What do the radiation test standards require, and why?

The fluence is set from below by statistics. If a part is irradiated and nothing happens, the result is not "the cross section is zero", it is "the cross section is below some bound". For a Poisson process with no observed events, that bound is a constant divided by the fluence. JESD57A writes it as 3.7 divided by the fluence of no errors times cos(theta), the 3.7 being the upper end of a central 95 percent Poisson interval (97.5 percent one sided; 3.0 would be 95 percent one sided). At 1e7 ions/cm2 that gives 3.7e-7 cm2, which is 37 square micrometers per device: on a memory die that is tens to hundreds of bit cells, on a discrete a small fraction of the die. Run only 1e5 ions/cm2 and the bound is 3.7e-5 cm2, 3,700 square micrometers, which still excludes the larger latchup cross sections but says little about upset.

The fluence is set from above by total dose. A heavy ion run is also a dose run, and the dose scales with LET. Using 1.602e-5 rad(Si) per unit of LET in MeV cm2/mg per ion/cm2: at LET 10, a fluence of 1e7 delivers about 1.6 krad(Si); at LET 37 about 5.9 krad; at LET 60 about 9.6 krad; at LET 85 about 13.6 krad. ASTM F1192 makes exactly this point, that the usual heavy ion fluence corresponds to kilorad dose levels in the part, and that the accumulated dose can change the effect being measured. So the ceiling is not a matter of beam time, it is that a part irradiated much past 1e7 at high LET is no longer the part that was put in the beam.

Those two constraints cross near 1e7, which is why the number has survived from ASTM F1192 into JESD57A and into ESCC 25100 essentially unchanged. It is a compromise, not a physical constant. Above the onset threshold, where events are plentiful, JESD57A explicitly says 1e6 or 100 observed events will do, because there the precision comes from the event count rather than from the fluence.

For a Poisson process with zero observed events, the upper limit on the mean at a one sided confidence level CL is minus the natural log of one minus CL. That gives 2.303 at 90 percent, 2.996 at 95 percent and 4.605 at 99 percent. This is where the familiar 2.3 and 3.0 come from.

JESD57A and ESCC 25100 instead use the chi-square form, half of the inverse chi-square at 0.5 plus CL over 2 with 2N plus 2 degrees of freedom. At N equal to zero and CL equal to 95 percent this evaluates to 3.689, which both documents round to 3.7. That is not a different statistical model, it is the same Poisson bound evaluated at the upper tail of a two sided 95 percent interval, which is the 97.5 percent one sided point. So 3.7 is simply more conservative than 3.0 by the amount that a two sided convention costs.

The practical consequence is that two laboratories can report different upper bounds on the same clean run and both be right. When comparing a published bound against your own, check which constant was used before concluding that one part is harder than another. The ratio between the 90 percent one sided and the JEDEC convention is 1.6, which is easily large enough to flip a margin argument.

The whole cross section formalism assumes each ion acts alone on an undisturbed device. Push the flux up and that assumption fails in several separate ways: two ions land in the same cell between reads and are counted as one multiple-bit upset; charge from one strike has not been swept out before the next arrives; the die heats; the dosimetry system, which is usually counting individual ions, saturates. ASTM F1192 calls these collective effects and allows higher flux only if each of them is shown not to matter.

There is a second, more mundane reason at the low end of the tester: dead time. ESCC 25100 puts a number on it and requires the flux to be low enough that the time the software spends reading, writing, resetting and logging stays below 20 percent of the active time, because an event that occurs during that window is never seen and the cross section comes out low. For latchup and for transients the guidance goes the other way and asks for lower flux still, so that events do not pile up and so that the part is not sitting in a latched state accumulating dose.

MIL-STD-750 Method 1080 approaches the same problem from the destructive side and caps the burnout event rate at 100 events per second, limited also by whatever the recording system can keep up with.

The counts differ by document because they are answering different questions. ESCC 25100 asks for three samples and permits two for non-destructive effects, and requires three as a minimum for gate rupture and burnout so that compliance can be checked at each test condition. JESD234 asks for five for proton work on a homogeneous lot, and more when the lot is not homogeneous. JESD57A declines to give a number at all and says to use the largest sample practical, on the reasoning that confidence comes from events and devices together.

The stated justification everywhere is lot homogeneity, not statistics. ASTM F1192 says plainly that device to device variation in soft error response is generally small among parts built on the same masks and process, which is why a small sample is defensible, and then immediately warns that the flight parts may not be from that population because manufacturers change processes without notice.

