System-Level Total Ionizing Dose Testing of Satellite Subsystems: EagleEye Microsatellite Case Study

Abstract

A system-level total ionizing dose test method of satellite subsystems is discussed in the context of the radiation qualification of a satellite. System-level tests are performed with high-energy X-rays, and the irradiation results of the key subsystems, including the on-board computer, attitude- and orbit-control-system computer, and battery management system, are presented and analyzed in terms of the repeatability of the results, the observability issues, and the importance of the test conditions. Furthermore, the main benefits of the system-level total ionizing dose tests of the given subsystems are discussed, as well as the risks related to performing tests at the system level.

1. Introduction

The radiation qualification of electronic components is an important part of the flight qualification of satellites. Depending on the target orbit, mission lifetime, and solar activity, the specific radiation tolerance/hardness level needs to be assured [1]. To meet this goal, the radiation testing of electronics is performed either by the manufacturer of the rad-tolerant or rad-hard parts or by the satellite developer if COTS (commercial off-the-shelf) components are chosen for the design. The standard approach involves tests at the level of the basic components, following well-established test specifications [2,3,4]. However, owing to the rapid increase in the use of COTS components, the increase in the complexity of electronic flight systems, and the search for cost reduction in the NewSpace era, new alternative test methods are being sought, including alternative radiation sources [5,6] and tests at the level of the electronic system (which may mean the electronic board, satellite module, or even the whole satellite [7]; processor or SoC devices are understood in this paper to be components, contrary to what was proposed, e.g., in [8]).

System-level tests of electronics were extensively studied within the RADSAGA project, providing insights into the use of this method for high-risk acceptance missions in mild radiative environments, incorporating COTS components [9]. Furthermore, a methodology for using deeply penetrating beams (protons, neutrons, and mixed fields) for systems’ qualification was provided in [7]. An example of such system-level tests with the mixed field at the CHARM [10] facility is the radiation characterization of the payload and the main data-handling unit of the CELESTA CubeSat [11,12] or the Ninano CubeSat computer accompanied by the 3D-Plus CMOS camera module [13]. In another example, the board-level proton tests of the ESP603 single-board space computer, evaluating its SEE (single event effects) performance, are presented [14]. Research on the system-level testing started within the RADSAGA project is continued in the frame of the RADNEXT project [15].

The total ionizing dose (TID)-related test at the board/system-level is presented, e.g., in [16], where COTS single-board computers (SBCs) are irradiated. In the experiment involving testing in different bias configurations, the failure mechanisms are disclosed, and the degradation of various electrical and functional parameters is given. Another work [17] presents irradiations of two different models of the Raspberry Pi SBC: Raspberry Pi Zero and Raspberry Pi 3B+, with the goal of providing basic information on the radiation sensitivity of these devices. Regarding the TID tests performed in that study, the main parameters monitored (and used to assess the health of the SBC) are the operating current (in different modes), the duration of the file transfer over WiFi, and the possibility to perform a command, e.g., play a transferred video file.

In [18], system-level radiation testing is discussed based on the results of system-in-package module irradiations. The system-level approach is evaluated for the purpose of electronic system qualification, and various opportunities as well as limitations of this approach are presented.

This paper presents the TID system-level test results of microsatellite subsystems and discusses the role of such tests in the qualification process. The main topics covered include the benefits that such tests bring to satellite developers, the parameter observability issues, the repeatability of results, the small-sample-size implications, as well as the importance of the test conditions. Therefore, certain ideas and issues discussed in [18] are reviewed but now in the context of microsatellite subsystem testing and not system-in-package module testing. The novel contribution of the paper is the in-depth analysis of the system-level TID-testing approach for microsatellite subsystems, based on the test results for three various subsystems.

2. Methodology

In this work, we study the role of the system-level TID testing of satellite subsystems in the process of the radiation qualification of the whole satellite. The research is based on a case study of TID tests of complex microsatellite subsystems, including the on-board computers (OBCs), attitude- and orbit-control-system computers (AOCS), and battery management system boards (BMS). The subsystems were developed in the frame of the EagleEye microsatellite project by Creotech Instruments SA and are based on the HyperSat platform. The EagleEye project aims to develop an Earth observation satellite, raise the technology readiness level (TRL) of the microsatellite platform on TRL9, and refine a number of subsystems designed for microsatellites. The satellite will be placed in a low Earth orbit (LEO) early next year and will provide 1 m resolution (ground sampling distance) imagery of Earth.

