DESCRIPTIVE MEMORY TECHNICAL FIELD OF THE INVENTION

The present invention, for which a patent is applied, has as its main object a method for the generation of an optimal supply current threshold for the protection of integrated circuits against the effect called Single Event Latchup (SEL) and the devices and arrangement that use it.

More specifically, the present invention refers to a method for the determination of an optimum threshold for the protected device supply current, which maximizes the probability of real SEL detection and minimizes the probability of spurious mitigations actions triggering and the devices and the arrangement which use said method to avoid destruction by overcurrent upon the occurrence of SEL in the susceptible elements of an electronic equipment.

This method predicts the limit value of the supply current to be used for deciding to interrupt the supply of power to the protected devices, using sample values of its supply current acquired from each of them, the level of the radiation flux and the temperature of the environment.

The present invention has practical and industrial application in electronic devices, such as integrated circuits, used in environments susceptible to suffer from ionizing radiation, such as geostationary satellites and remote sensing low orbit satellites.

STATE OF THE ART AND PROBLEMS TO BE SOLVED There are so many advanced electronic components developed for mass market appliances that a technological revolution would take place if they could be used in hostile environments without having to apply slow and expensive processes. One of the main weakness that these devices can have when operating in a radiation environment is the destructive process called SEL. It is well known that this phenomenon is produced in CMOS integrated circuits due to the parasitic structures that are formed during their manufacturing process. These parasitic structures normally present a high impedance to the supply voltage; but when the values of the current gains (b) of the parasitic bipolar transistors that compose them are high enough, a small charge induced by a particle of radiation in the sensitive region of the transistors is enough to make them suffer a transition to a very low impedance condition short circuiting the power supply.

It is obvious that, without limiting the current flowing, this phenomenon ends with the destruction of the integrated circuit by the formation of an extremely hot point inside it, which destroys semiconductor junctions and conduction paths. This limitation can occur unintentionally in the integrated circuit itself or in its external circuit. When the limitation occurs inside the integrated circuit this phenomenon is called micro-latchup. Generally the internal limitation causes that the current peak produced by the micro-latchup to be within the range of the normal consumption. This produce a non-destructive effect that only impacts negatively in stored data. From now on, only destructive events will be considered when reference is made to SEL.

There are several possible strategies to make the use of integrated circuits viable in environmental conditions with high levels of radiation. On the one hand, it is possible to do so by means of special modifications to the technology used for their manufacture, as can be seen in the patents EP 725,442 B1 granted to STMicroelectronics S.r.I in 2002, US 5,828.110 granted to Advanced Micro Devices Inc in 1998, US 6,028,341 granted to United Microelectronics Corp in 2000, US 8,891,215 B2 granted to Global Fondries Singapore Pty Ltd in 2014 and US 8,896,978 B2 granted to Texas Instruments Inc in 2014. US 10,204,906 B2 awarded to Intel Corporation in 2019 and JP6296636B2 awarded to Freescale Semiconductors in 2019.

It is not possible to think of mitigation by modification of its technology or by design in the case of integrated circuits that are designed and manufactured for mass consumption applications because they are not "a priori" designed to operate in aggressive radiation environments.

Another way to achieve the same objective is by applying the upscreening process. This consists of subjecting them to a qualification and selection process in the hope that a production lot subset with sufficient tolerance to radiation will emerge. According to several authors, including M. Pignol in his paper "COTS in Space: Constraints, Limitation and Disruptive Capability" presented at the SERESSA 2015 international meeting held in Puebla, Mexico in 2015, this process is more expensive, slower and riskier than the standard quality process for components to be used in aggressive environments. It therefore lacks the main advantage of devices intended for mass market products, which are their low cost and prompt supply. As a consequence its use is exceptionally justified because of the technological superiority that some state-of-the-art components may present (higher speed, lower power consumption, lower volume and mass, etc.).

In many cases where there is no alternative to using a SEL-prone component, a redundant system with monitoring is used. As soon as the supervisor detects that the system that is active in nominal operation stops working according to the initial specifications, it switch to the redundant module, as can be seen in US patent 10,048,997 B2 granted to Hamilton Sundstrand Corporation in 2018. This is done to protect the integrity of the higher level functional entity by disconnecting the faulted unit and replacing it with its redundancy to prevent the fault propagation to a higher level and not to prevent the destruction of the affected electronic component. It is important to remark here that a SEL event always originates at the component level and not at the system level.

