--- noisedef.h: NOISEAN, acdefs.h: ACAN, trandefs.h: TRANan, spardefs.h: SPAN and other analysis types
The first 3 fields must be equal to JOB fields
    int JOBtype;
    JOB *JOBnextJob;          /* pointer to next thing to do */
    char *JOBname;            /* name of this job */
<-- It is better to place struct JOB instead of them to avoid possible bugs when some of these structures is changed

Ndata
prtSummary <-- is not set

--- cktdefs.h
struct CKTcircuit
char *CKToscNode; /* PSS oscnode */ <-- is not used

--- ifsim.h
struct IFdevice
int flags <-- it is better to place it before #ifdef XSPICE block
// #ifdef OSDI
  registry_entry <-- is not initialized explicitly in devices structures
// #endif

--- optran.c
 /* txl, cpl addition */
 if (converged == 1111) { <-- hardcoded error

--- cktdojob.c
/* txl, cpl addition */
if (error == 1111) break; <-- hardcoded error

--- dctran.c
if (converged == 1111) <-- hardcoded error


    } else
/* gtri - modify - wbk - 12/19/90 - Send IPC stuff */
#endif
#ifdef CLUSTER
        CLUoutput(ckt);
#endif
        if((ckt->CKTmode&MODEUIC && ckt->CKTtime > 0 && ckt->CKTtime >= ckt->CKTinitTime) 
                || (!(ckt->CKTmode&MODEUIC) && ckt->CKTtime >= ckt->CKTinitTime))
            CKTdump(ckt, ckt->CKTtime, job->TRANplot);

<-- if CLUSTER is defined, the next if is not in the 'else' of the previous if

--- klusmp.c
SMPmultiply
iSolution = iRHS ; <-- useless

SMPluFac
if (Matrix->SMPkluMatrix->KLUmatrixCommon == NULL) { <-- after using KLUmatrixCommon in the previous if

SMPreorder
if( Matrix.SMPkluMatrix.KLUmatrixCommon == null )  <-- after using KLUmatrixCommon in the previous if

SMPreorderKLUforCIDER
if( Matrix.SMPkluMatrix.KLUmatrixCommon == null )  <-- after using KLUmatrixCommon in the previous if

--- bjtdefs.h
    BJT_MOD_TE_MAX, <-- 224
    BJT_MOD_RTH0, <-- 225
};

/* device questions */
enum {
    BJT_QUEST_FT = 211, <-- 211 !!!

--- sharedspice.c
/* Allocate space for global constants declared in const.h
 * and set their values */
double CONSTroot2 = CONSTsqrt2;
double CONSTvt0 = CONSTboltz * REFTEMP / CHARGE;
double CONSTKoverQ = CONSTboltz / CHARGE;
double CONSTe = CONSTnap;

<--- why aren't they in const.h as defines?

--- span.c
CKTspnoise
int a = 0;
a++;
if (a == 0) a = 2; <-- ???

initSPmatrix
return (3); <--- hardcoded return value

initSPmatrix
        vNoise = newcmatnoinit(1, ckt->CKTportCount);
        iNoise = newcmatnoinit(1, ckt->CKTportCount);
<--- there are not null checks for vNoise and iNoise after

--- spfactor.c
SearchEntireMatrix
    while (pElement != NULL && pElement->Row < Step)
        pElement = pElement->NextInCol;

    if((LargestInCol = FindLargestInCol(pElement)) == 0.0) <-- pElement can be NULL after 'while'
        continue; /* for loop */

FindBiggestInColExclude
    /* Travel down column until reduced submatrix is entered. */
    while ((pElement != NULL) && (pElement->Row < Step))
        pElement = pElement->NextInCol;

    /* Initialize the variable Largest. */
    if (pElement->Row != Row)                            <-- pElement can be NULL after 'while'
        Largest = ELEMENT_MAG(pElement);
    else
        Largest = 0.0;

ExchangeColElements
/* Element1 must be removed from linked list and moved. */
*ElementAboveRow1 = ElementBelowRow1; <--- set

/* Search column for Row2. */
...

/* Place Element1 in Row2. */
...
*ElementAboveRow1 =ElementBelowRow1; <--- set again

ExchangeColElements
    else {
        /* Element1 does not exist. */
        ...
        if (...) {
            
            ElementBelowRow2 = Element2->NextInCol; <-- ElementBelowRow2 is not used

            /* Move Element2 to Row1. */
            ....
        }
        Element2->Row = Row1;
    }


ExchangeRowElements
/* Element1 must be removed from linked list and moved. */
*ElementLeftOfCol1 = ElementRightOfCol1; <--- set

/* Search Row for Col2. */
...

/* Place Element1 in Col2. */
...
*ElementLeftOfCol1 =ElementRightOfCol1; <--- set again


--- devdefs.h, struct SPICEdev
DEVsenTrunc <-- never used

--- ifsim.h, struct IFdevice
char **termNames <-- never read

----
ckt->CKTcurJob->JOBtype <--- it is compared with different numbers in the code instead of named values
Example: ckt->CKTcurJob->JOBtype != 9
if (task->jobs->JOBtype != 4) 

--- ifsim.h
    /* valid values for the second argument to doAnalyses */

    /* continue the analysis from where we left off */
#define RESUME 0
    /* start everything over from the beginning of this task*/
#define RESTART 1
    /* abandon the current analysis and go on the the next in the task*/
#define SKIPTONEXT 2
<--- They are no used. In doAnalyses, the second argument is hardcoded

--- inpfindl.c
while ((*where == ' ') || (*where == '\t') || (*where == '=') ||
   (*where == ',') || (*where == '(') || (*where == ')') ||
   (*where == '+'))
{  /* legal white space - ignore */
    where++;
} <--- there is not the line end check

--- inpfindv.c
while ((*where == ' ') || (*where == '\t') || (*where == '=') ||
       (*where == ',') || (*where == '(') || (*where == ')') ||
       (*where == '+')) {   /* legal white space - ignore */
    where++;
} <--- there is not the line end check

printf("Warning -- Version not specified on line \"%s\"\nSetting version to 'default'.\n", line);
return (NULL); <-- it returns NULL at both branches and prints the same text
<-- 

--- inpeval.c, inpgtok.c
INPevaluate(char **line,...
*error = INPgetUTok(line, &token, 0); <-- token can return a new string from INPgetUTok: *token = copy_substring(*line, point);
...
  /* loop through all of the input token */
  here = token; <---
...
if (gobble) {
    FREE(token);
} else {
    *line = here; <--- what does it happen with the previous 'line'?
}

--- inpgmod.c
create_model
    } else if ((strcmp(parm, "level") == 0) || (strcmp(parm, "m") == 0)) { <--- 'm' parameter can't be used in models because 'm' is handled here
        /* no instance parameter default for level and multiplier */
        /* just grab the number and throw away */
        /* since we already have that info from pass1 */
        INPgetValue(ckt, &line, IF_REAL, tab);
        
    }

--- devdefs.h, struct SPICEdev
DEVsenSetup
DEVsenLoad
DEVsenUpdate
DEVsenAcLoad
DEVsenPrint
DEVsenTrunc
<-- they are not invoked. According description, they are used for an old method.

