DO-178C Certification of General-Purpose GPU Software: Review of Existing Methods and Future Directions

Abstract

General-Purpose GPU software is considered for use in avionics to satisfy the increased computational requirements of future systems. Therefore, it needs to be certified following the DO-178C guidance as all airborne software. In this work, we review the existing methods in the literature, we analyse their advantages and disadvantages, and we discuss how they can be combined to obtain certification with lower effort and cost. Our focus is restricted on application-level software, under the premise that successful completion of verification of avionics graphics GPU software products has been demonstrated, so their GPU compiler has been considered acceptable for these already DO-178C certified products, or existing qualified GPU compilers exist. Finally, we discuss upcoming solutions for certified general purpose GPU computing.

On the MC/DC Code Coverage of Vulkan SC GPU Code

“…A recent work on general purpose computations on GPUs [6] has argued that since Vulkan SC and GLSL are based on the C language, the existing code coverage tools for C can be extended to cover these dialects. In this paper we discuss in detail what are the implications of implementing MC/DC code coverage for GPU code, apart from the syntactic similarities of the GPU languages with sequential C code, and therefore what is the interpretation of MC/DC coverage in SIMT code.…”

“…However, such an implementation can be suboptimal in terms of performance as in the case of the matrix multiplication example we have examined. Moreover, some algorithms such as histograms, require to write in arbitrary output positions not determined by the thread identifier, a computation pattern known as scatter [6]. In that case, multiple potential programming issues can arise in GPU implementations, which we examine next.…”

“…Certifiability objectives considered in the DO-178C standard could be applicable to GPUs [6], but, so far, compliance with these objectives has only been demonstrated for CPUs. When these objectives are analyzed for completion in GPUbased airborne software applications, test coverage of software structure, up to MC/DC, arises as a challenge, due to the lack of qualified tools providing the capabilities to perform this analysis and the need to define specific design strategies.…”

“…Although previous solutions based on safety-critical graphics APIs such as OpenGL SC 1.0.1 [8] and 2.0 [9] limited control flow structures in GPU code, Vulkan SCs GLSL allows arbitrary complex control flow in GPU software, similar to CPU code, allowing much more general purpose algorithms to be accelerated [6]. For this reason, MC/DC code coverage is required to be performed in the GLSL code.…”

“…For this reason, MC/DC code coverage is required to be performed in the GLSL code. Moreover, unlike previous safety-critical APIs [6], Vulkan SCs GLSL permits multiple outputs per GPU thread and synchronization among the threads. This means that race conditions can be introduced when threads are writing in the same position, or stale data can be read in the absence of missing synchronization between reading and writing operations of the same or different threads.…”