Analog circuits play a vital role in electronic design and are key in connecting digital circuits with the physical environment. Ensuring the accuracy and reliability of analog circuit simulation tools (i.e., Simulation Program with Integrated Circuit Emphasis (SPICE)) is crucial; any errors in analog circuit simulation tools may lead to defects in analog circuit design, which may cause major problems and losses in the design and production process. Due to the lack of complete and unified specifications for analog circuit design, existing simulation tool testing works face the challenge of how to generate more effective analog circuits and improve test efficiency. To overcome these challenges, we propose a new fuzz testing method called SpiceFuzz, which is the first to use training-free LLMs to generate effective and diverse SPICE netlists to test SPICE simulators. First, SpiceFuzz combines carefully constructed mutation prompts with a flow with feedback to automatically generate effective analog circuits. Then, SpiceFuzz guides mutation selection by memorizing the historical selections and their results, thereby selecting mutations that are more likely to trigger bugs for the specific analog circuits. Finally, the differential testing component compares the simulation results of generated SPICE netlists to find potential bugs in the simulators. Experimental results show that SpiceFuzz outperforms the state-of-the-art methods, in terms of the number and simulation success rate of SPICE netlists generated. Meanwhile, in one month, SpiceFuzz reports 12 discovered bugs in NgSPICE and LtSPICE, 7 of which are confirmed by the developers.

Link prediction for circuit completion is a crucial task in Electronic Design Automation (EDA), aiming to infer missing connections in incomplete circuits to accelerate design workflows and ensure Printed Circuit Board (PCB) reliability. However, due to the practical reality that circuit connectivity is defined by nets that connect specific pins of component instances, existing methods that rely on homogeneous representations and scalar shortest path distances collapse pin-level constraints into a single proximity signal. This collapse obscures component identities and pin semantics, and fails to capture long-range functional paths, which can slow design closure and potentially compromise PCB reliability by increasing the risk of electrically invalid links and subsequent rework. Addressing these challenges, we present a T ype-aware H eterogeneous G raph network for C ircuit link prediction ( THGC ), which enables accurate circuit link prediction by explicitly preserving component functional semantics and modeling type-aware dependencies. Specifically, THGC constructs a circuit-aware heterogeneous graph from netlists to preserve physical connectivity and component semantics, and refines representations through a multi-view encoder with Type-Aware Distance Encoding (TADE) to capture non-local dependencies. It then performs circuit-oriented link prediction using a heterogeneous graph network with dense convolutions and global sort pooling, optimized by a composite objective enforcing topological and semantic consistency, to predict electrically feasible missing connections for circuit completion. Comprehensive experiments are performed on 6,195 circuits collected from three benchmarks, and the results demonstrate that THGC consistently outperforms state-of-the-art methods, achieving up to a 47.51% relative improvement in terms of AUC. These results confirm that THGC effectively preserves component functional semantics and captures type-aware non-local dependencies for accurate circuit link prediction. The source code is available at https://anonymous.4open.science/r/THGC.

Third-Party Library (TPL) detection, which identifies reused libraries in binary code, is critical for software security analysis. At its core, TPL detection depends on binary decomposition-the process of partitioning a monolithic binary into cohesive modules. Existing decomposition methods, whether anchor-based or clustering-based, fundamentally rely on the assumption that reused code exhibits similar function call relationships. However, this assumption is severely undermined by Function Call Graph (FCG) variations introduced by diverse compilation settings, particularly function inlining decisions that drastically alter FCG structures. In this work, we conduct the first systematic empirical study to establish the oracle for optimal binary decomposition under compilation variance. We first develop a labeling method to create precise FCG mappings on a comprehensive dataset compiled with 17 compilers, 6 optimizations, and 4 architectures; then, we identify the minimum semantic-equivalent function regions between FCG variants to derive the ground-truth decomposition. This oracle provides the first rigorous evaluation framework that quantitatively assesses decomposition algorithms under compilation variance. Using this oracle, we evaluate existing methods and expose their critical limitations: they either suffer from under-aggregation failure or over-aggregation failure. Our findings reveal that current decomposition techniques are inadequate for robust TPL detection, highlighting the urgent need for compilation-aware approaches.

