Semiconductor Technology from A to Z

A chip that performs flawlessly in a smartphone can fail within weeks in an engine control unit or a satellite. The reason isn't inferior manufacturing quality, but fundamentally different operating conditions and consequences of failure: a crashed smartphone can simply be restarted; a failed brake control unit or a satellite 36,000 km up cannot.

The industry has therefore established tiered qualification standards, each imposing stricter requirements on temperature range, allowable failure rate, documentation, and traceability:

• Consumer: No unified standard, typically 0 to 70 °C, failure rates in the range of several hundred FIT (see section 6), limited lot documentation.
• Automotive (AEC-Q100): Four temperature grades (0 to 3, see section 2), a mandatory stress-test catalog, full lot traceability (PPAP), single-digit FIT rates typically required.
• Military (MIL-STD-883): Defines test methods for component classes, often hermetic instead of plastic packages, 100% screening instead of sample testing.
• Space (e.g. ESA ESCC, NASA standards): Adds radiation hardness (sections 3 and 4) to the military requirements, plus mission durations of decades with no possibility of repair.

Each tier builds on the previous one — a space-qualified component must not only withstand its extreme environment, but also meet or exceed every automotive and military requirement.

Temperature range is the most visible difference between grade systems, but far from the only one.

Automotive components are graded by their location in the vehicle: the closer to the hot aggregate (engine, transmission, exhaust), the higher the required grade. These temperature spans directly affect device design — at 150 °C a MOSFET's threshold voltage and leakage current shift considerably compared to room temperature, which must already be compensated for in circuit design.

Space adds a stress form no terrestrial grade system captures: since a satellite in low Earth orbit cycles between sunlight and Earth's shadow roughly every 90 minutes, its electronics go through tens of thousands of temperature cycles over the mission — with no damping effect from an atmosphere and no convective cooling in vacuum. Heat can only be dissipated by radiation and conduction there, which shapes the thermal design of the whole enclosure and PCB.

Outside the protective shield of Earth's atmosphere and magnetic field, electronics face a radiation environment that plays practically no role at ground level: galactic cosmic rays, solar particle events, and — especially relevant for low Earth orbit — the Van Allen belts, where Earth's magnetic field traps and concentrates charged particles.

For device reliability, two fundamentally different damage mechanisms are distinguished:

• Total Ionizing Dose (TID): Cumulative damage from the radiation dose integrated over the entire mission. Ionizing radiation creates electron-hole pairs in the gate oxide; the holes get trapped there and permanently shift the transistor's threshold voltage — an aging mechanism following the same physical principle as Bias Temperature Instability covered in the reliability chapter, only driven by radiation instead of electric field. TID is usually given in gray or rad; typical requirements for Earth-orbit missions range from a few tens to a few hundred krad.
• Single Event Effects (SEE): Damage caused by a single high-energy particle passing directly through the chip, generating charge carriers along its track. Distinguished as:
  • Single Event Upset (SEU): A single particle flips the state of a memory cell (bit flip) — non-destructive, but a data error that must be corrected.
  • Single Event Latch-up (SEL): The particle triggers the same parasitic thyristor mechanism described as a latch-up risk in bulk CMOS in the SOI chapter — here induced by radiation rather than electrical crosstalk. Without timely power shutdown, the resulting current can thermally destroy the device.
  • Single Event Burnout / Gate Rupture (SEB/SEGR): In power semiconductors (power MOSFETs), a single particle can trigger a localized breakdown that destroys the device instantly and permanently.

The key conceptual difference: TID is a wear-out mechanism that can be slowed through adequate shielding and material choice. SEE, by contrast, are statistical events — even a perfectly shielded device can be struck by a single sufficiently energetic particle. Here, only a robust circuit architecture that tolerates or detects such a hit can help (see next section).

Since individual particle strikes can't be reliably prevented, radiation hardening shifts to the circuit and process level: the device should either not translate a hit into an error at all, or automatically detect and correct it.

• SOI/SOS as substrate choice: As described in the Bulk vs. SOI chapter, SOI eliminates the continuous semiconductor path to the substrate — which structurally rules out the parasitic thyristor structure that enables latch-up. For the same reason, SOI (and the related Silicon-on-Sapphire, SOS) is the preferred substrate for radiation-hardened digital circuits: a particle strike can no longer open a low-resistance path through the substrate.
• Reinforced guard-ring structures: In bulk CMOS designs still used for cost reasons, additional, wider guard rings surround the sensitive well junctions and drain off charge generated by a particle strike before it can trigger the parasitic thyristor.
• Triple Modular Redundancy (TMR): Critical logic or memory cells are implemented three times, with a majority voter comparing the three outputs. If an SEU flips one of the three copies, the other two outvote the error — the system stays functionally correct without the fault ever becoming visible. The price is more than triple the area of a simple implementation.
• Enlarged gate-oxide margins: To tolerate the threshold-voltage shift caused by TID over the entire mission, circuits are designed with significantly larger voltage margins than would be needed for terrestrial applications.

These measures come at a cost: a radiation-hardened device is typically several process generations behind the commercial state of the art, significantly larger, and considerably more expensive than its commercial equivalent — reliability and redundancy are deliberately traded against integration density and cost.

Beyond the device architecture itself, the path by which a component is certified as qualified also differs fundamentally from the consumer world.

The AEC-Q100 stress-test catalog for automotive semiconductors includes temperature-cycling tests (hundreds to thousands of cycles between minimum and maximum temperature), humidity tests, mechanical shock and vibration tests, and accelerated life tests. Only once a component passes the full catalog is it considered AEC-Q100-qualified for its grade.

In military and space applications, hermetic metal or ceramic packages replace the plastic packages common in consumer and mostly also automotive electronics. Plastic allows moisture ingress over the mission duration, an unacceptable risk given the long service times and lack of field or on-orbit maintenance.

Another key difference concerns the burn-in procedure from the previous chapter: while consumer electronics typically subject only a statistical sample of a lot to the burn-in test, military and space standards require 100% screening — every single delivered unit undergoes the full burn-in to weed out early failures (the high-failure-rate region of the bathtub curve) before installation.

Automotive adds full traceability via the Production Part Approval Process (PPAP): for every component, the exact wafer, lot, and production batch it came from must be fully documented — in case of a defect, the affected population can be pinpointed exactly instead of recalling an entire model line.

To make the reliability of different components and applications comparable, the FIT rate (Failures In Time) has become the standard metric: it gives the expected number of failures per one billion (10⁹) component operating hours. A value of 10 FIT, for example, means that among a million components operated simultaneously, about 10 failures are expected per 1000 hours. Automotive and space applications typically demand FIT rates in the low single digits — an order of magnitude achievable only through the combination of robust design, screening, and derating.

Derating is the deliberate practice of operating components well within their specified limits rather than pushing them to the edge: a chip specified for 150 °C is, for example, only designed in for automotive use up to 130 °C, a capacitor specified for a given voltage is operated at only a fraction of its rated voltage. Since virtually all aging mechanisms — electromigration, TDDB, NBTI — depend exponentially on temperature and electric field, even a moderate safety margin lowers the actual failure rate by orders of magnitude compared to operating at the specified limit.

Taken together, this paints a picture quite different from consumer electronics: it isn't the highest achievable integration density or the lowest component price that matters most, but predictable function — guaranteed over years to decades — under conditions far outside what commercial semiconductor processes were originally designed for.