SSC13-IV-3 Radiation Effects and COTS Parts in SmallSats

Full text

Sinclair 1 27th Annual AIAA/USU
Conference on Small Satellites
SSC13-IV-3
Radiation Effects and COTS Parts in SmallSats
Doug Sinclair
Sinclair Interplanetary
268 Claremont St., Toronto, Ontario, Canada
dns@sinclairinterplanetary.com
Jonathan Dyer
Skybox Imaging
1061 Terra Bella Ave, Mountain View, California, USA
jonny@skybox.com
ABSTRACT
An emerging class of small satellite missions requires assured operational lifetime and rapid development on a
moderate budget. This paper describes a “Careful COTS” approach to component selection and testing to meet
these needs. Commercial parts are selected based on best practices, and radiation tested to limits based on the
modeled mission environment. High-energy proton testing allows simultaneous exploration of total dose,
displacement damage, and some single-event effects.
The authors have developed these methodologies over the course of a number of successful low-earth orbit missions.
Provided the lifetime dose is under 30 krad, a solution can probably be realized with commercial parts. Various case
studies of commercial parts that have failed under this dose are given.
INTRODUCTION
In past decades, small satellites have had a reputation as
second-tier spacecraft, used primarily for amateur,
educational and technology demonstration purposes. In
these cases, lifetime was not of paramount importance.
Often the bulk of the mission’s utility lay in the design
and fabrication of the spacecraft, and not in its on-orbit
performance.
Today the secondary roles remain, but they are
augmented by a growing number of operational
constellations providing useful and necessary services.
These include communications (i.e. ORBCOMM),
remote sensing (i.e. Skybox Imaging) and science (i.e.
BRITE). The owners of these missions require an
assurance that their investments will operate
successfully on-orbit for many years. Lifetime, both
real and demonstrated, becomes of great importance.
Without careful attention, a satellite’s life may be cut
short by space radiation effects. This paper shows the
approach used by the authors to design satellite
electronics to meet a specific required lifetime while
maintaining reasonable budget and rapid development
cycle. It has been successfully demonstrated over
dozens of spacecraft, with the eldest now operating
usefully after 10 years on-orbit.
Definitions
In discussing space radiation effects, we start by
defining some frequently used terms.
Total Ionizing Dose (TID) – Material damage caused
by ionizing radiation sources. Quantified by deposited
energy per mass for a given material with units of Gray
(SI) or Rad.
Linear Energy Transfer (LET) – Rate at which energy
is deposited in matter as an ionizing particle travels
through. Typical units are MeV/cm or scaled by
material density as MeV-cm2/mg
Single Event Effects (SEE) – Disruption in function of
electronic circuits due to single ionizing particle
interaction. These may be:
• Single Event Upset (SEU)
• Single Event Latchup (SEL)
• Single Event Functional Interrupt (SEFI)
• Single Event Burnout (SEB)
• Single Event Gate Rupture (SEGR)
Particle energy – kinetic energy of a particle generally
given in keV or MeV

Sinclair 2 27th Annual AIAA/USU
Conference on Small Satellites
RADIATION AND RELIABILITY APPROACHES
Broadly speaking, there are three different approaches
to spacecraft parts selection in the context of radiation
and reliability. On one side is the radiation hardened /
space grade. At the other extreme is the buy-and-fly.
We propose a middle path, which we term “Careful
COTS”.
Radiation Hardened / Space Grade
A radiation hardened or “space-grade” component is
defined as one that is engineered by its manufacturer to
provide specific radiation performance. This is
typically accomplished by making certain process
changes at the silicon foundry level1. A radiation
hardened component will also be made with strict
quality control including periodic testing to the rated
radiation dose, and part-level environmental screening
for latent defects and infant mortality.
Radiation hardened components tend to have the
following properties:
• Rated radiation dose of 100 krad to > 1 Mrad
• No SEL, due to disabling of parasitic SCR
structures
• Characterized single-event effects
• Hermetic packages
• Low degree of integration, and mature
technology (~10 years behind cutting edge)
• No supplier stock, and long lead times
• High component cost
The use of radiation hardened components drives the
cost of a space mission design. The actual component
price, while high, is not the greatest effect. Instead, it is
the long lead times and low density that lead to long
engineering / build design cycles and relatively low
performance when compared with commercial designs.
Radiation hardened components are appropriate for
very high dose environments, where nothing else will
work. This includes certain high altitude orbits,
spacecraft operating near the outer planets, and military
devices intended to survive nuclear war. They may also
be suitable for extremely risk-averse programs, such as
human spaceflight, where the cost of proving any other
design to be safe would be overwhelming.
Careful COTS
An alternative to the radiation hardened / space grade
approach has been coined Careful COTS. It involves
proving radiation tolerance of specific commercial parts
at the level required for the mission and implementing
system-level design, screening and process control to
improve reliability. A “radiation tolerant” component
is defined as a commercial or industrial part that was
not manufactured with space radiation in mind, but
which has been found to be functional to a certain dose
by test.
Most commercial components are radiation tolerant to 5
krad. Many are radiation tolerant to 20 krad or more.
Some will fail before 1 krad. Without testing, it is
impossible to predict which category a part will fall
into.
Lot control and screening is critical to Careful COTS.
Commercial vendors may change their manufacturing
processes, or even the silicon foundry that produces
their parts. A particular part made last year may be
radiation tolerant, while parts made this year may not
be. Parts that are used for flight must be known to be
identical to parts that have been radiation tested.
