DO-254 high-speed interfaces compliance

As the complexity of electronics for airborne applications continues to rise, an increasing number of applications need to comply with the Radio Technical Commission for Aeronautics (RTCA) DO-254/The European Organization for Civil Aviation Equipment (EuroCAE) ED-80 standard for certification of complex electronic hardware. Complex electronic hardware includes devices like Field Programmable Gate Arrays (FPGAs) and Application Specific Integrated Circuits (ASICs). An important aspect of the regulations is that you need to capture requirements and track them throughout the design and verification process and the functioning hardware in the system. The DO-254 standard defines five levels of compliance depending on the effect the failure of the hardware will have on the operation of the aircraft. Level A is the most stringent, defined as "catastrophic" (e.g. loss of the aircraft), while a failure of Level E hardware will not affect the safety of the aircraft. Meeting Level A compliance for complex electronic hardware requires a much higher level of verification and validation than Level E compliance [1]. Chapter 6.2 of the DO-254 standard mandates that for the most stringent levels of compliance, the verification process for FPGAs and ASICs must measure and record the verification coverage by running tests on the device in its operational environment. What this essentially means is that you need to compare the behavior of the physical outputs of the device on the hardware device pins with their corresponding RTL (software model) simulation results. In addition the standard requires running robustness tests on the interface pins. The robustness testing is accomplished by forcing abnormal behavior on the device and its externalities and ensuring that the device is able to deal with this behavior without catastrophic results. These requirements become especially challenging for high speed interfaces such as DDR3 or PCIe because it is not possible to create and observe the abnormal behavior when an FPGA is connected directly to a functional operational counterpart. For example, when a real memory is connected to a DDR model, there is no way to control the DDR behavior and use different kind of DDR memories. This paper will explain the challenges inherent to DAL A and B certification of FPGAs and ASICs with a focus on the high speed interfaces. Based on advanced pre-silicon verification methodologies that will be introduced, the paper will present a new approach for hardware testing that makes it not only possible but also straightforward to comply more completely with the DO-254 requirements for real inhardware testing including easily running an array of robustness tests.