Two samples of each subsystem type were irradiated to determine whether the results were repeatable. The primary goal of the system-level irradiations was to ensure that subsystems may withstand TID levels exceeding the one expected in the target radiation environment. The secondary goal was that if the subsystem fails, the test should help in understanding what in the system is failing, what the significance of this is, and whether the failing components may be easily replaced.

The OBC and AOCS subsystems of the EagleEye satellite consist of single-board computers utilizing either a processor + FPGA tandem (OBC) or a processor only (AOCS), both incorporating dedicated internal power sections. The BMS features a complex analog section for power control and a mixed analog–digital section for internal telemetry and command handling. All subsystems rely on COTS components meticulously selected for the EagleEye mission. Specifically, a comprehensive radiation data review guided the selection of components resilient to radiation effects. Moreover, some of the crucial components underwent component-level testing before system-level tests, particularly in cases where radiation data were unavailable (e.g., the SDRAM memory). The radiation level of the target mission was simulated using the Omere 5.3 software [19], estimating a dose of 5 krad (50 Gy) over the 3-year mission duration (6 months in LEO and 30 months in very low Earth orbit (VLEO)).

The irradiations were performed with high-energy X-rays at the NCBJ (National Centre for Nuclear Research). The 6 MeV linear electron accelerator was used to produce the X-rays: electrons irradiated the tungsten target, and (through the Bremsstrahlung effect) the secondary photon beam with a wide energy spectrum ranging up to 6 MeV was created. The FLUKA [20,21] Monte-Carlo simulation of the energy spectrum is presented in Figure 1. A similar facility used for TID irradiations, ORIATRON, was described in [22,23], and the results of both the irradiations and simulations were consistent with those obtained using the standard Co-60 source.

The dosimetry system relied on the PTW TM30013 ionization chamber, managed by the PTW T10004 electrometer. Throughout irradiation sessions, the ionization chamber was positioned in close proximity to the device under test (DUT), maintaining an identical distance from the radiation source as the DUT itself (refer to Figure 2b below), while the electrometer remained stationed in the control room.

The subsystems underwent individual testing, with only one subsystem sample irradiated at a time. The irradiation sequence, inspired by [2], encompassed these key steps:

• Pre-irradiation functional and electrical tests of the subsystem;
• A series of irradiation steps (2.5 krad per step), followed by subsequent functional and electrical tests;
• Post-irradiation functional and electrical tests conducted after reaching 20 krad;
• Room-temperature annealing for a minimum of 24 h, followed by functional and electrical tests;
• High-temperature annealing for 168 h, followed by functional and electrical tests.

Throughout the irradiations, the subsystems were biased with nominal voltage values, while the dose rate maintained a consistent 5 krad/h. The maximum 20 krad total dose reached during the irradiations significantly surpassed the mission’s target dose of 5 krad. The purpose of this overtest approach is to irradiate with a significant TID margin and increase the credibility of results, reducing the risk related to irradiating a relatively low sample size (two subsystem samples for each type). However, it is important to note that despite testing to a higher TID level, inherent part-to-part variations in the radiation response of components persist as a potential risk, which is further addressed in the discussion section of this paper.

The functional and electrical parameters of the subsystems, verified after each irradiation step, were meticulously selected to offer insight into the performance of numerous subsystem components. This selection prioritized the components identified as the most susceptible to radiation (based on pre-test analysis) or those lacking available radiation susceptibility data. The monitored parameters included power supply currents, internal voltage telemetry (compared with digital meter readings), memory operations, and battery charging/discharging, among others.

Regarding the high-temperature annealing process, it was executed at 80 °C, instead of the recommended 100 °C (as suggested in [2,4]), aligning with the maximum temperature ratings for the components used in the tested subsystems.

Illustrations depicting the example setup for the OBC tests are presented in Figure 2.

3. Results

The key results of the OBC irradiation are depicted in Figure 3 and Figure 4. The abscissa marks the irradiation steps, followed by the annealing steps (room-temperature and high-temperature annealing). Above the abscissa, major events occurring during the irradiation are highlighted, denoted by color-labeled criticality (the darker—the more critical) and the respective event durations.

During the initial steps, setup errors and delays led to an accelerated irradiation process for OBC#1 after reaching 10 krad (i.e., steps 12.5 krad and 15 krad were bypassed), halting at 17.5 krad. The room-temperature annealing durations exceeded the planned 24 h for both OBCs, allowing subsystem recovery following high dose-rate irradiation. As per [4], parts that fail during irradiation but recover during room-temperature annealing may be considered acceptable for the irradiated TID level, if the dose rate in the target environment is lower than the resultant aggregate of the irradiation and annealing times.