Modern commercial part reliability is very high, with
the majority of failures occurring early in a part’s life
due to an inherent defect. One manufacturer shows 14
failures from a sample of 10,403 plastic packaged ICs,
tested at +135°C for 1000 hours2. This represents an
approximate 0.14% defect rate, leading to unacceptable
odds of failure for a satellite containing hundreds of
parts.
To mitigate this problem, flight hardware must
accumulate sufficient operating hours before launch so
that the “infant mortality” risk is retired. This should
be done by elevated temperature burn-in testing of
integrated assemblies. Testing at the component level
is unnecessary, and for many surface-mount package
types impractical.
It is possible for a commercial subsystem (GPS,
camera, computer, etc) to be tested and found to be
radiation tolerant. However the odds are lower. For
example, assume that a commercial camera uses 10
different types of IC and that each type of IC has a 90%
probability of being radiation tolerant to the mission
dose. The probability of the entire camera meeting the
mission dose is only 0.910 = 35%. Lot control is also
difficult for commercial subsystems. Even if two
cameras were made on the same day, can we be
absolutely certain that the detectors on each come from
the same lot?
Tin whisker risk must be mitigated by hot-solder
dipping at the component level. Where lead-free
commercial subsystems are acquired, they can be
conformal coated.

Sinclair 3 27th Annual AIAA/USU
Conference on Small Satellites
Careful COTS designs are suitable for many small
satellite missions where a high probability of mission
success is required and access to cutting edge
commercial technology is critical. They are not cheap,
and may be out of reach of educational or
demonstration missions.
Buy-and-Fly
A buy-and-fly philosophy takes a calculated risk in
discounting the effects of radiation on electronics.
Commercial components and subsystems are
purchased, and provided they meet the other
environmental requirements (vibration, temperature,
etc.) they are integrated into the spacecraft. Both
component and assembly quality can vary widely and
generally little or no screening is performed.
Buy-and-fly is suitable for missions with extremely low
radiation dose, either due to benign low orbits or short
mission lives. These two factors tend to go together, as
low orbit spacecraft re-enter quickly. It is also
necessary for cost-constrained missions where risk of
failure is tolerated.
CAREFUL COTS DESIGN SEQUENCE
Figure 1: Careful COTS Design Flow Chart
ENVIRONMENT MODELLING
The space radiation environment consists of high-
energy solar particles and photons, charged particles
trapped in Earth’s magnetic field, and extra-solar high-
energy particles called galactic cosmic rays (GCRs).
The largest sources of ionizing radiation in LEO and
MEO are trapped proton and electrons, while solar
origin particles dominate for higher orbits and
interplanetary mission. Photons (X-rays, gamma rays),
electrons, protons and heavier charged nuclei contribute
through slightly different mechanisms to the TID a
component receives during its lifetime. However only
protons and heavier nuclei deposit enough localized
energy in matter to generate single event effects.
The first step in a Careful COTS design is to understand
the expected environment that the device must survive.
The inputs to this analysis are:
• Mission orbit (or trajectory)
• Mission duration
• Device shielding
A simple mission will have a single orbit for a certain
lifetime, such as “850 km sun-synchronous for 2 years”.
A more complex mission may have different phases
that can be summed together, such as “two weeks in
GTO plus three years in GEO”. Interplanetary or low-
thrust missions may describe continuous trajectories
that must be piecewise integrated.
At this stage in the design the shielding estimate can be
very approximate. The simplest model is a spherical
aluminum shell, and this is often appropriate for
components buried in the heart of a satellite. If a device
has significantly more shielding on one side than
another then a sectoring analysis is required – the
problem is non-linear, so simply averaging the
shielding thickness is not applicable. More detailed
shielding analysis may include full particle transport
monte-carlo in a tool suite such as Geant4, although
other uncertainties in test and analysis generally make
the effort involved in such an analysis unwarranted for
all but the most critical missions.
If the shielding is a material other than aluminum,
weighting by density is a reasonable first
approximation. For example, aluminum has density
2700 kg/m3 and titanium has density 4500 kg/m3.
Therefore 1.0 millimeter of titanium is equivalent
shielding to 1.7 millimeters of aluminum.
The easiest place to perform this analysis is SPENVIS3.
This is an online service provided by ESA that includes
many industry-standard space radiation effects analysis

Sinclair 4 27th Annual AIAA/USU
Conference on Small Satellites
tools in an easy-to-use interface. Registration is
required, but it is free to use.
Radiation Environment Modelling Example
As an example, let us consider a hypothetical LEO
mission carrying a Sinclair Interplanetary ST-16 star
tracker. We set the orbit as 800 km altitude, dawn-dusk
sun-synchronous. The mission life is 5 years. At this
stage we may not know when in the 11-year solar cycle
we will launch – unexpected delays of several years are
not uncommon. The trapped electron environment is
worst at solar maximum, and paradoxically the trapped
protons are worst at solar minimum. To be
conservative we will assume both worst environments.
Finally we must choose our solar proton model. Solar
protons do not come in a steady flux, but are associated
with discrete flare events. Some years may have
exceptional flares, while some may be quiet. The
models require a confidence level, expressed as a
percentage chance of the result being an over-estimate
of the actual environment the mission will see. Be
careful with the degree of conservatism here. A 95%
confidence, while reassuring, may lead to significant
radiation overdesign. We choose 80%.