For destructive effects that reasoning is much weaker, and the literature says so. The response variability work on commercial power MOSFETs found burnout onset voltages that were not merely scattered but bimodal, which is exactly the shape that a five part sample is least able to detect. The NASA avionics RHA guidelines make the same point in their appendix on sampling: a small sample drawn from a distribution with a low probability second mode will usually come back clean, and the clean result is not informative.

An ion loses energy continuously as it travels. Every millimeter of lid, every micron of coating, every layer of overglass shifts the ion down its stopping power curve, so the LET that reaches the die is not the LET the facility quoted, and the shift depends on material and thickness that are usually not documented. The result is not a small correction, it is an unknown correction, and the cross section curve it produces cannot be integrated against a mission spectrum.

The same logic sets the exception. If the ion range is much larger than everything in front of the die, the energy loss is small and calculable, and both ESCC 25100 and JESD57A allow testing through the package at high energy facilities on that basis. This is why high energy heavy ion beam lines exist and why they are worth the cost for parts that cannot be opened.

Backside thinning is the other branch of the same problem: flip chip parts and parts with heavy metallization cannot be reached from the front at all. JESD57A warns that thinning is not free, because it changes the substrate available for diffusion and it reduces the power the part can dissipate, so a thinned part is not electrically identical to the flight part.

Quoting a single LET for an ion is a convenience that holds only while the stopping power is roughly constant. Near the end of the track it is not: the ion slows, the stopping power rises to the Bragg peak and then collapses. If the sensitive volume sits in that region, the effective LET across it is neither the surface value nor any single number, and the horizontal axis of the plot is fiction again.

The numbers follow from where the sensitive volume actually is. ESCC 25100 asks for 40 microns minimum for upset in CMOS logic, 60 microns for devices with thick sensitive volumes such as bipolar and JFET linear parts, and 60 microns specifically for latchup, because the parasitic thyristor that latches sits well below the surface circuitry. ASTM F1192 makes the same argument qualitatively, saying adequate range is especially crucial for latchup because the relevant junction is often buried deep, and cites 30 microns as a figure some test requirements specify. JESD57A gives no number and addresses the issue only through the requirement for near constant LET through the sensitive volume.

For power devices the effect is larger than for anything else, and it runs in the dangerous direction. The JPL gate rupture guideline shows short range ions overestimating failure voltages, with shifts as large as half the rated voltage between short and long range ions of nominally the same LET, on devices whose lightly doped drift region alone is 25 microns at 200 V and about 120 microns at 1000 V. A short range ion cannot traverse that region, so it deposits less charge where it counts and the part looks harder than it is.

The derivation is one line. If the sensitive volume is a thin sheet, an ion arriving at angle theta crosses a path longer by one over cosine theta, so it deposits more charge in the same proportion, so it behaves like a normally incident ion of higher LET. That is the whole content of the effective LET concept.

Every assumption in it is now routinely violated. ASTM F1192 states the relation with the explicit condition that theta be below 60 degrees, and states that it breaks down when the lateral dimensions of the sensitive volume become comparable to its depth, which it names as the case for VLSI and other dense parts. JESD57A goes further and says effective LET should not be used for multiple bit upset or for gate rupture, and does not apply to any effect in a device whose sensitive volume is deep relative to its lateral extent.

For vertical power MOSFETs it is not merely inaccurate, it has the wrong sign. JESD57A notes that gate rupture sensitivity often decreases as the angle moves off normal, and MIL-STD-750 Method 1080 simply prohibits angling the die to produce effective LET values. The NASA avionics RHA guidelines state the same conclusion from the physics side: normal incidence to the dielectric is the worst case, so the effective LET concept is inadequate for gate and dielectric rupture.

The two effects are driven by different integrals. Upset depends on the charge deposited within a collection volume, which grows with path length, so tilting the part helps the ion and hurts the device. Gate rupture depends on the transient field established across the gate dielectric by carriers moving in the underlying structure, and that is maximized when the ion track lies along the vertical axis of the cell, straight through the neck of the device and into the epitaxial layer beneath.

This is why the JPL gate rupture guideline requires the beam to be held within about 5 degrees of normal for rupture testing, and why it treats burnout as comparatively insensitive to angle. It is also why the RHA guidelines say plainly that normal incidence is the worst case for gate and dielectric rupture and that the effective LET concept is therefore inadequate for these mechanisms.

The practical trap is that a test campaign designed around upset habits will tilt the part to save beam time and will report a higher survival voltage than a normal incidence campaign would. Two datasets on the same part can disagree by a wide margin for this reason alone, with neither one wrong.

