Detecting Architectural Drift in Safety-Critical Firmware through Runtime Trace Analysis
This work addresses the challenge of detecting architectural drift—discrepancies between design-time architecture and runtime behavior—in long-lived embedded firmware. The authors propose a practical, hardware-assisted detection approach that captures runtime execution traces, abstracts them into inter-component message interaction sequences, and performs deterministic comparison against design-phase UML sequence diagrams to precisely identify confirmed, missing, extraneous, or inverted behavioral deviations. To facilitate expert review, the method further leverages a constrained large language model to generate human-readable explanatory reports. Integrating runtime trace analysis, deterministic architectural conformance checking, and constraint-guided LLM-based explanation generation for the first time, the approach demonstrates high agreement with expert annotations across 26 industrial cases, substantially reducing manual analysis effort while effectively supporting ISO 26262 safety documentation requirements.