Table 1: SPENVIS Environment Inputs
Coordinate
Generators
Spacecraft
Trajectories
1 mission segment
5 year duration
Heliosynchronous
Start Jan 1, 2011
800 km altitude
0600 local ascending node
Radiation
Sources
and
Effects
Trapped proton
and electron
fluxes
Proton model AP-8, solar
minimum
Electron model AE-8, solar
maximum
Long-term solar
particle fluences
ESP-PSYCHIC (total fluence)
Ion range: H to H
Confidence level: 80%
Galactic cosmic
ray fluxes
Ion range: H to U
Magnetic shielding: default
Ionizing dose for
simple
geometries
SHIELDOSE-2 model
Center of Al spheres
Silicon target
The graphical output from the SHIELDOSE-2 model is
shown. The report file contains tabulated data which
will also be very useful. The plot shows that below 4
mm of shielding, trapped electrons are the dominant
source of total dose. Above 4 mm of shielding, trapped
protons dominate. Electrons are strongly affected by
shielding, while trapped protons are not. As can be
seen in Figure 2, shielding has very small marginal
benefit beyond about 5mm (200 mil) thickness
aluminum which makes for a good design rule-of-
thumb.
Table 2: Continuous Stopping Distance in
Aluminum and Tungsten
Aluminum (Al)
Tungsten (W)
Al/W Ratio
Electrons
1 MeV
0.5546 g/cm2
0.7686 g/cm2
0.722
10 MeV
5.861 g/cm2
6.211 g/cm2
0.945
Protons
10 MeV
0.1705 g/cm2
0.3452 g/cm2
0.494
100 MeV
10.01 g/cm2
15.96 g/cm2
0.627
Figure 2: SHIELDOSE-2 Output
Next, we must determine the shielding of our device.
Space electronics are seldom packaged in convenient
aluminum spheres, so some approximations must be
made.
Table 3: Star Tracker Sectoring Analysis
Fraction
of
sphere
Element
Equivalent
Aluminum
Thickness
5 Year
Contributed
Dose
22%
Lens
20 mm
0.39 krad
53%
Chassis
side
2.5 mm
9.34 krad
25%
Satellite
body
10 mm
0.64 krad
Total
10.37 krad
For each element, the “5 Year Contributed Dose”
column is derived from the total dose in the
SHIELDOSE-2 report file multiplied by the fraction of
sphere. The great bulk of the star tracker’s total dose
comes from electrons penetrating the thin aluminum
side wall of the chassis.

Sinclair 5 27th Annual AIAA/USU
Conference on Small Satellites
If we wanted a lower total dose we could consider
adding additional shielding. A 1 mm thick tungsten
shell has been manufactured to fit over the ST-16 star
tracker. To evaluate its performance we must find the
equivalent thickness of aluminum. Using the NIST e-
star and p-star models4, we find the continuous stopping
distance approximation (CDSA) for electrons and
protons in the two materials, shown in Table 2.
The particle energies of interest are chosen
heuristically. Electrons much below 1 MeV have no
chance of penetrating the shielding, while 10 MeV is
about the maximum of the spectrum. The same
arguments apply for 10 MeV and 100 MeV protons.
By rough averaging we can say that tungsten stops
electrons equivalent to 85% of an equivalent mass of
aluminum. It stops protons equivalent to 55% of
aluminum. A 1 mm tungsten sheet has the same mass
as a 7.1 mm aluminum sheet. So our tungsten shell
looks like 6 mm of aluminum to electrons, and 4 mm of
aluminum to protons. Bremsstrahlung X-rays are a
small fraction of the total dose, and are ignored here.
Table 4: Sectoring Analysis with Shield
Fraction
of
sphere
Element
Equivalent
Aluminum
Thickness
5 Year
Contributed
Dose
22%
Lens
20 mm
0.39 krad
53%
Chassis
side
Tungsten
shell
Electrons
8.5 mm
0.04 krad
Protons
6.5 mm
1.64 krad
25%
Satellite
body
10 mm
0.64 krad
Total
2.71 krad
In this case, 74% of the total dose can be eliminated by
the addition of the tungsten shell.
It is interesting to note here that many people think of
Hi-Z materials such as tungsten or lead as better
radiation shields than Low-Z materials such as
aluminum. This is the case from a shielding thickness
perspective, but is not true from a mass perspective –
aluminum is a superior shielding material for both
protons and electrons when mass is the primary design
consideration. Generally Hi-Z materials are superior
for high energy photons (X-rays, gamma rays) as
anyone who has worn a lead blanket during an X-Ray
knows.
SPENVIS can also be used to look at single-event
effects.
Table 5: SPENVIS Single-Event Effects Inputs
Radiation
Sources
and Effects
Shielded flux
2 g/cm2 total thickness (Or
as appropriate for your
mission shielding)
0% Ta to Al mass ratio
Long-term
SEUs and
LET spectra
0.7 cm Al shielding (or as
appropriate for mission)
Material: Si (SRIM2008)
The proton orbit averaged flux shows the proton energy
spectrum that makes it past the shielding. It can be
used to relate SEU rates found during proton testing to
likely upset rates on orbit. For example, we know from
testing that the SEU cross-section for each RAM bit in
the ST-16’s supervisor processor is 3.27 x 10-14 cm2 for
105 MeV protons. The total proton flux striking the
processor is approximately 100 particles per cm2 per
second. If we assume the cross-section is invariant with
energy then we would expect each bit to upset every
3x1011 seconds. The processor has 67584 bits of RAM
total, so one upset is expected every 4.4x106 seconds, or
52 days. This is frequent enough that a software error-
detection-and-correction scheme is used to mitigate the
system impact.
