An LLM-Orchestrated Neuro-Symbolic Framework for Verifying Diagnostic Signal Reachability in Electronic Systems

1

An LLM-Orchestrated Neuro-Symbolic Framework for Verifying Diagnostic Signal Reachability in Electronic Systems

arXiv:2611.07040v1 [cs.SE] 4 Nov 2026

Heba Jaradat

, Mohammed-Khalil Ghali

, Saurabh Kulkarni

Abstract—Diagnostic Signal Reachability (DSR) captures whether board-level health signals are observable by management controllers, including baseboard management controllers (BMCs), complex programmable logic devices (CPLDs), and other smart controllers. Verifying DSR is essential for field diagnosability in datacenter fleets, where one design is deployed at very large scale, yet it remains largely manual, since each signal is traced by hand across schematic sheets, renamed nets, series components, and monitoring devices. Large language models (LLMs) are attractive but unreliable at structural connectivity reasoning, especially for renamed or indirectly observed signals, where over-claiming can silently hide a rare coverage gap. We present NetFlow-DSR, a neuro-symbolic framework in which an LLM orchestrates the end-to-end DSR pipeline and resolves device roles mainly from part-name families and library pin names, consulting device specifications only for the few parts that remain ambiguous. Pin directionality is read directly from the design library, and deterministic graph engines verify connectivity over the authoritative netlist. The pipeline detects diagnostic nets, canonicalizes renamed net fragments, and performs controllerseeded, power-aware breadth-first search over an admissibility graph that credits device-mediated monitoring. Each verdict carries an auditable per-signal trace card whose proof path is the witness. Across five production boards from an AI platform, covering 421 expert-graded in-scope signals, a three-stage ablation improves pooled F1 from 0.578 to 0.944. Because a monitored verdict is emitted only with such a proof path, the verifier is sound by construction, and precision and specificity were 100% in the evaluated data. In a cross-model reproducibility study on the system-controller module, precision remained 100% across three LLMs while recall tracked each model’s device-semantic extraction. Precision therefore depends on the netlist-grounded verifier and correct device semantics rather than on any single LLM. Index Terms—Diagnostic coverage, Diagnostic signal reachability, Electronic design automation, Generative AI, Hardware verification, Large language models, Netlist analysis, Neurosymbolic verification.

I. I NTRODUCTION

M

ODERN AI hardware servers and datacenter platforms expose hundreds of diagnostic signals, including power-good, presence, reset, interrupt, alert, I2C, and ADC (Corresponding author: Sangwon Yoon.) Heba Jaradat, Mohammed-Khalil Ghali, and Sangwon Yoon are with the School of Systems Science and Industrial Engineering, Binghamton University, State University of New York, Binghamton, NY 13902 USA (e-mail: hjaradat@binghamton.edu; mghali1@binghamton.edu; yoons@binghamton.edu). Saurabh Kulkarni and Rohan Kulkarni are with Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025 USA (e-mail: saurabhkulkarni@meta.com; irohan@meta.com).

, Rohan Kulkarni

, and Sangwon Yoon

telemetry nets. Fault detection and field recovery depend on these signals being observable by a management controller, typically a BMC or CPLD. If a diagnostic signal is not observable by the management path, the associated failure mode may remain invisible, increasing no-fault-found returns, service time, and system downtime. The cost is highest at datacenter scale. A hyperscale fleet deploys the same board design in very large numbers, so a single unobservable signal in one design is copied into every deployed unit. In large AI training clusters, one failing node can interrupt a job that spans thousands of accelerators, and fast fault isolation depends on the management path seeing the failure. A coverage gap found after deployment can require a board respin or a fleet-wide workaround, whereas the same gap found during design review costs only a design change. DSR is therefore a serviceability-critical signoff activity, typically performed during pre-production design validation. Before deployment, engineers confirm that faults on power rails, devices, connectors, and telemetry paths can be observed by management firmware. In current practice, however, DSR is verified manually, by first identifying the diagnostic signals and then tracing each one across schematic sheets and through intermediate components. This process is slow. For complex modules such as motherboards (MBs) and accelerators, reporting the diagnostic signals and then verifying each one across the schematics can require several weeks per board. It is also difficult to audit and increasingly errorprone as board complexity grows. The central challenge is to detect the in-scope diagnostic signals and verify, exhaustively and reproducibly, whether each one reaches an appropriate management controller. What makes this verification difficult is that the electrical evidence for a single signal is rarely local to one net or one schematic sheet. A physical signal is frequently split into several differently named fragments as it crosses a series resistor, ferrite bead, or zero-ohm link, so the fragment a controller actually touches may carry a different name from the one an engineer happens to inspect. Observability is also frequently indirect. A rail or pin may never connect electrically to a controller yet still be observed by a power monitor, an analog-to-digital converter, a temperature sensor, or a GPIO expander that relays the measurement or pin state to firmware over I2C. Legitimate paths further pass through devices such as I2C multiplexers, bus buffers and repeaters, and level translators, whereas high-fan-out power rails and grounds are better treated as barriers, because tracing through them would make almost every signal appear connected to every

2

controller. A reviewer therefore has to hold signal identity, admissible device hops, and rail exclusion in mind at once while following each signal across many sheets, a cognitive burden that scales poorly as board complexity grows. The two possible mistakes are, moreover, not equally costly. Reporting a genuinely unobservable signal as monitored silently removes a real coverage gap from the review set and lets a fault path escape scrutiny, whereas the opposite error merely returns an already-covered signal to a bounded, self-correcting review. Two requirements therefore follow for an automated verifier. It should be deliberately biased against over-claiming and make every positive verdict auditable rather than merely plausible. These two requirements give a useful basis for weighing the automation options available. Learning-based methods are a natural first candidate, and they have advanced rapidly across electronic design automation (EDA). Machine learning has been applied to EDA for over a decade [1], and large language models have since been used for HDL generation and debugging [2]–[4], EDA-workflow orchestration [5], analog design automation and sizing [6], [7], analog-netlist comprehension [8], and netlist generation from natural-language descriptions [9]. These systems synthesize, orchestrate, size, or generate design artifacts. None, however, verifies whether board-level diagnostic signals reach a management controller. There is also reason to be careful about delegating the structural part of the problem to a learned model. Neural executors of classical graph algorithms degrade out of distribution [10], and vision-language models read graph nodes far more reliably than edges when structure is extracted from images [11] and fine-grained visual understanding remains an active architectural problem in its own right [12]; large language models reasoning over linearized graphs have likewise been reported to assert or deny edges that are explicitly encoded in the input, a failure termed structural hallucination [13]. Taken together, these findings suggest that structural reasoning is better grounded in an authoritative graph than inferred from images, text, or net names. Such a graph can be searched with primitives that are individually well established. Renamed fragments of the same physical signal can be reconciled as an equivalence problem and evaluated efficiently with disjoint-set union [14], [15]. Controller observability is a reachability problem solved by breadth-first search with a parent tree that supplies a witness path [16], [17]. Deterministic graph search underpins connectivity analysis in design automation and in reliability engineering alike, in global routing [18], in signal-flow-based failure-mode analysis [19], and efficient reachability querying is itself a well-studied problem [20], [21]. These primitives are standard. Applying them directly is nonetheless insufficient for DSR, because the verifier still has to define which renamed nets are identical, which device hops are admissible, which rails act as non-conducting walls, and which functional observations through monitor devices count as coverage. These observations point to a division of the work rather than to a choice between the two families. NetFlow-DSR, the netlist-grounded neuro-symbolic framework presented here, separates learned semantics from computed structure. Instead of perceiving connectivity from schematic images or from