--- bjtsoachk.c
if (pd > pd_max) {
    soa_printf(ckt, (GENinstance*)here,
        "Pd=%.4g W has exceeded Pd_max=%.4g W\n        at Vce=%.4g V, Ib=%.4g A, Ic=%.4g A, and Te=%.4g C\n",
        pow, pd_max, vce, ib, ic, here->BJTtemp - CONSTCtoK); <--- pow is a function! must be pd?
    warns_pd++;
}

--- bjtload.c
if(){
    ....
   bypassing....
   cc = *(ckt->CKTstate0 + here->BJTcc); <---
}
...
 /*
  *   weil's approx. for excess phase applied with backward-
  *   euler integration
  */
 cc=0; <--- cc is overwrited

--- optran.c
double optime = 0;
...
if(optime == 0) { <--- always true here


/*  First, try a straight solution with all sources at zero */
converged = NIiter(ckt, ckt->CKTdcTrcvMaxIter); <--- 'converged' is not used here


#if !defined SHARED_MODULE
    goto nextTime;  /* no check on first time point */
#else
   redostep = 0;
   goto chkStep;
#endif
<--- several places where a different flow for a shared module. is this correct?

--- inpcompat.c
/* find the model */
static bool find_a_model(
        struct vsmodels *vsmodel, char *name, char *subcktline)
{
    struct vsmodels *x; <-- is not used
    for (x = vsmodel; vsmodel; vsmodel = vsmodel->nextmodel)


struct card *pspice_compat(struct card *oldcard)
...
#ifdef INTEGRATE_UDEVICES
    {
        struct card *ucard;
#ifdef TRACE
        list_the_cards(newcard, "Before udevices");
#endif
        ucard = u_instances(newcard); <--- ucard is not used
#ifdef TRACE
        list_the_cards(newcard, "After udevices");
#endif
    }
#endif

--- ckttroub.c
icode = CKTtypelook("Isource"); <-- is not used

--- isrcacct.c
case PWL: {
    int i;
    if(ckt->CKTtime < *(here->ISRCcoeffs)) {
        if(ckt->CKTbreak) {
           error = CKTsetBreak(ckt,*(here->ISRCcoeffs)); <-- error is ignored

--- isrcload.c
case SFFM: {
....
TD = here->ISRCfunctionOrder > 5 <--- TD is not used, and PHASEM uses the same definition
                ? here->ISRCcoeffs[5] : 0;
PHASEM = here->ISRCfunctionOrder > 5
             ? here->ISRCcoeffs[5] : 0.0;

--- numenum.h
/* Time-Integration Method */
#ifndef TRAPEZOIDAL
#define TRAPEZOIDAL  1
#define BDF 	     2
#define GEAR	     2 <-- equal to BDF
#endif

--- dctrcurv.c
/* else do new algorithm */

/* first get the current step in the analysis */
if (job->TRCVvType[0] == vcode) {
    g_mif_info.circuit.evt_step =
        ((VSRCinstance *)(job->TRCVvElt[0]))->VSRCdcValue;
} else if (job->TRCVvType[0] == icode) {
    g_mif_info.circuit.evt_step =
        ((ISRCinstance *)(job->TRCVvElt[0]))->ISRCdcValue;
} else if (job->TRCVvType[0] == rcode) {
    g_mif_info.circuit.evt_step =
        ((RESinstance*)(job->TRCVvElt[0]->GENmodPtr))->RESresist; <--- casting GENmodPtr to RESinstance
} else if (job->TRCVvType[0] == TEMP_CODE) {
    g_mif_info.circuit.evt_step =
        ckt->CKTtemp - CONSTCtoK;
}
….
if (job->TRCVvType[0] == rcode) { /* resistance */
    printf("Current Resistance Value : %.5e Ohm\n",
           ((RESinstance*)(job->TRCVvElt[0]->GENmodPtr))->RESresist); <--- casting GENmodPtr to RESinstance
}

--- dense.c
showmat and showcmat
for (int i = 0; i < A->row; i++) {
	for (int j = 0; j < A->col; j++) {
		if (j < A->col) { <-- always true
			printf("%f\t", A->d[i][j]);
		}
		else {
			printf("%f", A->d[i][j]);
		}
	}
	if (i < A->row) { <-- always true
		printf("\n");
	}
	else {
		printf("]\n");
	}
}

MatList* qr(Mat* A) {
Mat* uj = newmat(r, 1, 0);
...
for (int j = 0; j < r; j++) {
	...
	for (int k = 0; k < j - 1; k++) {
	...
		uj = minus(uj, ek); <--- uj, possible memory leak?
	}
...
}
...
freemat(uj);
...


--- initSPmatrix
    ckt->CKTBmat = newcmat(ckt->CKTportCount, ckt->CKTportCount, 0.0, 0.0);
    if (ckt->CKTBmat == NULL)
        return (3); <--- hardcoded return value


--- inp.c
controlled_exit(1); <--- EXIT_BAD ?

recifeval
else if (ciprefix(".endif", nd->line)) {
    elsefound = elseiffound = iffound = 0; <--- useless
    elsetrue = elseiftrue = iftrue = 0; <--- useless
    *s = '*';
    return;
}

doedit
    editor = "/usr/bin/vi"; <--- may be path must be in some config path?

inp_spsource
    endTime = seconds(); <--- endTime is not used

inp_dodeck
    bool have_err = FALSE; <--- useless
    ...
        have_err = TRUE; <--- useless
        return 1;

--- dcop.c
DCop
if (ckt->CKTsoaCheck)
   error = CKTsoaCheck(ckt); <-- error is not used

--- distoan.c
DISTOan
error = CKTacDump(ckt,ckt->CKTrhsOld[0],acPlot); <-- error is not used in one case

--- noisean.c
NOISEan
data = TMALLOC(Ndata, 1); <--- if there are multiple calling, it will be a memory leak

--- cktsens
int sens_sens(CKTcircuit* ckt, int restart) <---  a lot of static variables. Is this really necessary?

        if (is_dc)
            nvalue.v.vec.rVec = output_values; <---  'length of vector' is not set. is this correct?
        else
            nvalue.v.vec.cVec = output_cvalues; <---  'length of vector' is not set. is this correct?

--- dcpss.c
DCpss

 * Breakpoint handling scheme:
#ifdef STEPDEBUG
    fprintf (stderr, "Delta %g accepted at time %g (finaltime: %g)\n", ckt->CKTdelta, ckt->CKTtime, ckt->CKTfinalTime) ;
    fflush(stdout); <--- stdout, but printf to stderr (several places)
#endif /* STEPDEBUG */

    fprintf(stderr, "%%%5.2lf\b\b\b\b\b\b\b", ckt->CKTtime / ckt->CKTfinalTime * 100);
fflush(stdout); <--- the same

DFT
thd; <-- is not used
save_order; <-- is not used
int save_mode; <-- is not used
oscnNode; <-- is not used
time_err_min_1; <-- is not used
err_min_1; <--- used only for debugging

--- vectors.c
get_all_type
    /* Check for start of "all" */
    if (tolower(word[0] != 'a')) { <--- tolower(word[0]) ?
        return ALL_TYPE_NONE;
    }
    if (tolower(word[1] != 'l')) { <--- tolower(word[1]) ?
        return ALL_TYPE_NONE;
    }
    if (tolower(word[2] != 'l')) { <--- tolower(word[2]) ?
        return ALL_TYPE_NONE;
    }

vec_basename
if (cieq(v->v_plot->pl_typename, v->v_name))
    (void) strcpy(buf, v->v_name + strlen(v->v_name) + 1); <---
else
    (void) strcpy(buf, v->v_name); <--- what dfference between 2 branches?

--- indsetup.c
#define PI 3.141592654 <--- why not M_PI?