Figure 3: Proton Orbit Averaged Flux
The Shielded LET Spectra figure shows the number of
heavy ion interactions in the target silicon device over
the lifetime of the mission. Note that the LET units are
MeV-cm2/g. Divide by 1000 to get the more familiar
Mev-cm2/mg used in most literature.

Sinclair 6 27th Annual AIAA/USU
Conference on Small Satellites
Figure 4: Shielded LET Spectra
Proton testing may be assumed to uncover SEE out to
25 MeV-cm2/mg. This figure shows 2x104
particles/m2/sr above this LET over the lifetime of the
mission. The sensitive cross-section of a component
cannot be larger than its physical size. If we imagine a
component with physical area 10 mm2, it can expect to
see a single particle of greater than 25 MeV-cm2/mg
over the lifetime of the mission. Thus we can place
upper limits on SEE effects that have not been directly
tested with heavy ions.
CAREFUL COTS BEST PRACTICES
While radiation is the focus of this paper, success of a
space mission depends on a number of other factors
including design standards (de-rating, redundancy, etc),
part selection and degree of test at unit and system
level. References ESA ECCS-Q-30-11A5 and NASA
EEE-INST-0026 are excellent references for the design
factors outside of radiation effects that impact system
reliability and won’t be repeated here.
Exempt Components
Certain components can reasonably be assumed to be
radiation tolerant to at least 30 krad when operated in
proper and de-rated biasing conditions:
• Anything not containing a semiconductor.
(resistors, capacitors, inductors, etc.)
• Single-junction diodes (standard, Schottky,
Zener)
• Bipolar junction transistors (BJTs)
Be aware that there are two-terminal components that
may look like diodes, but that may contain considerable
complexity. These include some temperature sensors,
voltage regulators and references, and current
regulators. There is every possibility that these parts
are also radiation tolerant, but it cannot be safely
assumed.
Most non-electronic materials (PCB substrates,
conductors, fasteners, etc.) can be considered radiation
tolerant. One important exception is glass – certain
optical designs may rapidly degrade under space
radiation7.
CMOS Logic Families
The use of discrete digital logic ICs (i.e. the 74 series)
is decreasing as designs become more integrated.
Nevertheless, these parts are still used and the designer
will often need to choose between the different
available families. A number of vendors have released
white papers8,9 claiming immunity to latchup. These
claims must be treated carefully – often it is only the
I/O structures that are protected. The authors’
experience backs the assertion that some logic families
are weak against SEL while other interchangeable parts
are strong.
Operating voltage and Latchup
CMOS latchup is caused by parasitic bipolar SCR
structures being turned on, effectively clamping the
supply rail to the thyristor turn-on voltage. This voltage
can never be less than the silicon PN voltage drop (~0.7
V) and is typically closer to 0.9 V. If the supply
voltage is less than this value then latch-up becomes
impossible.
Even if the supply voltage is high enough to allow
latch-up, the cross section is reduced by selecting the
lowest possible value within the operating range. Many
modern digital components have core voltages around
or below 0.9 V, and these can be expected to be latch-
up free. However, these devices tend to have I/O
circuitry that runs at higher voltages and these circuits
are still subject to SEL. The designer should choose the
lowest possible I/O rail voltages. 1.8 V is safer than 2.5
V. 2.5 V is safer than 3.3 V. There is little reason for a
modern design to use 5.0 V. Obviously a move to
lower voltages reduces the design’s noise margins, and
so good EMC practices are mandatory.
Power MOSFETs
Power MOSFETs can fail due to single-event effects,
particularly single-event burnout (SEB) and single-
event gate rupture (SEGR). N-channel MOSFETs also
become depleted with increasing total dose, while P-
channel MOSFETs become enhanced.
The best practices are:

Sinclair 7 27th Annual AIAA/USU
Conference on Small Satellites
1. Where performance is not critical, replace the
MOSFET with a bipolar junction transistor
(BJT).
2. Where possible, replace N-channel MOSFETs
with P-channel MOSFETs. P-channel
MOSFETs have no SEB mechanism, and total
dose enhancement is seldom a problem.
3. Where possible, use MOSFETs with
maximum gate voltage rating lower than the
applied drain voltage. This mitigates SEGR.
This is clearly not possible in high voltage
applications. Limiting Vgs in circuit design
will also reduce susceptibility to SEGR10.
4. Massively derate the Vdss voltage rating for
N-channel MOSFETs. 20% derating is
appropriate11: use 150 V parts for a 28 V
nominal application.
Single event burnout in power MOSFETs is very real,
and we have been bitten by it before. In theory, N-
channel MOSFETs will also become depletion-mode
with significant total dose, leaking current in the off
state. This can be mitigated by gate drive circuits that
apply negative voltage. To date, at total doses of 20
krad, we have not seen problematic levels of depletion
leakage.
Charge Pumps
Some ICs contain onboard charge-pumps to create high
voltages. These include flash memories, N-channel
high-side switch controllers, and TTL-to-RS232
converters. For many years the received wisdom was
that these were radiation soft and should be avoided12.
Our testing has not supported this claim. By all means
avoid these parts if possible, but modern parts will
probably work well to modest dose.