net names, it computes connectivity deterministically over the authoritative electrical graph that schematic-capture tools already emit. A large language model orchestrates the pipeline and supplies only the semantics that a netlist cannot encode. It identifies the management controllers, selects the in-scope diagnostic signals, and resolves device roles mainly from partname families and pin names, consulting device specifications only where these do not suffice. Pin names and directionality are read directly from the design’s own EDA library. Two classical solvers then carry the structural burden. Disjointset Union-Find reconciles renamed fragments into canonical signals [14], [15], and controller-seeded, power-aware breadthfirst search decides reachability and returns a parent tree that serves as a witness path [16], [17]. A monitored verdict is emitted only when this procedure exhibits an explicit, netlistverified path to a controller, recorded as a per-signal trace card. The verifier is therefore sound by construction with respect to its admissibility model, and interpretable by design rather than through a post hoc rationale. Because NetFlow-DSR reports coverage figures, a terminological clarification is required before the formulation is presented. We use “diagnostic coverage” throughout in the observability sense, that is, the fraction of in-scope diagnostic signals for which an admissible management path to a controller is proven. This is distinct from the failure-rate-weighted diagnostic coverage defined in functional-safety standards such as IEC 61508 and ISO 26262, in which detected failure modes are weighted by their contribution to the dangerous failure rate. The two are related as precondition and realization. A failure mode whose diagnostic signal never reaches a management controller cannot be detected by management firmware, irrespective of the detection logic that firmware implements, so electrical reachability is a necessary condition for detection through the management path. NetFlow-DSR verifies this precondition exhaustively and emits the per-signal observability verdict that a weighted computation consumes as input. It does not compute the weighting itself, which requires component-level failure-rate data and a mapping of signals to failure modes that lie outside the scope of this work. The metrics reported in Section IV are accordingly verificationlevel quantities over the expert-labeled signal set, not certified coverage figures under a functional-safety standard. This paper makes the following contributions. 1) Ground connectivity in the netlist’s exact edges instead of perceiving it from images, removing the edgerecovery weakness (direction and polarity) that dominates vision-graph methods. Pin direction is read from the design’s EDA library, polarity is decoupled from the observability verdict, and the LLM supplies device semantics. 2) Formulate diagnostic coverage as two relations, signal identity and controller reachability, over a power-aware admissibility model covering series passives, muxes, level translators, I2C repeaters, and device-mediated sense-to-I2C monitoring. Union-Find and BFS serve as exact solvers. 3) Emit a proof-path trace card for every verdict, making the method interpretable by construction and reduc-

3

ing review to the unmonitored set. Because each card records the connector pin at a board boundary, cards can be joined across boards for system-level review. 4) Demonstrate, through a cumulative ablation and a crossmodel reproducibility study, that given correct semantics, seeds, and admissibility rules, the reliability of a monitored verdict comes from the netlist-grounded procedure rather than any single language model. The verifier guarantees a valid witness path within the model, and the LLM-supplied semantics determine how many signals are recovered. The contribution lies in the DSR-specific formulation of signal identity and admissible observability—not in the underlying graph-search algorithms, which serve as standard computational tools. The remainder of the paper is organized as follows. Section II reviews related work and positions NetFlowDSR against it. Section III formalizes diagnostic coverage over a netlist graph and presents the NetFlow-DSR methodology. Section IV reports the experimental results, discusses their implications, and notes the study’s limitations. Section V concludes the paper and outlines directions for future work. II. R ELATED W ORK Automated approaches to diagnostic coverage fall into two families, both insufficient on their own. Net-name heuristics match diagnostic keywords or controller tokens in signal names. They are fast and training-free, but they over-claim signals whose names contain misleading tokens and miss signals whose destination is not encoded in the name. Learningand clustering-based methods that operate directly on netlist or board structure, such as gate-level reverse engineering and hardware-Trojan detection, depend on models fitted to that structure, whether trained on labeled examples [22], [23] or fitted without supervision [24], and emit class labels rather than an auditable controller path, so their residual misclassifications cannot be verified against the netlist. They also target different problems, module identification and Trojan detection, rather than signal-to-controller reachability. Where structure is instead read from images, node identification is comparatively reliable while edge recovery, and especially edge direction and polarity, is the persistent weakness, with the best mean edgewith-polarity F1 at 0.54–0.60 versus 0.99 for nodes in systemmap extraction [25]. Formal verification has been applied at the netlist level, but to device-level SPICE netlists rather than board-level observability [26]; broad reviews of LLMbased hardware design and verification concentrate on RTL and functional flows [27]; and classical verification relies on simulation and formal methods [28], with information-flow coverage formalized at the register-transfer level [29]. None of these addresses board-level diagnostic coverage. That gap is compounded by how connectivity is often obtained. Many approaches reconstruct it from pixels, text, or net names, for example by extracting a netlist from circuit images [30], [31]. Schematic-capture tools already emit an exact electrical graph, so re-deriving it reintroduces perception and inference errors into a problem whose structural component reduces to explicit algorithmic steps. Even netlist foundation models that learn

representations directly from the graph [32] produce learned embeddings rather than an auditable controller path, underscoring the case for computing connectivity deterministically rather than learning it. Against this backdrop, NetFlow-DSR occupies a position none of these families reaches. It keeps the learned and computed parts of the problem separate, using an LLM only for the device semantics that a netlist cannot encode. Connectivity is computed by deterministic engines over the netlist’s exact edges rather than inferred from schematics, text, or net names. Unlike net-name heuristics, it does not depend on destination tokens in signal names; unlike graph-learning methods, it emits an auditable controller path rather than a class label; and unlike image-to-netlist pipelines, it does not re-derive a graph the design tool already provides. Because every positive verdict carries a proof path, a monitored verdict can be checked directly against the netlist rather than accepted on the strength of a post hoc rationale, reflecting the interpretability-by-design developed in explainable AI [33]. Table I positions NetFlowDSR against representative prior work spanning LLM-based hardware design, netlist comprehension and generation, graph learning on netlists, image-to-netlist extraction, and hardware verification. It highlights the two capabilities that distinguish board-level diagnostic-coverage verification, namely netlistgrounded structural connectivity and auditable proof paths. III. M ETHODOLOGY NetFlow-DSR is a netlist-grounded neuro-symbolic pipeline in which an LLM leads the process end to end, sequencing the stages, invoking deterministic engines as tools, and supplying their semantic inputs. The connectivity computation and the assembly of the final audited verdict are carried out by the deterministic graph engines. The method is organized as four layers. The Graph Construction Layer parses the raw netlist into a device-centric pinout and builds the power-aware signalconduction graph. The Semantic Interpretation Layer identifies management controllers, in-scope diagnostic signals, and device pin-roles, using the LLM for the judgments that require device knowledge (controller identification and device class) and deterministic detectors for the rest (keyword-based signal detection and library-declared pin directionality). The Signal Identity Layer applies a Union-Find identity relation that merges series-passive-renamed fragments into canonical signals. The Connectivity Resolution Layer performs controllerseeded breadth-first reachability over an admissibility graph that augments identity with modeled pass-through and devicemediated sense-to-I2C edges, with power rails excluded. Together, these layers realize a two-relation formulation in which identity is kept separate from reachability. Doing so avoids two opposite errors: over-merging distinct multiplexer channels when every conductive path is treated as identity, and undertracing legitimate paths when only exact net identity is considered. The LLM is the orchestrator and semantic front end. It never computes the structural path itself. Because reachability is decided by breadth-first search over exact netlist edges and explicit admissible semantic edges, every monitored verdict is accompanied by an inspectable proof path. Fig. 1 summarizes the approach.

4

TABLE I L ITERATURE P OSITIONING OF N ET F LOW-DSR AGAINST R ELATED W ORK Topic / research line

Representative reference(s)

Key limitation or gap

NetFlow-DSR contribution

LLMs for hardware design and EDA (generation, orchestration, comprehension)

[2], [5], [9]

The LLM or agent generates HDL or netlists and orchestrates EDA tools; correctness is judged by simulation, task success, or probabilistic scoring rather than by a netlist-backed controller proof path, and board-level signal-tocontroller DSR is absent.