With the continued advancement of Very Large-Scale Integration (VLSI) technology, IR drop in Power Delivery Networks (PDNs) poses a serious threat to chip performance and reliability. Due to the complex cross-scale interactions between local hotspots and global power paths in real-world scenarios, existing approaches face the challenges of lacking a coupled representation of multi-scale features and ignoring long-range dependencies and spatiotemporal feature fusion. This severely limits the ability of IR drop prediction approaches to capture voltage-drop hotspots, undermining the accuracy and reliability of their predictions. Therefore, this paper proposes a novel prediction framework named IR-Hunter. IR-Hunter first employs heterogeneous convolution kernels to model local electrothermal hotspots and global PDN impedance distributions, precisely capturing hotspot locations and macro-scale current-flow paths critical for chip layout and routing. Then, it adaptively fuses these multi-scale features. Additionally, IR-Hunter learns global power interactions within the PDN to identify long-range voltage coupling effects affecting routing and power-grid stability. Finally, IR-Hunter leverages cross-metal-layer current propagation pathways, efficiently integrating cross-scale spatiotemporal information between the encoder and decoder stages, consistently improving IR drop prediction accuracy during chip design. Comprehensive experiments conducted on 20,578 samples collected from over 20K instances demonstrate IR-Hunter’s superior prediction accuracy, achieving an average 4.57% NRMSE reduction and 4.12% SSIM improvement compared to state-of-the-art approaches. Additionally, to foster advancements in the EDA community, we have open-sourced the code at https://github.com/xhhlzy/IR-Hunter.

Software systems have traditionally been designed for human interaction, emphasizing graphical user interfaces, usability, and cognitive alignment with end users. However, recent advances in large language model (LLM)-based agents are changing the primary consumers of software systems. Increasingly, software is no longer only used by humans, but also invoked autonomously by AI agents through structured interfaces. In this paper, we argue that software engineering is undergoing a paradigm shift from human-oriented interfaces to agent-oriented invocation systems. We formalize the notion of agent interfaces, introduce invocable capabilities as the fundamental building blocks of AI-oriented software, and outline design principles for such systems, including machine interpretability, composability, and invocation reliability. We then discuss architectural and organizational implications of this shift, highlighting a transition from monolithic applications to capability-based systems that can be dynamically composed by AI agents. The paper aims to provide a conceptual foundation for the emerging paradigm of AI-native software design.

In software engineering, empirical studies on automated fault localization (FL) methods mainly focus on general software, and substantial progress have been made. However, the applicability and efficacy of these methods in specialized, domain-specific software like industrial software remains under-explored. Such specialized software is usually characterized by complex inputs and iterative computing paradigms, which could significantly influence the effectiveness of existing FL methods. To address this gap, this study takes a typical categorical of industrial software (i.e., computer-aided engineering (CAE) projects) as a case study, to investigate the feasibility and effectiveness of state-of-the-art FL methods within CAE projects. Through the reproduction of 76 real-world bugs from three widely used CAE projects (i.e., FDS, deal.II, and MFEM), we find that even the most precise FL methods require developers to examine on average 467.18 statements before finding bugs, and can take 208.13 hours to execute. The complex inputs and long-term computation characteristics of CAE projects further increase the difficulty of FL. Moreover, FL on CAE also faces challenges, such as insufficient differentiation of coverage information and missing CAE-specific FL features. Based on our findings, we improve FL on CAE projects by proposing a set of CAE main module based features, which improve the best-performed FL method in this study (i.e., DeepFL) by 35.93% and 45%, in terms of MAR and MFR, respectively.

