arxiv: 2603.02583 · v2 · submitted 2026-03-03 · 💻 cs.AR

Recognition: no theorem link

Pecker: Bug Localization Framework for Sequential Designs via Causal Chain Reconstruction

Jiaping Tang , Jianan Mu , Tianyun Ma , Zhiteng Chao , Jing Ye , Huawei Li

Authors on Pith no claims yet

Pith reviewed 2026-05-15 17:16 UTC · model grok-4.3

classification 💻 cs.AR

keywords bug localizationsequential designshardware debuggingcausal chain reconstructiontemporal backtrackingtrace pruningspectrum-based localization

0 comments

The pith

Pecker reconstructs causal chains in sequential hardware designs using minimal propagation cycles and trace pruning to localize bugs more accurately than prior methods.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper seeks to overcome the failure of spectrum-based bug localization in sequential hardware designs, where timing misalignment between bug activation and observation plus progressive error propagation through state elements hides the root cause. It proposes Pecker, which performs temporal backtracking via Estimated Minimal Propagation Cycles to recover activation points and applies strategic trace pruning to remove state pollution while preserving the true cause. A sympathetic reader would care because hardware debugging consumes substantial design effort, and improved localization ranks could shorten verification cycles for complex temporal circuits. Experiments on mixed combinational and sequential benchmarks show the method places 51 percent of bugs in the top-1 rank, 80 percent in top-3, and 85 percent in top-5 while holding performance as circuit size grows.

Core claim

Pecker addresses the challenges of bug localization in sequential designs by reconstructing the broken causal chain. It employs temporal backtracking based on Estimated Minimal Propagation Cycles to identify potential bug activation cycles and applies strategic trace pruning to eliminate the effects of state pollution. Evaluation on comprehensive benchmarks demonstrates localization of 51% of bugs in the top-1 rank, 80% in top-3, and 85% in top-5, with robust performance across circuit complexities unlike prior techniques.

What carries the argument

Temporal backtracking driven by Estimated Minimal Propagation Cycles together with strategic trace pruning to restore the causal chain and isolate the root cause from state-element pollution.

If this is right

Spectrum-based localization becomes viable for sequential hardware designs where it previously degraded sharply.
Localization accuracy stays consistent rather than declining as the number of state elements and propagation depth increase.
The same two-step reconstruction process outperforms existing techniques on both combinational and sequential test cases.
Debugging effort in hardware design flows can be reduced by focusing inspection on the top-ranked candidates returned by the reconstructed traces.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Similar causal-chain reconstruction might transfer to debugging software systems that contain long state machines or event queues.
The approach underscores that fault diagnosis in any system with delayed propagation benefits from explicit recovery of activation timing before pruning.
Integration with existing simulation tools could generate targeted stimuli that exercise the minimal propagation cycles to expose hidden bugs earlier.

Load-bearing premise

The estimated minimal propagation cycles correctly flag activation cycles and pruning removes only polluted state without discarding the true root cause.

What would settle it

On a sequential benchmark with known injected bugs, if Pecker's top-5 localization rate falls below that of spectrum-based baselines or misses the injected root cause after pruning, the central reconstruction claim would be falsified.

Figures

Figures reproduced from arXiv: 2603.02583 by Huawei Li, Jianan Mu, Jiaping Tang, Jing Ye, Tianyun Ma, Zhiteng Chao.

**Figure 1.** Figure 1: (a): Bug localization accuracy of Tarsel [20] and Detaque [10] on combinational and sequential circuits; (b): A HDL code snippet along with its execution trace and statues under specified inputs, where the buggy line (line 6) is highlighted in red, and the corresponding correct line is highlighted in green; (c): A program dependency graph corresponding to (b) and the bug activates at cycle 1, propagates… view at source ↗

**Figure 2.** Figure 2: The overall workflow of SBFL. 2.1 Bug Localization in the Software Domain In the software domain, numerous effective approaches have been developed to automate bug localization [19]. Spectrum-based fault localization (SBFL) is a more powerful and popular technique for precisely localizing bugs [3, 14, 16, 19]. The workflow of SBFL is shown in [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** Figure 3: Motivating Example. shown in [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

**Figure 4.** Figure 4: The framework of Pecker. Algorithm 1: Program Dependency Graph Input: HDL design code Output: Program dependency graph of the HDL 1 AST ← parse HDL into an abstract syntax tree; 2 PDG ← an empty graph; 3 for each node in AST do 4 if node is a control statement then 5 PDG.addControlEdge(node.parent, node) 6 for each node in PDG do 7 lhs ← left-hand side of node.statement; 8 rhs ← right-hand side of node.sta… view at source ↗

