# Detecting Architectural Drift in Safety-Critical Firmware through Runtime Trace Analysis

arXiv: https://arxiv.org/abs/2607.03135 · HTML: https://mlsanity.com/paper/2607.03135/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 54 references that are in the map.
- First posted on arXiv 3 Jul 2026.

## Builds on (most cited first, 5 of 5)

- [When LLMs Meet API Documentation: Can Retrieval Augmentation Aid Code Generation Just as It Helps Developers?](https://mlsanity.com/paper/2503.15231/) (2025)
- [Towards Effectively Leveraging Execution Traces for Program Repair with Code LLMs](https://mlsanity.com/paper/2505.04441/) (2025)
- [From Guessing to Seeing: Enhancing LLM-Based Program Repair via Trace-Guided Multi-strategy Debate](https://mlsanity.com/paper/2604.02647/) (2026)
- [Generating Software Architecture Description from Source Code using Reverse Engineering and Large Language Model](https://mlsanity.com/paper/2511.05165/) (2025)
- [Understanding Software Architecture Erosion: A Systematic Mapping Study](https://mlsanity.com/paper/2112.10934/) (2021)

## Abstract (arXiv)

Maintaining consistency between architectural design and runtime-observed behavior is challenging in long-lived safety-critical firmware. This paper presents a runtime-informed methodology for detecting architectural drift in ISO 26262-compliant firmware. The approach collects hardware-assisted execution traces, abstracts them into message exchanges among firmware components, and compares the resulting runtime behavior with design-time sequence diagrams through a deterministic differencing step. The computed delta identifies discrepancies as confirmed, missing, additional, or inverted, while a constrained LLM-based step generates a human-readable report only to support expert review. We evaluate the methodology in an industrial firmware context through agreement-based validation and a practitioner survey. Results over 26 test cases show strong agreement between the generated deltas and expert-curated references, while practitioners perceive the reports as useful for interpreting drift, reducing manual analysis effort, and supporting safety-oriented documentation activities. The findings suggest that combining runtime trace analysis, deterministic architectural differencing, and constrained LLM-based reporting can practically support architectural drift detection in evolving safety-critical firmware.