Chips in space

By Craig Horn, SEAKR Engineering and Michael Horn, Mentor Graphics

Consider the many challenges of verifying FPGA-based designs for an aerospace company whose devices have been to the moon and beyond. First are the everyday terrestrial concerns. Namely, due to increasing size and complexity, most modern FPGA designs are difficult to verify with traditional directed tests. Then there is the headache of havoc-wreaking radiation in space, which requires trading inexpensive reprogrammable parts for pricey radiation-tolerant one-time

programmable parts. The challenges lead to one overarching goal: reducing the number of logic changes during lab testing, which saves on the number of devices used as well as the time and expense of circuit-board changes or remounting new parts onto an existing printed circuit board.

This was the context when SEAKR Engineering sought to improve its verification methodology. The company’s response was to adopt constrained-random testing using Open Verification Methodology (OVM), which led to faster, more effective testing, new applications for verification IP and more business opportunities for the company.

SEAKR specializes in space-based, solid-state storage and processing systems for both manned and unmanned applications. The company pioneered the use of plastic encapsulated memory (PEM) for space-based storage systems. SEAKR products have been used in over 70 launches with a 100 percent success rate, including DigitalGlobe’s Worldview Satellite. SEAKR provided the largest capacity data recorder flown at the time, two terabits, for the satellite,

launched in September 2007. The Worldview Satellite provides high-resolution images for GoogleEarth. So SEAKR technology effectively is the memory stick for perhaps the best known repository of geographic information on the Web.

SEAKR products have also been frequent visitors to Mars. Launched in August 2005, the Mars Reconnaissance Orbiter has for years been returning high-resolution photographs and relaying climate data using SEAKR components. The orbiter contains the largest camera ever sent on a planetary mission and is being used to scout possible landing sites for future NASA missions. The images and data have resulted in a planetary survey that has surpassed researchers’

original expectations for the mission, which has been extended. The orbiter will continue to function both as a surveyor and communications relay for landed Mars missions through the end of 2010.

The demanding environments of space require complex and demanding logic to operate efficiently and correctly, which helped to motivate SEAKR’s recent one-year transition from directed to constrained-random FPGA verification. The adoption of advanced verification technologies and methodologies allowed them to find bugs more quickly in their designs as well as their customers’ designs. OVM eases adoption of SystemVerilog, speeds testbench construction, and

encourages reuse of verification components. By using an open source methodology and an IEEE standard language for their assertions, SEAKR has maximum flexibility with their testbench environment.

Before SEAKR made the switch to SystemVerilog and OVM, the testbenches used were generally Verilog or VHDL, with a high degree of dependence on lab testing to locate bugs and

verify fixes. OVM, available for download under the Apache 2.0 license, allows complicated features of designs that previously would have been extensively tested and debugged in the lab to be validated in the simulation phase. This led to a reduction in design cycle time

for SEAKR and the creation of higher quality products. The payoff was especially visible in a new SEAKR project to implement a complicated method of throttling traffic for a series of input ports according to a maximum assigned bandwidth. The OVM environment was used to quickly construct a series of constrained random tests of multiple traffic streams with different burst characteristics and average rates to show the product could correctly measure and block traffic with excessive rates. Several different architectures were considered and discarded using this method until an acceptable architecture reached the lab.

The object oriented, modular structure used by OVM allows a high degree of reuse, allowing different engineers to quickly construct useful test environments. This is a large improvement compared to earlier methods, in which tests were generally fully directed or used primitive randomization, and testbenches could not be easily reused for a later project. SEAKR has begun constructing a reuse library of OVM objects which are parameterized for easy reuse in new projects. The library includes commonly used objects like clock drivers and interface containers, drop-in simulation models for SEAKR IP, and templates of complete simulation environments for rapid deployment. The library will save development time and promote standardization of verification processes throughout the company.

Another advantage of OVM is that it allows engineers to construct a robust set of constrained tests with a very small configuration object. By documenting that object carefully, other engineers can use an environment easily without having to know the details of the test environment architecture. This allows design engineers to operate the environments constructed by the verification engineers to quickly produce their required tests.

For example, one verified SEAKR product contained 80 input and output ports which could be configured into different modes receiving different types of input traffic. By default the environment would choose a valid random configuration of ports and input traffic with the possibility of errors. Using the configuration object, the tester could constrain the test to isolate a particular path or function by changing error rates, manually selecting a port configuration or adjusting the input traffic rate and type for a particular port. This allowed the engineers to construct a series of semi-directed tests for debugging; these tests would be guaranteed to exercise particular blocks of code, while continuing to randomly check other device features.