Start with the one that is genuinely physics. A high energy proton does not usually upset a part directly; it undergoes a nuclear reaction and the recoiling fragment does the ionizing, so the recoil spectrum sets a ceiling on the effective LET a proton can deliver. In silicon, recoils from 200 MeV protons reach roughly 11.5 to 15 MeV cm2/mg, which is the basis for the ESA rule that proton testing is required below a heavy ion threshold of 15. Modern parts are not only silicon, and tungsten, copper and tantalum in the interconnect and the package produce heavier recoils, which is why the NASA proton guidance uses about 37 as approximately the highest LET secondary obtainable from a 500 MeV proton and waives proton single event testing above it.

That recoil argument is one reason for 37 and it is the one most often quoted, but it is not the only reason and treating it as the whole story is misleading. A threshold is also a risk decision. The integrated risk on a mission scales with how many susceptible devices are flown and for how long, so a short mission with a modest parts count can accept a threshold that a long mission with thousands of susceptible devices cannot. 37 is frequently adopted on that basis alone, and it is a perfectly defensible basis, but it is a statement about the mission rather than about the part. The tiered structure of the program specifications, with one number treated as unacceptable, another as acceptable and a third as immune, is itself the evidence that these are risk tolerance choices. They should be expected to move when the mission does.

The third route to 37 has nothing to do with either argument, and it is the one that catches people out. For vertical power MOSFETs, effective LET is not valid: normal incidence is the worst case for gate rupture, and MIL-STD-750 Method 1080 prohibits angling the die to manufacture a higher effective LET. So the usual trick of tilting the part to reach a high LET number is unavailable. What is left is the LET the beam actually delivers at normal incidence, and that fights the other requirement these parts have, which is enough range to cross the drift region. Higher LET needs a heavier ion, and at a given energy per nucleon a heavier ion has less range in silicon, while the drift region runs from roughly 25 microns on a 200 V device to well over a hundred on a 1000 V one. Getting LET 75 and adequate range simultaneously at normal incidence is hard, and often not available at all. That is why LET 37 requirements appear for vertical power MOSFETs on missions whose reliability class would otherwise demand 75. It is a facility capability limit wearing the costume of a requirement, and it is the reason the higher energy per nucleon beam lines exist.

The environment numbers are unrelated to protons. They come from the shape of the cosmic ray LET spectrum, which falls very steeply once the abundant species are exhausted. Iron is the practical top of that distribution, and the TREE handbook singles out 100 MeV iron at about 27 MeV cm2/mg as representing the most highly ionizing particles commonly encountered. Allow for angle of incidence and a margin above iron and you arrive at the program thresholds: ECSS treats a part with no events at 60 as immune, and the USAF specification treats above 75 as acceptable.

These should not be mixed, and the practical consequence is that the same number carries different evidence depending on how it was arrived at. A part that clears 37 on the recoil argument has been argued safe against proton induced secondaries, and that says nothing about the direct cosmic ray flux above 37, which is small but not zero. A part that clears 37 because the mission is short has not been argued safe at all; the risk has been accepted, which is a different thing and should be recorded as such. A power MOSFET that clears 37 because that is what the beam could deliver has been tested to the limit of the available evidence, and the residual risk above 37 is simply unmeasured. When you inherit a part qualified to 37, the first question is which of these three it was.

A rate prediction integrates the cross section curve against the environment spectrum. If the curve is still rising where the data stop, the integral is truncated and the rate is understated. JESD57A therefore asks for data out to twice the saturation LET, and where that is not achievable, out to 80 MeV cm2/mg, which is close to the practical limit of most heavy ion facilities.

The reason this became a requirement rather than an aspiration is that highly scaled parts often do not show a clean plateau at all. As cell dimensions shrink, ions that were once well past saturation begin to upset neighboring cells, so the measured cross section per device keeps climbing. A curve that looks flat over a narrow LET window can turn out to have simply been sampled coarsely.

JESD57A also asks for intermediate points at specific fractions of the maximum cross section, and gives a different reason for each: about 75 to 80 percent to constrain the Weibull shape, 50 percent for the median critical charge, 25 percent for a quick figure of merit rate estimate, and 10 percent for comparison against older data and proton parameterizations. Six well defined points is the stated minimum for a fit with any predictive value.