**Figure 5.** Figure 5: Match and mismatch ratio between estimated and true activation cycles. 51 39 32 80 63 53 85 66 68 0 20 40 60 80 1 00 A c c u r a c y ( % ) TOP-1 TOP-3 TOP-5 Full Half No [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗

**Figure 6.** Figure 6: Bug localization accuracy under Full, Half and No trace truncation. 5.3.3 Analysis of Trace. To further examine the impact of noisy traces on localization accuracy, we design three levels of trace truncation: full truncation, half truncation, and no truncation. Full truncation yields a noise-free trace, while no truncation produces the highest noise level. As shown in [PITH_FULL_IMAGE:figures/full_fig_p00… view at source ↗

read the original abstract

Debugging represents a time-consuming and labor-intensive task in hardware design, with bug localization constituting a substantial portion of this process. While spectrum-based bug localization techniques have achieved remarkable success in software domains and shown promise for hardware description languages, their effectiveness severely degrades in sequential designs. Unlike software programs, hardware designs exhibit intrinsic temporal characteristics that create fundamental challenges: timing misalignment between bug activation and observation, and progressive error propagation through state elements that obscures the root cause. To address these limitations, we propose Pecker, a novel bug localization framework that reconstructs the broken causal chain in sequential designs. Our approach introduces two key innovations: temporal backtracking using Estimated Minimal Propagation Cycles to identify potential activation cycles, strategic trace pruning to eliminate state pollution effects. We evaluate Pecker on comprehensive benchmarks comprising both combinational and sequential circuits. Experimental results demonstrate that Pecker effectively localizes 51%/80%/85% bugs within Top-1/3/5 ranks respectively, significantly outperforming state-of-the-art techniques. Notably, Pecker maintains robust performance across circuit complexities while existing methods exhibit severe degradation on sequential designs.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

Pecker adds temporal backtracking via estimated propagation cycles and trace pruning to handle sequential hardware bugs, but the evaluation details are too thin to confirm the reported gains.

read the letter

The punchline is that Pecker targets the timing and state propagation problems that break spectrum-based bug localization in sequential designs. It does this with Estimated Minimal Propagation Cycles for backtracking to activation points plus strategic pruning to cut state pollution, and the abstract claims this yields 51/80/85 percent top-1/3/5 localization while holding up better than priors on sequential cases. That combination is the actual novelty here, since prior work is noted to degrade once timing misalignment and error spread through registers enter the picture. The framing of the hardware-specific challenges is clear and the proposed fixes follow logically from them. The reported numbers suggest the method could be useful in practice if they generalize. The soft spots are in the evidence. The abstract supplies only aggregate rates with no benchmark list, no description of how baselines were implemented, no per-circuit breakdown, and no statistical tests or error analysis. This leaves open whether the outperformance is consistent or depends on particular choices. The EMPC heuristic itself is presented without a closed-form derivation, proof of minimality under feedback or resets, or sensitivity checks, so a one-cycle misestimate could remove the root-cause signal during pruning and directly undercut the top-k figures. The stress-test note on this point holds up based on the given description. This paper is for researchers and tool builders in hardware verification and EDA who deal with debug time on sequential circuits. A reader in that group could take the backtracking and pruning ideas as a starting point even if the current results need more grounding. It deserves peer review so the authors can add the missing experimental details and test the heuristic more rigorously.

Referee Report

3 major / 2 minor

Summary. The manuscript presents Pecker, a bug localization framework for sequential hardware designs. It addresses limitations of spectrum-based techniques by using temporal backtracking via Estimated Minimal Propagation Cycles (EMPC) to identify activation cycles and strategic trace pruning to eliminate state pollution effects. The paper claims that on comprehensive benchmarks of combinational and sequential circuits, Pecker localizes 51%/80%/85% of bugs within top-1/3/5 ranks and significantly outperforms state-of-the-art methods.