Connectivity is computed from the netlist by deterministic graph algorithms. The LLM orchestrates the pipeline and supplies device semantics but does not perform the structural computation, and every positive verdict carries a proof path.

Vision and imagebased structure extraction (image-tonetlist)

[30]

Structure is reconstructed from pixels or circuit images, so it is perceived rather than read from an authoritative source. Edge recovery, especially edge direction and polarity, is the persistent weakness (best mean edge-with-polarity F1 0.54–0.60 versus 0.99 for nodes), reintroducing perception error into the connectivity.

Structural edges are taken directly from the netlist rather than inferred from images, so no perception step is involved and each monitored verdict traces to netlist or pin-role evidence.

Graph learning on netlists (GNN classifiers, netlist representation models)

[22], [23], [32]

Learned models operate on the netlist graph but require training, whether labeled data or self-supervised pretraining, and target different objectives such as module identification, Trojan detection, or representation learning. Their outputs are class labels or learned embeddings whose residual errors carry no controller proof path.

Connectivity is computed deterministically over netlist-derived edges rather than learned or classified, requires no training, and every positive verdict carries an auditable proof path against the netlist.

Verification, coverage, and neuro-symbolic checking

[26], [27], [29]

Prior work covers RTL and functional verification, as a scoping review confirms, hardwaresecurity information-flow coverage, and devicelevel formal verification of SPICE netlists. None addresses board-level diagnostic coverage or signal-to-controller reachability with tracecard proof paths.

Exact graph algorithms compute connectivity over netlist-derived edges and define boardlevel diagnostic coverage as controller reachability, keeping the LLM out of the structural computation while every positive verdict carries an auditable proof path.

Fig. 1. NetFlow-DSR verifies Diagnostic Signal Reachability by separating learned semantics from computed structure. An LLM identifies controllers, selects diagnostic signals, and extracts device pin-roles from device specifications; deterministic Union-Find and power-aware BFS then prove connectivity over the authoritative netlist. Each monitored verdict carries an auditable proof-path trace card, yielding a verifier that is sound by construction and interpretable by design.

A. Graph Construction Layer The Graph Construction Layer turns the raw netlist into a structured connectivity model. A board is represented as a netlist hypergraph H = (P, N ), where P is the set of component pins and N is the set of electrical nets. Each net n ∈ N is incident to a subset of pins pins(n) ⊆ P , and

nets(p) denotes the nets incident to pin p. Two pins are directly connected when they share a net. Construction proceeds in two steps, pinout extraction and graph assembly. Pinout extraction parses the vendor netlist (here, OrCAD expanded netlists) into device-centric records, one per pin, of the form (reference designator (refdes), pin, part, net). An example record is

5

(U1, AD15, AST2620, FM_TPM_PRSNT_1_N). For every component, the pinout therefore states which signal each pin connects to. Graph assembly then inverts this pinout into a net-centric incidence structure that records, for every net, the pins and components it touches. Formally, pinout extraction recovers the pin–net incidence pins(n) and nets(p) together with a component map cmp(p) → (refdes, part). The pinout diagram is the devicecentric view keyed by component, and the net-centric incidence is its equivalent dual. Because extraction applies exact parsing rules, it is lossless and auditable. Every edge in the resulting graph traces back to a specific pin record in the netlist, which later supplies the evidence anchors used by the trace cards. Nets divide into power nets and signal nets. Power nets distribute a supply voltage or ground reference, whereas signal nets carry information and are the subject of DSR. We introduce a structural classifier ispower : N → {0, 1}

(1)

where ispower(n) = 1 marks net n as a power net (a supply rail or ground) and ispower(n) = 0 marks it as a signal net. The ispower function is a rule-based name classifier applied before reachability. A net that carries a health or diagnostic token (for example PWRGD, PRSNT, PERST, RESET, ALERT, or SENSE) is treated as a signal even when its name also resembles a rail. A net is otherwise marked as power when its name matches conventional supply or ground forms such as GND, VSS, P*V*, the VDD family, VBAT, VTT, VPP, VIN, VOUT, and VREF. Excluding these high-fan-out nets prevents unrelated signals from appearing connected through a shared rail. This predicate partitions the netlist into power and signal nets, Npwr = {n ∈ N : ispower(n) = 1},

Nsig = N \ Npwr (2)

where Npwr is the set of power nets, Nsig = N \ Npwr the signal nets, and “\” denotes set difference. This partition is essential for correct reachability, because power rails and grounds are high-fan-out nets, allowing traversal through them would make many unrelated signals appear connected to every controller. NetFlow-DSR therefore excludes power nets as traversal conductors. A power rail can nonetheless remain a diagnostic endpoint, credited through a sense-to-I2C or ADC edge rather than by conduction. Power nets are therefore kept as vertices of the reachability graph G but receive no identity or pass-through edges; they can only be the endpoint of a sense edge, so a rail can be reached but never traversed. Signal identity is constructed on the non-power signal graph, Gsig = (Nsig , E),

E ⊆ Nsig × Nsig

(3)

where Gsig is the signal-conduction graph, whose vertices are the signal nets Nsig , and power nets contribute no edges and therefore act as non-conducting walls. The Graph Construction Layer fixes this vertex set. The two remaining layers then populate two distinct edge relations, one at each level of the construction. The Signal Identity Layer populates E with the series-passive adjacencies defined in Section III-C, so that

the connected components of Gsig are exactly the canonical signals S. The Connectivity Resolution Layer works one level up, on those components, populating a separate admissible edge set Ereach ⊆ V × V , where V = S ∪ Npwr , with pass-through and device-mediated edges. Each sense edge is directed from the monitor’s I2C signal to the observed net, so the search can enter an observed net from a reachable monitor but never return through that edge. Power nets are sinks, deg+ G (r) = 0 for all r ∈ Npwr , so a rail can be reached but never traversed. The traversal searches G = (V, Ereach ). Each of these operations is defined explicitly over netlistgrounded inputs, so every edge traces back to a specific netlist record and remains auditable. B. Semantic Interpretation Layer Operating on the parsed netlist and device inventory produced by the Graph Construction Layer, the LLM performs a semantic survey of the design and supplies the inputs consumed by the connectivity engines. It computes no connectivity itself. It first identifies the management controllers by surveying the component inventory and flagging candidate BMC, CPLD, FPGA, and system-controller devices by part function. Known controller families are matched automatically, and the LLM confirms or resolves ambiguous parts. A direct-node smart-controller detector, which marks a signal as monitored only when a management controller is a direct node on its net, constitutes the S1 baseline. In-scope diagnostic signals are then selected by a deterministic detector that applies the DSR-library keyword categories to net names, keeping health signals and excluding local analog feedback nodes, voltage references, compensation nodes, and configuration straps. The keyword categories are curated with the LLM, but the per-net selection is a fixed, reproducible rule. Finally, it establishes the device pin-roles that the connectivity layer consumes. A pin-role has two components, the electrical directionality of each pin (input, output, bidirectional, or power) and the functional class of the device (I2C mux, level translator, I2C bus buffer/repeater, power monitor, ADC, temperature sensor, or GPIO expander). NetFlow-DSR draws these from two complementary provenances. Directionality is obtained deterministically from the design’s own EDA library, the OrCAD/Allegro LIBRARY_PARTS file (pstchip.dat) emitted by the same tool that writes the netlist, in which each pin declares its role through the INPUT_LOAD, OUTPUT_LOAD, BIDIRECTIONAL, and PINUSE fields. Because these fields are authored by the schematic-capture tool, pin direction is read rather than inferred and carries the same authority as the netlist itself. The functional device class is resolved in order of cost. Most parts are classified from their part-name family and from the pin names declared in the same library. For example, an SCL/SDA pair together with channel pins SC0–SD3 identifies an I2C multiplexer. The device specification (datasheet) is consulted only for the parts that remain ambiguous, and only for what names and pins cannot give, such as which analog input senses which rail and whether the measurement is reported over I2C. A part that no source settles is flagged for its datasheet rather than guessed. When both sources