Field Programmable Gate Array (FPGA) simulation tools have become indispensable in the design, simulation, and verification of Register Transfer Level (RTL) designs, serving as critical instruments in modern digital system development. As the complexity and scale of FPGA simulation tools continue to expand, the bugs root causes have become increasingly diverse, which leads to challenges in constructing comprehensive multi-dimensional bug features and locating test cases that trigger the root causes. In response to these challenges, we propose RCLoc, an innovative bug root cause localization framework for FPGA logic synthesis tools. RCLoc enhances diagnostic accuracy by leveraging a detailed analysis of multi-dimensional bug features extracted from test cases, as well as addressing feature extraction biases caused by redundant test cases. Specifically, RCLoc comprises two components: the Test-case Confidence Computation component and the Test-case Redundancy Elimination component. The TCC component integrates bug-related features, such as code coverage, code mutation, text complexity, and similarity, along with suspiciousness metrics, to generate a robust confidence matrix, i.e., the bug correlation matrix, that quantitatively evaluates the relevance of each test case to the underlying bug root causes. The TRE component uses this bug correlation matrix to systematically assess the contribution of individual test cases, identify redundant or non-informative cases, and subsequently eliminate them, thereby removing the noise and bias that redundant test cases may inadvertently introduce during the feature extraction process. Extensive experimental evaluations were carried out on 141 bugs obtained from two prominent open-source FPGA simulation tools, namely Iverilog and Verilator. The results demonstrate that RCLoc significantly outperforms state-of-the-art techniques, achieving improvements of 26.0% in Mean First Rank (MFR) and 30.3% in Mean Analysis Rank (MAR). On average, RCLoc reduces the fault localization cost by nearly 26% and 30% for FPGA engineers, highlighting its potential to substantially improve the efficiency and accuracy of bug diagnosis in complex FPGA simulation environments.

Software reuse allows existing components and third-party libraries to be incorporated into new applications, but binary-only components can obscure their origins and implementations. Software composition analysis seeks to identify these reused components and trace their provenance, supporting dependency inventory, vulnerability assessment, and security auditing. For PLC applications, binary2source matching provides a core link in this analysis: given an opaque PLC binary artifact, retrieve its corresponding Structured Text (ST) source file from a collected source repository. However, this task is complicated by cross-platform compilation heterogeneity, the representation gap between PLC binaries and ST source code, and the granularity mismatch between recovered binary units and ST source files. This paper presents PLC-Bin2Src, a cross-platform binary2source matching framework for retrieving corresponding ST source files for binaries produced by CODESYS, GEB, OpenPLC v2, and OpenPLC v3. Platform-aware frontends construct comparable representations, and a shared backend equally combines control–data flow graph (CDFG), function call graph (FCG), and recovered-symbol similarities to rank source candidates. We evaluate PLC-Bin2Src on PLC-BEAD. Results show that PLC-Bin2Src achieves 95.89

Deep learning (DL) compilers are crucial for optimizing DL models across diverse hardware platforms, ensuring their reliability is paramount. Although many techniques have been developed to test DL compilers, existing methods often suffer from efficiency issues. To resolve this problem, this study proposes MeDAC, a novel message-passing neural network-based framework for DL compiler testing acceleration. The key insight of MeDAC is to construct a learning model to accurately predict the bug-revealing probabilities of test cases (i.e., DL models), allowing the test cases with higher bug-revealing probabilities to be executed. First, to construct the learning model, three types of features for DL models are extracted. Then, we propose a novel learning model based on the message-passing neural network with an attention mechanism to accurately estimate the bug-revealing probabilities of DL models. Finally, MeDAC utilizes the learning model to predict the bug-revealing probability of each DL model, ensuring high-risk models are executed first. Experimental results on tensor virtual machine (TVM) and ONNXRuntime demonstrate that MeDAC achieves an average of 59.20% speedup in test execution time for DL compiler testing. Moreover, the peak performance improvements of MeDAC are 385.68% and 217.96% over the baseline approaches learning to test and graph convolutional network, respectively.