Now, if the component integrity is to be preserved, protection must be implemented at that level and not at a higher one. The damage produced by SEL depends on the energy delivered by the power supply circuit to the point in the integrated circuit where the effect occurs and the magnitude of that energy will depend on the amount of time during which the power supply continues delivering its power. It is estimated that if this time is less than a minimum value, the damage is negligible. This implies very fast speed of response if the damage is to be avoided by interrupting the power supply. Furthermore, once this SEL phenomenon has occurred, the only way to return to normal Operating condition is to extend the interruption for the period required to achieve the extinction of the effect.

Limiting the power delivered during the event is a valid alternative to achieve such mitigation when the other alternatives described above cannot or should not be used. One way to implement the limitation is through the use of a high internal impedance of the power supply as can be seen in US patent 9,391,448 B2 granted to The Boeing Company in the year 2016.

This strategy has the disadvantage that its scope is very limited because the higher the impedance, the worse the regulation of the power supply voltage against the load variations.

This can be solved if the impedance becomes high only at the time the event occurs. If this power control is performed at a very high level in a system, the current monitored for triggering the power interruption will be the sum of all the supply currents from the components. Its value will always be much higher than the peak current produced in the SEL affected component. In these circumstances the protection performance for detecting the variation in power consumption produced by the occurrence of a SEL in an integrated circuit is poor and the speed of response is slow.

Event detection can be done in several ways. One possible way was presented in the patent applications: CN 103762558 A filed in the year 2014 and CN108494240A/CN208401733U filed in the year 2018. Here the characteristic parameter used to detect the presence of a SEL is the growth rate of the supply current of the device to be protected.

Unfortunately, many of the most interesting state-of-the-art devices have very fast normal consumption fluctuations so this mechanism is not a guarantee of low spurious action rate; which significantly restricts the amount of applications in which it can be used.

The event can also be detected by measuring the sudden temperature change in the component that undergoes SEL as proposed by US patent 9,793,899 B1 granted to Xilinx in 2017. This strategy can only be applied if the power breaking mechanism and the temperature measurement are implemented within the same chip. This should be so because of the need to avoid the delays that would occur if the process was performed by an external element. Because of this we must discard its use for the protection of integrated circuits intended for mass market products, which are not designed to contain this type of mechanism.

The most frequently used mechanism to detect SEL events is to monitor the magnitude of the supply current consumed by the protected device. It has been used for specific cases by the main space agencies and several integrated circuit manufacturers provide specific products for that purpose. This mechanism is present in the patent CA1,287,103C granted to Microsemi Semiconductor in 1986 where the detection is made from the peak of supply current demanded by the load during a SEL event. This particular case uses a mechanism external to the device to be protected, but is restricted to those cases where switching type regulators are used to keep the voltage level on the device. To protect a device of interest from the over-current produced by SEL by interrupting its power supply two different criteria can be used: a) switch off the power when the value of the supply current is exactly below the minimum current produced by SEL or b) switch off the power when the value of the supply current is exactly above the highest value acceptable as normal consumption.

In the first case, the guarantee of having cancelled the risk of destructive SEL is achieved. However, the devices of interest (microcontrollers, memories, programmable logic, etc.) are extremely complex and therefore a great diversity of SEL modes can be expected. It is because there can be many types of sensitive points within each device and each of them can present different sensitivities and different values of intrinsic current limitation during the SEL occurrence.

This means that for the same device there is a great diversity of possible current values triggered by a destructive SEL. All possible cases must be evaluated. This makes complex and expensive the testing of the lowest possible SEL current value for each protected device in the radioactive environment. If the test is not comprehensive, there remains some uncertainty as to where the mitigation threshold should be located. If a safety margin is then applied that reduces the threshold value, the possibility that normal consumption peaks may produce spurious mitigations is increased.

In the second case (threshold greater than the highest supply current value), complete assurance is achieved that the risk of spurious mitigations has been cancelled. However, some uncertainty still remains about the possibility that some SEL events will not be detected. The great advantage of using this criterion is that neither expensive particle accelerators nor overly complex processes are required to perform the tests involved.