6

Fig. 2. Union-Find defragmentation. Blue arrows are the disjoint-set parent pointers, each net fragment linking to its immediate parent, whereas the green arrow is the shortcut installed by path compression, re-pointing the deepest fragment X_Rb directly to the canonical representative X.

are available, the deterministic library takes precedence for directionality and the device specification supplies only the residual semantics, further narrowing the part of the pipeline that depends on learned extraction. The two-source device pinroles are collected as the pin-role library Π. Together with the controller set and the in-scope diagnostic signals, Π forms the semantic input consumed by the downstream deterministic layers. C. Signal Identity Layer The Signal Identity Layer establishes signal identity. A physical signal may appear under several net names when it crosses a series resistor, ferrite bead, or zero-ohm link, so a net-by-net analysis, including an LLM trace over schematic text, can lose the signal at each renaming boundary. This layer resolves the fragmentation by merging two non-power nets whenever they are joined by an admissible two-terminal series passive (a passive with exactly two non-power legs). Chains of such merges define the canonical signal components. As depicted in Fig. 2, canonical components are computed by disjoint-set Union-Find with union by rank and path compression. A sequence of merges over the signal nets Nsig therefore runs in near-linear total time, with amortized cost O(α(|Nsig |)) per operation, where α is the inverse Ackermann function. Because α grows so slowly that it stays below five for any input size arising in practice, canonicalization is effectively constant-time per query and adds no meaningful cost to the pipeline. We write s(n) for the canonical representative of net n and S for the set of canonical signals. A pull-up or pull-down to a power rail is not a merge, because the rail is a power net and is excluded from the identity relation. Multiplexers, buffers, level translators, and other active or directional devices are likewise excluded from identity. Their ports may become reachable under certain conditions, but they are not the same conductor. This distinction prevents, for example, multiple downstream multiplexer channels from collapsing into one canonical signal. Fig. 3 illustrates the pipeline of one configuration, from netlist to canonicalization. D. Connectivity Resolution Layer The Connectivity Resolution Layer establishes controller reachability over a graph larger than identity. Coverage is

evaluated relative to a set of management controllers M , such as on-board CPLDs or BMCs, or connector egresses that lead to off-board management devices; each controller m ∈ M contributes a set of seed pins seed(m) ⊆ P . Because the reachability graph is defined over canonical signals rather than pins, these pins are first lifted to the set of seed signals σ(m) = {s(n) : p ∈ seed(m), p ∈ pins(n), ispower(n) = 0}, which is the set actually used to seed the traversal. Because identity has already been absorbed into the vertices of G, two canonical signals are adjacent in the reachability graph only when they are joined by a modeled pass-through device, namely an I2C multiplexer channel, an I2C bus buffer/repeater pass-through, or a level-translator channel, or by a device-mediated sense-toI2C edge. Power rails are excluded from traversal, preventing pull-up networks from creating false controller paths. Pin directionality, taken from the design library, further constrains admissibility. Each pass-through or device-mediated edge is added consistently with the input, output, or bidirectional role of the pins it joins. For a purely combinational device whose output is reachable from a controller, a backward relation to an input represents a potential influence on the monitored output, not necessarily independent observability of that input. Pin directionality establishes the direction of this relation but is insufficient to establish observability. Crediting an input as monitored additionally requires device-function and operating-condition evidence that the input’s diagnostic state is observable at the output. The traversal therefore runs BFS over G, whose vertices carry the identity relation and whose edges carry the admissible device-hop relation. Fig. 4 illustrates this composed traversal. Tm = BFS(G, σ(m)),

cov(s, m) = 1[ s ∈ Tm ]

(4)

where G = (V, Ereach ) is the reachability graph, over canonical signals and power-net endpoints,, BFS(G, σ(m)) is breadth-first search on G from the seed signals σ(m), Tm ⊆ V is the resulting reachable set, and 1[·] is the indicator function. Thus cov(s, m) = 1 exactly when signal s is monitored, that is, reachable, by controller m. Through device-mediated edges, coverage also credits signals observed by a monitor device (e.g., a power monitor or ADC) that has no direct electrical path to the controller. Reachable sets are maintained separately for each controller, so a signal can be classified as BMConly, CPLD-only, both, or neither. The diagnostic signal set Sdiag ⊆ V excludes local analog feedback and reference nodes such as *_FB, *_REF, and *_SW local-regulator nodes. For each controller, the DSR output is the monitored set and its complement, the unmonitored set, Monm = {s ∈ Sdiag : cov(s, m) = 1}

(5)

Am = Sdiag \ Monm

(6)

where Monm is the set of diagnostic signals monitored by controller m and Am is the corresponding unmonitored set. The unmonitored set Am is the primary review output, it enumerates the diagnostic signals for which no admissible management path has been proven. For each controller m, NetFlow-DSR performs a breadth-first flood from σ(m) and

7

Fig. 3. Canonicalization of a single configuration, series-passive-renamed net fragments are merged by Union-Find into one canonical signal.

Fig. 5. Per-signal trace cards, the LLM-grounding unit.

Fig. 4. BFS model.

records the reachable set. Each controller-seeded flood runs in O(|S| + |Ereach |) time and produces both a verdict and a parent tree, which is used as the proof path for every reached signal. The algorithmic novelty is not BFS itself, but the DSRspecific admissibility predicate that determines which signalto-signal hops are valid, which rails are barriers, and which functional device observations can be credited as monitored. The soundness of this construction can be stated precisely. Proposition 1 (Witness soundness): If cov(s, m) = 1, then the parent tree returned by BFS(G, σ(m)) exhibits a path in G from a seed signal in σ(m) to s every edge of which is admissible. The proof is immediate from the parent tree, which records for each reached vertex the admissible edge by which it was reached. Two consequences follow, and it is worth separating them. Proposition 1 is internal to the admissibility model, and in that sense the verifier never reports a signal as monitored without an explicit witness path. External validity, namely that every admissible edge corresponds to real observability, is an empirical property of the edge set rather than a theorem.

A false positive can therefore arise only from an incorrect admissible edge, for example a mis-supplied device class, and never from the search itself. Soundness in this sense does not eliminate the trust question, it relocates it. Instead of asking whether a verdict is correct, a reviewer asks whether one edge is admissible, a local question that the trace card answers directly. The 100% precision observed in the evaluated data is consistent with this structure. The engines are deterministic and, with the hash seed fixed, bit-reproducible, so identical inputs yield identical verdicts and proof paths. Device-mediated monitoring extends the admissibility graph for monitor devices. Some rails or pins do not connect electrically to a controller but are observed by a device such as a power monitor, ADC, or GPIO expander, which relays the measurement or pin state over I2C. In this case, the observed net is credited as indirectly monitored only if the device observes that net and the device I2C bus itself reaches the controller. A GPIO expander’s input pins are read in exactly this way, through the expander’s I2C port register. Temperature and leak sensors that report internal measurements require no external sense edge. Their coverage is decided by reachability of their I2C and alert signals. This rule adds semantic edges derived from device function without changing the underlying graph search. A trace card is the unit of evidence produced for each canonical signal. It records the merged net fragments, the source leaf and associated part, the traced path to each

