Equivalence Checking Research Articles

EnR: extend and reduce methodology to enable formal verification of truncated adders

Abstract Truncated adders are widely used in applications where using lower bit-width is enough to generate the desired outputs. Truncated adders give benefits in area, power, and delay as compared to their non-truncated counterparts. While prior works deal with the formal verification of n-bit adders, there is no prior work dealing with the formal verification of unverified m-bit truncated adders using verified n-bit adder designs, where m < ${< } $ n. In this work, we propose a methodology that enables the verification for any truncated adder designs, irrespective of the architecture, called Extend and Reduce (EnR). EnR uses a three-step methodology to formally verify the truncated adders, which are considered as Design Under Verification (DUV). Firstly, it extends the bit-width of the DUV (truncated adder) to match with the nearest higher 2 n -bit adder, called an Extended Truncated Adder (ETA). Secondly, it reduces off-the-shelf formally verified golden reference adder design by forcing 0’s at the input bits to match it to the extended DUV design and re-synthesizing it to generate a Reduced Golden Adder (RGA). Lastly, a combinational equivalence check is then performed between the ETA and the RGA for formal verification. If the truncated adder is correct, the ETA and RGA are equivalent and vice versa. We evaluate a number and variety of adder designs to show the efficacy of the EnR methodology. We performed the formal verification using Binary Decision Diagrams (BDDs) and And-Inverter Graphs (AIGs). Lastly, we show the scalability of EnR methodology using adders up to a bit-width of 512 bits. ACM CCS Hardware → Arithmetic and datapath circuits; Combinational circuits; Equivalence checking; Functional verification; Electronic design automation.

Systems of fixpoint equations: Abstraction, games, up-to techniques and local algorithms

Systems of fixpoint equations over complete lattices, consisting of (mixed) least and greatest fixpoint equations, allow one to express many verification tasks such as model-checking of various kinds of specification logics or the check of coinductive behavioural equivalences. In this paper we develop a theory of approximation for systems of fixpoint equations in the style of abstract interpretation: a system over some concrete domain is abstracted to a system in a suitable abstract domain, with conditions ensuring that the abstract solution represents a sound/complete overapproximation of the concrete solution. Interestingly, up-to techniques, a classical approach used in coinductive settings to obtain easier or feasible proofs, can be interpreted as abstractions in a way that they naturally fit into our framework and extend to systems of equations. Additionally, relying on the approximation theory, we can characterise the solution of systems of fixpoint equations over complete lattices in terms of a suitable parity game, generalising some recent work that was restricted to continuous lattices. The game view opens the way for the development of local algorithms for characterising the solution of such equation systems. We describe a local algorithm for checking the winner on specific game positions. This corresponds to answering the associated verification question (i.e., for model checking, whether a state satisfies a formula or, for equivalence checking, whether two states are behaviourally equivalent). The algorithm can be combined with abstraction and up-to techniques, thus providing ways of speeding up the computation.

ReSG: A Data Structure for Verification of Majority-based In-memory Computing on ReRAM Crossbars

Recent advancements in the fabrication of Resistive Random Access Memory (ReRAM) devices have led to the development of large-scale crossbar structures. In-memory computing architectures relying on ReRAM crossbars aim to mitigate the processor-memory bottleneck that exists with current complementary metal-oxide semiconductor technology. With this motivation, several synthesis and mapping approaches focusing on the realizations of Boolean functions in the ReRAM crossbars have been proposed earlier. Thus far, the verification of the designs realized on ReRAM crossbars is done either through manual inspection or using simulation-based approaches. Since manual inspections and simulation-based approaches are limited to smaller designs, they cannot be applied to the verification of complex designs on large-scale ReRAM crossbars. Motivated by this, we propose, for the first time, an automatic equivalence checking flow that determines the equivalence between the original function specification (e.g., Majority-inverter Graph ) and the crossbar micro-operations file formats. We consider two crossbar structures, zero-transistor, one-memristor (0T1R) and one-transistor, one-memristor (1T1R) to implement the micro-operations. While the micro-operations file format exists for 0T1R crossbar structures, no representations for micro-operations to be executed in 1T1R crossbars exist yet. In this work, we introduce the micro-operation file format for 1T1R crossbar structures to efficiently represent the micro-operations as ReRAM crossbar netlists. Afterwards, we introduce two intermediate data structures, ReRAM Sequence Graph for 0T1R crossbars (ReSG-0T1R) and for 1T1R crossbars (ReSG-1T1R) , that are derived from the 0T1R and 1T1R crossbar micro-operations file formats, respectively. These ReSGs are then translated into Boolean Satisfiability (SAT) formula, and then the verification is done by checking the generated SAT formulae against the golden functional specification (represented in Verilog) using Z3 Satisfiability solver. Experimental evaluations confirm the effectiveness of the proposed verification methodology on MCNC and ISCAS benchmarks.