A cobalt 60 cell is not a clean 1.25 MeV field. Photons scatter off the source housing, the walls, the fixture and the part itself, producing a low energy tail. Low energy photons interact strongly through the photoelectric effect, whose cross section rises steeply with atomic number, so at an interface between a high atomic number material and a low one the secondary electron population is out of balance. Near the gold or tungsten of a package, or the metallization of the die, the silicon and the gate oxide can receive substantially more dose than the free field reading implies. This is dose enhancement, and it means the number written in the test report is wrong in an unknown direction.

The lead and aluminum container fixes this by filtering the low energy tail before it reaches the part, and by supplying enough material for secondary electron equilibrium to be established. MIL-STD-883 Method 1019, MIL-STD-750 Method 1019 and ESCC 22900 all specify the same construction: a minimum of 1.5 mm of lead surrounding an inner shield of at least 0.7 mm of aluminum. The lead is the filter and the aluminum is there so that the electrons entering the part come from a low atomic number material rather than from the lead itself. All three documents state the purpose in the same terms, that the arrangement produces approximate charged particle equilibrium for silicon and for thermoluminescent dosimeters such as calcium fluoride.

The container also changes the dose rate inside it, which is why the field intensity has to be measured inside the box, with the dosimeter at the device position, and remeasured whenever the source, the orientation, the container or the fixture changes. The requirement can be waived, but only by demonstrating that the low energy scattered component is small enough not to cause a dosimetry error. That is a measurement, not an assertion.

The 50 rad(Si)/s floor is not arbitrary and it is not about beam economics. MIL-STD-883 Method 1019 defines enhanced low dose rate sensitivity as enhanced damage below 50 rad(Si)/s, and requires bipolar and BiCMOS linear or mixed signal parts destined for applications below that rate to be handled under the low dose rate provisions. Condition A therefore sits exactly at the boundary of the regime where the standard test is known to be non-conservative for bipolar technology.

The 300 rad(Si)/s ceiling is stated in the same clause with no reason attached, in any of the documents reviewed here. It is best understood as the point beyond which the irradiation becomes short compared with the timescales of hole transport and interface trap formation, so that the test stops resembling any real exposure. Note that ESCC 22900 uses a different and much lower window, 1 to 10 rad(Si)/s for its standard rate, and justifies its choice on a completely different basis, namely that the exposure should finish inside 96 hours.

The practical consequence is that a part qualified to Condition A of Method 1019 and a part qualified to the ESCC standard rate have not had the same test, and for a bipolar part they may not have the same answer.

In a thick, poor quality isolation oxide of the kind found in bipolar linear parts, the holes generated by irradiation move slowly and the space charge they build up affects how many of them are trapped and how many interface traps form. Deliver the same total dose quickly and the space charge shields part of the oxide; deliver it slowly and it does not. The result is that the slow exposure does more damage, which is the opposite of the intuition that a fast test is the conservative one.

Method 1019 does not hedge on this. It states that many bipolar linear parts exhibit an enhanced low dose rate response which cannot be simulated by a room temperature irradiation at 50 to 300 rad(Si)/s followed by an elevated temperature anneal. Condition D exists because of that, at 10 mrad(Si)/s or below, and the method requires that any alternative bounding approach be demonstrated with overtest or parameter delta margins rather than assumed. ASTM F1892 gives the same idea a name, defining a true dose rate effect as one that cannot be reproduced by a high rate irradiation and an equivalent anneal.

10 mrad(Si)/s is still roughly a thousand times faster than a geostationary mission. It is a bounding rate chosen so the test finishes, not a mission simulation, and even at that rate a full exposure takes weeks.

Irradiation of a MOS oxide leaves two things behind: positive charge trapped in the oxide, and negative charge in interface traps at the silicon boundary. In an n-channel transistor they shift the threshold in opposite directions, so immediately after a fast irradiation they partly cancel. The trapped positive charge anneals relatively quickly. The interface traps do not, and can continue building. So a part measured an hour after the irradiation can look acceptable, and the same part weeks later can be out of specification. That is rebound, and ESCC 22900 defines it in those terms, as net degradation from changes in trapped oxide charge and interface state density over periods of the order of several weeks.

The accelerated aging step is built to reproduce that worst moment quickly. Method 1019 specifies 100 degrees C plus or minus 5 for 168 hours plus or minus 12, under worst case static bias, preceded by an additional half of the specified dose. The method also states the target directly in its alternative condition: more than 60 percent annealing of trapped holes and less than 10 percent annealing of interface states. The temperature and the duration are the values that hit that split, they are not round numbers chosen for convenience.

The mirror image of this procedure is the extended room temperature anneal, which uses the same physics in the other direction to recover a part that failed immediately after irradiation because of trapped positive charge that will not be there in flight.

