SEL Test-LET Requirement Tool

Preliminary analysis aid. Check the result against your own analysis and, where needed, a test on the intended part. Full disclaimer.

1. What the tool calculates

You are building a system from unhardened commercial CMOS and cannot heavy ion test every part to destructive fluences. The practical compromise is a screen: test every potentially latchup susceptible part up to some LET, LET_T, and fly only parts that show nothing below it. The question is how high LET_T has to be for the system as a whole to meet a stated reliability over the mission. The calculation uses historical unhardened CMOS data to estimate the screening LET needed for N parts to meet that mission reliability requirement.

The tool answers that from the statistics of historical latchup test data rather than from data on your parts, which by assumption you do not have yet. It implements the system level method of Ladbury and Joplin [1] on the historical prior of Ladbury, Allen, Irom, Gaza, Vartanian, Barth and Hodson [2] (a historical database of 66 unhardened CMOS part types), and extends it with CREME96 spectral rate integration in place of the Petersen figure of merit, an episodic solar flare exposure model, and an n of m constellation survivability criterion. The output is a required test LET in MeV cm2/mg, the exact statistical statement it satisfies, and cross checks against the other criteria and the published closed form.

2. Inputs

Input	Meaning	Typical values
Reliability criterion	Definition of "system survives" (section 4)	paper, strict, or n of m
Confidence level	Quantile over the historical prior (epistemic). Applies to the strict and constellation criteria and to the rate charts	90 to 95%
Desired system reliability	Target probability that the criterion is met	97 to 99.5% inside the closed form fit range; up to 99.99% accepted
Satellites m, required n	Constellation criterion only: fleet size and minimum survivors	8 / 6
Device count	Three bases: susceptible parts directly (NP); total unhardened CMOS times one susceptible fraction; or a technology mix with editable susceptible probabilities defaulted to the EHSP 2026-09 posterior for the modern stratum (parts tested or published 2010 and later: bulk CMOS 0.45, ADC and DAC 0.83, BiCMOS 0.39, SiGe 0.25, SRAM 0.83, DRAM 0.29, flash 0.54, SRAM FPGA 0.32, antifuse FPGA 0.05, SOI 0.06, SOS 0.07, BCD 0.42, unknown 0.35). Per satellite in constellation mode	5 to 50, the source paper's fit range
Susceptible fraction	Total CMOS mode only; historically about half	0.4 to 0.6
Mission duration	Years, days or hours, 0.1 hour to 30 years	6 h (launch) to 20 yr
Environment	Exposure model and rate method (section 5)	GCR solar minimum default
Solar events per year	Episodic and composite modes: expected events per year at the chosen severity	0.2 to 5

Advanced settings: Monte Carlo trials (10,000 default; 30 to 50 thousand for publication numbers; the duration sweep chart uses reduced trials regardless), random seed (common random numbers keep the bisection stable; a seed change should move the answer under 5 percent), RPP dimension ratio for the CREME96 rate tables (0.2 best estimate default, 0.01 worst case, 1.0 isotropic; the tables carry the full chord length distribution of the box and the rate sum takes the flux at the log midpoint of each LET bin, both corrected in September 2026, see the SEE rate tool help), a cap on the sampled limiting cross section (uncapped by default as in the source method; 0.01 to 0.1 cm2 suppresses implausible lognormal tail draws for small dies), and the onset LET prior (EHSP 2026-09 default or TNS 2025, with an editable CDF table that becomes a custom prior when touched).

3. Calculation

Each Monte Carlo trial builds one hypothetical system from parts statistically like the historical database:

1. Onset LET. Each part draws an onset from the selected prior. The default is the Extended Historical SEL Priors (EHSP 2026-09) global onset CDF: 739 uniform LET at 1e-8 cm2 onsets from Poisson maximum likelihood Weibull fits and onset brackets, mechanism screened, all eras, with F(37) = 0.68, F(75) = 0.93, F(100) = 0.98 and closure extrapolated to 120 MeV cm2/mg. The alternative is the original TNS 2025 66 part CDF (0.5 to 72 MeV cm2/mg), kept for traceability to the published curves. The derivation is in the SEL threshold predictor methodology.
2. Limiting cross section. Sampled from the lognormal trend of the historical data against onset LET: low onset parts tend to have large saturated cross sections, with wide scatter (s_ln = 2.45).
3. Rate. In the CREME96 modes a full Weibull curve is built (shape parameters drawn from the 31 CERN database Weibull pairs) and integrated against the selected LET spectrum with the RPP tables. In the FOM modes the published bound and reduce method is used: the Petersen figure of merit bound C_E σ_s / LET₀², reduced by a beta distributed ratio fitted to the same 31 pairs.
4. Screening. Testing to LET_T removes parts with onset below it; removed parts are replaced by fresh draws, themselves screened once. Independently, every part carries a 3.5 percent chance of remaining susceptible just above the test LET regardless of screening: the 90 percent confidence bound implied by 0 of 66 database parts violating their screen. This beyond database floor is what eventually limits what screening can buy.
5. System. Part rates sum. Thousands of realizations of the prior give a distribution of system rates; the criterion is evaluated on it and the tool bisects on LET_T to find the requirement.