A Case Study on Formal Sequential Equivalence Checking based Hierarchical Flow Setup towards Faster Convergence of Complex SOC Designs

A Case Study on Formal Sequential Equivalence Checking based Hierarchical Flow Setup towards Faster Convergence of Complex SOC Designs

Demonstration of the VeriEQL Equivalence Checker for Complex SQL Queries

Equivalence checking for SQL queries has many real-world applications but typically requires supporting an expressive SQL language in order to be practical. We develop VeriEQL, a system that can prove and disprove equivalence of complex SQL queries. Specifically, given two SQL queries under a database schema, VeriEQL can verify whether these two queries always produce identical results on all possible input databases up to a bounded size that conform to the schema. This paper demonstrates VeriEQL in three scenarios, including validating the correctness of query optimizations, grading SQL queries on online coding platforms, and finding implementation bugs in database management systems.

Characterizing contrasimilarity through games, modal logic, and complexity

We present the first game characterization of contrasimilarity, the weakest form of bisimilarity. It corresponds to an elegant modal characterization of nested trees of impossible future behavior. The game is exponential but finite for finite-state systems and can thus be used for contrasimulation equivalence checking, of which no tool has been capable to date. By reduction from weak trace equivalence, we establish that contrasimilarity is PSPACE-complete. A machine-checked Isabelle/HOL formalization backs our work and enables further use of contrasimilarity in verification contexts.

VeriEQL: Bounded Equivalence Verification for Complex SQL Queries with Integrity Constraints

The task of SQL query equivalence checking is important in various real-world applications (including query rewriting and automated grading) that involve complex queries with integrity constraints; yet, state-of-the-art techniques are very limited in their capability of reasoning about complex features (e.g., those that involve sorting, case statement, rich integrity constraints, etc.) in real-life queries. To the best of our knowledge, we propose the first SMT-based approach and its implementation, VeriEQL, capable of proving and disproving bounded equivalence of complex SQL queries. VeriEQL is based on a new logical encoding that models query semantics over symbolic tuples using the theory of integers with uninterpreted functions. It is simple yet highly practical -- our comprehensive evaluation on over 20,000 benchmarks shows that VeriEQL outperforms all state-of-the-art techniques by more than one order of magnitude in terms of the number of benchmarks that can be proved or disproved. VeriEQL can also generate counterexamples that facilitate many downstream tasks (such as finding serious bugs in systems like MySQL and Apache Calcite).

PASDA: A partition-based semantic differencing approach with best effort classification of undecided cases

Equivalence checking is used to verify whether two programs produce equivalent outputs when given equivalent inputs. Research in this field mainly focused on improving equivalence checking accuracy and runtime performance. However, for program pairs that cannot be proven to be either equivalent or non-equivalent, existing approaches only report a classification result of unknown, which provides no information regarding the programs’ non-/equivalence.In this paper, we introduce PASDA, our partition-based semantic differencing approach with best effort classification of undecided cases. While PASDA aims to formally prove non-/equivalence of analyzed program pairs using a variant of differential symbolic execution, its main novelty lies in its handling of cases for which no formal non-/equivalence proof can be found. For such cases, PASDA provides a best effort equivalence classification based on a set of classification heuristics.We evaluated PASDA with an existing benchmark consisting of 141 non-/equivalent program pairs. PASDA correctly classified 61%–74% of these cases at timeouts from 10 s to 3600 s. Thus, PASDA achieved equivalence checking accuracies that are 3%–7% higher than the best results achieved by three existing tools. Furthermore, PASDA’s best effort classifications were correct for 70%–75% of equivalent and 55%–85% of non-equivalent cases across the different timeouts.

Branching bisimulation semantics for quantum processes

The qCCS model proposed by Feng et al. provides a powerful framework to describe and reason about quantum communication systems that could be entangled with the environment. However, they only studied weak bisimulation semantics. In this paper we propose a new branching bisimilarity for qCCS and show that it is a congruence. The new bisimilarity is based on the concept of ϵ-tree and preserves the branching structure of concurrent processes where both quantum and classical components are allowed. Furthermore, we present a polynomial time equivalence checking algorithm for the ground version of our branching bisimilarity.