8

Algorithm 1 NetFlow-DSR: Netlist-Grounded DiagnosticCoverage Verification Require: netlist hypergraph H = (P, N ); pin-role library Π; controller set M with seed pins seed(m) ⊆ P Ensure: coverage cov(·, ·); unmonitored sets {Am }; persignal trace cards C 1: function N ET F LOW-DSR(H, Π, M ) 2: Nsig ← {n ∈ N : ispower(n) = 0} ▷ power nets are not conductors 3: initialize disjoint-set forest over Nsig ▷ Signal Identity Layer 4: for each two-terminal series passive with legs (a, b), both non-power do 5: U NION(a, b) ▷ populates E of Gsig 6: end for 7: S ← Nsig /F IND(·) ▷ canonical signals: components of Gsig 8: V ← S ∪ Npwr ; Sdiag ← D ETECT-D IAGNOSTIC(V ) ▷ DSR category keywords 9: Ereach ← pass-through, I2C→observed-net and combinational back-edges licensed by Π, oriented by the declared pin directionality ▷ Connectivity Resolution Layer 10: G ← (V, Ereach ) ▷ quotient of Gsig ; identity is in the vertices 11: for each controller m ∈ M do 12: σ(m) ← {s(n) : p ∈ seed(m), p ∈ pins(n), ispower(n) = 0} 13: Tm ← BFS(G, σ(m)) with parent tree ▷ parent tree = proof path 14: cov(s, m) ← 1[s ∈ Tm ] for all s ∈ V 15: Monm ← {s ∈ Sdiag : cov(s, m) = 1}; Am ← Sdiag \ Monm 16: end for 17: C ← {T RACE -C ARD(s) : s ∈ V } ▷ Grounding 18: return cov, {Am }, C 19: end function controller, the role of each modeled hop, and the resulting verdict. Fig. 5 shows representative cards. In one, a fault signal reaches the CPLD through a series resistor, while an SMBus clock reaches both CPLD and BMC through a shared mux path. These cards make positive verdicts auditable and expose the unmonitored set for review. Trace cards also carry signal identity beyond a single board. When a controller is declared as a connector egress, the card records the exact connector pin at which the signal leaves the board, and the card of the mating board starts at the same pin. Cards from two boards can therefore be joined at that pin, so a signal is followed across boards by matching its cards rather than by re-tracing it on each board. Algorithm 1 summarizes the complete NetFlowDSR procedure over the notation of Section III. IV. R ESULTS NetFlow-DSR is evaluated on an expert-labeled benchmark spanning the principal functional classes that compose a modern AI accelerator server tray, namely host compute, accelera-

tion, storage, I/O expansion, and tray-level management. This setup assesses diagnostic-coverage behavior across distinct board roles rather than on a single board type. The evaluation uses five anonymized production server and accelerator boards with distinct management-controller architectures. The MB has an off-board BMC path through an I2C multiplexer and an on-board CPLD. The Accelerator has an on-board BMC and CPLD. The remaining three boards are a HDD, a PCIe board, and a SCM. Together, these boards cover direct controller wiring, renamed nets across series passives, passthrough devices, and device-mediated telemetry. Annotation was performed at the signal level. Candidate diagnostic signals were collected from netlist names and DSR categories, including power-good, presence, reset, interrupt, alert, I2C/SMBus, ADC, fault, enable, and telemetry signals. Local analog feedback nodes, voltage references, regulator-compensation nodes, configuration straps, and duplicate aliases judged by manual review to refer to the same physical signal were excluded from scope. Ground truth was assigned by three hardware engineers experienced in server platform design review. For each board, one engineer labeled every in-scope signal from the schematic, netlist, and the pinout descriptions of the involved ICs, and a second engineer verified every label against the same sources, with differences resolved by joint schematic review. Each inscope signal received a binary expert label. A positive label means that manual engineering review judged the signal observable or controllable by an in-scope management controller. That path could be a direct electrical one, an admissible passthrough path, or device-mediated monitoring supported by the IC pinout descriptions, such as sense-to-I2C reporting. A negative label means that no such management path was present within the declared controller scope. These labels were assigned independently of the NetFlow-DSR output (from the schematic, netlist, and IC pinout descriptions rather than from the method’s trace cards) and were frozen before any stage was scored. The method is evaluated as a cumulative three-stage ablation. S1 is a direct-node smart-controller detector that flags a signal as monitored only when a management controller is a direct node on its net. S2 adds the Signal Identity Layer to apply canonicalization, and merges renamed net fragments across series passives into canonical signals, so a controller that is a direct node on any fragment is credited with monitoring the whole signal. S3 adds the Connectivity Resolution Layer, which floods the canonical-signal graph from each controller and reaches signals through pass-through devices (muxes, level translators, I2C repeaters) and device-mediated sense-to-I2C monitors. The stages are strictly nested (S1 ⊆ S2 ⊆ S3), so each stage can only add monitored verdicts, never retract them. After in-scope filtering, the benchmark contains 421 expertgraded signals, of which 369 are positives (monitored) and 52 are negatives (unmonitored) at the signal level, not the netfragment level. This signal count reflects the review scope adopted here, not a limit of the method. The identity and reachability engines process every net on the board, and a trace card is produced for every canonical signal, so a team with a different target, or a designer who needs every signal, obtains verdicts for the full set by changing only the scope

9

gain, recovering 87 signals (+23.6 points of pooled recall), which demonstrates the importance of canonicalization. Raw netlists often split one physical signal into multiple named fragments at series resistors, ferrites, or zero-ohm links, and a Board Stage Acc. Sens. Prec. F1 MCC (%) (%) (%) direct-node detector misses a signal whenever the controllerside fragment carries a different name from the reviewed S1 33.8 27.9 100 0.436 0.175 fragment. Union-Find canonicalization merges these fragments Motherboard S2 61.25 57.82 100 0.733 0.317 S3 96.3 95.9 100 0.979 0.810 before reachability is evaluated. On the Motherboard, for example, 6,196 raw nets (5,903 of them signal nets, after S1 63.1 59.7 100 0.750 0.334 excluding 293 power rails) are reduced to 4,803 canonical Accelerator S2 76.9 74.8 100 0.856 0.448 signals through 1,100 fragment merges, including 710 multiS3 85.4 84.0 100 0.913 0.555 fragment signals. Recall increases on every board after this S1 29.8 8.3 100 0.154 0.144 step, from 27.9% to 57.8% on the Motherboard, 59.7% to HDD S2 53.2 38.9 100 0.560 0.360 74.8% on the Accelerator, 8.3% to 38.9% on the HDD, 55.9% S3 83.0 77.8 100 0.875 0.671 to 79.4% on the PCIe board, and 48.5% to 66.7% on the SCM S1 59.5 55.9 100 0.717 0.305 module. The S2-to-S3 improvement adds controller-seeded PCIe board S2 81.1 79.4 100 0.885 0.488 reachability, recovering a further 93 signals (+25.2 points of S3 97.3 97.1 100 0.985 0.853 pooled recall). S2 credits a signal only when a controller S1 63.8 48.5 100 0.653 0.468 is a direct node on its canonical signal. S3 instead runs SCM module S2 76.6 66.7 100 0.800 0.611 breadth-first search from each controller over the canonicalS3 89.4 84.8 100 0.918 0.791 signal graph, flooding across modeled pass-through devices (muxes, level translators, I2C repeaters) and device-mediated filter. The same fixed labels are used for every stage, so the sense-to-I2C relations. Those relations derive from the device differences across stages reflect only the evidence and graph pin-roles the LLM extracted from the components’ device relations available to the method, not changes in the annotation specifications. Reachability at S3 is therefore BFS over the set. Fig. 6 shows the resulting confusion-matrix components union of the canonical-signal identity edges from S2 and (TP, FP, TN, FN) per board and stage. The false-positive count these admissible pass-through and device-mediated edges. is zero for every board at every stage, while true positives This effect is most visible on the HDD, where recall increases rise and false negatives fall. Because no false positives occur from 38.9% to 77.8% and F1 from 0.560 to 0.875, and on in the evaluated data, observed precision and specificity are the PCIe board, where S3 reaches 97.1% recall and 0.985 100%. With zero false positives among 52 negatives, the F1. The majority of the remaining false negatives are power rule of three bounds the false-positive rate above by 5.8% at rails. NetFlow-DSR credits a rail as monitored only when a 95% confidence, corresponding to specificity of at least 94.2% monitor or ADC directly senses it and relays the measurement under this sample size, assuming approximately independent over I2C. Power rails that are monitored through indirect negatives from a single platform. The discriminative variation mechanisms the method does not model, for example a poweracross stages is therefore carried by accuracy, sensitivity good indication from their voltage converter, are not captured (recall), F1, and MCC, defined in (7)–(12). by the current approach and therefore remain false negatives. The remaining false negatives involve active buffers, which are TP + TN Accuracy = (7) single-direction and therefore not bridged, I2C I/O-expander TP + TN + FP + FN cases not resolved in the evaluated run, or signals whose expert-confirmed endpoint was not declared as a controller TP Precision = (8) seed in the run. TP + FP The zero-false-positive result is what makes this recovered TP Sensitivity (Recall) = (9) recall useful in practice, because in a diagnostic-coverage signTP + FN off the two error types are not symmetric. A false negative TN returns an already-monitored signal to the review list, adding Specificity = (10) bounded, self-correcting effort. A false positive, by contrast, TN + FP removes a genuinely unmonitored signal from the set of 2TP F1 = (11) candidate coverage gaps and lets a fault path escape review 2TP + FP + FN silently. Since the negative class is small, only 52 of the TP · TN − FP · FN 421 signals, this unmonitored set receives the reviewer’s full MCC = p (T P + F P )(T P + F N )(T N + F P )(T N + F N ) attention. Even a single over-claim would be disproportion(12) ately costly. NetFlow-DSR is deliberately biased against overTable II reports the derived per-signal metrics for each board claiming for this reason. An admissible edge is added only (MB N = 160, Accelerator N = 130, HDD N = 47, when it is backed by netlist evidence or by a device pin-role the PCIe board N = 37, SCM module N = 47) and each of LLM extracted from a device specification. The 52 negatives the three cumulative stages. Fig. 6 reports the underlying therefore serve as a stress test of soundness in the evaluated confusion counts. The S1-to-S2 step produces a large recall data, and the method leaves all of them correctly unmonitored TABLE II P ER -S IGNAL V ERDICT ACCURACY OF THE T HREE -S TAGE A BLATION ON F IVE P RODUCTION B OARDS