This type of protection could be implemented using the mechanism shown in US patents 5,212,616 granted in 1996, US 6,064,555 granted in 2000 and US 7,907,378 B2 granted in 2011 and, in addition, in the Chinese applications CN 103701087A and Japanese JP 2006/350, 425A and the Chinese patents CN 101910973A, CN 107134758A. However, this mechanism that seems to be so simple presents a high number of implementation problems.

According to the analysis contained in the paper "Single Event Latchup Protection of Integrated Circuits" presented at RADECS 97, Fourth European Conference on Radiation and its Effects on Components and Systems by P. J. Layton and others in 1997, there are several relevant criticisms of the method of limiting the power delivered to the device by interrupting the supply current.

The first is that a radiation test is required for any device of interest in order to determine the protection threshold to be applied for each case. The cost and time involved in the preparation and execution of such tests would considerably reduce the advantages of using these components. The second is that the accumulated damage produced by total radiation dose (TID) increases the average value of the supply current during the lifetime, causing the fixed protection threshold originally established to become less effective.

Another factor that makes difficult the use of this type of protection are the diodes that most integrated circuits use internally to protect themselves from the electrostatic discharge that they frequently suffer during handling. When the supply voltage falls to a minimum value during a latchup event, these diodes act as an alternative path for the power supply. They sustain the SEL condition even when the power from the supply circuit has been completely cut off. In this case, the supply of power through the inputs is avoided by limiting the parasitic supply currents by means of series resistors.

A more effective way to solve the problem of power supply by the inputs than the simple use of series resistors is described in the US patent 5,672,918 granted to The United States Department of Energy in 1997. In this case the device uses transistors in series and in parallel with the power input as switches. The parasitic currents supplied through the inputs finds a preferential path through the shunt transistor. So the SEL cannot be sustained. Another innovation presented by this proposal is the detection of SEL events from the coincidence of the measurement of a supply current peak simultaneously with the measurement of a pulse produced by the incidence of the ionizing radiation particle that produces these peak. Unfortunately, it is practically impossible to implement a radiation detector with 100% efficiency. Therefore, it is very likely that SEL events will be produced that are never detected by the radiation detector. On the other hand, there will be coincidences of independent events that initiate unnecessary mitigation processes.

In conclusion, although the device proposed here effectively solves the problem of power supply through the input signals, it continues to suffer from the other limitations already described. Many semiconductor manufacturers have developed integrated circuits that interrupt the power supply in case of an abnormal power demand peak (e.g.: 3DPLUS - 3DPM0168-2, Analog Devices - LTC 1153, ST - RHRPMICLl A, TI

- TPS22946). In all cases, the normality or abnormality of the event is determined by setting a protection threshold value that separates the two conditions. All of them require the setting of a permanent protection threshold during the design stage or eventually the choosing between two fixed levels during the operation phase.

It is possible to dispense with the costly process of characterizing the vulnerable device in terms of radiation if, instead of using the criterion of setting the protection threshold exactly below the value of the minimum supply current produced by SEL, it is set just above the maximum value of the supply current that the device will consume under the worst operating conditions. The difficulties in achieving this objective are: a) that this current is a function of the operating states of the protected device and the equipment in which it operates, b) that the ambient temperature is not constant and significantly influences the value of this current and c) that while the device ages due to the effects of TID the average value of the supply current increases significantly.

The US patent 10,289,178 B1 granted in 2019 to Xilinx Inc. allows solving the problem of power consumption variable with the operating temperature but leaves the evolution of the supply current due to aging by radiation unresolved.

A very original proposal has been recently made by the company HARRIS Corporation whose patent US 9,960,593 B2, granted in 2018, for a device that could solve these limitations. It includes a controller which creates a database with signature vectors components that allow the identification of normal and abnormal power consumption profiles. These vectors not only include data profiles of the supply current consumption but also its correlation with the operating states of the protected device and the equipment in which it is operating. One of the main drawbacks of this proposal is that the generation of such a database implies an exhaustive process of tests under nominal and anomalous conditions whose result will be specific to each particular application. Because of this its cost may be equivalent to that of testing the device to be protected to determine its tolerance to the radiation environment conditions it will have to withstand. This technique, while calling itself adaptive, cannot learn to differentiate between normal and destructive conditions without having experienced both, and this cannot be done under normal operating conditions. This being the case, it is not possible to automatically update the signature vectors periodically and therefore there is no guarantee that they will not become outdated throughout the lifetime of the device to be protected due to the degradation that the radiation produces during it.