--- udevices.c
u_process_instance
fprintf(stderr, "ERROR bad syntax in logicexp\n");
fflush(stdout); <--- may be stderr?

fprintf(stderr, "ERROR bad syntax in pindly\n");
fflush(stdout); <--- may be stderr?

fprintf(stderr, "ERROR unknown U* device\n");
fflush(stdout); <--- may be stderr?

fprintf(stderr, "ERROR U* device syntax error\n");
fprintf(stderr, "ERROR at line  \"%s\"\n", nline);
if (ps_udevice_exit) {
    fflush(stdout); <--- may be stderr?

--- logicexp.c
static bool bparse(char *line, bool new_lexer, int optimize)
{
    ...
    DS_CREATE(stmt, LEX_BUF_SZ); <--- why is stmt required?
    ...
    while (lookahead != '\0') {
        ds_clear(&stmt);
        ds_cat_str(&stmt, parse_lexer->lexer_buf);
        ...
    }

    ...
    ds_free(&stmt);
    ...
    return ret_val;
}

--- inpcom.c
is_a_modelname

/* not beeing a valid number */
testval = strtod(s, &st);
/* conversion failed, so no number */
if (eq(s, st)) { <-- may be better: if( s == st )
    return TRUE;
}

inp_fix_inst_line
    inst_name_end = skip_non_ws(inst_line); <--- inst_name_end is not used?
    inst_name = copy_substring(inst_line, inst_name_end); <--- inst_name is not used?
    ...
    tfree(inst_name);

inp_get_w_l_x
...
for (; card; card = card->nextcard) {
    ...
    int skip_control = 0;
    ...
    /* exclude any command inside .control ... .endc */
    if (ciprefix(".control", curr_line)) {
        skip_control++;
        continue;
    }
    else if (ciprefix(".endc", curr_line)) {
        skip_control--;
        continue;
    }
    else if (skip_control > 0) { <-- always false. must skip_control=0 be before for?
        continue;
    }
...
}

--- inpc_probe.c
inp_probe
havedifferential <-- only written, not read

/* node containing ':' 
vd(R1:1,R2:2)
vd(M4:1:3)
vd(m5:d:s)*/
else {
    char* tmpstr2, *nodename1, *nodename2;
    struct card* tmpcard2;
    tmpstr2 = tmpstr; <--- tmpstr2 is not used here
    ...
    tmpstr++;
    tmpstr2 = tmpstr;


/* vd(M4:1:3) */
...
if (!nodename1) {
   ...
    continue;
}
...
nodename2 =  gettok_char(&tmpstr2, ')', FALSE, FALSE);
if (!nodename1 || !nodename2) { <--- !nodename1 is always false here
    ...
    continue;
}

--- cmath1.c
cx_sqrt
for (i = 0; i < length; i++)
    if (dd[i] < 0.0)
        cres = 1; <--- the loop can be stopped here

--- cmath4.c
void * cx_deriv
    return (char *) outdata; <--- (void*) ?

void* cx_integ
    return (char*)outdata;  <--- (void*) ?

void* cx_group_delay
    return ((char *) group_delay);  <--- (void*) ?

--- parse.c
PPlex
if ((sbuf[0] == 'g') && (sbuf[1] == 't') && <-- lots of ifs with testing indexes sbuf+N
...

switch (*sbuf) {
case '\0': <-- test to end of string after using sbuf[1]
    lexer_return(*sbuf, 0);

--- com_history
dohsubst
char buf[BSIZE_SP], *s, *r = NULL, *t; <-- char* r = NULL here
....
default:
...
for (s = ":^$*-%"; *s; s++) {
    t = strchr(buf, *s);
    if (t && ((t < r) || !r)) { <--- t < r !
        r = t;
        string += r - buf;
    }
}

dohmod
/* Now we know what wordlist we want. Take care of modifiers now. */
r = NULL;
for (s = ":^$*-%"; *s; s++) {
    t = strchr(*string, *s);
    if (t && ((t < r) || (r == NULL))) <-- t < r !
        r = t;
}

numwords = wl_length(wl); <-- numwords is not used
if (**string && *++*string)
    goto anothermod;

--- rawfile.c
raw_read

// This cast is bad, but...
if (cieq((char *) v->v_scale, nv->v_name)) { <--- why not v->v_scale->v_name ?
    v->v_scale = nv;
    break;
}

 // This cast is bad, but...
fprintf(cp_err,
        "Error: no such vector %s\n", (char *) v->v_scale) <--- why not v->v_scale->v_name ?

} else if (ciprefix("scale=", t)) {
    // This cast is bad, but...
    v->v_scale = (struct dvec *) copy(t + 6);--- why not v->v_scale->v_name = copy(t + 6) ?

/* Note that we reverse these commands eventually... */
s = SKIP(buf);
/* Exec command only if not ngspice simulator info */
if (!ciprefix(ft_sim->simulator, s)) {
    NONL(s);
    if (curpl) {
        curpl->pl_commands = wl_cons(copy(s), curpl->pl_commands);
        wl = curpl->pl_commands;  <--- wl is not used
    }
    else {
        fprintf(cp_err, "Error: misplaced Command: line\n");
    }
    /* Now execute the command if we can. */
    (void)cp_evloop(s);
}

--- spiceif.c
if_getstat
if (ft_sim->askAnalysisQuest (ckt,
                              &(ft_curckt->ci_curTask->taskOptions),
                              if_parm->id, &parm,
                              NULL) == -1) <--- what is -1? askAnalysisQuest returns codes from iferrmsg.h, E_BADPARM=7 for example, but CKTacct returns 0 or -1
{
    fprintf(cp_err, "if_getstat: Internal Error: can't get %s\n", name);
    return (NULL);
}

--- shyu.c
if_sens_run
    err = ft_sim->newTask (ft_curckt->ci_ckt, &(ft_curckt->ci_specTask),
                           "special", & (ft_curckt->ci_defTask));
    if (err) {
        ft_sperror(err, "newTask");
        return (0); /* temporary */
    }

    which = ft_find_analysis("options");

    if (which == -1) {
        /* in DEEP trouble */
        ft_sperror(err, "in DEEP trouble"); <-- err is 0 here
        return (0); /* temporary */
    }

--- device.c
printdesc
if (p.dataType & IF_NONSENSE)
    strncat(flags_str, "X", 20); <-- 20 ? here and later
...

--- gens.c
dgen_nth_next(dgen **p_dg, int n)
{
    int    i, dnum;
    dgen  *dg_save = *p_dg; /* va: save, to avoid memory leak */

    dnum = (*p_dg)->dev_type_no;

    for (i = 0; *p_dg && (*p_dg)->dev_type_no == dnum && i < n; i++) {
        dgen_next(p_dg);
        /* va: it might be too much tests, but safer is better... */
        if (*p_dg != dg_save && *p_dg == NULL && dg_save != NULL)
            tfree(dg_save); <-- maybe if and tfree should be after the for loop?
    }
}

--- pvec.c
pvec
if (len > icopy) {
    fprintf(stderr, "Warning: Potential buffer overflow while setting a vector dimension"); <-- \n missed ?
}

--- streams.c
cp_redirect
if (!fp) {
    tfree(fname);
    perror(fname); <--- after tfree
    goto error;
}

--- break.c
ft_bpcheck
 if (dt == NULL) {<--- always true

--- com_measure2.c
measure_rms_integral
/* Now set the measurement values if not set */
if (toVal < 0.0) {
    if (ac_check) {
        if (d->v_compdata) {
            value = get_value(meas, d, i); //d->v_compdata[i].cx_real;
        } else {
            value = d->v_realdata[i];
            // fprintf(cp_err, "Warning: 'meas ac' input vector is real!\n");
        }
        xvalue = xScale->v_compdata[i].cx_real;
        toVal = xScale->v_compdata[d->v_length-1].cx_real;
    } else {
        toVal = xScale->v_realdata[d->v_length-1];
    }
} <--- value and xvalue are not used