Significance. If the core heuristics are validated, Pecker could meaningfully improve debugging productivity for sequential hardware where existing spectrum-based methods degrade due to timing misalignment and error propagation through state. The two innovations (EMPC-based backtracking and pruning) directly target the temporal challenges highlighted in the abstract. However, the absence of benchmark details, statistical validation, and sensitivity analysis on the central EMPC assumption currently limits the assessed significance.

major comments (3)

[§3.2] §3.2: EMPC is defined as the shortest cycle distance from bug site to observable output under a simplified propagation model, yet the manuscript supplies no closed-form derivation, no proof of minimality under feedback loops or asynchronous resets, and no sensitivity study when multiple state elements interact. This is load-bearing because the headline 51/80/85 % top-k figures rest on EMPC correctly identifying the activation window; a one-cycle error can cause the subsequent pruning step to excise the root-cause signal.
[Experimental evaluation] Experimental evaluation (abstract and §4): aggregate performance numbers are reported without benchmark circuit details, baseline implementations, statistical significance tests, or error analysis. Without these, it is impossible to determine whether the claimed superiority over SOTA reflects genuine improvement or post-hoc selection on the chosen sequential designs.
[§3.3] §3.3: Strategic trace pruning is presented as removing state pollution without discarding the true root cause, but no experiment or argument demonstrates that this holds when EMPC under- or over-estimates the activation cycle in realistic sequential designs with interacting state elements. This assumption directly affects the reliability of the reported localization rates.

minor comments (2)

[Abstract] The abstract refers to 'comprehensive benchmarks comprising both combinational and sequential circuits' but provides no concrete list or characteristics; this information should appear in the evaluation section with at least a summary table.
[§3.2] Notation for EMPC and related quantities should be introduced with a clear equation or definition box on first use to improve readability for readers unfamiliar with the propagation model.

Simulated Author's Rebuttal

3 responses · 1 unresolved

We thank the referee for the constructive and detailed feedback. We have revised the manuscript to strengthen the justification of EMPC, expand the experimental section with required details and tests, and add robustness experiments for the pruning step. Point-by-point responses follow.

read point-by-point responses

Referee: [§3.2] §3.2: EMPC is defined as the shortest cycle distance from bug site to observable output under a simplified propagation model, yet the manuscript supplies no closed-form derivation, no proof of minimality under feedback loops or asynchronous resets, and no sensitivity study when multiple state elements interact. This is load-bearing because the headline 51/80/85 % top-k figures rest on EMPC correctly identifying the activation window; a one-cycle error can cause the subsequent pruning step to excise the root-cause signal.

Authors: We agree a more formal treatment is needed. The revised manuscript adds a derivation of EMPC from the unit-delay propagation model in §3.2, showing it computes a conservative lower bound on activation cycles. A complete proof of minimality across arbitrary feedback and asynchronous resets is intractable (equivalent to full state reachability), but we include concrete examples and a new sensitivity study in §4 demonstrating that localization rates stay above 75% for ±2-cycle perturbations. revision: partial
Referee: [Experimental evaluation] Experimental evaluation (abstract and §4): aggregate performance numbers are reported without benchmark circuit details, baseline implementations, statistical significance tests, or error analysis. Without these, it is impossible to determine whether the claimed superiority over SOTA reflects genuine improvement or post-hoc selection on the chosen sequential designs.

Authors: We accept this criticism. The revised §4 now lists all benchmark circuits with gate counts, sequential depths, and sources; provides implementation details and references for the SOTA baselines; reports Wilcoxon signed-rank and paired t-tests (all p < 0.05); and adds an error-analysis subsection discussing the 15% of cases where Pecker ranks the bug outside top-5. revision: yes
Referee: [§3.3] §3.3: Strategic trace pruning is presented as removing state pollution without discarding the true root cause, but no experiment or argument demonstrates that this holds when EMPC under- or over-estimates the activation cycle in realistic sequential designs with interacting state elements. This assumption directly affects the reliability of the reported localization rates.

Authors: We have added targeted experiments in the revision that deliberately shift the EMPC window by ±1 to ±3 cycles on multi-state sequential benchmarks. Results show the root cause is retained in 87% of cases because EMPC is intentionally conservative (under-estimates) and pruning only removes post-window activity. A supporting argument is now included in §3.3 explaining why the true activation cycle always lies inside the estimated interval under the model. revision: yes

standing simulated objections not resolved

A complete mathematical proof of EMPC minimality for arbitrary feedback loops and asynchronous reset scenarios

Circularity Check

0 steps flagged

No circularity: heuristics and experimental evaluation are independent of fitted inputs

full rationale

The paper introduces Pecker via two domain heuristics—temporal backtracking with Estimated Minimal Propagation Cycles (EMPC) and strategic trace pruning—then reports top-k localization rates on external benchmarks. No equation or definition reduces the reported performance to a parameter fitted on the same data; EMPC is presented as a shortest-path estimate under a simplified model without self-referential closure. No self-citation chain, uniqueness theorem, or ansatz smuggling appears in the derivation. The central claims rest on empirical comparison to prior techniques rather than internal re-labeling of inputs, satisfying the self-contained criterion.

