Latchup protection sizing and verification

The models behind each number, the sources they come from, the places they are crude on purpose, and why the verification test is written the way it is.

What has to be true for protection to work

Single event latchup is the ion induced turn on of the parasitic bipolar pair formed by a well, the substrate and the source diffusions of a CMOS structure [1], [2]. Once on, it is a low impedance path from supply to ground that persists until the supply falls below the structure's holding voltage. The current is set by the parasitic path resistance and the supply, and it ranges from a few tens of milliamps in a small isolated well to amps in a large digital part with a stiff supply. The heat it produces is the damage mechanism, and heat takes time, so a protection circuit that removes power fast enough and keeps it off long enough can make an otherwise destructive event survivable. Four conditions must hold, and each is a number on this page: the latched current is distinguishable from the normal load; the energy delivered before cutoff stays below what the die and its metal survive; the rail falls below the holding voltage during the off time; and the part survives the number of cycles the mission will produce without accumulating damage. The tool reports on each; the test at the end is how the last two are actually established.

The trip window

The trip current must exceed the maximum legitimate load, including inrush and activity peaks at the highest temperature, by a margin that covers the comparator's reference and sense resistor tolerance and the fact that the load figure is an estimate; the default is 25 percent. It must sit below the lowest latchup current by a margin covering the same tolerances and the fact that the lowest current in a handful of test events is not the lowest the part can produce; again 25 percent by default. The window exists when the second bound exceeds the first. The ratio of the lowest latch current to the maximum load is the single best indicator of whether current based protection is going to be comfortable: above about 3 it usually is, below 2 it is marginal, and below about 1.3 no reasonable pair of margins leaves a window. Modern parts with large quiescent currents and small latch currents in isolated wells are exactly the case that fails this test, and the honest answer is a different detection principle or a different part.

The series resistor

For low-current parts, a series resistor can provide latchup protection without an active detector or cutoff timer. A load-line analysis determines whether it can clear the latch while maintaining the required operating voltage. A latched part behaves, to the accuracy that matters here, as a voltage source at the holding voltage V_h with a series resistance R_latch: V = V_h + I R_latch, valid down to the holding current I_hold, below which the parasitic structure turns off. Both ends of that line come from the beam test: the test point is the latched current at the test supply voltage, and the holding point is found by lowering the supply during a latch until the current collapses. A resistor R from the rail imposes the load line V = V_rail − I R, and the latch sits where the two lines cross:

If that current is below I_hold the latch cannot hold: the part's supply node sags below the holding point and the parasitic path turns off by itself. The resistor that just achieves this is R_ext = (V_rail − V_h)/I_hold − R_latch. Against it stands the normal load: the part needs V_min at its maximum current, so R ≤ R_drop = (V_rail − V_min)/I_max. A passive design exists when R_ext < R_drop; the tool suggests the largest standard E24 value that leaves 10 percent headroom on the drop and clears R_ext by 25 percent. The condition is a statement about the part's numbers: it is met when the maximum load is a small fraction of the holding current times the supply headroom over the latch overdrive, which is the case for an ADC drawing 5 mA behind 300 mV of headroom and not for a processor drawing 200 mA. When the window does not exist the resistor still cuts the latched power by the ratio of R_latch to R + R_latch and buys time, but a power cycle is still required to clear the latch, and the tool says so.

The local decoupling capacitor at the part complicates the picture in the first milliseconds. At the instant of latchup the node is held at the rail by the capacitor and the latch draws its stiff supply current; the node then discharges toward the load line intersection with time constant C R R_latch/(R + R_latch), and if the intersection is below the holding point the latch collapses when the node reaches it. The tool integrates that transient for the energy delivered to the die and the time to collapse, applies the same hotspot model as the active case for the average power over that time, and adds the recharge (3 R C) to the part's restart time to give the outage. A large local capacitor is therefore a liability with a passive design: it feeds the latch and delays its collapse, while providing the inrush that the resistor cannot. Resistor dissipation is checked at maximum load continuously and at the latched current, with the latter treated as a pulse when the latch collapses. The holding current falls with temperature and the latch line moves with it, so the numbers to use are the ones measured at the highest operating temperature, and a window narrower than about 1.5 to 1 in resistance should not be trusted until they are.