Accurate architecture-level power modeling is a critical enabler for early Design Space Exploration (DSE), re- quiring robust estimation under severe data scarcity and limited simulation budgets. However, due to the complexity and diversity of modern processor designs, existing methods face the challengesof capturing dynamic component coupling and achieving robust cross-scale power extrapolation. This limitation arises from a fundamental modeling gap: microarchitectural power is governed by structured, causal interactions among components, yet pre- vailing methods rely on flattened performance representations that obscure physical dependencies and entangle scale-specific statistical artifacts. To address these challenges, we propose TP- GDA, a physics-consistent, topology-driven domain adaptation framework for cross-scale microarchitecture power modeling. Specifically, TP-GDA transforms flat performance counters into a Component Dependency Graph to explicitly encode inter- component causality, thereby capturing the dynamic cascading power effects within the processor. Building upon this struc- tured representation, a topology-driven domain-invariant learn- ing mechanism distills scale-invariant features to mitigate nega- tive transfer, ensuring reliable extrapolation for physical-awarepower modeling. Comprehensive experiments are performed on200 samples covering 25 diverse configurations and 8 real-world workloads collected from two mainstream RISC-V processorarchitectures, and the results demonstrate the superior cross- scale extrapolation capability of TP-GDA, achieving 12.72% to 18.81% prediction error reduction over state-of-the-art methods. These results confirm that TP-GDA effectively establishes a physics-consistent benchmark for cross-scale power modeling with superior data efficiency and interpretability. The source code is available at https://github.com/asdj-byte/TP-GDA.

Data prefetching techniques have been widely adopted to resolve the bottleneck of access latency between processors and memory. However, existing prefetchers, while effective in hiding memory access latency, often aggressively prefetch large amounts of overpredictions into caches in advance. This behavior can result in cache pollution, bandwidth waste, and even degrade overall system performance. To resolve this issue, numerous filters have been integrated into prefetchers to eliminate overpredictions during prefetching. Nevertheless, existing mainstream filters in prefetchers typically suffer from two critical limitations. First, they lack the awareness to system performance , neglecting the overall impact of prefetch decisions on the system. Second, they exhibit insufficient adaptivity to program behaviors , making them incapable of dynamically adjusting to changes in different programs or execution stages. To overcome these limitations, we propose RELOAF, a RE inforcement L earning-based O nline A daptive F iltering framework that can be integrated into different prefetchers. Specifically, RELOAF comprises two key components: a system information feedback component and an adaptive reinforcement learning (RL) decision component. In system information feedback component, system-level feedback information, such as prefetch accuracy, coverage, and IPC, is introduced as a decision criterion to evaluate the validity of prefetching, thereby resolving the first limitation. In the adaptive RL decision component, RELOAF dynamically adjusts prefetching based on the current program state using reinforcement learning, thus handling the second limitation. Experiments validate the effectiveness of the proposed approach. Results on benchmark workloads show that augmenting state-of-the-art prefetchers with RELOAF improves their average prefetch accuracy by 3.65%–6.49% and IPC by 0.81%–1.83%, compared to the same prefetchers operating without RELOAF.

With the emergence of the needs of edge computing, there arises a demand for training and inferring deep learning (DL) models on memory-constrained devices. However, many DL models, namely computation graphs, have complex structure and plenty of parameters, incurring heavy memory consumption at runtime. Hence it is challenging but necessary to reduce their memory footprints at runtime. This paper proposes OPAss, a novel approach to perform hierarchical memory-constrained operator scheduling of machine learning models, and orchestrate optimization passes of Apache's TVM (a machine learning compilation framework) for lowering memory footprints of computation graphs, finally allowing the graphs to run on memory-constrained devices. Firstly, given a computation graph G, OPAss optimizes the graph heuristically and iteratively: OPAss learns the effects of passes on the graph; it then optimizes G iteratively - each iteration picks up a pass by the reduction of the memory footprint of G and as well the implicit effects of the pass for further optimizations, letting the pass be applied. The second core component of O-PAss is its memory computation technique, named OPAssMem, which hierarchically schedules G's operators. It constructs a hierarchical computation graph and employs an iterative scheduling algorithm to progressively reduce memory footprints. We evaluate OPAss on REBENCH (a suite of computation graphs) and two real-world models (Transformer and ResNet). The results show the strength of OPAss: it reduces up to 90.83% of graph's memory footprints, outperforming TVM's default by 2.34x. Specifically, pass orchestration and graph scheduling reduce memory footprints by up to 54.34% and 81%, respectively.