10

Fig. 6. Per-board confusion-matrix components (TP, FP, TN, FN) across the three ablation stages.

across every board. Review effort is redirected from exhaustive signal tracing to focused examination of the unmonitored set, and each monitored verdict can be audited directly through its trace-card proof path. On the Accelerator, 100 of 130 signals are returned as monitored and 30 remain for audit. On the PCIe board, only 4 of 37 remain. This auditability is a property of the structure itself. The procedure decomposes DSR into explicit, netlist-grounded stages, and every positive verdict carries a proof path that can be checked against the netlist. Because the evaluated signal set is class-imbalanced, MCC (reported in Table II) is included as a balance-aware summary metric alongside accuracy and F1. The dominant error mode of the direct-node baseline is under-claiming rather than over-claiming. Signals are missed when their evidence is split across renamed fragments, series passives, pass-through devices, or monitor-mediated telemetry paths. NetFlow-DSR recovers these signals by extending the graph only with admissible, evidence-backed edges over a power-guarded graph, so each stage adds true positives while preserving empirical zero false positives in the evaluated data. Fig. 7 summarizes the pooled tray-level metrics from S1 to S3. Two regularities hold across every board. First, recall increases monotonically from S1 through S3, confirming that each added relation, canonicalization at S2 and devicemediated resolution at S3, recovers monitored signals that the preceding stage had missed. Second, observed precision and specificity remain fixed at 100% at every stage and on every board, so no stage introduces a spurious monitored verdict in the evaluated data. Pooled across all 421 signals, recall rises from 40.7% at S1 to 64.2% at S2 and 89.4% at S3, while F1 improves from 0.578 to 0.782 and 0.944 and MCC from

Fig. 7. Pooled verdict metrics across the three ablation stages.

0.279 to 0.426 and 0.715. Because observed precision is held at unity, the F1 gain is attributable entirely to recovered true positives. The cumulative stages enlarge the set of correctly identified monitored signals without weakening the reliability of a monitored verdict in this benchmark. Balanced accuracy, the mean of sensitivity and specificity shown in Fig. 7, rises with recall from 0.70 at S1 to 0.82 at S2 and 0.95 at S3, because specificity is fixed at 100%. These results give empirical weight to the perception bottleneck reviewed in Section II. In NetFlow-DSR, perception-based edge recovery is not used for structural connectivity because the netlist encodes the electrical edges, connectivity is computed over netlist-derived structure rather than perceived from pixels. The missed-edge failures that dominate image-based extraction

11

are therefore removed from the structural part of the DSR verdict. For the coverage decision used here, reachability is modeled over admissible monitoring paths. Polarity and signal direction are semantic properties recorded separately from the binary question of whether a controller can observe the signal. NetFlow-DSR thus removes the connectivity portion of the perception bottleneck, which helps explain why observed precision does not degrade with board complexity or across models. A further finding is that interpretability is produced by the same mechanism that delivers accuracy. Because connectivity is computed on the netlist, every positive verdict is emitted with an explicit proof path, namely the chain of canonical signals and admissible edges terminating at the controller. Each verdict is therefore auditable by construction rather than rationalized after the fact. This realizes the interpretability-by-design reviewed in Section II, and it is decisive at production scale, where a single board carries several hundred candidate diagnostic signals and a free-form model rationale would be infeasible to audit. The remaining disagreements point to extensions rather than to a change in formulation. Active buffers and scope-dependent endpoints such as CPU-hosted DIMM telemetry require additional device semantics or broader controller declarations. The procedure verifies reachability. Whether an unmonitored signal is an actual design gap remains a semantic engineering judgment. This asymmetry admits a stronger statement than the error counts alone convey. Because the verifier emits no monitored verdict without a netlist-verified proof path, the absence of false positives in the evaluated data implies Γ ⊆ Am , where Γ denotes the set of genuinely unmonitored diagnostic signals and Am the flagged unmonitored set of controller m. Every genuinely unmonitored signal in the evaluated data is contained in the set the method returns for review. Examination of Am is therefore exhaustive with respect to the genuinely unmonitored set rather than a sample of it, and the residual error mode is redundant effort rather than escaped risk. This containment property is what separates a sound verifier from a merely accurate classifier. A method with comparable F1 but a nonzero false-positive rate would discard an unknown subset of Γ before a reviewer ever saw it, and no aggregate metric would reveal which signals had been lost. Containment also makes the review burden quantifiable. The quantities that follow are reported over the pooled benchmark rather than for one controller, so a pooled review set is required. A signal needs review only when no in-scope controller reaches it, which is the intersection rather than the union of the per-controller sets, \ [ A = Am = Sdiag \ Monm (13) m∈M

m∈M

where A collects the diagnostic signals left unmonitored by every controller on every board. Since Γ ⊆ Am holds for each m, containment carries over to the pooled set, Γ ⊆ A. Let the review reduction be |A| (14) ρ=1− |Sdiag | and let the enrichment η be the ratio of unmonitored-signal density within A to that density within the full in-scope

set Sdiag . These two quantities are not independent under containment, because Γ ⊆ A fixes the numerator of both densities at |Γ|, giving η=

|Γ| / |A| |Sdiag | 1 = = |Γ| / |Sdiag | |A| 1−ρ

(15)