Most of the OBC functions that could be verified during irradiation were operating correctly. However, four errors were observed across different components or sections of the OBC. Three errors—degradation of the current sense amplifier, keying transistor failure, and failure of the processor’s supervisory circuit—resulted from single component failures. These components were subsequently replaced with more radiation-tolerant alternatives in the final design. The origin of the fourth error, a boot loop in the 12 V bank, could not be precisely determined. In both OBCs, it started after the 17.5 krad step, but in OBC#1, the error was observed when the device was already transported from the irradiation facility to Creotech Instruments premises for annealing. The error disappeared in OBC#1 after room-temperature annealing, whereas in OBC#2, it disappeared after 1 h of the high-temperature annealing.

The malfunctioning processor’s supervisory circuit, which impeded the processor’s power-up, was removed after irradiation (OBC#1) or after the 15 krad step (OBC#2). Post-circuit removal, the correct functionality of the processor was verified.

The significant findings concerning the BMS boards are detailed in Figure 5 and Figure 6. While most of the BMS functionality remains intact throughout the entire irradiation, several errors manifest in both devices under test. An error in battery voltage measurement is noted from the 5 krad step, initially around 1% deviation, escalating to approximately 10% during irradiation. This error exhibits partial annealing at higher temperatures. Concurrently, errors in the BMS output voltage and current measurement arise from the 17.5 krad step and vanish post-annealing. The sole major failure, the battery charger malfunction, emerges at the 20 krad step. BMS#2 successfully recovers from this error following annealing, while BMS#1 remains affected.

The significant findings pertaining to the AOCS subsystems are outlined in Figure 7 and Figure 8.

AOCS#1 underwent irradiation up to 12.5 krad, where critical errors in the LCL (latch-up current limiters) resulted in the failure to power two banks—3.3 V and 5 V. One of the LCL chips recovered after room-temperature annealing and another after high-temperature annealing. In the case of AOCS#2 testing, a different lot’s LCL was employed; yet, it also failed just before reaching 12.5 krad. Consequently, the LCL on the AOCS#2 board was bypassed to continue testing of the subsystem.

At 10 krad, the power MOSFET transistors within the magnetotorquer circuits of AOCS#1 experienced failure. These transistors were subsequently replaced with different parts (new part reference), exhibiting proper functionality throughout the entirety of AOCS#2 testing.

AOCS#2 encountered two critical chip failures at the 17.5 krad dose: the GPIO (general-purpose input/output) expander failure and the serial interface driver failure. The former error recovered post-room-temperature annealing, while the latter error resolved after high-temperature annealing.

4. Discussion

System-level TID radiation tests of the EagleEye microsatellite key subsystems were performed to ensure that the devices may withstand the targeted environmental doses. Most of the major failures were observed at the dose level of 17.5 krad and higher, and a few components failing below 15 krad were replaced in the final design with more radiation-tolerant parts, identified through supplementary component-level radiation tests. Therefore, there shall be at least a threefold margin between the expected dose level in orbit and the level of failures observed during the tests. The second goal of the system-level tests was to determine which components should be replaced, given any failures observed. In most of the cases, this goal was also met: the failing components were detected and replaced with the ones that had better radiation data from the component-level tests. Notably, in the AOCS subsystem, transistors showing failure were replaced before the AOCS#2 irradiation; so, the second test campaign could confirm that the new transistors (already tested at component-level, while waiting for the AOCS#2 irradiation) perform correctly in the subsystem up to the dose of 20 krad. However, there was one instance where the specific component responsible for the subsystem failure at ~17.5 krad—manifesting as a boot loop error in both OBCs—could not be identified.

To evaluate the component radiation performance effectively, good observability of its parameters, both electrical and functional, is required. Achieving this level of observability is relatively straightforward in component-level tests. However, during system-level tests, observability is often more constrained [18]. An example illustrating this limitation is the challenge encountered in analyzing the boot loop error in OBCs. Despite this, our experiments allowed us to identify failures in several components relatively easily. Most of these components formed a tree-like structure (e.g., processor—interface driver—peripheral devices or processor—FPGA—switching transistor—peripheral device; the failing parts were underlined). This structural hierarchy simplified the search for the failing part: the malfunctioning branch indicated the location of the failure. On the other hand, components building the 12 V power section in the OBC (which entered a boot loop at 17.5 krad) are organized in a feedback loop structure, complicating the search for the failing component. Implementing an approach that emphasizes enhanced observability in such loop structures might streamline the search for the failing component.