Reconfigurability
Many components can be reconfigured, based on the
state of internal registers. A simple example is a power
supply with an I2C interface that can be commanded to
different output voltages. A more complex example is
a microprocessor that contains thousands of bits of
reconfigurable register. It is a good design practice to
ensure that no combination of register states can cause
hardware damage.
A general purpose logic pin may be configured as an
input or an output. Any time that two pins are
connected together, it is a good idea to include a series
resistor. If the system becomes misconfigured such that
both pins become outputs the resistor will limit the
current flow to a manageable level.
If a power supply is adjustable, make sure no damage
will occur at the extremes of its commandable range. If
this is not possible, add a Zener diode to the output to
limit its voltage – but make sure that something
upstream will limit the current before the Zener
overheats.
Often multiple power supply rails will require a certain
sequencing order. For example, an IC with +5V and
+3.3V inputs may require that the +5V rail be powered
first and may enter a latch-up state if this is not done
correctly. CMOS analog switches and multiplexers are
particularly vulnerable here. The problem can be
mitigated by the use of nominally reverse-biased
Schottky diodes between the rails.
Latchup Mitigation
Almost every commercial IC has the potential to enter a
latchup state where its power supply input is effectively
shorted to ground. Typically no damage is done
provided that the current flow is not so great as to cause
burnout, and not of so a long enough duration to cause
overheating.
Some degree of power supply protection is
recommended. Most linear or switch-mode DC/DC
converters have current and thermal limiting, and that
should be sufficient. Complex circuit-breaker designs
may ultimately reduce the reliability of the system
through increased parts count.
Massive Integration
Experience shows no clear correlation between the
complexity of an IC and its radiation tolerance. A
commercial microprocessor may handle the
environment fine, while a commercial temperature
sensor IC may experience catastrophic latch-up.
Tolerance is dictated largely by the manufacturing
processes and not by the transistor count.
Given this, the design that is most likely to survive
radiation testing is the design with the fewest types of
IC. Where possible, use modern parts with massive
integration so that one part can replace multiple
conventional parts. This is in direct contrast to
traditional radiation hardened design methodologies
that typically use low-integration devices.
Idle State
If a component is not under bias it cannot suffer single-
event effects. Its damage from total dose is minimized
as electron-hole pairs are not pulled apart. Where
possible, remove power from circuits that are not
needed.

Sinclair 8 27th Annual AIAA/USU
Conference on Small Satellites
PURCHASE PARTS LOT
Once a detailed design and bill-of-materials has been
prepared, purchase the components. It is recommended
that the PCB layout be completed before parts are
ordered. Often the layout exercise will result in a
decision to change component packages. It is also
recommended that PCBs not be fabricated until the
parts arrive so that footprints can be directly checked.
Order a quantity of each component sufficient to last
several years of anticipated production volume, and
ensure that all components are from the same lot and
date code. Only rarely will COTS parts have lot codes
marked on the outer packaging. Many parts will have
lot or date codes marked on the part itself, though the
manufacturer-specific codes require some deciphering.
Tiny parts (SOT23 and smaller) may not have any such
text. In that event, parts from the same tape can be
safely assumed to be from the same lot.
This step entails significant financial risk. You may be
buying thousands of dollars of a part that has every
chance of failing the radiation tests. This is the price of
quality.
PROTOTYPE BOARDS
Build up at least three prototype boards. If GSE is
needed to test functionality, built a set as well. Develop
onboard software (if applicable) to the point where all
hardware functions can be demonstrated and SEUs can
be counted. There may be errors in the board design
that prevent it from working properly. Apply cuts-and-
jumps, dead-bug components, and other repairs as
necessary to achieve the desired functions.
Prepare a functional test sequence to demonstrate
operation. Board power consumption should be
measured and logged externally. Run this test a number
of times in the lab to develop a baseline.
RADIATION TEST
Test Types
Radiation testing for space electronics generally falls
into three categories: cobalt-60 (gamma ray), proton
and heavy ion.
Cobalt-60 generates high energy gamma rays with
excellent penetration. It causes total ionizing dose, but
no single event effects. It is cheap, and readily
available.
Proton testing requires a cyclotron capable of
accelerating protons to energies >50Mev. It causes
ionizing dose, and single-event interactions with LET
of up to 25 MeV-cm2/mg. Cost and availability are
moderate.
Heavy ion testing may be done with an accelerator, or
with a radioisotope source. Very high LETs can be
generated, allowing the full space environment to be
explored. It also causes total ionizing dose. This
testing tends to be expensive, and availability is poor.
We recommend proton testing as a key element of a
Careful COTS design. It gives the biggest “bang for
your buck”, allowing board level testing for total dose
effects, SEU and SEFI characterization, and screens for
parts with unacceptably low SEL, SEB or SEGR
tolerance.
The three prototypes will serve the following functions:
• Unit A: control, not irradiated
• Unit B: irradiated to expected mission dose (no
margins)
• Unit C: irradiated to twice expected mission
dose
Cobalt-60 Testing
The test method for cobalt-60 is laid out in MIL-STD-
883G, method 1019.7. The board should be powered
and running in a normal mode during irradiation so that
components are biased in a representative fashion.
Gamma ray penetration is such that an integrated unit
can be successfully irradiated from any convenient
angle. Power consumption should be logged during
dose (Fluke 289 multimeters are very useful for this).