Two kinds of uncertainty are kept apart. The Monte Carlo spread is ignorance about which parts you got, an epistemic uncertainty over the prior; the confidence level applies to it. The Poisson arithmetic on each realization is in flight randomness, aleatoric; the reliability target applies to that. Keeping them separate is what makes the constellation criterion meaningful.

4. The three reliability criteria

Paper criterion: expected count below one. Reliability is the fraction of realizations whose expected SEL count over the mission stays below one. This is the definition behind Figs. 3 to 6 and the closed form Eq. (4) of [1]; use it for numbers traceable to the published curves. It is the most permissive of the three.

Strict criterion: zero SELs at confidence. Take the confidence quantile of the system rate distribution and require the Poisson probability of zero events over the mission to meet the reliability target. Every SEL is mission ending. At 99 percent reliability this tolerates a rate about 100 times lower than the paper criterion (minus ln 0.99 is about 0.01 expected events against 1), so the required LET_T is much higher and often lands where the 3.5 percent floor governs. Use it for single string spacecraft where any latchup is unacceptable.

Constellation criterion: n of m satellites SEL free. For m identical satellites each carrying the stated parts, require at least n to remain SEL free through the mission at the stated confidence and reliability. Two structural points. First, a shared design means correlated uncertainty: each realization draws one set of part characteristics and applies it fleet wide, so a bad prior draw is bad for every satellite at once, and constellation reliability is not the single satellite result raised to a binomial power; treating satellites as independent would be optimistic. Second, given the design, in flight events are independent Poisson processes per satellite:

The binomial tail is monotone in R, so the confidence quantile is applied to the rate and the tail evaluated there. n = m = 1 recovers the strict criterion exactly. Redundancy earns real credit: accepting the loss of 2 of 8 satellites typically lowers LET_T by 15 to 20 MeV cm2/mg against a single satellite zero SEL requirement at the same confidence. Every SEL is treated as satellite ending; if only a fraction f of latchups would really end a satellite (supply current events cleared by a watchdog power cycle, say), scale the mission duration by f to emulate it.

5. Environments and the flare exposure model

Continuous. GCR solar minimum at GEO (CREME96, behind 100 mil aluminum; the quiet time worst case and the default, matching the GEO and interplanetary intent of the source paper's C_E = 400) and the orbit cases apply for the whole mission: ISS 400 km 51.6 degrees with the quiet and with the stormy magnetosphere, LEO 400 km 28.5 degrees, the 550 km 53 degree constellation orbit, sun synchronous 600 km, polar 1200 km, MEO 20,200 km, GTO, and the lunar and Mars surfaces. All are one set of CREME96 runs (11 and 12 September 2026, solar minimum, 100 mil aluminum, quiet geomagnetic transmission unless labeled stormy). The low inclination 400 km case has no heavy ion flux above LET 20 MeV cm2/mg at quiet time, so it can only ever ask for a test LET of 20 or less; take the ISS stormy case when a disturbed magnetosphere must be covered.

Episodic. Worst week, worst day and peak 5 minute are solar particle event spectra. Applying one for a full mission is physically meaningless; a "ten year worst week" overstates the exposure by a factor of 500. The tool treats them as episodes: you state the expected events per year, and each contributes its flux for its duration (7 days, 1 day, 5 minutes). Poisson exposures add, so this folds into an exact mission averaged rate,

and everything downstream (expected counts, zero SEL Poisson, constellation binomial) stays exact; the duration sweep chart stays meaningful because longer missions accumulate more episodes.

Short missions. When the mission is shorter than one episode, mission averaging answers the wrong question: a six hour launch does not care about the expected number of worst days per year, it cares what happens if the event is in progress. The tool detects this and applies the flare flux continuously for the whole mission, labeling the verdict "event in progress." For a six hour flight select worst day and enter six hours; for a flight through the peak itself, peak 5 minute with a five minute duration is the stress case.

Composite. GCR solar minimum plus a stated number of worst week episodes per year. This is the design case to use for solar active mission phases. For latchup the flare episodes usually dominate: one worst week per year contributes more to the requirement than ten years of quiet time GCR.

Petersen FOM modes. Reproduce the source paper engine bit for bit: the figure of merit bound with C_E = 400 or a custom value, reduced by the beta distributed bound to rate ratio. Use them to compare with the published curves. When a CREME96 environment is primary the FOM equivalent is reported in the cross checks line. The two agree where they should (at LET₀ = 10 the mean spectral to bound ratio in GCR solar minimum, 0.18, matches the mean of the paper's beta distribution) but the FOM is a bound, so FOM requirements typically run 10 to 20 MeV cm2/mg higher than spectral ones.