Evaluating trustworthiness of decision tree learning algorithms based on equivalence checking

Evaluating trustworthiness of decision tree learning algorithms based on equivalence checking

Orthologic with Axioms

We study the proof theory and algorithms for orthologic, a logical system based on ortholattices, which have shown practical relevance in simplification and normalization of verification conditions. Ortholattices weaken Boolean algebras while having polynomial-time equivalence checking that is sound with respect to Boolean algebra semantics. We generalize ortholattice reasoning and obtain an algorithm for proving a larger class of classically valid formulas. As the key result, we analyze a proof system for orthologic augmented with axioms. An important feature of the system is that it limits the number of formulas in a sequent to at most two, which makes the extension with axioms non-trivial. We show a generalized form of cut elimination for this system, which implies a sub-formula property. From there we derive a cubic-time algorithm for provability from axioms, or equivalently, for validity in finitely presented ortholattices. We further show that propositional resolution of width 5 proves all formulas provable in orthologic with axioms. We show that orthologic system subsumes resolution of width 2 and arbitrarily wide unit resolution and is complete for reasoning about generalizations of propositional Horn clauses. Moving beyond ground axioms, we introduce effectively propositional orthologic (by analogy with EPR for classical logic), presenting its semantics as well as a sound and complete proof system. Our proof system implies the decidability of effectively propositional orthologic, as well as its fixed-parameter tractability for a bounded maximal number of variables in each axiom. As a special case, we obtain a generalization of Datalog with negation and disjunction.

Modeling Bidirectional Switches for Enabling Logic Equivalence Checking in a Transistor-Level Programmable Fabric

Modeling Bidirectional Switches for Enabling Logic Equivalence Checking in a Transistor-Level Programmable Fabric

An efficient circuit-based SAT solver and its application in logic equivalence checking

In this paper, we propose an integrated approach that combines a circuit-based SAT solver (CirSAT) with a technique based on XOR-Majority Graph (XMG) rewriting for logic equivalence checking. CirSAT harnesses circuit information to implement a variety of efficient SAT algorithms on the And-Inverter Graph (AIG). Specifically, we introduce the “AIG-J-frontier” algorithm to minimize unnecessary search space during SAT solving. This algorithm employs the fanout count of logic gates as a heuristic to guide conflict resolution decisions. Furthermore, we present a flexible and efficient two-pointer watching scheme for rapid Boolean constraint propagation. The XMG-based rewriting technique is used to simplify logic networks and accommodate a larger number of high fanout nodes. In experiments using ISCAS’85 and EPFL benchmark suites, our method outperforms CNF-based solvers such as Minisat and Lingeling with a 3.66 speedup. It also exhibits an 8.26 speedup compared to the circuit-based solver QuteSAT and a 5.99 speedup when compared to using the CirSAT solver independently.

On-the-fly bisimulation equivalence checking for fresh-register automata

Register automata are one of the simplest classes of automata that operate on infinite input alphabets. Each automaton comes equipped with a finite set of registers where it can store data values and compare them with others from the input. Fresh-register automata are additionally able to accept a given data value just if it is fresh in the computation history. One such use for this is representing processes in the π-calculus, where private names need to be fresh with respect to any process context. The bisimilarity problem for fresh-register automata is known to be in NP, when empty registers and duplicate register content are forbidden. In this paper, we investigate on-the-fly algorithms for solving bisimilarity, which attempt to build a bisimulation relation starting from a given input configuration pair. We propose an algorithm that uses concise representations of candidate bisimulation relations based on generating systems. While the algorithm runs in exponential time in the worst case, we demonstrate through a series of benchmarks its efficiency compared to existing algorithms and tools. We moreover define and implement a novel translation from π-calculus processes to fresh-register automata, and use the latter to obtain a (strong early) bisimilarity checking tool for finitary π-calculus processes. Using a series of benchmarks for this, we demonstrate an improvement in run-time compared to another equivalence checker.

Generalized Affine Equivalence Checking of Boolean Functions via Reachability Analysis

We consider the problem of checking the generalized affine equivalence of two given Boolean functions. This problem arises in various computer-aided design (CAD) and cryptographic applications, such as circuit synthesis and Reed-Muller codes. Based on the theory of affine group acting on the Boolean functions, we define the coefficient spaces and transition relations, and transform the checking problem into reachability analysis of finite state machines. Two methods are proposed to check the affine equivalence of Boolean functions using Binary Decision Diagrams (BDDs) and Property Directed Reachability (PDR), respectively. Both methods can check affine equivalence of bent and semi-bent functions, which state-of-the-art methods can hardly handle. Furthermore, existing methods only consider the case of affine equivalence, while our methods can handle the generalized affine equivalence of subspaces of Boolean functions. In the application of circuit synthesis, our methods can significantly reduce the size of the library compared to Boolean matching. To classify Boolean functions up to the generalized affine equivalence, we propose a method to obtain a complete classification based on BDDs. In the experiments, we have successfully applied our methods to some examples that can hardly be solved by using the previous methods, thus validating the effectiveness of our methods.