Realtime telemetry may be gathered from the
equipment, though in the absence of single-event
effects this is seldom particularly interesting.
Cobalt-60 facilities are available at university and
government labs worldwide. It is inexpensive, at
<$200/hour. Similar results can be achieved using 10
keV X-ray sources13, though package de-lidding is
required and this is generally not useful for testing of
complete boards.
Proton Testing
High energy protons pass through solid matter without
leaving much energy behind, whereas low energy
protons interact more frequently with the atoms they
pass through, rapidly dumping energy until they come
to a stop. Thus, proton LETs are higher at lower
energies. But the LETs of even low energy protons are
only 0.02 Mev-cm2/mg and are not sufficient to trigger
SEEs.

Sinclair 9 27th Annual AIAA/USU
Conference on Small Satellites
Occasionally a proton may strike a silicon nucleus and
send it moving through the crystal lattice. This is a
heavy ion generated directly inside the component. It
may have14 an LET as high as 8 MeV-cm2/mg. On rare
occasions, a proton may strike an even heavier nucleus.
This could be aluminum, copper or gold in bond-wires
or die metalization. Tungsten is also used as a silicon
via fill material. Studies15 show that these heavy ions
can generate LET of up to 25 MeV-cm2/mg.
Production of these ions is a function of the proton
energy, and for this reason it is recommended to test at
the highest energy possible.
Protons have sufficient penetration that packaging and
orientation are not significant concerns. Components
on the back side of a PCB will be irradiated to
essentially the same dose as parts on the front. Big
metal chassis or heat sinks should be taken into
account.
Irradiation should be performed on an active unit,
running test software or otherwise exercised in a
representative manner. It should be powered from its
highest rated voltage to put the greatest stress on its
power supply. Temperature is typically ambient to
simplify logistics. Hot or cold tests may sometimes be
done to investigate particular SEE mechanisms.
Examine telemetry in realtime. Stop the proton beam if
an anomaly is seen. Attempt to return the unit to
normal operation by commands, hardware reset, or
power-cycle as appropriate. Statistics on all of the
anomalies observed and the resolution method should
be kept.
There are several labs world-wide that can perform
proton testing16. Expect to schedule beam time months
in advance. The price will be ~$500/hr and it may take
three or four hours to test a particular design.
Table 6: Proton Testing Facilities in North America
Facility
Maximum Beam Energy
University of California at Davis
62 MeV
Texas A&M University
70 MeV
TRIUMF, Vancouver
105 MeV typical
500 MeV by request
Indiana University
200 MeV
Francis H. Burr Proton Therapy
Center
230 MeV
Heavy Ion Testing
Heavy ions may be generated in an accelerator,
typically by firing a beam of lighter particles at a metal
foil target. Radioisotope sources that decay by
spontaneous fission are less bulky, but have far lower
energy and fluence.
The primary concern for test planning is the penetration
of the ion beam. Some facilities have sufficient
penetration that an integrated PCB can be tested in
much the same way as in a proton test. However, other
facilities have very limited penetration and the ion may
be stopped by the component packaging before it
reaches the silicon. In these cases the components must
be “de-lidded” to expose the die. De-lidding of
traditional space-grade hermetic parts is relatively
straightforward. The same cannot be said for modern
plastic components. They require expert attention to
etch, grind, and otherwise remove the cover without
damaging the silicon or bond wires. Very modern
devices (such as PoP BGAs and flip-chips) are probably
impossible to decapsulate.
Detailed heavy ion test design is outside the experience
of the authors. There is a perception that it is expensive
and hard to access. For a low Earth orbit mission,
proton testing alone is typically sufficient.
POST-TEST ANALYSIS
Both proton and heavy-ion tests will leave some
induced radioactivity in the boards, and it will be
several days before they can be legally transported.
Cobalt-60 tests leave no induced radioactivity, and the
boards can be removed immediately.
When the hardware is returned, re-run the standard
tests. If off-nominal results are found, probe the board
with multimeters and oscilloscopes to better understand
what is happening.
When the unit has been thoroughly tested, it should be
annealed. MIL-STD-883 method 1019.7 contains
schedules for both ambient and high-temperature
annealing. The purpose of annealing is to acknowledge
that the total dose that has been received in testing has
accumulated at a rate thousands of times greater than it
would in space. On-orbit some of the damage will
recover over the years of mission life, even as more
damage is being accumulated. Following annealing the
board should be tested one last time.
It is worth noting that there is some disagreement as to
the validity of highly accelerated radiation testing in
bipolar parts due to Enhanced Low Dose Rate
Sensitivity (ELDRS)17. However if a sufficient factor
of safety is used in total dose testing, it should cover the
ELDRS effects.

Sinclair 10 27th Annual AIAA/USU
Conference on Small Satellites
SUCCESS EVALUATION
The test can be considered an unqualified success if all
of these statements is true:
• No destructive single-event effects were seen
• The single-event upset rate is manageable in
the context of the overall system
• The unit remains functional up to the expected
mission dose
• The unit is functional following annealing
after twice the expected mission dose
In this case the design can be considered radiation
tolerant for the application.
