MatheusFerronato

Abu Dhabi, UAE

Lead Digital Design Engineer

FPGA and ASIC design, from RTL and verification through implementation and system bring-up. I work across SystemVerilog, VHDL, Vivado, Quartus and Cadence flows, with hardware experience in optical and wireless communications and post-quantum acceleration.

Download CV · PDFmatheus@ferronato.meferronato.me/gitferronato.me/linkedinferronato.me/badges
1 kmOptical link demonstrated

Pointing, acquisition and tracking owned end to end.

Explore the optical system →
162×Post-quantum acceleration

Hardware accelerator versus a single-core software baseline.

Explore the accelerator →
ASICUltra-low-power backscatter

Led the digital architecture of HaiLa’s BSC2000 wireless backscatter device.

Explore the ASIC →
2 US patentsBackscatter innovation

Granted patents for frame-check-sequence preservation.

View the patents →

Work & study

● Career · ● Study · Drag to explore

2016– 2018 CEITEC S.A. — Porto Alegre, Brazil

Bring-up team, then EDA team

Validated the very-high-bit-rate contactless interface of the Brazilian passport chip against ISO 14443-4, then moved to the EDA team to automate the design flow.

stackISO 14443-4, ISO 7816-4; OrCAD; C++ with Qt; uC/OS; RedHat, Python, Bash, DesignSync

ISO 14443-4 exchange between reader and passport chip. Move the rate slider: the PPS negotiation and SELECT round-trip speed up as the bit rate climbs into the very-high-bit-rate range.
2018– 2020 Datacom — Porto Alegre, Brazil

Developer — Hardware and Software R&D

Built a 40 Gbit/s IEEE 802.3ba test switch on Virtex-7 with built-in self-test and RFC 2544 validation, and cut the area of the legacy architecture by 93%.

stackVirtex-7; VHDL, Verilog; 802.3ba; PCIe; VXLAN, EVPN, BGP, GRE, GENEVE; C raw sockets; C#

The 40 Gbit/s test switch. Frame size and load drive the lane utilisation; toggle the legacy architecture to compare area, and run RFC 2544 to see the built-in self-test.
C# test application driving Linux virtual firmware instances. Normal traffic uses the primary route; failure mode moves it to the backup path.
2020– 2022 HaiLa Technologies — Montreal, Canada

Lead Digital Hardware Engineer

Designed the digital architecture of BSC2000, an ultra-low-power Wi-Fi backscatter ASIC, and invented the frame-check-sequence preservation method that became two granted US patents.

stackASIC RTL in SystemVerilog; UVM, SVA; SPI, APB; RISC-V firmware; 802.11, GNU Radio; Python host stack

Ultra-low-power Wi-Fi backscatter. The tag has no transmitter. It reflects the chosen AP's own frame — a tag bit of 1 flips the phase — and radiates the reply in every direction. Only the AP whose frame it rode lights its RX LED.
2022– now Technology Innovation Institute — Abu Dhabi, UAE

Lead Hardware Engineer

Led the team that delivered a post-quantum key-encapsulation hardware accelerator at 162× a single-core software baseline, owning the hardware and software architecture and the verification plan.

stackPCIe Gen4 x16, DDR4; Kyber, Dilithium, FIDO2; UVM, SVA, VPI/DPI; Xcelium, Vivado, Questa, Quartus, Libero, Genus, Verilator; CI/CD

  • Led a team of engineers delivering a high-throughput hardware encryptor for post-quantum key encapsulation, owning hardware and software architecture and the verification plan.
  • Accelerator module reached 162x over the single-core software baseline.
  • Built a hardware authenticator combining Kyber key encapsulation, Dilithium signatures and FIDO2.
  • Integrated PCIe Gen4 x16 and DDR4 into the architecture.
  • Implemented a ring-oscillator TRNG and a novel method for unbiased generation.
  • Created a Python framework unifying tool flows across Xcelium, Vivado, Questa, Quartus, Libero, Genus and Verilator.
  • Developed BFMs for AXI4, Avalon-MM/ST and APB with generic and randomised packet generation.
  • Used SystemVerilog VPI and DPI to bridge UVM classes and C functions; added coverage analysis and SVA properties.
  • Designed abstraction modules hiding multiple memory hierarchies, and synchronisation for high-throughput serialisation.
  • Introduced CI/CD pipelines into the project flow; ran price and availability analysis across the full BOM.
The KEM and signature datapath. Drag the card into the x16 slot and the queue drains through six KEM units at 162×; pull it out and the CPU takes the same work at 1×.
The hardware authenticator. Drag the key into the USB port, then step through the challenge. The FPGA hashes and signs inside the device; the secret key is generated there and never leaves.
2026– now Technology Innovation Institute — Abu Dhabi, UAE