Thus, the method of comparison with a supply current threshold would be superior for its simplicity and speed of action if it were possible to solve the problem of the evolution of power consumption in all circumstances of the lifetime without over-dimensioning the protection threshold at the beginning of it. This is impossible if a fixed threshold is established a priori because it must always be higher than the worst peak of supply current expected throughout the lifetime of the protected device. Therefore, in most cases it will be well above the actual power consumption of the device at the beginning of its life, increasing the risk of destruction.

The patent application US 2017/237,250 A1 filed by Nanyang Technological University attempts to solve this problem by using thresholds for the supply current of the protected device and for its derivative. Such thresholds are determined automatically by an estimate of the maximum operating range.

The problem that remains to be solved here is how this mechanism determines whether the data used for such estimation correspond to values in normal operation or operating under SEL event conditions. Lacking such capacity, it could take the consumption value during such an event as a normal operation condition and tolerate a destructive situation. If, in the best case, such an event does not result in the destruction of the device, the value determined for the new threshold will be so high that it will expose the device to new destructive events.

BRIEF DESCRIPTION OF THE INVENTION

The method and the arrangement that uses it, both presented here, proposes an adaptive strategy for updating the maximum allowable threshold for the supply current. This protection threshold is taken as a reference for initiating a mitigation process. This is performed by applying a self-adjustment of the threshold along the protected device lifetime. By using a variable reference threshold it is possible to minimize the risk of spurious mitigation and maximize the level of protection of the device. Previously, the determination of this reference threshold was made under conditions of high uncertainty since there is no certainty that, among the data used to calculate it, there is any erroneous data produced by having been acquired during a SEL. The strategy proposed here is based on the fact that, throughout the lifetime of the protected device, the ambient radiation conditions fluctuate through high and low levels and, therefore, the levels of risk of using a SEL current peak as an input for the calculation of the threshold also fluctuate.

The method consists of determining in real time the protection threshold from the instantaneous values of the supply current of the protected device (or other equally relevant parameter for the purpose), when the measurement conditions are safe, i.e. when the probability of a SEL event is negligible because the radiation level to which it is exposed is very low. In addition, it suspends such determination when the radiation levels are so high that the probability of SEL occurrence exceeds a certain risk level.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1: The figure shows a typical CMOS integrated circuit supply current profile during normal operation and its evolution due to environmental radiation damage along its lifetime. It includes a fixed reference threshold for detection of possible SEL events.

FIG. 2: The figure shows an idealization of the statistical distributions of supply current consumption as a percentage of the total operating time. The supply currents considered here are the current consumption of the individual integrated circuit, the current consumption of the electronic printed circuit board or equipment on which the individual integrated circuit operates and the different currents demanded by the integrated circuit in different SEL events in the same device.

FIG. 3a: Flow chart of the operating mode determination process.

FIG. 3b Flow chart of the processes executed by the Protection Unit according to the determined operating mode.

FIG. 4: Block diagram of a possible implementation of the Protection Arrangement against a SEL event using the proposed method.

FIG. 5: Block diagram of a possible implementation of the Protection Unit against a SEL event using the proposed method.

FIG 6: The figure shows a typical supply current consumption profile of a CMOS integrated circuit in normal operation and its evolution due to radiation damage during its lifetime, together with an optimal reference threshold estimated by the proposed device for protection against the occurrence of a SEL event.

DETAILED DESCRIPTION OF A PREFERRED EXAMPLE OF REALIZATION

The previous art techniques provide very limited protection to the integrated circuits susceptible to the current overload produced by SEL because they use a fixed protection current threshold. This impossibility arises from the fact that the value of the current consumed by the devices of interest increases over their lifetime due to the degradation caused by the total accumulated radiation dose.

FIG 1 shows the effect of the aging produced by the radiation through the representation of the evolution of the supply current consumption of the protected device. Here it can be seen how none of the supply current peaks consumed by the protected device reaches the threshold imposed (100) to protect the device against a SEL until the end of its lifetime. It can also be seen how the need to achieve this objective forces the over-dimension (102) of the protection threshold during most of its lifetime. This is due to the fact that to avoid spurious mitigations, the supply current threshold (100) must be set very far (102) from the normal consumption values (101) which causes a certain number of possible destructive SEL current peaks to be undetected because they are below the threshold.