But the biggest advantage that SEAKR derived from using a constrained-random environment was the ability of the random nature of the testbench to come up with unexpected tests. With constrained-random testing the company’s engineers could not only check the normal areas a directed test might focus on, but also test many scenarios they would not have been likely to think of as part of a directed suite of tests. This helped a great deal in the debugging of a packet

switch. The random insertion of packets with errors and varying packet lengths exposed issues that were visible only due to the presence of multiple sequential errors in the incoming stream. These tests almost certainly would not have been developed for a set of directed tests. While all FPGA designers agree that thorough testing is critical, it is especially so for SEAKR. The bottom line: when you’re launching a one-time programmable FPGA or ASIC design into space, it has to be as nearly perfect as you can make it. 

The newfound advantages in testing and debugging did not come without a price. Although SEAKR had many engineers comfortable with directed verilog and VHDL testbenches, they had to train a team to use OVM and constrained-random techniques to construct their advanced environments. The object-oriented nature of OVM and the change in mindset required a steep learning curve for the engineers involved.

SEAKR set about retraining its engineers by scheduling several workshops with Mentor Graphics for in-depth training on SystemVerilog, OVM, and the advanced functional coverage features of Questa. This, in addition to guidance from their assigned support, allowed the team to quickly reach the point of writing full environments to perform useful verification.

Another challenge was the evolving nature of the language itself. Initially the team trained on AVM, which was replaced in rapid succession by OVM 1.0, 1.1, and finally OVM 2.0. Major language constructs were modified in this period, with unified stimulus sequences replacing earlier separate sequence and transaction objects. OVM 2.0 has been a stable release, largely unchanged for the last year. Only a few extensions to the language have been announced

for next year, including standard classes to represent registers and memories and improvements to test configuration.

These growing pains for the verification group were offset by the new capabilities that using OVM brought to the company. SEAKR found that the new advanced verification techniques they had developed led to new applications beyond RTL verification. They were able to use SystemVerilog and OVM to develop cycle accurate models of IP that they had designed for use in a reconfigurable computing subsystem. The models were developed by creating an OVM testbench for each IP block receiving stimulus in parallel with the System Verilog model counterpart. Fully exercising the IP and comparing the results with the model helped guarantee cycle-accuracy.

By replacing the static RTL of the system with faster SystemVerilog models and allowing their customers to insert their own RTL for verification, SEAKR was able to achieve two goals: providing customers with a verification environment up to 15 times faster than the old RTL verification environment; and avoiding distribution of internally developed RTL, leading to tighter control of valuable IP.

Spending the resources to develop an advanced verification team even led to new business opportunities. A leading aerospace company asked SEAKR to validate an FPGA which they had produced as a prototype design.  SEAKR’s constrained-random environment produced corner-case reset scenarios for the main finite-state-machine, which would have caused the chip to lock-up after reset. The customer was so impressed that they hired SEAKR to verify two more FPGA designs and to oversee the integration of the three parts into a single ASIC.

Even though most technologists don't develop devices for prolonged use tens of millions of miles from the nearest lab, all FPGA designers aim for a high bar in their verification methods. And the payoff for this diligence goes beyond better devices that far exceed the expectations of end users. At least occasionally, based on our experience, advanced verification methods also help boost the bottom line by attracting new customers. For those of us who toil in IC design world, that's something that's almost as exciting as the latest images of the Red Planet. (see: http://photojournal.jpl.nasa.gov/jpegMod/PIA12491_modest.jpg) or from the GeoEye satellite (see: http://earth.google.com/geoeyemso-bidi-font-style:italic).      

About the authors

Craig Horn is the Verification Group Lead Engineer for SEAKR Engineering, Inc. During the last 15 years he has held verification and design positions at a number of digital design firms, including STS Technologies, Inc.; Erlang Technologies; and Winnow Technologies, Inc. Mr. Horn earned a Bachelors and Master’s degree in Electrical Engineering from Washington University in St. Louis.

Michael Horn is an Application Engineer with Mentor Graphics. With over 10 years of experience, Mr. Horn has held senior and principal engineer positions at such companies as Calix Networks and Broadcom, specializing in design and functional verification. Mr. Horn earned his BEng from the University of Illinois at Urbana-Champaign. 

Worldview 2 Tbit solid state recorder, designed and built by SEAKR.

Artist’s conception of Mars Reconnaissance Orbiter, courtesy NASA/JPL

Dune Symmetry Inside Martian Crater; captured by the orbiter’s HiRISE imager; complete information here: http://photojournal.jpl.nasa.gov/catalog/PIA12491