Back to the moon: The verification of a small microprocessor’s logic design

Abstract

The original and primary task of self-test program Smalley3 was independent verification of the logic design of the LOLA DU (lunar orbiter laser altimeter digital unit) microprocessor. Tasks were added to verify continuing correct operation of this central processing unit (CPU) under margin testing for supply voltage, ambient temperature, and clock frequency. Finally, an on-orbit diagnostic task was added so that any malfunctions of LOLA in lunar orbit can be identified as faults in, or not in, the CPU. The Lunar Reconnaissance Orbiter spacecraft will be launched to the Moon in 2009 with six scientific instruments including LOLA, each containing an embedded microprocessor to perform real-time subsystem control calculations. LOLA's CPU is a small, custom-designed processor, designed to meet the mission requirements while minimizing resources. This 8-bit machine is essentially code compatible with Intel's 8085 but is implemented in modern technology, an advanced, radiation-hardened 0.15 mum gate array, with the only logic element types being a 4:1 multiplexor and a flip-flop. This paper explains the fundamental structure of the verification task, shows how particular instructions are verified, presents a high-coverage scheme for detecting inadvertent RAM alteration, describes subsystem testing of RAM, and reviews the results of the verification effort. Some infamous CPU design flaws from both the commercial industry and aerospace flight control systems are discussed.