Developing and testing heterogeneous space systems with Renode

While landing humans on the Moon was a feat accomplished with very basic compute power of 2MHz provided by the Apollo Guidance Computer, modern spacecraft can take advantage of a much more advanced and capable data processing infrastructure. The space systems of today are essentially powerful heterogeneous multi-node setups with many layers of redundancy and lots of communication flowing in all directions. The resulting complexity requires rigorous testing in order to predict and prevent possible catastrophic failures - because in space, no one can hear your hardware beep.

Open and scalable tools for testing systems for space use are also more relevant than ever, as the relative ease to launch payloads thanks to reusable spacecraft from SpaceX, unifying standards like CubeSat, and the rapidly sinking cost of hardware platforms in combination with advancements in open source control software have jointly brought about a surge in new investments, ventures and applications. A myriad of startups and many mid-to-large private players thus join the usual defense and state actors in a competition which pushes the boundaries of human creativity. All those parties have one thing in common: they need to build systems that can last for years outside of Earth’s atmosphere, without actually taking years to build them.

As an open source and flexible tool capable of supporting the complex variety of space-bound hardware, our Renode simulation framework is already helping to achieve just that: vastly reduce iteration time and cost of development by introducing a structured and deterministic approach to testing the real binaries destined for space. In this note, we will go over how Renode benefits our customers in the space industry by parallelizing software and hardware development, simulating entire heterogeneous systems and enabling fully-replicable and scalable testing thanks to the framework’s extensive integrations and automation capabilities.

Space-faring ISAs

Given the radiation tolerance and redundancy required of space hardware systems, as well as a certain flexibility necessary to operate under changing circumstances, for a long time, space was the exclusive domain of specialized ASICs and FPGAs. The SPARC-based LEON CPU series was a prime example of that: developed specifically for space by ESA, available in both FPGA and rad-hard ASIC variants, it was successful in its own niche, without ambitions for ever outgrowing it. Similarly, space-qualified FPGAs can cost tens-to-hundreds of thousands of dollars apiece, and are not meant for “civilian” use. Thanks to Antmicro’s early work in space and deep involvement with advanced FPGA systems, for many years Renode has had support for LEON CPUs, extreme configurability useful for simulating soft SoCs, and capabilities to co-simulate HDL with tools like Verilator, which enables supporting the mix of hard and soft IP found in traditional space systems.

The industry’s relative detachment from the rest of the world’s electronics landscape has changed in recent years with the availability of commodity high-performance embedded hardware brought about by the success of the ARM ISA family. Devices based on ARM, in the form of both special rad-hard versions for critical applications as well as regular commercial variants, including e.g. the AMD/Xilinx Zynq FPGA SoC series, the NVIDIA Jetson Orin, or Qualcomm’s Snapdragon are taking the space world by storm.

The CubeSat specification is a factor here, pushing affordability and reusability in the industry with over 2300 satellites launched and counting. Some of the top players in the space industry are also increasingly open about their preference for off-the-shelf hardware and open source solutions, reducing barriers to entry even more. This unprecedented scale does, however, come with a higher-than-ever need to develop and test diverse systems in a unified way.

Fortunately, Renode has excellent support for the ARM ISA family as well. Each subfamily within the ARM Cortex series is present both in space and Renode’s mainline open source codebase: SoCs based on CPUs like Cortex-A72, Renode support for which stems from the equally demanding automotive industry, are used for compute-intensive on-board applications including real-time data compression and transmission. The extremely popular Cortex-M series, with hundreds of supported boards in our Renode-Zephyr dashboard, powers e.g. sensor data processing units, and Cortex-Rs, with now almost complete support in Renode, are being adopted for safety-critical applications. Heterogeneous multi-core systems, as well as ones including a built-in FPGA fabric on top of hard IP in the form of e.g. the dual/quad core Cortex-A and dual-core Cortex-R Zynq UltraScale+ FPGA SoC are also not uncommon, and Renode can handle all of it through its support for AMP systems and co-simulation.

In the move towards off-the-shelf and open solutions mentioned above, the open RISC-V ISA has been a rising star in the space industry, thanks to its general purpose nature combined with extreme customization potential and possibility of royalty-free use in both FPGA and ASICs. Indeed, in 2017-2018 together with Thales we have been already exploring the potential of RISC-V for creating flexible triple modular redundancy setups. Also notably, the first large adopter of RISC-V as well as Antmicro’s early RISC-V customer who heavily contributed to RISC-V support in Renode as well as co-simulation features, Microsemi (now part of Microchip, who also own Atmel, another important space-focused SoC vendor), targets space as their primary vertical with their unique flash-based FPGA technology. In late 2022, NASA has signed a contract with Microchip and SiFive (coincidentally also an Antmicro customer and partner) in order to develop RISC-V CPU cores for NASA’s High-Performance Spaceflight Computer (HPSC), featuring SiFive U7-series cores, already supported in Renode. As disclosed by NASA, Blue Origin is also looking into the possibilities the open architecture offers for its Blue Moon vehicle with a soft processor instantiated in a radiation-tolerant FPGA.