The quantity being measured is changing while it is being measured. Trapped charge begins to anneal at room temperature immediately, so a part measured at 20 minutes and the same part measured at 6 hours give different numbers, and neither is more correct than the other. Fixing the interval is what makes results comparable between laboratories and between lots.

MIL-STD-883 and MIL-STD-750 Method 1019 and ESCC 22900 all set the same limits: measurement to begin within 1 hour of the end of the exposure, and the next irradiation to begin within 2 hours, with longer intervals for the slower conditions and a dry ice option to suspend the annealing when the schedule cannot be met. All three say the same thing about why, that the intervals should be as short as practical to minimize time dependent effects.

This is one of the most commonly broken requirements in practice, and it breaks silently: nothing in the data shows that the part sat overnight, and the part that sat overnight looks harder.

If a lot is irradiated to a level above the requirement and passes, that is stronger evidence than a pass at the requirement, and it is stronger in a quantifiable way. MIL-HDBK-814 works the relation through for a lognormal failure distribution and shows that overtesting reduces the sample size needed to reach a given acceptance confidence. That is the actual justification for the practice, and it is a statistical one.

The particular factor of 1.5 appears in Method 1019 for the prescribed low dose rate path and in ASTM F1892's definition of an overtest factor, and in both cases it is asserted rather than derived from that relation. It is best treated as a convention that is known to be useful rather than as an optimum.

Radiation design margin is a different quantity and should not be confused with this one. Overtest is applied in the test to buy statistical strength on a given lot. Design margin is applied in the requirement to cover environment uncertainty and lot to lot variation.

Typical spacecraft shielding falls in the range of about 100 to 250 mils of aluminum equivalent, so 100 mils is a defensible lower end of the real range. The NASA avionics RHA guidelines describe the practice plainly: the environment is transported through an assumed nominal level of shielding, often 100 mils of aluminum equivalent, using an idealized slab or solid sphere geometry, and the analysis is refined toward real geometry once there is a model to refine it with.

What matters more than the number is what changes when you move it. Going from 100 to 250 mils cuts the trapped proton dose by less than a factor of two, and the electron contribution to dose is already negligible beyond about 100 mils. So within the range that spacecraft actually occupy, the shielding assumption is not a strong lever on total dose, and it is almost no lever at all on the cosmic ray heavy ion spectrum.

No document in this library derives 100 mils from an optimization. It is a starting point that has survived because it is approximately right and universally understood.

When an energetic electron decelerates in matter it emits bremsstrahlung. The TREE handbook gives the scaling directly: the intensity depends linearly on the atomic number of the material and on the square of the initial electron energy, and the mean photon energy is about a third of the electron energy. So a lead first surface facing a trapped electron belt turns a stoppable particle flux into a photon flux that is much harder to stop. Aluminum is a poorer absorber per unit thickness but it produces far less bremsstrahlung, which is why spacecraft are built out of it.

The handbook also gives the quantitative picture for a low earth orbit: trapped electrons are almost entirely stopped by more than about 0.2 g/cm2 of aluminum, while the bremsstrahlung above 70 keV is essentially unaffected by aluminum anywhere from 0.1 to 10 g/cm2. The saving grace is that the photon fluxes above 100 keV are on average more than three orders of magnitude below the incident electron fluxes at the same energy.

That is the argument for grading the atomic number rather than picking one: a low atomic number outer layer to slow and stop the electrons while generating as little bremsstrahlung as possible, then a higher atomic number inner layer to absorb the photons that were generated anyway, and sometimes a final low atomic number layer to catch the secondary electrons the high atomic number layer produces. It should be said that the avionics RHA guidelines cite the graded material literature without spelling out this mechanism in their own text, so the reasoning above is assembled from the bremsstrahlung physics in the TREE handbook rather than quoted from a requirement.

Spot shielding is the same idea applied locally. Schwank and co-authors note that adding high atomic number layers around individual components can further shield a critical circuit, and that this is worthwhile against electrons but much less so in a proton rich orbit, where going from 100 to 250 mils buys under a factor of two.

The two populations sit at different places on the energy axis. A large solar particle event is dominated by particles of modest energy, so bulk material genuinely removes them: Schwank and co-authors report that going from 25 mils to about 1570 mils of aluminum cuts the flare flux above LET 30 by five orders of magnitude. Over the same span, the galactic cosmic ray LET spectrum is barely touched, because those particles carry hundreds of MeV to many GeV per nucleon.

