Guarded Equivalence Predicates for Scalable Formal Hardware Information-Flow Verification

2026-06-20

AI Summary

Existing hardware information flow verification methods struggle to scale under general-purpose PDR engines due to their reliance on global equivalence predicates, which cannot capture local equivalences that hold only within specific control contexts—such as transaction windows or protocol phases. This work proposes a guarded equivalence predicate mechanism that automatically derives context-sensitive guard conditions from counterexamples via CTI-local extraction and state-partitioning search. Mismatched scenarios are then injected into the PDR verification loop as auxiliary blocking obligations. By relaxing the restrictive assumption of global equivalence, the approach substantially improves scalability: on a benchmark suite of 12 designs, it verifies two previously timeout-prone cases in 34.2 and 89.5 seconds (within an 1800-second limit) and achieves up to a 10.8× speedup on the remaining instances.

Abstract

Formal hardware information-flow verification is a principled way to rule out secret-dependent functional or timing observations, but scaling such proofs remains difficult. Self-composition reduces information-flow verification to safety checking over two circuit copies, creating relational proof obligations that are hard for a generic PDR engine to discover from bit-level logic alone. Recent PDR-based techniques exploit this duplicated structure through copy symmetry and global cross-copy equivalence predicates. These predicates are effective when corresponding internal signals agree throughout the reachable state space, but they do not capture equalities that are relevant only in a specific control context. We observe that such contextual relations arise naturally in hardware IFV proofs: an internal signal pair may need to agree only within a control phase, transaction window, loop state, or protocol region. We introduce guarded equivalence predicates to expose these relations to PDR. Rather than treating a proposed contextual equality as an assumption, the verifier submits the corresponding mismatch condition as an auxiliary blocking obligation. Guards are proposed from relational counterexamples-to-induction using CTI-local extraction and state-split search; only candidates proved unreachable by the backend affect the proof. Across 12 IFV benchmarks and two PDR backends, guarded predicates convert two contextual baseline timeouts into completed proofs within 34.2--89.5s under an 1800s limit, while reducing proof time by up to 10.8x on additional benchmarks.

Problem

• information-flow verification
• equivalence predicates
• control context
• formal verification
• hardware security

Innovation

• guarded equivalence predicates
• information-flow verification
• PDR
• relational verification
• hardware security