so the concentration of genuinely unmonitored signals improves at precisely the rate at which the review set contracts. Whether a genuinely unmonitored signal constitutes a design gap is a separate engineering judgment, so ρ and η quantify the concentration of the review set rather than defect density. A verifier that admitted false positives would break this identity, because each over-claim removes a member of Γ from A and reduces the numerator that (15) holds fixed. Enrichment and effort reduction coincide only for a sound procedure. Applied to the pooled benchmark, S3 returns 330 of the 421 in-scope signals as monitored and flags |A| = 91 for review, comprising the 52 true negatives and the 39 signals that S3 fails to credit, giving ρ = 78.4% and η = 4.63. An engineer inspecting the flagged set encounters a genuinely unmonitored signal in 57.1% of cases, against a base rate of 12.4% over the full signal set, and all 52 remain within it. The corresponding values are ρ = 35.6% and η = 1.55 at S1 and ρ = 56.3% and η = 2.29 at S2, so the cumulative stages concentrate residual risk monotonically and not only improve the classification metrics. Containment holds at every stage and on every board, since the false-positive count is zero throughout. On the benchmark it held exactly: every one of the 52 genuinely unmonitored signals remained in A. The in-sample residual error mode is thus redundant effort rather than escaped risk. A signal that escapes review is precisely a false positive: a genuine negative over-claimed as monitored and thereby removed from A. Because a monitored verdict is emitted only with a netlistverified proof path, such an event can originate only from an incorrect admissible edge (e.g., a mis-supplied device class), never from the search itself. Its observed rate is zero. The approximate 95% upper confidence bound on the false-positive rate is 5.8%, based on the 52 negatives in the main 421-signal benchmark. Whereas the containment guarantee above holds the falsepositive rate fixed within a single procedure, the cross-model study on the SCM subset (N = 47; 33 positives and 14 negatives) asks whether the observed zero-false-positive behavior persists across language models. To test this, every model was given the identical package, namely the same deterministic Union-Find and BFS engines, the same netlist, and the same device specifications. Each model ran those engines while extracting the device pin-roles and controller identifications itself, with no model-specific tuning. Because the engines are identical across models, the experiment isolates the modeldependent semantic extraction step from the deterministic verifier, so any difference in outcome reflects how completely a model extracts the semantics the engines consume, not the determinism of the engines. In the SCM module, Model A, Model B and Model C were run five times from a clean context and scored against the same expert ground truth. Precision and specificity remained at 100% in every run, while mean

12

TABLE III C ROSS - MODEL REPRODUCIBILITY OF THE N ET F LOW-DSR METHOD . Model

Acc %

Sens %

Prec %

F1

Time*

Model A Model B Model C

88.52 ± 1.17 88.08 ± 2.85 80.43 ± 8.16

83.63 ± 1.65 83.03 ± 4.07 72.12 ± 11.62

100 100 100

0.911 ± 0.010 0.907 ± 0.025 0.834 ± 0.077

≈6 ≈3 ≈ 21

* Time is reported in minutes.

accuracy and variance differed across models. These crossmodel results are reported in Table III. As summarized in Table III, Model A and Model B achieved comparable mean accuracy (88.52%±1.17 and 88.08%±2.85, respectively), with Model A showing the lowest variance and Model B the fastest average runtime at approximately 3 minutes per run. Model C trailed at 80.43% ± 8.16 and was the slowest at approximately 21 minutes. Its lower accuracy and higher variance reflect less complete and less consistent execution of the procedure’s semantic steps, not any loss of precision. The ± values are standard deviations over five clean-slate runs. The run-to-run and model-to-model differences come from how many device-mediated telemetry signals each model extracted from the device specifications. Four of Model B’s five runs reproduced the deterministic result around (89.36% accuracy), while a single run missed three sense-to-I2C signals (82.98%), and no run over-claimed. The decisive observation is a clean decomposition. Precision shows zero variance across models (100% ± 0 in every run), whereas accuracy and sensitivity variance grow only with how completely a model extracts the device semantics. This is what the architecture predicts, because the deterministic engines assert only netlist-verified paths and therefore fix observed precision in the evaluated data, while LLM-supplied semantics, namely device pin-role extraction, signal detection, and controller identification, govern recall. Consistent with this decomposition, the pin-role component that varied across models was the device class extracted from the device specifications and its monitoring semantics, not pin directionality, which is read deterministically from the design library and is therefore identical for every model. Under correct device semantics, reliability thus follows from the netlist-grounded procedure rather than any single model. Given correct device semantics, the model determines how much is recovered, while precision depends on the verifier’s inputs being correct. The main limitation of these results is the dependence on accurate extraction of device roles from device specifications. When design-library metadata is unavailable, connectivity can still be recovered from the netlist, but pin roles are then inferred from device specification documents rather than treated as a deterministic design-library input.

are computed by deterministic engines over the netlist, while an LLM extracts device semantics from device specifications to extend the graph only where component function justifies additional observability. Across five anonymized production boards spanning 421 in-scope signals, the cumulative procedure raises pooled recall from 40.7% to 89.4% and F1 from 0.578 to 0.944, reaching up to 97.1% recall on the PCIe board. Observed precision and specificity hold at 100%, with zero false positives in the evaluated data. The role of structure and grounding, rather than any single model, is made explicit by the cross-model study. When the same procedure was executed on the SCM by Model A, Model B, and Model C over five clean-slate runs each, precision remained exactly 100% (±0) for all three models even as mean accuracy varied (88.5%, 88.1%, and 80.4%, respectively) and wall-clock time ranged from roughly 3 to 21 minutes. The property that matters most for a serviceability sign-off, that no unmonitored signal in the evaluated data was reported as covered, therefore tracks the structured, netlist-grounded procedure rather than a particular language model. This zerofalse-positive behavior is structural rather than incidental. The verifier emits a monitored verdict only when the admissibility predicate exhibits a netlist-verified proof path, so it is sound by construction with respect to that model. A false positive can originate only from an incorrect admissible edge, never from the search. Every positive verdict carries a proof path that concentrates engineering effort on the flagged unmonitored set rather than on repeated manual tracing. NetFlow-DSR thus offers a scalable, auditable foundation for DSR automation in reliable electronic systems. For datacenter platforms, where one design is replicated across a fleet, it moves coverage gaps into the design review, before they are deployed at scale. In this foundation, netlist grounding and explicit structure supply the reliability and learning is reserved for the semantics a netlist alone cannot encode. Because the diagnostic scope is a configurable filter over a complete per-board analysis, the same procedure serves narrow sign-off reviews and full-design audits alike. Several directions for future work follow from this study. First, widening the declared controller scope to destinations that currently fall outside it, such as CPU-hosted DIMM telemetry, would let scope-dependent signals be judged against the correct endpoint. Second, joining per-board trace cards at shared connector pins would extend the same proof path across a full tray, so each cross-board signal keeps one identity card and system-level review reduces to checking the joined cards. Third, coupling NetFlow-DSR’s proof paths with firmware and sensor-configuration checks would close the gap between electrical reachability and end-to-end diagnosability. R EFERENCES

V. C ONCLUSION This paper presented NetFlow-DSR, a netlist-grounded, neuro-symbolic procedure for automated detection and verification of diagnostic-signal reachability. The method formulates DSR as two graph relations, an identity relation over series-passive-renamed fragments and a power-guarded reachability relation from management-controller seeds. Both

[1] G. Huang, J. Hu, Y. He, J. Liu, M. Ma, Z. Shen, J. Wu, Y. Xu, H. Zhang, K. Zhong, X. Ning, Y. Ma, H. Yang, B. Yu, H. Yang, and Y. Wang, “Machine learning for electronic design automation: A survey,” ACM Transactions on Design Automation of Electronic Systems, vol. 26, no. 5, p. 40, 2021. [2] S. Thakur, B. Ahmad, H. Pearce, B. Tan, B. Dolan-Gavitt, R. Karri, and S. Garg, “VeriGen: A large language model for Verilog code generation,” ACM Transactions on Design Automation of Electronic Systems, vol. 29, no. 3, p. 46, 2024.