The consequence for single event rates was put into a memorable form by Petersen and repeated in the CREME96 literature: error rates fall by roughly a factor of ten behind about 6.5 inches of aluminum. Since a spacecraft wall is a tenth of an inch, shielding is not a single event mitigation. It is a total dose mitigation, and a good one, in orbits where dose comes from trapped particles.

This is the structural reason single event work is organized the way it is. Total dose can be engineered against with mass; single events cannot, so they are engineered against with part selection, derating, detection and recovery.

The three models in CREME96 are constructed from measured data during the October 1989 event: about 180 hours of it for the worst week, an 18 hour interval for the worst day, and the highest 5 minute average proton flux for the peak, with heavy ion fluxes scaled from the proton data. All three are described as worst case at roughly the 99 percent confidence level.

The integration times exist because different failure modes integrate over different windows. Accumulated dose and total upset count over an event care about the week. A single event rate that has to stay inside a fault management budget cares about the peak, because that is when a detection and recovery scheme is most likely to be overwhelmed by coincident events. The documents present the three products for these different uses without deriving the specific windows, so the mapping between window and failure mode is engineering practice rather than a stated requirement.

Note the change from the earlier code: CREME86 used a 10 percent worst case flux, meaning only one in ten events would be more severe, which is a different kind of statement from a confidence level on a fluence.

The rate integral needs the distribution of path lengths through the sensitive volume, because deposited charge is LET times chord length. A rectangular parallelepiped is used because Bradford derived a closed form chord length distribution for it, which makes the integral tractable. That is the entire reason for the shape.

The Weibull has even less claim to physical meaning. It is a four parameter curve with the right qualitative behavior, a threshold and a saturation, and it fits. Edmonds says this bluntly in his review of CREME96 practice: the Weibull function has no physical basis, and a two parameter exponential often fits as well.

This matters because the parameters get over-interpreted. The same review warns that the box thickness must be chosen so the model reproduces the measured angular dependence, not set equal to a physical charge collection or funnel depth, and reports that using a literal collection depth of tens of microns instead of the sub-2 micron value that reproduces the directional response can inflate a rate estimate by two orders of magnitude. The funnel is real physics; putting it into the box thickness by hand is not how the model works.

The NASA avionics RHA guidelines state the expectation directly: a good rate estimate should agree with the observed on-orbit rate within a factor of two to five, citing Petersen's short course and the data workshop literature. They also list where the error comes from: the environment model, part to part variation, departures from the assumed sensitive volume geometry, and Poisson counting error on the cross section measurements. Only the last of those gets better by running more beam time.

This is a useful number to hold onto in both directions. A prediction that misses flight data by a factor of three is behaving as documented. A prediction quoted to two significant figures is claiming a precision the method does not have, and an argument that turns on a factor of two difference between two predictions is not an argument.

There is a separate and much larger error mode which is not part of this figure, namely using the model wrongly. The CREME96 usage review shows that choosing a physically motivated but incorrect sensitive volume thickness can move a rate estimate by two orders of magnitude, which dwarfs everything above.

For the historical record, the first cosmic ray upset rate calculation, by Binder, Smith and Holman in 1975, landed within a factor of two of the observed satellite anomalies. The state of the art has not improved on that by very much, and for structural reasons it is not likely to.

The JPL gate rupture guideline derates from the test result. Its worked example takes a device rated 100 V that ruptures at 80 V under beam, and arrives at 60 V for use, which is 75 percent of the measured threshold and 60 percent of the nameplate. The NASA avionics RHA guidelines do the same thing, deriving an operating limit of 58.5 V from a 78 V measured survival voltage. In this construction the 75 percent covers part to part variation and test uncertainty around a number that was actually measured on that part type.

Derating from the datasheet is a different procedure. For a commercial part there is usually no test result, so the factor has to cover the spread of commercial device response as well as the margin, and the factors in use are correspondingly harsher and vary by technology. Confusing the two is a common and expensive error. Applying 75 percent to a datasheet rating on an untested commercial part is not the same procedure as applying 75 percent to a measured rupture voltage, and it does not carry the same evidence.

One further complication is that a nameplate rating is not always what it appears. A supplier selling into the space market may already have applied its own margin before publishing a rating, in which case a derating factor applied on top is being applied twice, invisibly, and the design gives up voltage it did not need to. There is nothing in the documents reviewed here that addresses this, and the only defense is to derate from a measured failure voltage with a known test protocol rather than from a rating.

The design margin breakpoint method sorts parts by the ratio of the level at which they fail to the level the mission requires. Below about 2 the part is unacceptable. Between 2 and 10 it is hardness critical in the strict sense and every purchased lot has to be tested. Between 10 and 100 it is hardness critical in a weaker sense and occasional confirmatory testing suffices. Above 100 it is hardness non-critical and can be bought like any other part.