Axiom & Free-Parameter Ledger

1 free parameters · 2 axioms · 0 invented entities

The framework rests on domain assumptions about temporal behavior in sequential circuits and introduces the Estimated Minimal Propagation Cycles concept, which may embed implicit parameters or heuristics not detailed in the abstract.

free parameters (1)

Estimated Minimal Propagation Cycles
Central estimation step whose exact computation or tuning is not specified in the abstract and may involve circuit-dependent choices.

axioms (2)

domain assumption Sequential designs exhibit timing misalignment between bug activation and observation.
Explicitly stated as a fundamental challenge in the abstract.
domain assumption Progressive error propagation through state elements obscures the root cause.
Presented as an intrinsic temporal characteristic creating challenges for localization.

pith-pipeline@v0.9.0 · 5502 in / 1255 out tokens · 48435 ms · 2026-05-15T17:16:21.681530+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

24 extracted references · 24 canonical work pages · 1 internal anchor

[1]

van Gemund

Rui Abreu, Peter Zoeteweij, and Arjan J.C. van Gemund. 2007. On the Accuracy of Spectrum-based Fault Localization. InTesting: Academic and Industrial Conference Practice and Research Techniques - MUTATION (TAICPART-MUTATION 2007). 89–

work page 2007
[2]

doi:10.1109/TAIC.PART.2007.13

work page doi:10.1109/taic.part.2007.13 2007
[3]

Hammad Ahmad, Yu Huang, and Westley Weimer. 2022. CirFix: Automatically Repairing Defects in Hardware Design Code. InProceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’22). Association for Computing Machinery, New York, NY, USA, 990–1003. doi:10.1145/3503222.3507763

work page doi:10.1145/3503222.3507763 2022
[4]

Spectrum-based Software Fault Localization: A Survey of Techniques, Advances, and Challenges

Higor A. de Souza, Marcos L. Chaim, and Fabio Kon. 2017. Spectrum-based Software Fault Localization: A Survey of Techniques, Advances, and Challenges. arXiv:1607.04347 [cs.SE]https://arxiv.org/abs/1607.04347

work page internal anchor Pith review Pith/arXiv arXiv 2017
[5]

Fung, Ahmad-Reza Sadeghi, and Jeyavijayan Rajen- dran

Ghada Dessouky, David Gens, Patrick Haney, Garrett Persyn, Arun Kanuparthi, Hareesh Khattri, Jason M. Fung, Ahmad-Reza Sadeghi, and Jeyavijayan Rajen- dran. 2019. HardFails: Insights into Software-Exploitable Hardware Bugs. In Proceedings of the 28th USENIX Security Symposium (SEC’19). USENIX Associa- tion, USA, 213–230

work page 2019
[6]

Ottenstein, and Joe D

Jeanne Ferrante, Karl J. Ottenstein, and Joe D. Warren. 1987. The program dependence graph and its use in optimization. 9, 3 (July 1987), 319–349. doi:10. 1145/24039.24041

work page arXiv 1987
[7]

H. Foster. 2025. 2024 Siemens EDA & Wilson Research Group IC/ASIC Functional Verification Trend Report. Siemens EDA (Wilson Research Group). Accessed Feb. 17, 2025

work page 2025
[8]

H. D. Foster. 2015. Trends in Functional Verification: A 2014 Industry Study. In Proceedings of the 52nd ACM/EDAC/IEEE Design Automation Conference (DAC). San Francisco, CA, USA, 1–6. doi:10.1145/2744769.2744921

work page doi:10.1145/2744769.2744921 2015
[9]

Heidari and B

M. Heidari and B. Alizadeh. 2025. Localizing Multiple Bugs in RTL Designs by Classifying Hit-Statements Using Neural Networks.IEEE Trans. Comput.74, 5 (May 2025), 1786–1799. doi:10.1109/TC.2025.3543609

work page doi:10.1109/tc.2025.3543609 2025
[10]

Jian Hu and Zhenlei Liu. 2025. Context-Aware Data Augmentation for Hardware Code Fault Localization.ACM Transactions on Design Automation of Electronic Systems30, 3, Article 46 (May 2025), 20 pages. doi:10.1145/3725889

work page doi:10.1145/3725889 2025
[11]

Jian Hu and Zhenlei Liu. 2025. Context Aware Deep Learning-Based Fault Localization for Hardware Design Code.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems44, 9 (Sept. 2025), 3617–3628. doi:10. 1109/TCAD.2025.3543426

work page arXiv 2025
[12]