Program-level Binary Code Similarity Analysis (BCSA) aims to identify semantically similar code regions across binary programs, serving as a fundamental technique for software plagiarism detection, vulnerability search, and malware analysis. Existing approaches often decompose binaries into modules following the structure of function call graphs (FCGs) and then match these modules by their contained functions. However, function inlining changes both FCG structures and binary function semantics, making existing decomposition and module matching methods less effective. In this work, we propose N2NMatcher, an inlining-resilient framework for binary decomposition and module matching. We first conduct an empirical study to examine whether binaries still contain functions that provide stable module boundaries across compilation settings. N2NMatcher learns to predict such functions as anchors using a hierarchical graph neural network that encodes binary ACFG-FCG representations built from opcode sequences, control-flow structures, and FCG calling context. It then performs anchor-bounded decomposition and matches the generated modules using learned module graph embeddings. Experimental results show that N2NMatcher improves both the decomposition quality and module matching accuracy compared to existing works, enabling more effective program-level BCSA.

FPGA interactive debugger tools assist engineers in quickly detecting and correcting bugs in RTL designs through powerful built-in interactive debugging tools. The interactive debugging process ensures the accuracy and development efficiency of RTL designs. Rigorous testing of such FPGA interactive debugging tools is crucial, as engineers may misinterpret RTL designs and introduce incorrect fixes due to bugs in FPGA interactive debugging tools, leading to security risks. In this study, we propose a novel differential testing method called ID-Hunter, which is the first study to leverage the mutation diversification search guided via the Multi-Armed Bandit (MAB) for generating RTL designs to test FPGA interactive debugging tools. ID-Hunter consists of three components: the mutation rule component, the interactive mutation optimization component, and the differential testing component. The mutation rule component designs two types of mutation rules (i.e. program transformation and interactive debugger action transformation) to generate equivalent RTL designs during interactive debugging. Then, the combined mutation optimization component conducts mutation diversification search via MAB for guiding the construction of effective RTL designs based on the memoization for the explored mutation rules during the on-the-fly interactive debugging process. ID-Hunter then detects bugs by analyzing the outputs of these RTL designs by the differential testing component. Specifically, ID-Hunter considers the diversity among mutation rules to efficiently explore the input space and the testing results under each explored mutation rules to learn which portions of space are more bug-triggering. Within three months, ID-Hunter reported 15 bug issues, 10 of which were confirmed by Xilinx support as bugs, with 3 of them were fixed.

Field-programmable gate array (FPGA) logic synthesis compilers are widely used in electronic design automation to translate hardware description language (HDL) code into gate-level netlists through transformation passes, which support downstream optimization and implementation. Engineers often adjust the combination and sequence of synthesis passes to improve timing and resources, but this flexibility can also trigger sequence-dependent defects that lead to incorrect netlists or functional failures. Although recent methods employ randomly generated HDL test cases to detect faults, they rely on fixed and predefined pass sequences and therefore cannot systematically explore the legal combinatorial space of pass orderings, where many sequence-dependent faults arise. Transformation Recipe-based FPGA Synthesis compiler Testing (TReST) introduces a dependence-aware exploration mechanism by constructing a staged pass dependence graph (PDG) that encodes execution order and precedence constraints among transformation passes, enabling systematic and legal exploration of pass sequences. Guided by the PDG, it applies Monte Carlo tree search to efficiently generate diverse and valid pass combinations and employs differential testing to detect potential synthesis faults by comparing outputs across sequences. Experiments on commercial and open-source compilers, including Vivado, Yosys, and Iverilog, show that TReST substantially improves fault detection. Within three months, it discovered 21 unique faults, 17 of which were confirmed and patched by developers.

As FPGA design complexity increases, the correctness and reliability of logic synthesis tools are critical to ensuring correct hardware implementation. These tools translate hardware description languages (e.g., Verilog) into gate-level netlists, where latent faults may introduce functional errors or performance degradation during synthesis. Existing approaches rely on automatically generated Verilog test cases to find these latent faults. However, their effectiveness depends heavily on generator configurations and is typically guided by input diversity, which fails to accurately capture differences in synthesis behavior. Moreover, the high-dimensional configuration space of generator further hinders efficient exploration. To address these challenges, we propose SynaSpace, a behavior-driven configuration optimization framework for fault detection in logic synthesis tools. SynaSpace focuses on synthesis behavior coverage to guide configuration search, by constructing behavioral representations through joint analysis of synthesis logs and gate-level netlists. The framework comprises four components: (1) configuration space modeling for unified parameter representation; (2) Bayesian optimization–based configuration search for efficient exploration; (3) synthesis behavior characterization and coverage evaluation for capturing and quantifying behavioral differences; and (4) fault detection and utility modeling for extracting effective feedback via differential testing and deduplication. These components are integrated into a unified optimization framework to enable efficient configuration exploration and improved testing effectiveness. We evaluate SynaSpace on two established logic synthesis tools (i.e., Vivado and Yosys). SynaSpace identifies 18 faults across four categories, all of which have been confirmed and fixed by vendors and the open-source community.