The logic is about variability rather than about the mean. A large margin means that even a lot several times worse than the one tested still passes, so the consequences of not testing every lot are small. A margin of 2 means an ordinary lot to lot excursion can put the part over the line, so every lot must be checked. The TREE handbook, which sets out the method, describes the specific breakpoints as conventions used by the services rather than as a derived criterion, and offers an alternative that ties the breakpoint to each part's measured response variability instead.

MIL-HDBK-814 gives the underlying statistical point for the low end: a part with a margin of one has about a 50 percent chance of surviving, which is why a margin near unity is not a margin at all. It recommends a minimum of 2 to 3 while acknowledging that at very high dose levels a factor of 3 may not be achievable.

The NASA avionics RHA guidelines are notably more skeptical, describing the margin approach as ad hoc, capable of both under and over specifying, and note that the agency is moving toward quantifiable assurance methods. They do not prescribe a fixed factor.

Above roughly 100 MeV the proton upset cross section of most parts has stopped changing, because the nuclear reaction cross sections that produce the ionizing recoils have leveled off. A single point above that captures the saturated value, and JESD234 states that testing above 200 MeV is not generally necessary for non-destructive upset because higher energy protons are rare enough in the environment that the extra contribution to the rate is small.

The dose argument points the same way and is worth doing explicitly. A 30 MeV proton deposits about 3.0e-7 rad(Si) per proton per square centimeter, a 63 MeV proton about 1.8e-7, and a 200 MeV proton about 7.0e-8. So the fluence needed for good statistics costs about 30 krad at 30 MeV, 18 krad at 63 MeV and 7 krad at 200 MeV. This is why Schwank and co-authors recommend starting at high energy: it minimizes the dose accumulated before the measurement is made, and if the cross section turns out to be flat the low energy points can be skipped entirely.

63 to 65 MeV is common for a different reason: it is what a large number of cyclotrons produce, and the older guidance notes that in the trapped environment there are roughly as many protons below 60 MeV as above, so a single point near there is representative if only one can be afforded. Its weakness is stated just as plainly, that a facility limited to 63 MeV may be too low to reach saturation.

For latchup the logic reverses and the highest available energy is the right choice. Schwank and co-authors go further and advise against proton latchup testing at facilities below 180 MeV at all, because latchup probability can be significantly underestimated, and JESD234 notes devices where latchup was seen only above 400 MeV, driven by spallation reactions in high atomic number metallization.

The statistics are the same as for heavy ions: with no events, the bound on the cross section is a constant over the fluence. JESD234 gives a nominal 1e10 protons/cm2 for soft devices and 1e12 for hard ones, with a rule of thumb of a hundred events where events are available. The 2002 lessons learned guidance is more specific about the null case: stop either at 1e11 protons/cm2 or when the part is destroyed, whichever comes first.

That phrase, whichever comes first, is the whole problem. At 30 MeV, 1e11 protons/cm2 deposits about 30 krad(Si), which is above the total dose capability of a great many commercial parts. So for a hard part the single event test and the total dose test are the same test whether you intended that or not, and the cross section you measure at the end of the run is the cross section of a degraded device.

This is why the standards insist on tracking dose during the run and swapping parts. JESD234 suggests replacing devices at 20 to 50 percent of the established total dose or displacement damage failure level; the NASA proton guidance uses 80 percent of known tolerance. Those two numbers disagree, and the disagreement is worth knowing about when reading somebody else's report.

For most of the history of the field, protons upset parts indirectly: a nuclear reaction produced a recoil, and the recoil did the ionizing. A proton's own stopping power was simply too low to deposit the critical charge. As feature sizes shrank the critical charge fell, and at 65 nm and below the direct ionization from a slow proton near its Bragg peak became sufficient on its own.

The consequence is that the cross section stops being flat at low energy and instead rises steeply as energy falls, which is exactly the region the standard test methods exclude. JESD234 addresses this by prohibiting the case: it notes that direct ionization effects have been observed in technologies below 100 nm, primarily below 5 MeV, and states that testing at those energies is outside its scope. It also notes the effect extends to higher energies at glancing incidence, where the path length through the sensitive volume is longer.