--- misccoms.c
void
com_bug(wordlist *wl)
{
    NG_IGNORE(wl);

    fprintf(cp_out,
            "Please use the ngspice bug tracker at:\n"
            "https://sourceforge.net/p/ngspice/bugs/\n"); <--  maybe better place links in some one place?
}

--- spiceif.c
parmtolist
    int              i;

    for (i = pv->v.numValue; --i >= 0;) {
        switch (opt->dataType & (IF_VARTYPES & ~IF_VECTOR)) {
        case IF_INTEGER:
            list = var_alloc_num(NULL, pv->v.vec.iVec[i], list);
            break;
        case IF_REAL:
        case IF_COMPLEX:
            list = var_alloc_real(NULL, pv->v.vec.rVec[i], list);
            break;
        case IF_STRING:
            list = var_alloc_string(NULL, copy(pv->v.vec.sVec[i]), list);
            break;
        case IF_FLAG:
            list = var_alloc_bool(NULL, pv->v.vec.iVec[i] ? TRUE : FALSE,
                                  list);
            break;
        default:
            fprintf(cp_err,
                    "parmtolist: Internal Error: bad PARM type "
                    "%#x for %s (%s).\n",
                    opt->dataType, opt->keyword, opt->description);
            if (name)
                free(name);
            break;
        }
    }

    if (i || pv->v.numValue == 0) <-- always true?
        list = var_alloc_vlist(name, list, NULL);

--- inpcom.c
inp_get_func_from_line
...
    function->body = copy(end);

    if (inp_strip_braces(function->body)) { <-- inp_strip_braces is used only 1 time in the code, it makes changes in the ->body, but it looks like it is not required
        int i;

        char *accept = TMALLOC(char, function->num_parameters + 1);
        for (i = 0; i < function->num_parameters; i++)
            accept[i] = function->params[i][0];
        accept[i] = '\0';

        function->accept = accept;
        return;
    }

    tfree(function->body);


inp_expand_macro_in_str
    if (curr_str == NULL) {
        curr_str = orig_ptr;
    }
    else {
        if (str != NULL) { <-- it looks like str can't be NULL here
            size_t curr_str_len = strlen(curr_str);
            size_t len = strlen(str) + 1;
            curr_str = TREALLOC(char, curr_str, curr_str_len + len);
            sprintf(curr_str + curr_str_len, "%s", str);
        }
        tfree(orig_ptr);
    }

--- newcoms.c
com_reshape
/* find the first '[' */

p = NULL;
for (w = wl; w; w = w->wl_next) {
    if ((p = strchr(w->wl_word, '[')) != NULL)
        break;
}
if (p && *p) {
    if (p != w->wl_word)
        w = w->wl_next;
    wlast = w;
    *p++ = '\0'; <-- is this required?
} else {
    wlast = NULL;
}

--- com_options.c
com_option
printf("Sparse 1.3\n"); <-- version is hard coded

--- com_ahelp.c
/* assert: number of commands must be less than 512 */
struct comm *cc[512]; <-- there must be some check for the size

/* sort the commands */
for (n = 0; cp_coms[n].co_func != NULL; n++)
    cc[n] = &cp_coms[n];

--- grid.c
drawlingrid
 for (i = 0, m = lmt * 100.0;
      m - 0.001 <= hmt * 100.0;
      i += spacing, m += step)
 {
     j = (int)m;
...
     /* This is to make sure things work when delta > hi - lo. */
     if (nsp == 1)
         j += 1000; <-- not used
 }

drawsmithgrid
mag = (int)floor(mylog10(maxrad)); <--- useless
...
for (mag = -20; mag < 20; mag++) {

--- device.c
all_show
count = (screen_width - LEFT_WIDTH) / (DEV_WIDTH + 1); <--- ??
count = 1;

--- string.c
/*-------------------------------------------------------------------------*
 * this function strips all white space inside parens
 * is needed in gettoks (dotcards.c) for correct processing of expressions
 * like "    .plot v(   5  , 4  ) v( 6 )" -> .plot v(5,4) v(6)"
 *-------------------------------------------------------------------------*/
char *
stripWhiteSpacesInsideParens(const char *str)
<--- it strips only 1 pair of (). Example: mag( v(pr1)  ) -> mag(v(pr1)  )

--- runcoms2.c
com_resume
  for (db = dbs, resumption = FALSE; db; db = db->db_next)
     if (db->db_type == DB_IPLOT || db->db_type == DB_IPLOTALL)
         resumption = TRUE; <-- break should be added

--- cktop.c
CKTop
    if (converged == 106) <-- hardcoded value

---
bjtdef.h
    BJTgbcx <-- used only to read data

---
bsim1def.h
   B1cqb, B1cqg, B1cqd, B1cqbd, B1cqbs, B1vono <-- used only to read data

--- b1ld.c
B1load
qsrc <-- only computed, not used

--- diodefs.h
typedef struct sDIOinstance {
...
    double DIOdIdio_dT; <-- the same name is used for #define
    double DIOdIdioSW_dT; <-- the same name is used for #define
...
} DIOinstance ;

#define DIOdIdio_dT DIOstate+13 <-- the same name is used in struct sDIOinstance
#define DIOdIdioSW_dT DIOstate+14 <-- the same name is used in struct sDIOinstance

--- ltramisc.c
LTRAlteCalculate
    f1i = hivalue1;
    g1i = intlinfunc(lolimit1, hilimit1, lovalue1, hivalue1, lolimit1, hilimit1);
    h1dashTfirstCoeff = 0.5 * f1i * (curtime - *(ckt->CKTtimePoints + ckt->CKTtimeIndex)) - g1i; <-- not used


    hivalue1 = LTRArcH2TwiceIntFunc(hilimit1, model->LTRArclsqr);
    lovalue1 = 0.0;

    f1i = hivalue1;
    g1i = intlinfunc(lolimit1, hilimit1, lovalue1, hivalue1, lolimit1, hilimit1);
    h1dashTfirstCoeff = 0.5 * f1i * (curtime - *(ckt->CKTtimePoints + ckt->CKTtimeIndex)) - g1i; <-- not used


    hivalue1 = LTRArcH2TwiceIntFunc(hilimit1, model->LTRArclsqr);
    lovalue1 = 0.0;

    f1i = hivalue1;
    g1i = intlinfunc(lolimit1, hilimit1, lovalue1,
	hivalue1, lolimit1, hilimit1);
    h1dashTfirstCoeff = 0.5 * f1i * (curtime -
	*(ckt->CKTtimePoints + ckt->CKTtimeIndex)) - g1i;

--- jfetdefs.h
/* device questions */
enum {
    JFET_DRAINNODE = 301, <--
...
};

/* model questions */
enum {
    JFET_MOD_DRAINCONDUCT = 301, <-- the same number. is it correct?
...
};


--- fte2defs.h
/* device questions */
enum {
    JFET2_DRAINNODE = 301, <--
...
};

/* model questions */
enum {
    JFET2_MOD_DRAINCONDUCT = 301, <-- the same number. is it correct?
...
};

--- mos1ask.c
MOS1ask
        case MOS1_OFF:
            value->rValue = here->MOS1off; <-- maybe value->iValue?
            return(OK);

--- mos2ask.c
MOS2ask
        case MOS2_OFF:
            value->rValue = here->MOS2off; <-- maybe value->iValue?
            return(OK);