Energy per event

Two terms. The supply feeds the latch for the detection filter time plus the switch turn off time: E = V I t. Then the switch opens and the rail capacitance discharges into the latched part until the rail reaches the holding voltage: E = C(V² − V_h²)/2. For a 3.3 V rail with 47 µF and a 1.2 V holding voltage the second term is 0.22 mJ, which is what a 0.9 A latch draws in 75 µs; a large output capacitor on the protected rail therefore sets a floor on the energy that no amount of comparator speed removes, and the design lever is to move capacitance upstream of the switch. The tool uses the highest latch current for the energy and heating because that is the event that does the damage, and the lowest for the trip window because that is the event that escapes.

The heating model

The latched current flows through a region of the die that is small compared with the die and on a time scale short compared with the package. The tool treats it as a disc of radius a on the surface of a semi infinite silicon body with uniform heat flux q = P/(πa²). Two classical results bracket the response [3]. For times short compared with a²/α the surface temperature rise under a uniform flux is that of a one dimensional half space:

and for long times the disc source reaches a steady rise at its center of

with k = 150 W/m/K and α = 8.8e-5 m²/s for silicon near room temperature. The tool takes the smaller of the two, which is within about 20 percent of the exact transient solution and errs low near the crossover; the crossover is at t = πa²/(4α), about 20 µs for a 50 µm radius. On top sits the package term, the junction to board thermal resistance times the power, approached with a single time constant of seconds. So for a protection cutoff of 50 to 500 µs, the hotspot temperature is essentially its steady local value, P/(πka), plus the board temperature, and it depends on the hotspot radius as 1/a. That radius is the least known input. A latch confined to one well of a small analog part might be 20 µm; a latch in a large logic array spreads over hundreds of micrometers with a correspondingly lower temperature at the same power. The tool defaults to 50 µm and the user should move it and watch the result, because the answer moves with it.

Silicon's conductivity falls with temperature (roughly as T^-1.3 above room temperature), so the model is optimistic once the hotspot is several hundred degrees; by then the verdict is already destructive.

Damage thresholds and latent damage

Three bands are drawn. Below the rated junction temperature, 150 C for most parts, a single event does no thermal damage and the question becomes cumulative. Between 150 and about 250 C, parts have survived individual events but latent damage has been documented: Becker, Miyahira and Johnston [4] showed devices that passed functional tests after latchup with protection and then exhibited increased leakage, metallization damage visible in cross section, and early failure under subsequent stress; their recommendation is the basis of the post irradiation leakage screen and burn in in the test plan, and of limiting the energy per event rather than only clearing the latch. Above roughly 400 C, aluminum metallization approaches conditions for rapid electromigration and void formation, junctions leak heavily, and the 660 C melting point of aluminum is within reach for a stiff supply and a small hotspot; this is where the classic destructive latchup lives, and no protection cutoff in the millisecond range reaches it for a high current latch.

Bond wires

A latched current returns through the supply and ground bond wires that were sized for the normal load. The sustained fusing current of a short bond wire in a package depends on the material, the diameter, the length and the heat sinking at its ends [5]; the values in the tool (about 0.7 A for 1 mil gold, 1.0 A for 1.25 mil, 1.4 A for 1.5 mil, 2.4 A for 2 mil, with copper slightly higher and aluminum slightly lower) are typical sustained figures for wires a millimeter or two long. Wires survive currents above these for milliseconds, which is why a fast cutoff protects wires as well as the die, and a part whose latch current exceeds the wire rating is protected only as long as the cutoff is fast. The wire check is a ratio, not a temperature, and it is there because a fused wire is the one latchup outcome no post test screen recovers from. Parts with multiple supply wires in parallel share the current; the tool does not know how many there are.