Schwank and co-authors explain why no standard method exists yet, and the reasons are all practical. Putting the Bragg peak inside the sensitive volume with a genuinely low energy beam means large uncertainty by the time the proton has crossed the overlayers. Using a heavier ion at matched stopping power reduces straggle but needs careful energy loss modeling. Degrading a 60 to 70 MeV beam through added material adds straggle, but has the merit of resembling how low energy protons actually arise inside a spacecraft, as degraded higher energy protons.

Latchup is a parasitic thyristor turning on and holding itself on. Higher temperature raises the well and substrate resistances and raises the current gains of the parasitic bipolar transistors, both of which make the structure easier to trigger and easier to sustain. ASTM F1192 states the effect directly, that latchup susceptibility and soft error cross sections increase with temperature, and JESD57A and ESCC 25100 both require latchup testing at maximum rated operating voltage and maximum operating temperature.

Burnout is second breakdown in a parasitic bipolar structure in a power device, and it goes the other way. MIL-STD-750 Method 1080 states that higher temperature raises the burnout LET threshold, so lower operating temperature is the worst case. JESD57A gives the same guidance in its worst case table: burnout at maximum reverse bias and minimum operating case temperature. Gate rupture is treated as essentially temperature independent, and the JPL guideline says so explicitly.

Note that none of these documents give an absolute temperature. The requirement is always relative to the device's own rated maximum or minimum, which is why a test report that says 125 degrees C without saying what the part is rated to has not established that it tested the worst case.

One caution from the source text: MIL-STD-750 Method 1080 contains two notes that disagree with each other on the direction of the temperature effect, and only the later one is consistent with the rest of the literature. If you are working from that method, use the physics rather than the note.

Both present the same way on the bench: current goes up sharply. What distinguishes them is what happens next. Latchup is a self-sustaining state that clears when power is removed, and it becomes destructive only if the current is allowed to run. Burnout in a power device is thermal destruction and does not clear. The JPL gate rupture guideline addresses this directly and says that a high current condition that recovers on power cycling should be noted but not recorded as burnout or gate rupture.

The consequence for data analysis is larger than it looks. Latchup depends on the current limit of the test fixture, on temperature in the opposite direction from burnout, and on the bias of the control logic rather than the power stage. A dataset that records recoverable latchup events as burnout failures will show failures at voltages far below the true burnout locus, and any derating fitted through those points will be unnecessarily severe. When reviewing a screen from any source, the first question about a destructive event should be whether the part recovered.

A focused laser pulse creates carriers by photon absorption, not by the coulomb interaction of a charged particle track. The spatial profile of the deposited charge is different, so there is no first principles conversion between pulse energy and LET. The desk reference is explicit that either an empirical correlation factor, which itself requires heavy ion data, or a tuned laser equivalent LET must be used, and that in most cases heavy ion and proton data are still required for a rate prediction.

The access problem is the other half. Laser light cannot pass through metal, so the interconnect stack, the package and opaque coatings all block the beam, which forces delidding, backside polishing to a mirror finish, or substrate thinning. The through-wafer route uses two photon absorption, which needs sub-bandgap photons, typically 1250 to 1550 nm in silicon rather than the 1064 nm used for single photon work, and the choice between them is dictated by the packaging rather than by preference.

There is also a geometry limitation: laser testing is done almost exclusively at normal incidence, because the working distance of the objective and refraction at the semiconductor surface make angled illumination impractical. That rules out the grazing angle work sometimes needed for hardened-by-design circuits.

What the laser is good at is the thing broad beam cannot do at all, which is telling you where on the die the sensitivity is. The two techniques answer different questions, which is why the literature calls them complementary rather than alternative.

Total dose response in particular depends on oxide growth conditions, hydrogen content and thermal history, none of which appear on a datasheet and none of which the manufacturer is obliged to hold constant. A part can meet every electrical parameter across a process change and behave completely differently under irradiation. The NASA avionics RHA guidelines state that design mask or fabrication process changes can invalidate archival data while form, fit and function are maintained, and that manufacturers are not necessarily required to give notice.

The guidelines put a timescale on it for leading edge commercial parts: die revisions can occur as often as every 18 months for state of the art memory. They also give the practical rule for archival data, that data on a non-flight lot usually has limited predictive value, and recommend more than three lots of historical data before drawing conclusions about variability.

The same guidelines make a related point that is easy to miss: standard screening flows say nothing about radiation. Passing a military screening specification, or even carrying a hardness assured designation, does not establish single event or displacement damage behavior, because those designations often address total dose only.

For destructive single event effects the argument is stronger still, because the variability is not just wide but structured. The commercial MOSFET response variability work found burnout onset voltages in trench devices that were bimodal, which is the shape a small lot sample is least likely to reveal.