--- mos3ask.c
MOS3ask
        case MOS3_OFF:
            value->rValue = here->MOS3off; <-- maybe value->iValue?
            return(OK);

--- mos6ask.c
MOS6ask
        case MOS6_OFF:
            value->rValue = here->MOS6off; <-- maybe value->iValue?
            return(OK);

--- mos9ask.c
MOS9ask
        case MOS69_OFF:
            value->rValue = here->MOS9off; <-- maybe value->iValue?
            return(OK);

--- b2ask.c
B2ask
        case BSIM2_OFF:
            value->rValue = here->B2off; <-- maybe value->iValue?
            return(OK);

--- b3ask.c
BSIM3ask
        case BSIM3_OFF:
            value->rValue = here->BSIM3off; <-- maybe value->iValue?
            return(OK);

--- b3v0ask.c
BSIM3v0ask
        case BSIM3v0_OFF:
            value->rValue = here->BSIM3v0off; <-- maybe value->iValue?
            return(OK);

--- b3v1ask.c
BSIM3v1ask
        case BSIM3v1_OFF:
            value->rValue = here->BSIM3v1off; <-- maybe value->iValue?
            return(OK);

--- b3v32ask.c
BSIM3v32ask
        case BSIM3v32_OFF:
            value->rValue = here->BSIM3v32off; <-- maybe value->iValue?
            return(OK);

--- mos3temp.c
MOS3temp
if(!model->MOS3vt0Given) {
    if(!model->MOS3surfaceStateDensityGiven) 
            model->MOS3surfaceStateDensity=0;
    vfb = wkfngs - model->MOS3surfaceStateDensity * 1e4 
            * CHARGE/model->MOS3oxideCapFactor;
    model->MOS3vt0 = vfb + model->MOS3type * 
            (model->MOS3gamma * sqrt(model->MOS3phi)+
             model->MOS3phi);
} else {
    vfb = model->MOS3vt0 - model->MOS3type * (model->MOS3gamma*
        sqrt(model->MOS3phi)+model->MOS3phi); <--- vfb is not used
}

--- b1noi.c
B1noise
	 NevalSrc(&noizDens[B1IDNOIZ],&lnNdens[B1IDNOIZ],
		 ckt,THERMNOISE,inst->B1dNodePrime,inst->B1sNodePrime,
                (2.0/3.0 * fabs(inst->B1gm * inst->B1m)));<-- ??? inst->B1gm is #define B1gm B1states+ 7

	 noizDens[B1FLNOIZ] *= model->B1fNcoef * inst->B1m *
			 exp(model->B1fNexp *
			 log(MAX(fabs((double)inst->B1cd),N_MINLOG))) / <-- ??? inst->B1cd is #define B1cd B1states+ 4
			 (data->freq *
			 (inst->B1w - model->B1deltaW * 1e-6) *
			 (inst->B1l - model->B1deltaL * 1e-6) *
			 model->B1Cox * model->B1Cox);

--- b2eval.c
B2evaluate
    if ((model->B2channelChargePartitionFlag > 1) <--
	 || ((!ChargeComputationNeeded) &&
	 (model->B2channelChargePartitionFlag > -5))) <-- B2channelChargePartitionFlag is either 0 or 1

--- b2mask.c
B2mAsk
        case  BSIM2_MOD_DELTAL :
          value->rValue = model->B2deltaL =  value->rValue; <-- is this corect?
            return(OK);
        case  BSIM2_MOD_DELTAW :
          value->rValue = model->B2deltaW =  value->rValue; <-- is this corect?
            return(OK);

--- b2noi.c
B2noise
	NevalSrc(&noizDens[B2IDNOIZ],&lnNdens[B2IDNOIZ],
		 ckt,THERMNOISE,inst->B2dNodePrime,inst->B2sNodePrime,
                 (2.0/3.0 * fabs(inst->B2gm * inst->B2m)));<-- ??? inst->B2gm is #define B2gm B2states+ 7


	noizDens[B2FLNOIZ] *= model->B2fNcoef * inst->B2m *
		 exp(model->B2fNexp *
		 log(MAX(fabs((double)inst->B2cd),N_MINLOG))) / <-- ??? inst->B2cd is #define B2cd B2states+ 4
		 (data->freq *
		 (inst->B2w - model->B2deltaW * 1e-6) *
		 (inst->B2l - model->B2deltaL * 1e-6) *
		 model->B2Cox * model->B2Cox);

--- b3.c
char *BSIM3names[] = {
   "Drain",
   "Gate",
   "Source",
   "Bulk",
   "Charge" <--
};
int        BSIM3nSize = NUMELEMS(BSIM3names);
<--- 5 node names but 4 external nodes in sBSIM3instance
In bsim3init.c:
.terms = &BSIM3nSize, <-- 5
But in bsim3def.h, typedef struct sBSIM3instance:
typedef struct sBSIM3instance
{
...
    const int BSIM3dNode;
    const int BSIM3gNode;
    const int BSIM3sNode;
    const int BSIM3bNode; <--- 4 external nodes
    int BSIM3dNodePrime;
    int BSIM3sNodePrime;
    int BSIM3qNode; /* MCJ */
...

--- b3ld.c
BSIM3load
#define Charge_q 1.60219e-19 <--- why not numconst.h CHARGE 1.602191770e-19 ?

--- b3temp.c
BSIM3temp
#define Charge_q 1.60219e-19 <--- why not numconst.h CHARGE 1.602191770e-19 ?

--- b3set.c
BSIM3setup
#define PI 3.141592654 <--- why not M_PI ?

--- b3v0.c
char *BSIM3v0names[] = {
   "Drain",
   "Gate",
   "Source",
   "Bulk",
   "Charge" <--
};
int	BSIM3v0nSize = NUMELEMS(BSIM3v0names);
<--- 5 node names but 4 external nodes in sBSIM3v0instance
In bsim3v0init.c:
.terms = &BSIM3v0nSize, <-- 5
But in bsim3v0def.h, typedef struct sBSIM3v0instance:
typedef struct sBSIM3v0instance
{
...
    const int BSIM3v0dNode;
    const int BSIM3v0gNode;
    const int BSIM3v0sNode;
    const int BSIM3v0bNode; <--- 4 external nodes
    int BSIM3v0dNodePrime;
    int BSIM3v0sNodePrime;
    int BSIM3v0qNode; /* MCJ */
...

--- b3v0ld.c
BSIM3v0load
#define Charge_q 1.60219e-19 <--- why not numconst.h CHARGE 1.602191770e-19 ?

--- b3v0temp.c
BSIM3v0temp
#define Charge_q 1.60219e-19 <--- why not numconst.h CHARGE 1.602191770e-19 ?

--- b3v0set.c
BSIM3v0setup
#define PI 3.141592654 <--- why not M_PI ?

--- b3v1.c
char *BSIM3v1names[] = {
   "Drain",
   "Gate",
   "Source",
   "Bulk",
   "Charge" <--
};
int	BSIM3v1nSize = NUMELEMS(BSIM3v1names);
<--- 5 node names but 4 external nodes in sBSIM3v1instance
In bsim3v0init.c:
.terms = &BSIM3v1nSize, <-- 5
But in bsim3v1def.h, typedef struct sBSIM3v1instance:
typedef struct sBSIM3v1instance
{
...
    const int BSIM3v1dNode;
    const int BSIM3v1gNode;
    const int BSIM3v1sNode;
    const int BSIM3v1bNode; <--- 4 external nodes
    int BSIM3v1dNodePrime;
    int BSIM3v1sNodePrime;
    int BSIM3v1qNode; /* MCJ */
...