Even Frontgrade Gaisler, the original authors and stewards of the LEON CPU line, have jumped on the RISC-V bandwagon (shuttle?) with the NOEL-V processor IP or perhaps more interestingly, the hardened GR765, an octa-core chip with the possibility to select between both LEON and RISC-V cores.

Stellar RISC-V support

RISC-V’s claim to fame, besides openness, is configurability: specific elements of the ISA might be optionally included or not, and a powerful interface for standardized custom instructions is available. A CXU working group, taking over the work of the CFU special interest group which Antmicro helped establish, is developing a specialized FPGA-focused interface for even more efficient acceleration on FPGAs, and Renode has been a staple prototyping device for that use case.

The plug-and-play nature of RISC-V maps very well onto the configurability of Renode, where adding a specific instruction set to your simulation platform is just one line of configuration away, and custom instructions can be added in a number of ways, including with a simple Python function. Indeed, RISC-V has been a boon to Renode’s flexibility as the tool has evolved in its capability for pre-silicon development and architectural prototyping to keep track of the ascent of the open ISA, and is being used for many such scenarios, especially in AI. Renode is often an agent in the adoption of RISC-V, letting companies embrace the new ISA in a stepwise and informed manner, porting over simulation test suites and ensuring they continue to work, bringing up new operating system ports with full understanding of a system, tweaking system configurations and custom accelerators and observing the results instantly with advanced debugging. In fact, as maintainers of RISC-V in the Zephyr RTOS, Antmicro uses Renode constantly in its own work of creating and curating new RISC-V ports.

Full system simulation

The ability to simulate SoCs based on various ISAs helps with testing individual subsystems, but many potential system-level problems are related to I/O interfaces and inter-device communication and interactions. Renode can comprehensively simulate complete heterogeneous multi-node systems, with support for a variety of wired and wireless protocols.

Another core idea behind Renode is supporting real, production binaries and complete software agnosticism – your simulated hardware can run the same software as its physical counterparts instead of a cut-down, abstract version, increasing the relevance of your testing. Renode lets you represent the complete multi-stage boot flow of your system, and has already been powering simulation with a wide variety of software including RTOSes like Zephyr, seL4, FreeRTOS, AzureRTOS or NuttX, larger systems like FreeBSD or Linux, or any mixture of these and other proprietary or industry-specific options we have encountered over the years.

Support for sensors and actuators, including multi-sensor data input via the specialized RESD format, enables providing real or mock data to your simulation to test the behavior of your systems, recreating typical or extreme conditions that are difficult to reproduce in a lab, or verifying system behavior when presented with invalid or faulty sensor readouts.

Scalable testing and integrability

Renode’s many integrations and examples of use with testing frameworks and tools like the Robot Framework, pytest, Zephyr RTOS’ Twister or Unity, let us build reliable, bespoke test suites for a wide range of customers across many verticals. Such test environments can then be automated in Continuous Integration pipelines in Jenkins, GitHub Actions, GitLab CI, CircleCI, or others, incorporating variability and corner cases which are impossible to test in hardware.

The Renode-Zephyr Dashboard and the Renode-U-Boot Dashboard are a good showcase of the scale enabled by Renode. Those CI systems build and run thousands of binaries across hundreds of simulated boards, with downloadable artifacts including SBOM, UART outputs, visual traces, Robot test results or even interactive Google Colab playgrounds, a testimonial to the framework’s scalability and automation capabilities.

The simplicity with which Renode can be integrated into CI and testing infrastructure allows for a lot of creativity, enabling scenarios like fault injection, fuzzing, stress testing and continuous performance evaluation, all in the quest for achieving spaceworthy test coverage. With the recent addition of pyrenode3, a proper Pythonic interface for Renode, the framework now offers unlimited scripting capabilities and direct interfacing with larger Python-based applications, which vastly increases its integrability and extensibility.

Fault-proof your next space mission with Renode

Renode offers broad simulation testing capabilities that can radically improve productivity of teams developing software and hardware for space, and helps develop standardized, test-based workflows where each change in the system can be meticulously tracked and verified. As an open source framework that’s highly configurable and extendable with new platforms, capable of supporting software development for both complex ASIC and FPGA platforms, it helps hardware and software teams collaborate and make more informed decisions faster. It can also be easily integrated with other existing tools and shared between project partners with no extra licensing costs, with commercial support from Antmicro available to help in advanced use cases.

If you are interested in introducing CI-driven prototyping and testing capabilities offered by simulation in Renode and speed up the development cycle for your space-facing solutions, do not hesitate to try out Renode and contact us at contact@antmicro.com to discuss your particular use case.