Jones, M.J

J.A. Jones, M.J. Harrold, and J. Stasko. 2002. Visualization of test information to assist fault localization. InProceedings of the 24th International Conference on Software Engineering. ICSE 2002. 467–477. doi:10.1145/581396.581397

work page doi:10.1145/581396.581397 2002
[13]

Pavneet Singh Kochhar, Xin Xia, David Lo, and Shanping Li. 2016. Practition- ers’ expectations on automated fault localization. InProceedings of the 25th International Symposium on Software Testing and Analysis(Saarbrücken, Ger- many)(ISSTA 2016). Association for Computing Machinery, New York, NY, USA, 165–176. doi:10.1145/2931037.2931051

work page doi:10.1145/2931037.2931051 2016
[14]

Xia Li and Lingming Zhang. 2017. Transforming programs and tests in tandem for fault localization.Proc. ACM Program. Lang.1, OOPSLA, Article 92 (Oct. 2017), 30 pages. doi:10.1145/3133916

work page doi:10.1145/3133916 2017
[15]

Yi Li, Shaohua Wang, and Tien N. Nguyen. 2021. Fault Localization with Code Coverage Representation Learning. InProceedings of the 43rd International Con- ference on Software Engineering(Madrid, Spain)(ICSE ’21). IEEE Press, 661–673. doi:10.1109/ICSE43902.2021.00067

work page doi:10.1109/icse43902.2021.00067 2021
[16]

Ruiyang Ma, Daikang Kuang, Ziqian Liu, Jiaxi Zhang, Ping Fan, and Guojie Luo

work page
[17]

InProceedings of the 44th ACM/IEEE International Conference on Computer-Aided Design (ICCAD ’25)

Wit-HW: Bug Localization in Hardware Design Code via Witness Test Case Generation. InProceedings of the 44th ACM/IEEE International Conference on Computer-Aided Design (ICCAD ’25). Association for Computing Machinery, Munich, Germany, 1–9

work page
[18]

Ernst, Deric Pang, and Benjamin Keller

Spencer Pearson, José Campos, René Just, Gordon Fraser, Rui Abreu, Michael D. Ernst, Deric Pang, and Benjamin Keller. 2017. Evaluating and Improving Fault Localization. In2017 IEEE/ACM 39th International Conference on Software Engi- neering (ICSE). 609–620. doi:10.1109/ICSE.2017.62

work page doi:10.1109/icse.2017.62 2017
[19]

2021.FLACOCO: Fault Localization for Java based on Industry-grade Coverage

André Silva, Matias Martinez, Benjamin Danglot, Davide Ginelli, and Martin Monperrus. 2021.FLACOCO: Fault Localization for Java based on Industry-grade Coverage. Technical Report 2111.12513. arXiv.http://arxiv.org/pdf/2111.12513

work page arXiv 2021
[20]

Shinya Takamaeda-Yamazaki. 2015. Pyverilog: A Python-Based Hardware Design Processing Toolkit for Verilog HDL. InProceedings of the 20th Asia and South Pacific Design Automation Conference (ASP-DAC ’15). IEEE, Chiba, Japan, 330–335. doi:10.1109/ASPDAC.2015.7059025

work page doi:10.1109/aspdac.2015.7059025 2015
[21]

Eric Wong, Ruizhi Gao, Yihao Li, Rui Abreu, and Franz Wotawa

W. Eric Wong, Ruizhi Gao, Yihao Li, Rui Abreu, and Franz Wotawa. 2016. A Survey on Software Fault Localization.IEEE Transactions on Software Engineering 42, 8 (2016), 707–740. doi:10.1109/TSE.2016.2521368

work page doi:10.1109/tse.2016.2521368 2016
[22]

Jiang Wu et al. 2022. Fault Localization for Hardware Design Code with Time- Aware Program Spectrum. In2022 IEEE 40th International Conference on Computer Design (ICCD). Olympic Valley, CA, USA, 537–544. doi:10.1109/ICCD56317.2022. 00085

work page doi:10.1109/iccd56317.2022 2022
[23]

Jiang Wu, Zhuo Zhang, Deheng Yang, Jianjun Xu, Jiayu He, and Xiaoguang Mao

work page
[24]

2024), 25 pages

Time-Aware Spectrum-Based Bug Localization for Hardware Design Code with Data Purification.ACM Transactions on Architecture and Code Optimization 21, 3, Article 64 (Sept. 2024), 25 pages. doi:10.1145/3678009 7

work page doi:10.1145/3678009 2024