--- b3v1ld.c
BSIM3v1load
#define Charge_q 1.60219e-19 <--- why not numconst.h CHARGE 1.602191770e-19 ?

--- b3v1temp.c
BSIM3v1temp
#define Charge_q 1.60219e-19 <--- why not numconst.h CHARGE 1.602191770e-19 ?

--- b3v1set.c
BSIM3v1setup
#define PI 3.141592654 <--- why not M_PI ?

--- b3v32.c
char *BSIM3v32names[] = {
   "Drain",
   "Gate",
   "Source",
   "Bulk",
   "Charge" <--
};
int	BSIM3v32nSize = NUMELEMS(BSIM3v32names);
<--- 5 node names but 4 external nodes in sBSIM3v32instance
In bsim3v32init.c:
.terms = &BSIM3v32nSize, <-- 5
But in bsim3v32def.h, typedef struct sBSIM3v32instance:
typedef struct sBSIM3v32instance
{
...
    const int BSIM3v32dNode;
    const int BSIM3v32gNode;
    const int BSIM3v32sNode;
    const int BSIM3v32bNode; <--- 4 external nodes
    int BSIM3v32dNodePrime;
    int BSIM3v32sNodePrime;
    int BSIM3v32qNode; /* MCJ */
...

--- b3v32ld.c
BSIM3v32load
#define Charge_q 1.60219e-19 <--- why not numconst.h CHARGE 1.602191770e-19 ?

--- b3v32temp.c
BSIM3v32temp
#define Charge_q 1.60219e-19 <--- why not numconst.h CHARGE 1.602191770e-19 ?

--- b3v32set.c
BSIM3v32setup
#define PI 3.141592654 <--- why not M_PI ?

--- b4soi.c
char *B4SOInames[] = {
   "Drain",
   "Gate",
   "Source",
   "Backgate",
   "",
   "Body",
   "Temp",
   "Charge", <-- 8
};
int	B4SOInSize = NUMELEMS(B4SOInames);
<--- 8 node names but 7 external nodes in sB4SOIinstance
In b4soiinit.c:
.terms = &B4SOInSize, <-- 8
But in b4soidef.h, typedef struct sB4SOIinstance:
typedef struct sBSIM3v32instance
{
...
    const int B4SOIdNode;
    const int B4SOIgNodeExt; /* v3.1 changed gNode to gNodeExt */
    const int B4SOIsNode;
    const int B4SOIeNode;
    const int B4SOIpNodeExt;
    const int B4SOIbNodeExt;
    const int B4SOItempNodeExt; <---
    int B4SOIpNode;
    int B4SOIbNode;
    int B4SOItempNode;
    int B4SOIdNodePrime;
    int B4SOIsNodePrime;
    int B4SOIgNode;    /* v3.1 */
    int B4SOIgNodeMid; /* v3.1 */
    int B4SOIdbNode;   /* v4.0 */
    int B4SOIsbNode;   /* v4.0 */
...

--- b4soidef.h
typedef struct sB4SOIinstance
{
...
    double B4SOIqb; <--- the same name used for #define
...
    #define B4SOIqb B4SOIstates+ 12 <--- the same name used in the struct
...
}

--- b4.c
char *BSIM3v32names[] = {
   "Drain",
   "Gate",
   "Source",
   "Bulk",
   "Charge" <--
};
int BSIM4nSize = NUMELEMS(BSIM4names);
<--- 5 node names but 4 external nodes in sBSIM4instance
In b4soiinit.c:
.terms = &BSIM4nSize, <-- 5
But in b4soidef.h, typedef struct sBSIM4instance:
typedef struct sBSIM4instance
{
...
    const int BSIM4dNode;
    const int BSIM4gNodeExt;
    const int BSIM4sNode;
    const int BSIM4bNode;<--- 4 external nodes
    int BSIM4dNodePrime;
    int BSIM4gNodePrime;
    int BSIM4gNodeMid;
    int BSIM4sNodePrime;
    int BSIM4bNodePrime;
    int BSIM4dbNode;
    int BSIM4sbNode;
    int BSIM4qNode;
...

--- b4soidef.h
typedef struct sBSIM4instance
{
...
    double BSIM4qdef; <--- the same name used for #define
...
    #define BSIM4qdef BSIM4states+ 27 <--- the same name used in the struct
...
}

--- b4soiset.c
double epsrox, toxe, epssub; <-- can be local vars
double NchMax; /* v4.4  */ <-- can be local var

--- b4.c
char *BSIM4names[] = {
   "Drain",
   "Gate",
   "Source",
   "Bulk",
   "Charge" <-- 5 external nodes, but 4 external nodes in the struct sBSIM4instance
};

--- b4ask.c
BSIM4ask
    value->rValue = here->BSIM4off; <-- maybe value->iValue ?

--- b4temp.c
BSIM4temp
    int Fatal_Flag = 0; <--- several times assigned but never used

--- b4mpar.c
BSIM4mParam
    case  BSIM4_MOD_VERSION :
        mod->BSIM4version = value->sValue; <--- should BSIM4version be freed before?

--- b4v5.c
char *BSIM4v5names[] = {
   "Drain",
   "Gate",
   "Source",
   "Bulk",
   "Charge" <-- 5 external nodes, but 4 external nodes in the struct sBSIM4v5instance
};

--- bsim4v5def.h
typedef struct sBSIM4v5instance
{
...
    double BSIM4v5qdef; <--- the same name used for #define
...
    #define BSIM4v5qdef BSIM4v5states+ 27 <--- the same name used in the struct
...
}

--- b4v5ask.c
BSIM4v5ask
    case BSIM4v5_OFF:
        value->rValue = here->BSIM4v5off; <--- may be value->iValue?

--- bsim4v6def.h
typedef struct sBSIM4v6instance
{
...
    double BSIM4v6qdef; <--- the same name used for #define
...
    #define BSIM4v6qdef BSIM4v6states+ 27 <--- the same name used in the struct
...
}

--- b4v6.c
char *BSIM4v6names[] = {
   "Drain",
   "Gate",
   "Source",
   "Bulk",
   "Charge" <-- 5 external nodes, but 4 external nodes in the struct sBSIM4v6instance
};

--- b4v6mpar.c
BSIM4v6mParam
    case  BSIM4v6_MOD_VERSION :
        mod->BSIM4v6version = value->sValue; <--- should BSIM4v6version be freed before?

--- b4v6ask.c
BSIM4v6ask
    value->rValue = here->BSIM4v6off; <-- maybe value->iValue ?

--- bsim4v7def.h
typedef struct sBSIM4v7instance
{
...
    double BSIM4v7qdef; <--- the same name used for #define
...
    #define BSIM4v7qdef BSIM4v6states+ 27 <--- the same name used in the struct
...
}

--- b4v7.c
char *BSIM4v7names[] = {
   "Drain",
   "Gate",
   "Source",
   "Bulk",
   "Charge" <-- 5 external nodes, but 4 external nodes in the struct sBSIM4v7instance
};

--- b4v7mpar.c
BSIM4v7mParam
    case  BSIM4v7_MOD_VERSION :
        mod->BSIM4v7version = value->sValue; <--- should BSIM4v7version be freed before?

--- b4v7ask.c
BSIM4v7ask
    value->rValue = here->BSIM4v7off; <-- maybe value->iValue ?

