Theory of safe replacements for sequential circuits

Theoretical framework for compositional sequential hardware equivalence verification in presence of design constraints

“…Recall that circuit C 2 is a safe replacement of C 1 if ∀s 2 ∈States(C 2 ) and ∀π , there is s 1 ∈States(C 1 ) such that, from s 1 and s 2 , C 1 and C 2 produce equal outputs along π [SPAB01]. And C 2 is a 3-valued safe replacement of C 1 if…”

“…But in our approach, it is enough for corresponding subcircuits in the two circuits to behave same under the imposed constraints. Therefore, the criticism of alignability equivalence concept in [SPAB01] becomes vacuous for our verification framework.…”

“…We call these constraints verification properties, because they are introduced simply for the purpose of verification -in order to eliminate spurious counter-examples arising during verification of subcircuits (i.e., verification of subcircuits without the environment). Note that the criticism of alignability equivalence concept in [SPAB01] is based on the fact that alignable circuits do not behave in the same manner in an arbitrary environment. But in our approach, it is enough for corresponding subcircuits in the two circuits to behave same under the imposed constraints.…”

“…Singhal et al [SPAB01] pointed out that alignability is not compositional, and this observation led them actually to abandon alignability and to define a more restricted and complex concept of equivalence -(delay) safe replaceability, which is compositional: replacing, in a design D, a piece C with its (delay) safe replacement C 1 results in a design D 1 which is (delay) safe replacement of D. The idea of safe replaceability is that two equivalent circuits behave similarly under any environment.…”

Sequential synthesis using S1S

“…Conversely, if there were some input on which the composed design had an output differing from that in the original design, there is a surrounding environment which could observe the change and as a result function incorrectly. Following the parlance of Singhal [30], we will refer to implementations satisfying this condition as being "safe replacements" for the component.…”