The test can be considered a marginal success if all of
these statements is true:
• No destructive single-event effects were seen
• The single-event upset rate is manageable in
the context of the overall system
• The unit is functional following annealing
after the expected mission dose
In this case one of the following mitigating steps can be
taken to declare the design radiation tolerant without
further testing:
• Reduce the design life by 50%
• Apply shielding (possibly just spot shielding
on the affected component) to reduce expected
mission dose by 50%
The test can be considered a failure if any of these
statements is true:
• Destructive single-event effects were seen
• The single-event upset rate is unmanageable in
the context of the overall system
• The unit is not functional following annealing
after the expected mission dose
In these cases the affected components must be
identified, and replaced. Sometimes a drop-in
equivalent part from a different vendor can be used.
Otherwise the unit may require substantial redesign to
replace a unique part. When redesign is complete,
more parts must be purchased and the tests repeated.
RADIATION CASE STUDIES
It is instructive to look at the way in which parts change
under dose. Complex parts will often lose functionality
in one area while remaining unaffected in others. A
complete and sudden failure is seldom seen. Here we
relate some of Sinclair Interplanetary’s experiences
testing commercial parts under Co-60 and protons.
All of these case studies should be treated as anecdotal.
They refer to results of specific tests on specific lots of
parts. These results may not be applicable to your
parts.
IR2104S MOSFET Driver
This IC is intended to drive a half-bridge of N-channel
MOSFETs. It has a built-in 520 nsec dead-time delay
when switching between MOSFETs.
At approximately 10 krad of total dose the dead-time
begins to increase. At some point before 20 krad the
dead time becomes infinite and the IC will no longer
switch.
LT3012 Linear Regulator
The internal voltage reference of this IC is changed by
radiation, and increases by 0.6% per krad of total dose.
If the system tolerance on a power supply rail is 10%,
then it will go out of tolerance after 15 krad. It remains
functional in every other respect.
C8051F410 8-bit Microcontroller
The microcontroller includes a realtime clock section,
intended to be powered from an external auxiliary
battery. It contains a 20 kHz oscillator to keep track of
time. A register bit indicates whether the oscillator is
running properly. After moderate total dose this bit
indicates failure. All functions of the microcontroller
outside the realtime clock continue working well to
beyond 20 krad.
C8051F580 8-bit Microcontroller
This microcontroller contains an onboard temperature
sensor. At 12 krad total dose the temperature sensor
begins to read lower than expected. It quickly
degenerates to read -200 C. All other functions of the
microcontroller continue working well to beyond 20
krad.
SN65HVD1781 RS485 Transceiver
This transceiver has a separate enable controls for the
transmitter and receiver. If both are disabled the part
enters a low power standby mode. The maximum
specified wakeup time for the transmitter, from standby
mode, is 9 µsec. Starting at 14 krad the wakeup time

Sinclair 11 27th Annual AIAA/USU
Conference on Small Satellites
takes longer and longer. If the receiver is held always
enabled, thus avoiding standby mode, the part remains
fully functional beyond 20 krad.
ZXMN6A11DN8 Dual Power N-channel MOSFET
These are 60 V rated N-channel MOSFETs. When
biased at 34 V they reliably and repeatedly fail in
single-event burnout from 105 MeV protons. Note that
the traditional MOSFET voltage derating rules (i.e.
75% from EEE-INST-002) assume radiation hardened
components and cannot be applied to COTS parts.
SiM3C1XX 32-bit Microcontroller
This microcontroller proved to be extremely vulnerable
to SEL. Over the course of 1 krad of 105 MeV proton
dose it suffered 6 hard latches (>250 mA fault current).
Some latches stopped the processor. Interestingly, the
core did continue to operate through some of the latch
events, sending plaintive error messages through the
UART reporting that the on-chip SRAM was non-
responsive. We hypothesize some sort of latchup
within the bus controller.
LT3437 DC/DC Converter
This DC/DC converter will operate to greater than 20
krad with steady output voltage. However its minimum
turn-on voltage will increase with dose. The datasheet
specifies that with a +3.3 V output it requires a
minimum of +5.5 V input to start, and +4.5 V to keep
running. After 15 krad of total dose and a period of
annealing the minimum start-up voltage is +13 V. The
run voltage is unchanged at +4.5 V.
DDR DRAM
DDR memory manufacturers have implemented ECC in
some modern parts in order to reduce refresh power
consumption18. This has the happy side-effect of
making them essentially immune to SEU. The authors
have indirectly observed the effect of this
undocumented internal ECC during proton testing.
CONCLUSION
In this paper we have presented a systematic approach
to designing electronics for a particular radiation
environment. This method has allowed us to build
reliable and successful space missions from modern
commercial components. Proton testing, together with
controlled lot buys, assures parts will meet radiation
requirements. Expensive rad-hard components and
heavy ion testing are avoided.

Sinclair 12 27th Annual AIAA/USU
Conference on Small Satellites
REFERENCES
!"#$%&'()"#*"+*)",-."/*"0*"1'-.'223)"45,.6,263-"788'92("
,-."#,:.'-6-%"38"0;<="='9&-3>3%?@"A'B69'(",-."
C6:9$62(D)"E777"=:,-(,9263-("3-"F$9>',:"<96'-9')"G3>"HI)"
F3"J)"/$-'"KIIJ*"
K"4#6%&L5'>6,M6>62?"5$%%'."N>,(269D)"0OPE0"E-2'%:,2'."