Formal Verification of Sequential Circuits in Superconducting Single Flux Quantum Technologies

Logical equivalence checking is one of the most effective verification steps in the entire design process of integrated circuits. However, it faces challenges in emerging technologies due to differences between its logic models and those of the standard complementary metal oxide semiconductor (CMOS). This paper presents qSC, an equivalence checking framework targeting <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">sequential</i> circuits mapped to rapid superconducting single-flux-quantum (RSFQ) logic circuits. In addition to a logical checking module, qSC also includes several structural checking modules. The structural checking modules are used to check whether the circuit meets the design rules of superconducting RSFQ logic circuits. The main difficulty of verifying nonlinear <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">sequential</i> circuits is in finding the levels of logic cells in the circuit for full-path-balancing checking for which the conventional topological sorting algorithm of acyclic digraphs is not applicable. The key is to define and calculate levels for nodes in a cyclic graph and to avoid any loop trap. Hence, a new algorithm is presented for full-path-balancing checking of the cyclic digraph that satisfies all of these desirable features. The experimental results show the feasibility of qSC on sequential circuits implemented in RSFQ technologies.

Proving and Disproving Equivalence of Functional Programming Assignments

We present an automated approach to verify the correctness of programming assignments, such as the ones that arise in a functional programming course. Our approach takes as input student submissions and reference solutions, and uses equivalence checking to automatically prove or disprove correctness of each submission. To be effective in the context of a real-world programming course, an automated grading system must be both robust, to support programs written in a variety of style, and scalable, to treat hundreds of submissions at once. We achieve robustness by handling recursion using functional induction and by handling auxiliary functions using function call matching. We achieve scalability using a clustering algorithm that leverages the transitivity of equivalence to discover intermediate reference solutions among student submissions. We implement our approach on top of the Stainless verification system, to support equivalence checking of Scala programs. We evaluate our system and its components on over 4000 programs drawn from a functional programming course and from the program equivalence checking literature; this is the largest such evaluation to date. We show that our system is capable of proving program correctness by generating inductive equivalence proofs, and providing counterexamples for incorrect programs, with a high success rate.

Forest GUMP: a tool for verification and explanation

AbstractIn this paper, we present Forest GUMP (for Generalized, Unifying Merge Process) a tool for verification and precise explanation of Random forests. Besides pre/post-condition-based verification and equivalence checking, Forest GUMP also supports three concepts of explanation, the well-known model explanation and outcome explanation, as well as class characterization, i.e., the precise characterization of all samples that are equally classified. Key technology to achieve these results is algebraic aggregation, i.e., the transformation of a Random Forest into a semantically equivalent, concise white-box representation in terms of Algebraic Decision Diagrams (ADDs). The paper sketches the method and demonstrates the use of Forest GUMP along illustrative examples. This way readers should acquire an intuition about the tool, and the way how it should be used to increase the understanding not only of the considered dataset, but also of the character of Random Forests and the ADD technology, here enriched to comprise infeasible path elimination. As Forest GUMP is publicly available all experiments can be reproduced, modified, and complemented using any dataset that is available in the ARFF format.

Formal Verification of Integer Multiplier Circuits Using Binary Decision Diagrams

Multiplier circuit covers a more extensive area of embedded system application in digital signal processing, cryptography, and multimedia. Nonstandard implementations and custom optimization are being done to reduce the size of multipliers. The circuit became prone to a buggy, and hence the demand for verification increased. Formal verification methods, such as satisfiability (SAT), symbolic computer algebra (SCA), and binary decision diagrams (BDDs) have made massive progress over the last few decades. However, these methods are insufficient to verify the optimized multipliers. SAT-based equivalence checking is computationally expensive. SCA-based backward rewriting is limited to algebraic-friendly multipliers. The complexity of BDDs is exponential with the input size. Although, by allowing an additional variable method, the size of the BDD is limited to 4th degree polynomial of the number of the inputs, this method is not explored to verify optimized multipliers. This article focus on verifying integer multipliers with diverse architectures. We propose an algorithm for the direct construction of BDDs without traversing circuits and generate BDDs up to 1024 bits. We utilize the additional variable method and constructing BDDs using high-to-low variable ordering. We reduce the complexity of BDD size to a 3rd degree polynomial. We generate BDDs and verify the multipliers with various architectures up to 64 bits. We propose a method to verify optimized multipliers by checking equivalence and verifying up to 32-bits optimized multipliers. We do the error tolerance analysis of our approach by inserting bugs in a circuit at various locations.

Structural analysis attack on finite state machine obfuscated circuits

In this letter, a structural analysis attack is explored as the first kind of attack to disclose the secret key of the circuit encrypted by the latest obfuscation technique JANUS-HD. By extracting the finite state machine (FSM) diagram from the circuit and converting structural traces into constraints, the secret key can be deduced by the CP-SAT solver within a few minutes or even seconds in most cases. Incorrect keys can be further pruned by sequential equivalence checking with several oracles in case more than one key is obtained. The entire attack procedure lasts no longer than a few hours even for an FSM with 4096 states.