weibull fit where a fit exists, else the author-stated threshold. The tool page shows these numbers live; the case-study page lists every public part.

• Proton SEL tracks low onset. Parts that latched under protons have a median heavy-ion onset of 3.0 MeV·cm²/mg (16 of 20 below LET 10). No part with onset above 20 has produced a proton SEL anywhere in the corpus.
• A null is not a threshold. Of the 30 parts with an adequate null proton test (≥ 50 MeV, ≥ 10¹⁰ p/cm²) and heavy-ion data, 7 (23%, 90% interval 13–38%) were heavy-ion susceptible at LET ≤ 37, and 5 (17%) at LET ≤ 15 the population this tool exists to quantify. Detection probability by onset bin (events vs. adequate nulls): <5: 82%, 5–10: 33% (n=3), 10–20: 71%, ≥ 20: no events.
• Cross-section ratio. Where both cross sections are measured, σ_p (≥ 100 MeV) / σ_HI has a median of 10^-7.09 (range 10^-10.37–10^-6.05, n=5), one to two decades below the 1-in-289,000 recoil-count ceiling: most recoils that do occur deposit less than the part's onset.
• Energy thresholds are real. XCZU9EG: no SEL at 30 MeV, SEL at 50 MeV rising ×16 to 200 MeV; BU65170G1: none at 80 MeV, SEL at 190 MeV; K6R4016V1D: fitted proton threshold 51 MeV; ADS1271: σ_p grows >40× from 100 MeV to 24 GeV (tungsten vias). Test at the highest energy you can get.

7. Validation Against Paired Data

The engine was run on the paired parts with a known heavy-ion Weibull (11 parts, 16 proton tests) using the tool's default settings.

• Bounding (null results). For the 4 heavy-ion-susceptible parts with an adequate null proton test, the tool called out residual risk (models left unbounded) in every case at 2, 5 and 10 µm SV depth, 0 missed escapes, 0 bound violations. Small n, but it is the falsification test that matters: the tool never declared a susceptible part safe.
• Forward prediction. Predicting the measured proton cross section from the heavy-ion curve (12 measurements): median predicted/measured ×1.05 at 5 µm (58% within ×10, 33% within ×3); ×2.69 at 2 µm and ×0.26 at 10 µm. Treat the emulator as an order-of-magnitude instrument whose main uncertainty is the SV depth you assign.
• Known failure modes. Parts with onset ≥ 10 that still show rare proton SEL (GP2021 micro-latch at 4×10⁻¹³ cm²; ADS1271 at 4×10⁻¹² cm² through tungsten vias): the silicon-recoil emulator predicts essentially zero at ≥ 5 µm; switching on the high-Z option brings ADS1271 to within ×1.71. Multi-die hybrids (BU65170G1) are over-predicted ×30–350 because the package geometry is not represented.

8. Accuracy and Limitations

• The recoil fluence-vs-LET_EQ family is an emulator of the published CRÈME-MC results, not a transport calculation. Validation: worst-case bounded rate at ISS / 10 µm / 10¹⁰ 200-MeV reproduces the published power-law within ×1.04; the %-unbounded matrix matches 2016 Fig. 9 within about ±8 points across 50–400 MeV; bounds drift conservative (up to ~×4) at 10¹² p/cm².
• The τ = 0.003 cm² "meaningful bound" criterion is calibrated to reproduce the paper's bounded/unbounded classification; it is editable under Advanced.
• LET_EQ treats deposited energy as if uniform across the SV; real charge-collection efficiency profiles, angular effects, and SEGR's gate-oxide field dependence are not modeled the 2015 poster shows these make proton tests underestimate destructive risk, so treat destructive-mode results as optimistic.
• In-flight proton-induced SEE (trapped/solar protons causing events by the same recoil mechanism) is a separate calculation, use the SEE Rate Assessment Tool's proton rates; a null ground test at adequate fluence bounds that too.
• Facility energies are limited to the 50–500 MeV range of the underlying data.

9. References