Yet another issue is related to the observability in system-level testing: usually, we do not have information about the degradation of the component, but what we see is the failure threshold. In many cases, gathering more extensive information might not be feasible—additional instrumentation could, e.g., decrease the performance. However, more often, this limitation stems from optimizing the test setup for simplicity, cost reduction, and obtaining the most pertinent results for subsystem qualification purposes. For more information on the component degradation, complementary component-level testing would be necessary. This additional information might be crucial at times to precisely determine the failure dose threshold of the entire system, in particular, if there is a limited number of system samples tested (resulting in significant statistical errors), and if the system failure is a result of a failure of a single component.

In our tests, we exposed two samples of each subsystem to radiation to ascertain the repeatability and bolster the credibility of the proposed TID failure threshold.

Table 1. Summary of major failures observed during tests, with a comparison of the results for the two samples tested. The different colors group the results with the same specificity, as discussed in the text below.

Subsystem and Failure Information	Sample 1	Sample 2
OBC: degradation of the current sense amplifier	@2.5 krad does not anneal	@2.5 krad does not anneal
OBC: keying transistor failure	@10 krad does not anneal	@10 krad does not anneal
OBC: processor’s supervisory circuit failure	@10 krad chip removed to enablefurther testing	@10 krad chip removed to enable further testing
OBC: boot loop @12 V	after 17.5 krad, with a delay annealed in room temperature	@17.5 krad annealed in high temperature
BMS: battery voltage measurement error	@5 krad does not anneal	@5 krad does not anneal
BMS: output voltage and current measurement error	@17.5 krad annealed in high temperature	@17.5 krad annealed in high temperature
BMS: battery charger failure	@20 krad does not anneal	@20 krad annealed in high temperature
AOCS: failure of the power MOSFET transistors	@10 krad does not anneal	[replaced with a new component type that did not fail up to 20 krad]
AOCS: LCL failures	in both samples failure was below 12.5 krad; various performance of the component depending on the lot number
AOCS: GPIO expander failure	[failure not observed, irradiation stopped @ 12.5 krad step]	@17.5 krad annealed in room temperature
AOCS: interface driver failure	[failure not observed, irradiation stopped @ 12.5 krad step]	@17.5 krad annealed in high temperature

summarizes the major failures observed across all the tested subsystems, comparing the results for the two tested samples. The different colors group the results with the same specificity, as discussed below.

The results marked in grey indicate good repeatability between samples 1 and 2 of the subsystems; however, the TID failure threshold is insufficiently low, and the parts were replaced in the final design by component-level tested ones, demonstrating higher radiation tolerance. Conversely, light green highlights results demonstrating full repeatability and a sufficiently high TID level (17.5 krad) to accept the part for the mission. Finally, dark green denotes a part replaced after the first test campaign; the replacement was tested at the component level, and its radiation tolerance was confirmed at the system level (it did not fail up to 20 krad).

The results highlighted in blue indicate instances of greater discrepancy, such as a slightly different TID failure threshold or different behavior during the annealing, but the TID failure threshold is also high, and the parts might be accepted.

The yellow color marks the results where no repeatability was observed, but it was due to the fact that the irradiation stopped too early during the first test campaign, to observe failures in given components. During the second test campaign, the TID failure threshold reached a high level (17.5 krad), suggesting potential acceptance of these parts. However, it is important to note that the value of these test results is somewhat lower than, for instance, the blue ones, as there is limited information about the variability of the TID failure level for these parts. The risk related to using these parts could be further reduced by performing complementary tests at the component level.

Finally, the orange color represents the results for LCLs in both AOCS boards. The same type of LCL (same manufacturer and reference number) functioned correctly up to 20 krad in the OBCs. For the AOCS design, a new lot was chosen, which has shown better electrical performance—but it failed at 12.5 krad in AOCS#1. Subsequently, a third lot also failed at 12.5 krad during the AOCS#2 test campaign. This TID level of failures gives too little margin for the target mission, and a replacement for the component was searched for. The procurement of LCL components occurred during a global shortage of electronic components due to the pandemic, potentially contributing to significant variations between different lots. These variations might indicate variations in the manufacturing process, semiconductor fabrication plant, or even semiconductor layout, impacting the parameters of the new lots. This situation underscores the importance of testing the exact component lot planned for use in the flight model of the system. The change in electrical performance of the new lot might serve as an indicator that different radiation performance could be expected. However, no change in electrical performance does not mean that no change in the radiation response of the new lot is guaranteed [24].