--- bssoidd.c
char *B3SOIDDnames[] = {
   "Drain",
   "Gate",
   "Source",
   "Backgate",
   "",
   "Body",
   "Temp",
   "Charge", <-- 8 external nodes, but 7 external nodes in the struct sB3SOIDDinstance
};

--- b3soidddef.h
typedef struct sB3SOIDDinstance
{
...
    double B3SOIDDqb; <--- the same name used for #define
...
    #define B3SOIDDqb B3SOIDDstates+ 12 <--- the same name used in the struct
...
}

--- b3soiddask.c
B3SOIDDask
    value->rValue = here->B3SOIDDoff; <-- maybe value->iValue ?

--- bssoipd.c
char *B3SOIPDnames[] = {
   "Drain",
   "Gate",
   "Source",
   "Backgate",
   "",
   "Body",
   "Temp",
   "Charge", <-- 8 external nodes, but 7 external nodes in the struct sB3SOIPDinstance
};

--- b3soipddef.h
typedef struct sB3SOIPDinstance
{
...
    double B3SOIPDqb; <--- the same name used for #define
...
    #define B3SOIPDqb B3SOIPDstates+ 12 <--- the same name used in the struct
...
}

--- b3soipdask.c
B3SOIPDask
    value->rValue = here->B3SOIPDoff; <-- maybe value->iValue ?

--- bssoifd.c
char *B3SOIFDnames[] = {
   "Drain",
   "Gate",
   "Source",
   "Backgate",
   "",
   "Body",
   "Temp",
   "Charge", <-- 8 external nodes, but 7 external nodes in the struct sB3SOIFDinstance
};

--- b3soifddef.h
typedef struct sB3SOIFDinstance
{
...
    double B3SOIFDqb; <--- the same name used for #define
...
    #define B3SOIFDqb B3SOIPDstates+ 12 <--- the same name used in the struct
...
}

--- b3soifdask.c
B3SOIFDask
    value->rValue = here->B3SOIFDoff; <-- maybe value->iValue ?

--- soi3ask.c
SOI3ask
    value->rValue = here->SOI3off; <-- maybe value->iValue ?

--- vbictemp.c
VBICtemp
...
    double p[108], pnom[108], TAMB;
...
     memcpy (&pnom, &model->VBICtnom, sizeof(pnom));
 <--- there must be some comment in the struct sVBICmodel that the positions of 108 doubles must not be changed
also used in VBICload
 memcpy (&p, &model->VBICtnom, sizeof(p));
...

--- hicum2defs.h
/* device questions */
enum {
...
    HICUM_QUEST_CRBI, <-- 301
/* transit time */
    HICUM_QUEST_TF, <-- 302
    HICUM_QUEST_FT, <-- 303
    HICUM_QUEST_ICK, <-- 304
/* power */
    HICUM_QUEST_POWER, <-- 305
};

/* model questions */
enum {
    HICUM_MOD_COLLCONDUCT = 301, <--- id overlaped

--- hicum2.c

char *HICUMnames[] = {
    "collector",
    "base",
    "emitter",
    "substrate",
    "temp" <-- 5 external nodes, but 4 external nodes in the struct sHICUMinstance

};

--- hicum2mask.c
HICUMmAsk
     case HICUM_MOD_TUNODE:
         value->rValue = model->HICUMtunode = value->iValue; <-- value->rValue = model->HICUMtunode ?

--- hicum2ask.c
HICUMask
/* voltages */
        case HICUM_QUEST_VBE:
            value->rValue = *(ckt->CKTstate0 + here->HICUMbaseNode)-*(ckt->CKTstate0 + here->HICUMemitNode);
            return(OK);
        case HICUM_QUEST_VBBP:
            value->rValue = *(ckt->CKTstate0 + here->HICUMbaseNode)-*(ckt->CKTstate0 + here->HICUMbaseBPNode);
            return(OK);
        case HICUM_QUEST_VBC:
            value->rValue = *(ckt->CKTstate0 + here->HICUMbaseNode)-*(ckt->CKTstate0 + here->HICUMcollNode);
            return(OK);
        case HICUM_QUEST_VCE:
            value->rValue = *(ckt->CKTstate0 + here->HICUMcollNode)-*(ckt->CKTstate0 + here->HICUMemitNode);
            return(OK);
        case HICUM_QUEST_VSC:
            value->rValue = *(ckt->CKTstate0 + here->HICUMcollNode)-*(ckt->CKTstate0 + here->HICUMsubsNode);
            return(OK);
<--- *(ckt->CKTstate0 + here-> *** Node) Node is used for indexing in the states. Is it correct?

--- hfetload.c
hfeta
  } else {
    gmg = NULL; <-- what is the reason for nulling?
    gmd = NULL; <-- what is the reason for nulling? 
  }  

HFETAload
...
    icheck = 0;
...
    /*
     *  check convergence 
     */
    if( (!(ckt->CKTmode & MODEINITFIX)) | (!(ckt->CKTmode & MODEUIC))) {
        if( (icheck == 1) <--- icheck is always 0

--- hsm2ld.c
HSM2load

      if ( model->HSM2_info >= 3 ) { /* physical valiables vs bias */
	static int isFirst = 1; <--- 
	if (isFirst) {
	  printf("# vbs vds vgs cggb cgdb cgsb cbgb cbdb cbsb cdgb cddb cdsb\n");
#ifndef USE_OMP
	  isFirst = 0;
#endif
	}

    if ((ckt->CKTmode & MODEDC) && 
	!(ckt->CKTmode & MODEINITFIX) && !(ckt->CKTmode & MODEINITJCT)) 
      showPhysVal = 1;
    if (model->HSM2_show_Given && showPhysVal && isConv) {
      static int isFirst = 1; <--- 
      if (vds != vds_pre) 
	ShowPhysVals(here, model, isFirst, vds_pre, vgs, vbs, vgd, vbd, vgb);
      else 
	ShowPhysVals(here, model, isFirst, vds, vgs, vbs, vgd, vbd, vgb);
#ifndef USE_OMP
      if (isFirst) isFirst = 0;
#endif
    }
<--- isFirst: 2 similar vars. Is it correct?

--- nb.c

char *NBJTnames[] = {
  "Collector",
  "Base",
  "Emitter",
  "Substrate"<-- 4 external nodes, but 3 external nodes in the struct sNBJTinstance
};

--- nbjtdel.c
NBJTmodDelete
 TWOtranInfo *pInfo = model->NBJTpInfo;	/* transient analysis information */
<-- model->NBJTpInfo is ONEtranInfo. Is it correct?

--- nb2.c

char *NBJT2names[] = {
  "Collector",
  "Base",
  "Emitter",
  "Substrate"<-- 4 external nodes, but 3 external nodes in the struct sNBJT2instance
};

--- numconst.h
#define  VELOCITY_OF_LIGHT	2.997924562e8		/* CM/S */
<--- const.h
/* https://physics.nist.gov/cgi-bin/cuu/Value?c
 * value = 299 792 458 m s-1 (exact) */
#define CONSTc 299792458

--- misc.c
foundError(int error)
	case spNO_MEMORY:
	    printf( "Error: LU Decomposition Failed - NO MEMORY\n" ); <-- fprintf(stderr, ?
	    matrixError = TRUE;
	    break;

--- onecont.c
ONE_rhsLoad
 double perTime;
 ...
 /* find reciprocal timestep */
 if ( tranAnalysis ) {
   perTime = info->intCoeff[0]; <--- perTime is not used
 }

ONE_jacLoad
	generation = ONEavalanche(FALSE, pDevice, pNode); <-- generation is not used

--- twocont.c
TWO_rhsLoad
 double perTime;
 ...
 /* find reciprocal timestep */
 if ( tranAnalysis ) {
   perTime = info->intCoeff[0]; <--- perTime is not used
 }