Timing optimization during global placement is critical for achieving optimal circuit performance and remains a key challenge in modern Field Programmable Gate Array (FPGA) design. As FPGA designs scale and heterogeneous resources increase, dense interconnects introduce significant resistive and capacitive effects, making timing closure increasingly difficult. Existing methods face challenges in constructing accurate timing models due to multi-factor nonlinear constraints as well as load and crosstalk coupling effects arising in multi-pin driving scenarios. To address these challenges, we propose TD-Placer, a critical path aware, timing-driven global placement framework. It leverages graph-based representations to capture global net interactions and employs a nonlinear model to integrate diverse timing-related features for precise delay prediction, thereby improving the overall placement quality for FPGAs. TD-Placer adopts a quadratic placement objective that minimizes wirelength while incorporating a timing term constructed by a lightweight algorithm, enabling efficient and high-quality timing optimization. Regarding net-level timing contention, it also employs a finer-grained weighting scheme to facilitate smooth reduction of the Critical Path Delay (CPD). Extensive experiments were carried out on seven real-world open-source FPGA projects with LUT counts ranging from 60K to 400K. The results demonstrate that TD-Placer achieves an average 10

Large language models (LLMs) have shown great promise for automated code translation, yet existing approaches often rely on token-level statistical patterns rather than sufficient understanding of program semantics. As a result, translated programs may still contain logical and semantic errors. Although high-quality semantic guidance, such as functional descriptions and test cases, can help mitigate these errors, such resources are often unavailable in real-world scenarios. This raises two key challenges: how to construct rich semantic information directly from source code, and how to ensure that such semantics are accurate and reliable enough to guide translation.To address these challenges, we propose Multisage, a multi-semantic augmentation and self-calibration framework for LLM-based code translation. Multisage consists of three modules. First, a semantic representation parsing module extracts structured base semantics from source code, including data-flow graphs, type constraints, and external API information. Second, a multi-semantic augmentation module builds on these representations to generate diverse augmented semantics, including code summaries, function-level test cases, and API-oriented descriptions and tests. Third, a semantic consistency calibration module uses semantics-preserving mutations and cross-semantic consistency verification to filter, calibrate, and refine the generated semantics.Experiments on the HumanEval-X code translation benchmark show that Multisage improves translation success rates by up to 2.22 times across diverse backbone models. It consistently outperforms vanilla prompting, instruction-tuned LLMs, and Chain-of-Thought reasoning, with the largest gains observed on smaller models. These results demonstrate that explicit semantic augmentation can substantially improve the reliability of LLM-based code translation.

Computer-aided engineering (CAE) tools are extensively used in safety-critical domains like aerospace design to simulate real-world physical processes on computers at reduced costs. However, CAE tools are prone to bugs, leading to incorrect simulation and serious design flaws. Existing testing methods have limited success in finding these bugs, since constructing test cases for CAE tools (known as CAE inputs) is challenging, due to the complexity of input parameter constraints and the differences of input syntax for each tool. Therefore, we propose NSGen, a template-based Numerical Simulation test case GENerator for effective CAE input generation. To bridge input differences, NSGen designs general syntax rules that ignore semantic details of CAE inputs but retaining the format and validity of these inputs for different CAE tools. NSGen then designs semantic rules to define the parameters and their intricate constraints (i.e., dependency, exclusion, and extension). By instantiating these rules as templates, valid CAE inputs are generated using a syntax parser implemented by NSGen. Experiments show that NSGen can effectively generate CAE inputs with less than 0.33 second on average, triggering 6.28 to 10.55 times more potential issues than the baseline. Using these inputs, NSGen finds 12 bugs in popular CAE tools, including crash bugs and instability bugs.