N:3.$92()"
&22Q@RRSSS*T,U6T6-2'%:,2'.*93TRV,R:'>6,M6>62?R%'-':
,>RN5L!*Q.8*"
J"4<Q,9'"7-B6:3-T'-2"E-83:T,263-"<?(2'TD)"7$:3Q',-"
<Q,9'"O%'-9?)"&22Q@RRSSS*(Q'-B6(*3T,*M'R"
W"X':%':)"0*"/*)"/*"<*"C3$:('?)"0*"O*"Y$9Z':",-."/*"C&,-)"
4<23QQ6-%LN3S':",-."5,-%'"=,M>'("83:"7>'92:3-()"
N:323-()",-."#'>6$T"E3-(D)"F,263-,>"E-(262$2'"38"
<2,-.,:.(",-."='9&-3>3%?)"
&22Q@RRSSS*-6(2*%3BRQT>R.,2,R(2,:R6-.'U*98T"
H"4<Q,9'"N:3.$92"O(($:,-9'@"A':,26-%"["777"
C3TQ3-'-2(D)"7C<<L\LJIL!!O)"7$:3Q',-"<Q,9'"
O%'-9?)"KII]*"
]"4E-(2:$9263-("83:"777"N,:2("<'>'9263-)"<9:''-6-%)"
\$,>6869,263-",-."A':,26-%D)"777LEF<=LIIK)"FO<O"
X3..,:."<Q,9'"^>6%&2"C'-2':)"KIIJ*"
_"O>L/$T,6>?)"X&,-6T"O*)"4788'92("38"5,.6,263-"3-"2&'"
;Q269,>"N:3Q':26'("38"X>,(("0,2':6,>(D)"<NE7"G3>"!_]!)"
!``K*"
a"4^,6:9&6>.b("N:39'(("7-&,-9'T'-2("7>6T6-,2'"2&'"
C0;<"<C5"+,29&LcQ"N:3M>'T"6-"_W#C"+3%69D)"^,6:9&6>."
<'T693-.$923:"OQQ>69,263-"F32'"JJ`)"F3B'TM':"!`a_*"
`"4O.B,-9'."#6%&L<Q''."C0;<"dO#Ce"+3%69"^,T6>?D)"
='U,("E-(2:$T'-2(".39$T'-2"<COOIJWC)"A'9'TM':"
KIIK*"
!I"C3(()"/*5*)"'2",>*)"4C3TQ'-.6$T"38"<6-%>'"7B'-2"
^,6>$:'("6-"N3S':"0;<^7=(D)"/'2"N:3Q$>(63-"
+,M3:,23:?)"!`aa*""O99'(('."3->6-'@"&22Q@RR2:(L
-'S*fQ>*-,(,*%3BR.(Q,9'RM62(2:',TRKI!WRKIK``R!R`aL
!KIJ*Q.8"
!!"^3$2g)"/'::3>.)"4N3S':"=:,-(6(23:"<6-%>'"7B'-2"
1$:-3$2D)"&22Q@RRSSS*(TQ(2'9&*93TRQ3S':LT3(8'2L
(6-%>'L'B'-2LM$:-3$2*&2T"
!K"F%$?'-)"A*"F*)"C*"E*"+''",-."O*"#*"/3&-(23-)"4=32,>"
E3-6g6-%"A3('"788'92("3-"^>,(&"0'T3:6'(D)"5,.6,263-"
788'92("A,2,"h3:Z(&3Q)"E777)"!``a*"
!J"<9&S,-Z)"/,T'("5*)"'2",>*)"45,.6,263-"#,:.-'(("
O(($:,-9'"='(26-%"38"069:3'>'92:3-69"A'B69'(",-."
E-2'%:,2'."C6:9$62(@"5,.6,263-"7-B6:3-T'-2()"N&?(69,>"
0'9&,-6(T()",-."^3$-.,263-("83:"#,:.-'(("
O(($:,-9'D)"<,-.6,"F,263-,>"+,M3:,23:6'()"
O>M$V$':V$')"F'S"0'U693)"<OFALKIIaL]aH!N*"
!W";bF'6>>)"N*"0*)"'2",>*)"456(Z"O(('((T'-2"83:"#',B?"E3-("
38"N,:2("='(2'."S62&"N:323-(D)"E777"=:,-(,9263-("3-"
F$9>',:"<96'-9')"G3>"WW)"F3"])"A'9'TM':"!``_*"
!H"<9&S,-Z)"/*"5*)"'2",>*)"4788'92("38"N,:269>'"7-':%?"3-"
N:323-LE-.$9'."<6-%>'L7B'-2"+,29&$QD)"E777"
=:,-(,9263-("3-"F$9>',:"<96'-9')"G3>"HK)"F3"])"
A'9'TM':"KIIH*"
!]"1$9&-':)"<2'Q&'-)"'2",>*)"4N:323-"='(26-%"X$6.'>6-'"
A'B'>3QT'-2"["+'((3-("+',:-'.D)"FO<O"7>'92:3-69"
N,:2(",-."N,9Z,%6-%"dF7NNe"N:3%:,T)"O$%$(2"KK)"KIIK"
!_"4=&'"7+A5<"788'92(D)"
&22Q@RR'>.:(*-'2R6-.'U*Q&Qi>6-Zj2&'k7+A5<k'88'92("
!a"l6T)"<,'-%L#S,-)"'2",>*)"4O"+3S"N3S':",-."#6%&>?"
5'>6,M>'"WII"0MQ("03M6>'"AA5"<A5O0"S62&";-LC&6Q"
A6(2:6M$2'."7CCD)"E777"O(6,-"<3>6.L<2,2'"C6:9$62("
C3-8':'-9')"F3B'TM':"!KL!W"KII_*"
"