In our test campaigns, we did not encounter any critical discrepancies between the results obtained from both samples of the same subsystem (e.g., sample#1 being fully tolerant up to 20 krad and sample#2 with the same components failing at 5 krad). However, the most unexpected outcome arose in the case of the LCLs. These components were fully tolerant up to 20 krad in the OBCs; yet, two different lots of these components failed at 12.5 krad in the AOCS boards.

With a limited number of samples, our ability to predict potential failures in the target system due to potential pathologies within components’ distributions, even within the same lot, is restricted [25]. When dealing with a sample size of only two, we have a minimum of repeatability, which brings more credibility to the results but is far too low to state that we have no problems with thick-tailed or bipolar distributions. While the overtest approach and the application of a substantial margin (such as our threefold margin between the expected orbital dose and the weakest components’ threshold dose) is useful for the normal/lognormal distributions of components’ radiation response, it may not effectively address issues arising from pathological distributions [25]. Radiation qualification of the subsystems based on the system-level tests of two samples only, requires accepting the risk described above. To address this challenge, the MINIATURA-7, funded by the National Science Centre (NCN, Narodowe Centrum Nauki) and recently initiated at the NCBJ, aims to investigate the radiation response and failure distributions in large sample sizes of single board computers under TID irradiation. This endeavor holds promise for shedding new light on the discussed problem.

In component-level test specifications like [2], the worst case bias configuration is required for the components under irradiation, to produce the maximum degradation. In the EagleEye tests, all subsystems were biased during irradiation, aligning with the “test as you fly” approach and owing to the limited number of samples available for testing. However, we tried to set various bias or operating conditions of basic components wherever feasible. This approach revealed variability in the radiation performance of specific components, depending on their bias or operating conditions:

-

The degradation of transistors failing in AOCS#1 was strongly dependent on the duty cycle with which they were switching—see

Table 2. The degradation of transistors during the AOCS#1 test: the dependence of the failure threshold from the duty cycle with which they were operated.

Transistor#	T1	T2	T3
Duty cycle	90%	80%	70%
Failure threshold	10.4 krad	11 krad	12.5 krad

below;

-

Similarly, the degradation of the transistors in the OBCs was dependent on their bias configuration:

○

Transistors polarized in conduction mode during irradiation transitioned to a constant conduction mode;

○

Transistors zero-biased or polarized into non-conduction mode experienced a shift in their V_GS threshold from 1.8 V to 0.6–0.8 V;

• (this characterization was conducted after desoldering these transistors from the OBC)

-

In the GPIO expander chip (experiencing failure in AOCS#2 at 17.5 krad), only outputs in a high state during irradiation failed; those in a low state remained functional until the irradiation concluded.

It is notable that some of the mentioned failures might not have surfaced if only one bias or operating condition had been exclusively employed. However, due to the limitations in irradiation setups, achieving varied biases or other operating conditions for all components was not always feasible. Our aim was to closely approximate the target operating conditions whenever possible. Furthermore, the bipolar parts used in the subsystems’ designs were not irradiated in their worst case conditions (such as no bias and low dose rate) due to constraints in beam time and the limited number of available test samples. Employing an overtest approach in the test campaign aimed to also mitigate the risk associated with these suboptimal test conditions for bipolar parts. However, it is important to note that while this approach helps mitigate the risk, complete elimination of this risk through this method remains unattainable.

5. Conclusions

The system-level TID tests conducted on the EagleEye microsatellite subsystems yielded valuable insights into the radiation performance of these devices. These tests revealed certain electronic components within the design that exhibited excessive sensitivity for the LEO mission. Consequently, conducting complementary component-level tests became necessary solely for the replacement of these identified failing components, presenting a potential avenue for cost and schedule savings within the project. Additionally, in a specific instance, the system-level test facilitated the validation of a replacement part for the AOCS.

The aggregated information from the system-level and complementary component-level tests allows for the determination of TID thresholds that satellite subsystems should withstand. However, the TID levels established through this approach carry inherent risks for several reasons, including:

• Part-to-part variability within a single lot that is impossible to assess by testing only a limited number of samples;
• Limited observability, which disables detecting hidden errors or hidden degradation of components;
• Testing in conditions that are not always the worst-case conditions for certain components.

To partially mitigate this risk, EagleEye subsystem tests were conducted at significantly higher TID levels than expected in the target environment. The most sensitive parts were replaced to ensure a threefold margin between the expected orbital dose level and the observed failure threshold during the tests. However, it should be noted that the level of credibility achieved through these test campaigns is still far from what is possible to obtain in the component-level high sample-size tests. Nonetheless, the system-level test approach remains appealing for specific missions where the associated risk is acceptable, due to offering insights into the radiation performance of the system, potentially leading to cost and schedule savings for the project.