Lead Digital Design Engineer — Wireless Communications

Took a free-space optical video link from concept to a working proof of concept over a 1 km horizontal path, and own the pointing, acquisition and tracking that keeps it up under turbulence.

stackXilinx ZynqMP on ZCU102; Vivado, Vitis; SystemVerilog; Python lab automation; link budget, BER

  • Developed a proof-of-concept free-space optical communication system for high-throughput, low-latency video transmission.
  • Own the complete pointing, acquisition and tracking solution for reliable optical-link establishment and stabilisation.
  • Coordinate PCB, FPGA firmware, analog front-end, system bring-up and hardware integration across the programme.
  • Designed the laboratory validation platform that correlates Vivado simulations, ILA captures, oscilloscope measurements, BER results, link-budget estimates and real-time bench telemetry.
  • Xilinx ZynqMP on ZCU102, Vivado and Vitis flows.
HDMI over a laser: two ZynqMP terminals, 1 km of turbulent air, and the tracking loop that keeps the picture up. The left FPGA serialises an HDMI stream onto the beam; the right one recovers it through FEC and drives a monitor. The quad detector reads where the spot landed and the fast steering mirror closes the loop. Raise the turbulence and the picture breaks into blocks before the link drops; open the loop or kick the beam and watch it reacquire.

Engineering skills

Select a skill to see its animation alongside. Hover for where it was used.

Design and verification
SystemVerilog, Verilog, VHDL, RTL design, UVM, SVA, functional coverage, VPI, DPI, Verilog-AMS, Verilog DMS
EDA
Vivado, Vitis, Quartus, Libero, Xcelium, Questa, Verilator, Genus, Innovus, Tempus, Modus
Optical and RF
Free-space optics, pointing/acquisition/tracking, link budget, BER, BPSK, QPSK, CDMA, CCK, IQ modulation, backscatter, Gen2 RFID, GNU Radio, SDR
Interfaces
PCIe Gen4, DDR4, AXI4, AXI-Stream, Avalon-MM, Avalon-ST, APB, SPI, I2C, Ethernet, ISO 14443
Hardware design
PCB design (KiCad)
Networking
802.3ba, SpaceWire, 802.11b, 802.11ba, 802.2, IPv4, TCP, UDP, VXLAN, EVPN, BGP, GRE, GENEVE, Scapy, GNS3
Security
Post-quantum cryptography, Kyber KEM, Dilithium signatures, FIDO2, ring-oscillator TRNG
Platforms
Xilinx ZynqMP, Intel Agilex 7, Microchip PolarFire SoC, Virtex-7, RISC-V
Programming
C, C++, C#, Python, TCL, Bash, MIPS assembly
Languages
Portuguese (native), English (native or bilingual), Chinese (limited working)

Patents

Method and system for preserving a frame check sequence during backscatter communication

US 12,255,741 B1
granted 18 Mar 2025 · filed 15 Mar 2024 · appl. 18/606,819
Communication system claims — end to end

Continuation of 11,962,412, claiming the transmitting unit, backscattering tag and receiver as a single system.

read the grant on Google Patents
US 11,962,412 B1
granted 16 Apr 2024 · filed 18 Dec 2023 · appl. 18/543,764
Method claims — tag data and CRC preservation

The original grant. Assignee HaiLa Technologies; co-inventors Vytas Kezys and Juan Miguel David Becerra.

read the grant on Google Patents
The tag changes the payload; the original FCS stays. Switch preservation off to see the difference.
how the method works

A backscattering tag has no transmitter; it reflects a frame another radio is already sending. That frame’s check sequence was computed by an access point that knows nothing about the tag, so any changed bit makes every receiver drop it. The method: the access point ends its payload with a run of zeros, the tag overwrites the start of that run with its data and then a short preservation sequence — the XOR of the CRC of the tag data and the CRC of as many zeros, serialized in the required bit order (least-significant byte first in this reflected CRC-32 implementation) — and the original FCS stays correct. Below, live, with a real CRC-32.

Courses

courses by

Inside the portfolio

A career on an AXI bus. Run the trace, then inspect each transaction.

Ready · recorded SV simulation
— C1 — M1 — Δ —
TOP.career_top ▸ click a folded channel to open its signals · click to place C1 · shift-click for M1 · ←→ move · n/p step transactions · click a company segment to open that role

Career history
FromToEmployerRoleLocation

Run plays the recorded SystemVerilog trace once. Each hire briefly holds the timeline; afterwards, pan, zoom and inspect the decoded bus values.