6. Reading the results

• The number is the required test LET in MeV cm2/mg. "none" means the untested system already meets the target. A dash with a red badge means no amount of screening reaches the target because the 3.5 percent floor dominates; the remedies are redundancy, SEL immune part selection, or mitigation credit, not more beam time.
• The verdict sentence states exactly what the number means: criterion, confidence, environment, exposure model. The same LET under different criteria means very different things.
• Badges flag the active environment, part counts outside the 5 to 50 studied in [1], and results above the highest onset in the database (about 72 MeV cm2/mg), which are extrapolations governed by the floor.
• Tiles give the system (or per satellite) rate at the confidence level, expected SEL count over the mission, achieved reliability, and in constellation mode the expected survivors and P(≥n of m).
• Cross checks solve the same problem the other ways: the closed form Eq. (4) fit, the Monte Carlo under the alternative criterion, and the FOM equivalent. Paper against strict is the price of "zero events" over "less than one expected"; spectral against FOM is the conservatism of the bound.
• Charts. Failure probability against test LET (roughly exponential until the floor flattens it); system rate against confidence, untested and screened, where the horizontal gap is the screening benefit, typically two to three orders of magnitude; and required LET_T against mission duration (reduced trials, so some jitter), with the closed form dashed where the inputs are inside its validity range.

7. Worked examples

Approximate values with default settings; small variations with trials and seed are expected. All use 20 susceptible parts, 99 percent reliability, 90 percent confidence.

A. Single GEO spacecraft, 5 years, quiet sun. GCR solar minimum, paper criterion, EHSP prior: LET_T about 39 (about 36 with the TNS 2025 prior; the EHSP prior's heavier high LET tail adds a few units). The FOM cross check gives about 57, so the figure of merit bound costs roughly 18 MeV cm2/mg of requirement. The strict criterion raises the spectral requirement to about 64.

B. Ten years with solar activity. GCR only, paper criterion: about 47. Add one worst week per year (composite): about 68. Seventy days of worst week flux out of 3,652 dominate the requirement. Running worst week flux for the whole decade instead would overstate the exposure by about 50 times and push the requirement past 100.

C. Eight satellite constellation, 6 of 8 at 5 years. GCR solar minimum, constellation criterion, 20 parts per satellite: LET_T about 48, per satellite zero SEL probability about 94 percent, expected survivors about 7.5 of 8. Against about 64 for a single satellite under the strict criterion, tolerating the loss of two buys roughly 16 MeV cm2/mg. Requiring all eight pushes the requirement to about 90: a fleet with no redundancy margin is harder than one spacecraft because eight times as many parts all have to behave.

D. Technology mix. Ten bulk CMOS, four ADC or DAC, two SRAM FPGA and four SOI parts have an effective N_P of about 8.7 and need LET_T about 33 (paper criterion, 5 year GCR), against about 39 with all 20 counted susceptible and about 34 at a generic 50 percent fraction. An all SOI design drops to about 19. The mix mode puts the technology selection trade directly into the screening requirement.

8. Assumptions

• Your parts are statistically like the historical database of unhardened CMOS. If you have measured Weibull parameters, use the SEE rate tool instead; the prior is for parts you have not tested.
• Screening at LET_T is done to adequate fluence and at the flight maximum temperature and voltage per your test standard. Test escapes beyond the modeled 3.5 percent floor are not included.
• Weibull shape is sampled independently of onset, consistent with the SEE rate tool. If shape correlates with onset in reality, low onset parts' untested rates may be somewhat high; the solved requirement, set near the screening level, is little affected.
• All CREME96 tables are behind 100 mil of aluminum. Very different shielding, deep space against magnetospheric trajectories, or solar cycle averaging need externally generated spectra.
• SEL only. The prior, the susceptibility fractions and the criteria are specific to destructive latchup in unhardened CMOS. Do not reuse the numbers for SEU, SET, SEB or SEGR.

9. Implementation details

• Validation against the source papers: the untested rate distributions of Fig. 2 are reproduced, as is the more than 200 times screening rate reduction at 20 MeV cm2/mg; required LET solutions land within 10 to 15 percent, on the conservative side, of the paper's fitted curves. The FOM engine is bit identical to the original implementation; the closed form coefficients follow the figure validated fits, correcting three apparent typos in the printed equations.
• The 3.5 percent floor is retained from the published method (0 of 66 bound) even under the larger EHSP prior, which is conservative given that prior already quantifies its own high tail.
• Bisection on LET_T uses common random numbers across candidate values so the solved requirement is stable.

10. Limitations

• Results above the prior's observed range (about 72 in the TNS 2025 prior, about 100 in EHSP with closure extrapolated to 120) are governed by the floor and should be read as "screening alone is marginal here."
• The closed form fit is valid for 5 to 50 parts and 97 to 99.5 percent reliability; outside that the Monte Carlo is the answer and the dashed curve is suppressed.
• This is a screening requirement tool. It says how hard to test; it does not say a part that passes is immune, only that a system of parts that passed has the stated statistical reliability under the stated prior.

11. References

Back to the SEL Test-LET Tool