In FIG. 2, the statistical distributions of the values of: (a) the supply current consumed by the protected device (200), (b) the supply current consumed by the electronic board or equipment in which it is used (202) and (c) the different possible currents that can be produced by a SEL (204) are ideally represented; assuming that they follow a normal distribution. The purpose of this diagram is to show more clearly the different effectiveness that results from applying the method of interrupting the supply current of a whole piece of equipment or electronics board and of an individual integrated circuit that undergoes the SEL. Note that the mean (208) and standard deviation (210) of the supply current distribution of the equipment containing it (202) is much higher than the mean (207) and standard deviation (209) of the protected integrated circuit (200). This is because this average (208) is composed by the sum of the averages of all the currents of all the components operating on the board or equipment and its standard deviation (210) is a function that depends on the accumulation of all the standard deviations of all those devices. Therefore, to avoid spurious actions, the protection thresholds (201 and 203) must be located to the right of the average current of the protected element (207 and 208) whatever it is, at certain distance of it. The more these thresholds are shifted to the right, the more the probability of false negatives (205) increases, i.e. destructive conditions that will not be detected. Note how it is much more likely that the supply currents of the equipment or board will overlap with the values of the SEL currents (205 and 206) than the latter will overlap with the supply currents consumed by the integrated circuit to be protected. This indicates a higher probability of unwanted (spurious) mitigations and undetected SEL events when the protected element is an equipment or board instead of an integrated circuit. This can be understood more clearly if one observes that in both cases the false positive (spurious mitigations) rate is the area under the current curve to the right of the board protection threshold (206) and the false negative (undetected SEL events) rate is the area under the SEL current curve to the left of the same threshold (205).

The main limitations of this type of devices come from the need to determine a protection threshold that minimizes the probability of spurious mitigations. It shall be permanently updated according to the changes that occur in the protected device, mainly due to its aging. Fortunately, the radiation levels supported by the device to be protected are variable within wide ranges during its lifetime. Then an adaptive strategy with self-adjustment can be used.

This strategy relies on defining as the optimal threshold that which is as low as the value of the maximum peak of supply current consumed by the protected device without producing any spurious mitigation action.

The method presented here calculates a real-time estimate of the protection threshold to be used in the following instant. It is based on the measurement of the value of the supply current of the protected device during its normal operation. It is processed by means of an estimation algorithm such as a function of the maximum value of the type:

I (t + \) = n I (t) si I (t) > I (t - 1) or a statistical function based on the calculation of the mean and standard deviation of the values of the supply current consumed by the device of interest over time such as: I (i + 1 ^" ) = I + n £7 where:

I(t): is the instantaneous value of the supply current in time t.

/ : is the average value of the supply current consumed by the device of interest.. s: is the standard deviation of the supply current consumed by the device of interest. n: is an experimentally determined factor that in some implementations can be a function of temperature.

These elements used in the threshold prediction algorithm that involve not only the mean but also the variance and/or the standard deviation are known as "statistical moments". Other methods for calculating the protection current threshold are also possible, such as using a function of the different harmonic components of the frequency spectrum of the supply current consumed by the protected device.

The problem that arises with this concept is that an extremely high value of the reference threshold could be calculated if during the continuous process of updating the protection threshold a SEL is produced. In that case, the threshold would take such high value that it would not provide any possible protection.

Fortunately, in the vast majority of applications cases, the radiation flux to which they are exposed is highly variable. In particular, when used on low-earth orbit (LEO) satellites, the amplitude of this fluctuation can be as much as five or six orders of magnitude and its fluctuation period of an hour, aproximately.

Taking this into account it is possible to think of a methodology where the next value of the protection threshold is calculated only within the time segment in which the radiation flux is low enough. This threshold will be applied at a later time, when the radiation flux reaches important risk levels. It is possible to associate these two conditions to two different operating modes: the Learning Mode and the Protection Mode respectively.

A preferred implementation of the proposed method is based on the execution of three processes: a) the mode determination process, b) the protection threshold calculation and refreshing process, and c) the power interruption process. A Flow chart showing the Mode Determination Process is shown in FIG 3a. The Radiation Flux Meter measures periodically (it could be between every two seconds or every two minutes) the flux of ionizing radiation from the environment in which it is operating (302).