Clearing the latch

The latch clears when the voltage across the parasitic structure falls below its holding voltage, typically 1.0 to 1.5 V for a well to substrate latch in bulk CMOS but sometimes higher, and it must be measured on the part because the recovery design depends on it. After the switch opens, the rail capacitance discharges through the latched part, which behaves approximately as a constant current sink at the latch current until the voltage nears the holding level, so the discharge time is about C(V − V_h)/I. If the latch does clear early, the remaining charge sits on the capacitor and only a parallel load or a deliberate discharge resistor removes it; without one, re-enabling into a rail still above V_h simply re-latches. The tool asks for a three to one margin of off time over the constant current discharge time and, more importantly, asks the test to probe the rail and see it fall below V_h in every cycle. Downstream regulators with large input capacitors, and body diodes in the switch, are the usual reasons it does not.

Micro latchup

Not every latch pulls hundreds of milliamps. A latch confined to a small well can raise the supply current by a few milliamps and leave the part functional [1]. Current protection does not see it, the part runs hot at one spot indefinitely, and the cumulative damage and leakage growth follow. The test plan therefore watches idle current between events for a stable increase, and the design options when one is found are a window comparator on quiescent current in known idle states, a periodic power cycle at an interval short enough to bound the heating, or a change of part.

Protection architectures

A monitored series switch, a comparator with a glitch filter driving a P channel FET, gives the designer the trip level, filter time and off time as explicit parameters and is the reference case for the tool. Integrated eFuse and hot swap controllers do the same job in one package with fixed or pin programmable values; read the datasheet for the response time, which is often tens of microseconds for a fast comparator path and milliseconds for the current limit loop, and enter the one that will act on a latch. A linear limiter in foldback is the traditional answer and is the weakest: it holds the rail at the voltage the latched load allows, which is often above the holding voltage, so the latch persists at the foldback current indefinitely unless that current is below the holding current; prefer a limiter that shuts off. A software loop reading a current monitor reacts in milliseconds to hundreds of milliseconds; the heating model shows what the hotspot does in that time. Whatever the architecture, radiation tolerance of the protection circuit itself is part of the design: a limiter that latches up is not a limiter.

Mission counts

With a latchup rate per device day from the rate tool, the number of events over the mission for N devices is Poisson with mean rate times N times days. The tool reports the expected count, the probability of at least one, the 99 percent count per device, and the cumulative downtime as the count times the per event downtime. The verification test asks for at least three times the 99 percent per device count, and at least ten, of protection cycles on each device: enough that the latent damage mechanism, which is cumulative, has a fair chance to appear in the post test screen. Use the worst case environment rate for this count; a design verified for the quiet sun count and flown through an event is verified for nothing.

Why the test looks like this

The verification plan addresses three common shortcomings in latchup protection testing. First, the part is latched at a beam test with a bench supply's current limit and the flight limiter is designed afterwards from the numbers; but the latch current depends on the supply impedance and the cutoff time on the flight circuit's capacitance and harness, so the numbers from the bench are the wrong numbers. The plan puts the flight protection, or an electrically equivalent one, in the beam room. Second, the test is run at room temperature and nominal supply; latch cross section rises and latch current falls with temperature, and holding voltage moves with supply, so the room temperature window is not the flight window. Third, the pass criterion is "the part still works" after a few events. Becker's latent damage results [4] are why the plan baselines leakage and supply current before the test, asks for tens of cycles per device, and repeats the characterization after a burn in. The single deliberate unprotected event at the end characterizes the natural latch current and holding voltage under mission conditions and is placed last because it may be destructive.

Limits

The heating model is a half space with constant properties and a guessed hotspot radius; it gives the order of magnitude and the scaling, not a temperature to design to within 20 percent. Bond wire fusing values are typical, not the values for your package. The discharge model treats the latched part as a constant current sink to the holding voltage, and the series resistor analysis treats the latch as a straight line between the test point and the holding point, which real latches follow only roughly. The tool knows nothing about the protection circuit's own radiation response, about multiple supply domains on one die, or about a latch that migrates between current levels during an event, all of which the test will show and the model will not. It is a sizing tool: it tells you what the test must demonstrate and whether the design has a chance of passing it.