--- twoncont.c
TWONrhsLoad
 double perTime;
 ...
 /* find reciprocal timestep */
 if ( tranAnalysis ) {
   perTime = info->intCoeff[0]; <--- perTime is not used
 }

--- twocond.c
contactConductance
 if ( !OneCarrier ) {
   nInc = 1; <-- not used
   pInc = 2; <-- not used
 } else {
   nInc = 1;
   pInc = 1;
 }

--- hsm2eval.c
HSM2evaluate
  if ( lp_bs > lp_bs_max ) { lp_bs -- ; } <--- why? lp_bs is not used after it

--- inpcom.c
inp_fix_macro_param_func_paren_io
str_ptr = skip_token(card->line); // skip over .param
while (!isspace_c(*str_ptr) && *str_ptr != '=') {
    if (*str_ptr == '(')
        is_func = TRUE; <-- break should be added
    str_ptr++;
}

inp_fix_subckt
    beg = skip_back_ws(equal, s);
    beg = skip_back_non_ws(beg, s);
    beg[-1] = '\0'; /* fixme can be < s */ <--- "s" string is splitted here

    head = insert_new_line(NULL, NULL, 0, 0, "internal");
    /* create list of parameters that need to get sorted */
    first_param_card = c = NULL;
    while ((ptr1 = strchr(beg, '=')) != NULL) {
        ...

        if (!ptr2) {
            fprintf(stderr, "Error: Missing } in line %s\n", s); <--- here, "s" is incomplete
            controlled_exit(EXIT_FAILURE);
        }

--- com_meausre2.c
get_measure2
    if (!wl) {
        printf("usage: measure .....\n");
        return MEASUREMENT_FAILURE;
    }

...

    words = wl;
    wlTarg = NULL;
    wlWhen = NULL;

    if (!words) { <--- wl is not NULL here
        fprintf(cp_err, "Error: no assignment found.\n");
        return MEASUREMENT_FAILURE;
    }

--- postcoms.c
com_destroy
  Should ngSpice_Reset reset constantplot.pl_lookup_valid?
vectors.c findvec pl->pl_lookup_table may be null otherwise.
    It looks like it is required to add in "com_destroy" something like:
  plotting.plot_cur = &plotting.constantplot;
  plotting.plot_list = &plotting.constantplot;
  plotting.constantplot.pl_lookup_valid = false;
Example for using "ngspice" as a library:
ngSpice_Init
ngSpice_Circ
ngSpice_Reset <-- calls com_destroy
ngSpice_Init
ngSpice_Circ calls "findvec" and causes crash because pl->pl_lookup_table is NULL at pl_lookup_valid=TRUE?

--- shareddspice.c
static void* euserptr; <-- used only in XSPICE

--- acan.c
ACan
#ifdef XSPICE
        /* gtri - begin - wbk - Call EVTop if event-driven instances exist */

        if (ckt->evt->counts.num_insts != 0) {
            error = EVTop(ckt,                           <---- error is not used, the same in NOISEan, SPan
                (ckt->CKTmode & MODEUIC) | MODEDCOP | MODEINITJCT,
                (ckt->CKTmode & MODEUIC) | MODEDCOP | MODEINITFLOAT,
                ckt->CKTdcMaxIter,
                MIF_TRUE);
            EVTdump(ckt, IPC_ANAL_DCOP, 0.0);
            EVTop_save(ckt, MIF_TRUE, 0.0);
        }
        else
#endif 
            /* If no event-driven instances, do what SPICE normally does */
            if (!ckt->CKTnoopac) { /* skip OP if option NOOPAC is set and circuit is linear */
                error = CKTop(ckt,
                    (ckt->CKTmode & MODEUIC) | MODEDCOP | MODEINITJCT,
                    (ckt->CKTmode & MODEUIC) | MODEDCOP | MODEINITFLOAT,
                    ckt->CKTdcMaxIter);

                if (error) {
                    fprintf(stdout, "\nAC operating point failed -\n");
                    CKTncDump(ckt);
                    return(error);
                }
            }
            else
                fprintf(stdout, "\n Linear circuit, option noopac given: no OP analysis\n");

        ckt->CKTmode = (ckt->CKTmode & MODEUIC) | MODEDCOP | MODEINITSMSIG;
        error = CKTload(ckt);

--- evtshared.c
EVTshareddata
    char* node_value <-- only written, useless

--- evtcheck_nodes.c
examine_device(MIFinstance *inst, const char **family)
	*family = pdp->element->svalue; // May be NULL
	if (family && !family[0]) <--- if family after *family = . "*" is missed?
	    family = NULL;  <--- useless   // Ignore empty string.

--- cm.c
cm_analog_integrate
 for(got_index = MIF_FALSE, i = 0; i < here->num_intgr; i++) {
     if(here->intgr[i].byte_index == byte_index) {
         got_index = MIF_TRUE; <--- break; should be added here
     }
 }

--- miftrunc.c
MIFterr
	double diff[8];
	double deltmp[8];
	double      *state_ptr[8];
...
	/* now divided differences */
	for(i=ckt->CKTorder+1;i>=0;i--) { <--- can CKTorder+1 be greater than 7?
	    diff[i] = *(state_ptr[i]);
	}
	for(i=0 ; i <= ckt->CKTorder ; i++) { <--- can CKTorder be greater than 7?
	    deltmp[i] = ckt->CKTdeltaOld[i];
	}

--- cm.c
cm_static_integrate
	double  intgr[7];
...
	/* Get integral values from current and previous timesteps */
	for(i = 0; i <= ckt->CKTorder; i++) { <--- can ckt->CKTorder be greater than 6?
	    ...
	    intgr[i] = *double_ptr;
	}

--- evtcheck_nodes.c
scan_devices
 /* Scan output connections. */
 for (i = 0, oip = ckt->evt->info.output_list;
      oip;
      ++i, oip = oip->next) <-- "i" is not used

--- mifmpara.c
MIFmParam
        for (i = 0; i < size; i++) {
            switch(value_type) {
            case  IF_FLAGVEC:
                target[i].ivalue = value->v.vec.iVec[i]; <-- target[i].bvalue ?
                break;

            case  IF_INTVEC:
                target[i].bvalue = check_int(value->v.vec.iVec[i],   <-- target[i].ivalue?
                                             param_info, inModel->GENmodName);
                break;

--- evtsetup.c
EVTswitch_plot
	Evt_Job_t* jobs;
	jobs = &(ckt->evt->jobs);
	if (jobs) { <-- jobs cannot be NULL because it is a place holder in struct Evt_Ckt_Data

--- evtload.c
EVTload_with_event
	cm_data.circuit.temperature = ckt->CKTtemp - 273.15; <-- 273.15, maybe CONSTCtoK?

--- mif_inp2.c
static char *alltokens[BSIZE_SP]; <--- is it correct using of BSIZE_SP?

MIF_INP2A
    /* Locate the last token on the line, the model name. */
    while (*line != '\0') {
        model_loc = line; <--- model_loc is not used
        model = MIFgettok(&line);
    }

--- cktdes.h
struct CKTcircuit
	double* CKTportY; <-- unused
	char *CKToscNode; <-- unused

--- xfer/cfunc.mod
read_file
	mult = 1.0e9; // Default to GHz <-- read, but not used, so frequency value can be incorrect

--- square/cfunc.mod
typedef struct { <-- Local_Data_t is not used
    Boolean_t tran_init;        /* for initialization of phase1) */
} Local_Data_t;