Simultaneously, the Radiation Flux Comparator compares the level of ionizing radiation flux measured (304) with the threshold set in the Radiation Flux Reference level. If the level guarantee that the probability of a SEL is low enough, the Radiation Flux Measurement Unit will determine that the mode will be Learning (303). Otherwise, it will be Protection (301). The magnitude of the Reference Threshold for the Radiation Flux could be recorded permanently at the factory in a ROM memory or could be changed by commands from the ground station; using a rewritable, non-volatile and radiation-tolerant memory. The process shown in Fig. 3a is carried out using a radiation detector and its associated circuitry exposed to ionizing radiation, to produce a status signal defining the Operation Mode shared by all the protected devices on the satellite electronics.

FIG 3b shows a flowchart for the processes associated to each protected electronic device carried out in each Protection Unit(s) as a function of the Operation Mode and the measured parameter on the electronic device. Either immediately after the power-up, when the protected device is energized, or immediately after the execution of a SEL mitigation, the initial conditions are set up (305) and a delay occurs (306) to avoid acquiring the transient values of the in-rush current from the protected device and its power filter. At the end of the initial transient, the Current Sensor measures (308) the value of the supply current consumed by the device of interest and check (307) the status of the mode signal.

If the mode is Learning, the protection unit starts the process of calculating and refreshing the protection threshold. In this process, the Optimum Threshold Calculation unit (513 - shown in Fig. 5 below) acquires the supply current values and, from them, calculates the new threshold (310) and stores it (311) in the Reference Register. When the ambient radiation level exceeds the preset radiation threshold the mode indicated by the external signal switches to the Protection mode (307).

The calculation/updating operations of the supply current values used to calculate the protection threshold are suspended, and the device goes on to permanently check whether a SEL has been produced. When the mode of operation is Protection, the Protection Unit goes on to execute the interruption mitigation process upon the occurrence of a SEL. The acquired value is compared (316) with that of the protection threshold. If the measured supply current value is lower than the value of the reference threshold, the measurement (308) and comparison (316) process is repeated indefinitely. If, on the other hand, the supply current consumed is above this threshold, the protection device turns the power supply off immediately (317). The power supply is kept off (318) for the minimum time necessary to ensure the total extinction of the SEL.

At the end of this period, the device automatically reconnects the power (319) repeating the whole process from the beginning (300).

In FIG. 4 a block diagram can be seen representing a preferred realization of the layout using the method by a series of Protection Units (405) for the different protected devices. These Protection Units (405) are very small integrated circuits located externally very close to the corresponding protected electronic device (407). They all share the same information on the state of the ambient ionizing radiation flux but calculate different optimal protective current thresholds for each case. In the Radiation Flux Measurement Unit (404), the Radiation Flux Meter (402) periodically measures the ambient radiation flux within which the arrangement operates. In turn, the Radiation Flux Comparator module (403) compares radiation flux level measured periodically by the Radiation Flux Meter

(402) with the fixed level preset in the Radiation Flux Reference (401) and transmits the radiation flux status to each of the Protection Units (405). If the flux level is below the threshold preset by design, the Protection Units (405) will operate in the Learning mode. Otherwise they will operate in the Protection mode.

FIG 5 shows a block diagram of the Protection Unit (405), which allows to execute a SEL mitigation process using the optimal current reference value for each case. This unit is composed of two modules: the Optimal Current Threshold Calculation Unit (513) and the Power Supply Control Unit (514). The operation of both is conditioned by the radiation flux level indicated by the mode signal status (503).

During the Learning mode, the Reference Calculator (501) receives periodically samples of the supply current that also feeds the Supply Current Comparator (506). While in this mode the module calculates the optimal current threshold and updates it on the Reference Register (502) according to the evolution of the supply current. For the calculation, you can use one of the algorithms mentioned above, such as the maximum value function or the statistical function based on the calculation of the average and standard deviation of the current samples, to estimate the value of the protection threshold with which you update the corresponding register in real time.

If, instead, the mode is Protection, the Reference Calculator block (501) stops calculating and refreshing the optimal current threshold in the Reference Register

(502) and the Protection Unit (405) remains awaiting the occurrence of a SEL until the mode is changed again. Each Protection Unit (405) is connected in series between the VDC power supply (504) and the protected device (407) so that the supply current can be quickly interrupted by an electronic switch (508) in case a SEL is detected. This detection is achieved by continuously comparing the instantaneous value of the supply current of the protected device (407) with the value of the current Reference Register (502), using the Supply Current Comparator (506). In many implementations, a parallel switch (508) is also included with the protected circuit in order to provide a low impedance path for the parasitic currents entering through the inputs so that they are not able to sustain the SEL. A Timer (507) extends the power interruption long enough (e.g. 50-100 microseconds) to ensure that the SEL effect is extinguished and switch the power supply back on once this process has been completed. A summary of the operations performed in the different modes can be seen in TABLE 1.