13

[3] N. Pinckney, C. Batten, M. Liu, H. Ren, and B. Khailany, “Revisiting VerilogEval: A year of improvements in large-language models for hardware code generation,” ACM Transactions on Design Automation of Electronic Systems, vol. 30, no. 6, pp. 1–20, 2025. [4] K. Qayyum, C. K. Jha, S. Ahmadi-Pour, M. Hassan, and R. Drechsler, “LLM-assisted bug identification and correction for Verilog HDL,” ACM Transactions on Design Automation of Electronic Systems, vol. 30, no. 6, pp. 1–28, 2025. [5] H. Wu, Z. He, X. Zhang, X. Yao, S. Zheng, H. Zheng, and B. Yu, “ChatEDA: A large language model powered autonomous agent for EDA,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 43, no. 10, pp. 3184–3197, 2024. [6] C. Liu and D. Chitnis, “EEsizer: LLM-based AI agent for sizing of analog and mixed signal circuit,” IEEE Transactions on Circuits and Systems I: Regular Papers, vol. 73, no. 6, pp. 3825–3834, 2026. [7] Z. Wei, Z. Kong, Y. Wang, D. Z. Pan, and X. Tang, “TopoSizing: An LLM-aided framework of topology-based understanding and sizing for AMS circuits,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 2026, early access. [8] A. Dăescu, A. Guzu, G. Nicolae, and C. Dan, “Assessing the capabilities of large language models to comprehend analog integrated circuits via netlist analysis,” in 2025 3rd Cognitive Models and Artificial Intelligence Conference (AICCONF). IEEE, 2025, pp. 1–7. [9] K. Ye, Q. Yang, Z. Lu, H. Yu, T. Cui, R. Bai, and L. Shen, “LLM4Netlist: LLM-enabled step-based netlist generation from natural language description,” IEEE Journal on Emerging and Selected Topics in Circuits and Systems, vol. 15, no. 2, pp. 337–348, 2025. [10] P. Veličković, A. P. Badia, D. Budden, R. Pascanu, A. Banino, M. Dashevskiy, R. Hadsell, and C. Blundell, “The CLRS algorithmic reasoning benchmark,” in International Conference on Machine Learning. PMLR, 2022, pp. 22 084–22 102. [11] X. Zhao, W. Pang, Z. Yu, X. Jian, X. Song, Y. Xu, Z. Xue, D. Chen, S. Wu, P. Torr et al., “When vision meets graphs: A survey on graph reasoning and learning,” TechRxiv, 2026. [12] L. Kou, W. Fan, X. Huang, B. Lin, B. Yang, J. Zhang, Y. Lin, and M. Wang, “Trivllo: Tri-view dynamic architecture and unified crossmodal representation for efficient fine-grained vision–language understanding,” IEEE Transactions on Reliability, vol. 75, pp. 1281–1290, 2026. [13] S. Wang and M. Fu, “Large language models for graph reasoning: Capabilities, limitations and future directions,” Authorea Preprints, 2026. [14] B. A. Galler and M. J. Fisher, “An improved equivalence algorithm,” Communications of the ACM, vol. 7, no. 5, pp. 301–303, 1964. [15] R. E. Tarjan, “Efficiency of a good but not linear set union algorithm,” Journal of the ACM (JACM), vol. 22, no. 2, pp. 215–225, 1975. [16] E. F. Moore, “The shortest path through a maze,” in Proc. of the International Symposium on the Theory of Switching. Harvard University Press, 1959, pp. 285–292. [17] T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction to Algorithms, 4th ed. Cambridge, MA, USA: MIT Press, 2022. [18] Z. Huang, H. Huang, R. Shi, X. Li, X. Zhang, W. Chen, J. Wang, and Z. Zhu, “Detailed placement and global routing co-optimization with complex constraints,” Electronics, vol. 11, no. 1, p. 51, 2021. [19] H. Kumamoto, E. J. Henley, and K. Inoue, “Signal-flow-based graphs for failure-mode analysis of systems with control loops,” IEEE Transactions on Reliability, vol. R-30, no. 2, pp. 110–116, 1981. [20] E. Cohen, E. Halperin, H. Kaplan, and U. Zwick, “Reachability and distance queries via 2-hop labels,” SIAM Journal on Computing, vol. 32, no. 5, pp. 1338–1355, 2003. [21] J. X. Yu and J. Cheng, “Graph reachability queries: A survey,” in Managing and Mining Graph Data. Springer, 2010, pp. 181–215. [22] L. Alrahis, A. Sengupta, J. Knechtel, S. Patnaik, H. Saleh, B. Mohammad, M. Al-Qutayri, and O. Sinanoglu, “GNN-RE: Graph neural networks for reverse engineering of gate-level netlists,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 41, no. 8, pp. 2435–2448, 2021. [23] P. Ma, J. Li, H. Liu, J. Shi, S. Zhang, W. Pan, and Y. Hao, “Hardware Trojan detection methods for gate-level netlists based on graph neural networks,” IEEE Transactions on Computers, vol. 74, no. 5, pp. 1470– 1481, 2025. [24] Y. Zhang, J. Wang, Z. Chen, and Z. Yang, “Hardware trojan detection on pcbs using density peak clustering,” IEEE Transactions on Reliability, vol. 75, pp. 518–528, 2026. [25] J. White and P. Barbrook-Johnson, “Using vision-language models to extract network data from images of system maps,” Humanities and Social Sciences Communications, vol. 13, p. 1183, 2026.

[26] C. K. Jha, S. Singh, K. Qayyum, A. Bende, M. Hassan, V. Rana, F. Merchant, and R. Drechsler, “veriSiM: Formal verification of SPICE netlists for MAGIC-based logic-in-memory,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 45, no. 2, pp. 845–854, 2026. [27] M. Abdollahi, S. F. Yeganli, M. Baharloo, and A. Baniasadi, “Hardware design and verification with large language models: A scoping review, challenges, and open issues,” Electronics, vol. 14, no. 1, p. 120, 2025. [28] W. K. Lam, Hardware Design Verification: Simulation and Formal Method-Based Approaches, ser. Prentice Hall Modern Semiconductor Design Series. United States: Prentice Hall PTR, 2005. [29] A. Meza and R. Kastner, “Information flow coverage metrics for hardware security verification,” arXiv preprint arXiv:2304.08263, 2023. [30] Ö. B. Peker, E. Toker, D. Öcal, T. Dalyan, E. Afacan, and Y. D. Gökdel, “A fully automated SPICE-compatible netlist extraction from image using deep learning and image preprocessing techniques,” IEEE Access, vol. 14, pp. 19 750–19 765, 2026. [31] A. T. Erozan, M. Hefenbrock, M. Beigl, J. Aghassi-Hagmann, and M. B. Tahoori, “Reverse engineering of printed electronics circuits: From imaging to netlist extraction,” IEEE Transactions on Information Forensics and Security, vol. 15, pp. 475–486, 2020. [32] W. Fang, W. Li, S. Liu, Y. Lu, H. Zhang, and Z. Xie, “NetTAG: A multimodal RTL-and-layout-aligned netlist foundation model via text-attributed graph,” in 2025 62nd ACM/IEEE Design Automation Conference (DAC). IEEE, 2025, pp. 1–7. [33] A. Barredo Arrieta, N. Dı́az-Rodrı́guez, J. Del Ser, A. Bennetot, S. Tabik, A. Barbado, S. Garcı́a, S. Gil-López, D. Molina, R. Benjamins, R. Chatila, and F. Herrera, “Explainable artificial intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI,” Information Fusion, vol. 58, pp. 82–115, 2020.

Related documents

• Near Infrared Spectroscopy in Children With Autism and ADHD#1128087
• Operational design domain monitoring for safe intelligent vehicle navigation#1415208
• Prototipo de automatización para la integración del diagnóstico y el plan de acción bajo el modelo integrado de planeación y gestión (MIPG) en entidades públicas#438478
• DDaT26094 - Supply of End User Devices and IT Peripheral Equipment — ICS on behalf of DSIT and DESNZ — Jigsaw Systems Ltd#1571348
• On-demand Technology Learning Platform — STUDENT LOANS COMPANY LIMITED — COMPUTACENTER (UK) LIMITED#1180963