TABLE 1

For clarity purposes, this table shows the operations performed by the Protection Unit (405). In low-radioactive environmental conditions (Learning mode) this unit dedicates all its time to estimate the optimum threshold and refresh the reference (502). If the measured supply current exceeds the value of the protection threshold, this value is adjusted without interrupting the power supply of the protected device. If the radiation level is high (Protection mode) then the Reference Calculator module (501) stops estimating the new threshold and stops refreshing the Reference Register (502). At the same time, the Supply Current Comparator (506) verifies that the supply current consumed by the protected device (407) does not exceed the previously established threshold value. If this happens, i.e. if a SEL occurs in these conditions, the Protection Unit (405) switchs off the protected device power supply until the undesirable condition becomes extinguished.

An example of the many possible preferred implementations of the Protection Unit (405) consists of an integrated circuit that requires no more than a few pins (let's say six, approximately) to perform its function. Two are connected in series between the power supply (504) and the protected device (510), one reads the operating mode signal (503), one inform the rest of the equipment if a mitigation is taking place (512) and the fifth connects to ground (509). This integrated circuit uses analog and digital technologies. The analog one performs the measurements (505), the comparison with the reference threshold (506) and the power interruption (508) for a limited period of time (507). It also uses digital technology including the Reference Calculator (501) and the Reference Register

(502) which will perform the operations for determining the optimum threshold from the measured data of the supply current history.

An example of the many possible implementations of the Radiation Measurement Unit (404) is the use of a CMOS image sensor as a radiation detector (402) with associated logic for operation. This implementation is extremely useful because in addition to its low cost it has the ability to detect protons and heavy ions that are the main type of particles that can produce SEL in these applications.

The protection arrangement (406) in Fig. 4 includes one or more Ambient Temperature Measurement Units (not illustrated) connected to one or more of the SEL Protection Units (405) in Fig. 5. The Temperature Measurement Unit consists of a temperature sensor configured to operate within the range of ambient temperatures in which the protected devices (407) have to operate. It provides them with a signal that is representative of the ambient temperature that the Protection Unit (405) uses to estimate the protection threshold for the next instant. For example, it can be used as an extra factor in any of the proposed algorithms whose value will be modulated by thermal cycles that occur inside the satellite when switching from the full sun exposition to the eclipse condition.

FIG 6 shows the effect of aging by radiation through the representation of the evolution of the supply current consumption of the protected device. It can be seen here how none of the supply current peaks in normal operation (601) reaches the threshold imposed (800) to protect the device against a SEL occurrence.

However in this case the threshold is permanently adjusted avoiding spurious mitigations, independently of the consumption fluctuations derived from the thermal cycles of the environment and independently of the total ionizing radiation aging of the protected device.

DEFINITIONS

SEL: Single Event Latchup, is an undesirable effect that can occur in CMOS technology devices by which a low internal impedance between the power terminals causes the device destruction.

SEL Mitigation: is the process by which the destructive consequences of SEL are avoided.

Spurious Mitigation Rate: is the percentage of mitigation processes that are executed without a SEL having occurred.

Protected Device: is the SEL-susceptible CMOS technology device whose possible destruction is to be avoided through the mitigation process.

Destruction Risk Level: is the probability that there is a destructive SEL current value that is not detected because it is below the protection current threshold used to initiate a SEL mitigation process.

Protection Current Threshold: is the value of the supply current consumed by the protected device taken as a reference to identify a SEL and initiate a mitigation process. The definition of the value of this threshold determines the rate of spurious mitigations and the level of risk of destruction. It is not always possible to zero both figures simultaneously and the relationship between them is inverse, i.e. the higher the spurious mitigation rate, the lower the risk of destruction. Optimum Protection Current Threshold: is the value of the Protection Current Threshold that simultaneously minimizes the Spurious Mitigation Rate and the Risk of Destruction. This value is immediately above the maximum value of the supply current consumed by the protected device and evolves as it ages due to the effect of accumulated damage from the radiation received.