EquivFusion: Unifying Hardware Equivalence Checking from Algorithms to Netlists via MLIR

Abstract: Ensuring functional consistency between high-level algorithmic models and low-level hardware implementations is a critical challenge, particularly as modern design flows increasingly span heterogeneous abstractions--from deep learning frameworks to hardware netlists. In this paper, we present EquivFusion, an end-to-end equivalence checking tool tailored for multi-modal circuit designs. Unlike traditional flows that rely on siloed tools or ad-hoc translation, EquivFusion leverages a verification-oriented MLIR lowering pipeline to unify diverse entry points, including PyTorch, C/C++, Chisel, Verilog, and gate-level netlists, into a common intermediate representation. This architecture enables automated, pairwise equivalence checking across diverse abstraction levels by rigorously translating designs into standard formal verification formats, i.e., SMT-LIB, BTOR2, AIGER. We demonstrate EquivFusion's feasibility to bridge the semantic gap between software specifications and hardware realizations, showcasing its effectiveness in facilitating "shift-left" formal verification for datapath-intensive hardware designs.

• The paper introduces EquivFusion, a unified platform that performs hardware equivalence checking across algorithmic and hardware descriptions via MLIR.
• It employs a systematic translation flow and miter construction to detect mismatches in scenarios such as sort implementations and deep learning operators.
• The approach streamlines cross-abstraction verification, reducing reliance on simulation and enabling early bug detection in complex hardware design flows.

Unifying Multi-Modal Hardware Equivalence Checking with EquivFusion

Motivation and Problem Statement

Ensuring functional equivalence between high-level algorithmic models and low-level hardware implementations is a central problem in modern hardware design flows, particularly in domains such as machine learning accelerators, image processing pipelines, and custom SoCs. Existing verification tools are heavily fragmented by abstraction boundaries—PyTorch or C++ algorithmic models, Chisel or Verilog RTL, and synthesized gate-level netlists all require bespoke flows for functional checking. This disjointed landscape exacerbates the challenge of validating functional consistency across modalities, with traditional simulation-based verification susceptible to subtle arithmetic or datapath mismatches that evade standard testbenches. Moreover, existing open-source and commercial equivalence checkers predominantly target only specific language or abstraction pairs, for instance, C-to-RTL or RTL-to-gate, and lack both extensibility and early-stage formal integration.

Methodology: Architecture of EquivFusion

EquivFusion introduces an end-to-end verification platform that systematically unifies heterogeneous frontends—PyTorch, C/C++, Chisel, Verilog, and gate-level netlists—into a single, verification-oriented flow via MLIR and CIRCT infrastructure. At its core, the approach deploys a systematic lowering strategy in MLIR, preserving critical high-level semantics (arrays, control flow, arithmetic structure) while transforming all forms of input into standardized intermediate representations (IR) amenable to formal analysis.

The verification process in EquivFusion comprises several key steps:

1. Multi-Modal Frontends: Utilize Polygeist to lower C/C++ code and torch-mlir to lower PyTorch models to MLIR Affine dialect; hardware sources are translated using CIRCT and Slang parsers for Chisel and Verilog.
2. Verification-Oriented Lowering: Progressively transform the IR through MLIR/CIRCT passes designed to preserve verification-relevant information. For sequential hardware, explicit sequential unrolling enables equivalence checking over transactions, not just combinational instances.
3. Miter Construction: Build a unified miter circuit at the MLIR IR level to formalize the notion of equivalence by feeding identical inputs to both spec and implementation and asserting output equality.
4. Export and Solving: Lower the miter to standard solver formats (SMT-LIB for SMT solvers, BTOR2 for word-level SAT solvers, AIGER for bit-level SAT solvers). EquivFusion provides an abstract interface to backends including Z3, Bitwuzla, and Kissat, allowing tailored solver selection based on the structure and depth of the equivalence task.

   Figure 1: Overview of EquivFusion's architecture, illustrating modality-agnostic frontend translation, verification-oriented IR lowering, miter construction, and modular backend solving.

Capabilities and Verification Scenarios

EquivFusion is maximally general in scope for datapath-intensive equivalence tasks, supporting:

• Combinational Equivalence Checking: For modules or kernels whose behavior is captured as pure functions.
• Transactional (Multi-Cycle) Equivalence Checking: Enables miter construction for modules with internal state and temporal offsets, by unrolling implementations for a fixed number of cycles to encode functional equivalence over complete I/O transactions.

The tool is agnostic to algorithmic differences, enabling, for example, formal proof that a hardware parallel bitonic sort is equivalent to a C++ bubble sort reference, or a synthesized deep learning operator matches its PyTorch functional description.

Implementation Details

Frontends and IR Transformation

• Algorithmic Descriptions: Polygeist and torch-mlir handle input lowering for C++ and PyTorch. Only statically analyzable, HLS-friendly program constructs are accepted, ensuring deterministic translation.
• Hardware Descriptions: Chisel is compiled to FIRRTL and then to CIRCT IR using firtool. Verilog and netlists are lowered directly into CIRCT HW dialects via circt-verilog and the Slang parser.
• Sequential Logic: Finite unrolling for transactional operations is systematically handled, allowing the equivalence of stateful computations over bounded temporal windows.

Miter Construction and Backends

• Port Mapping: Automatic I/O mapping ensures correct signal alignment between spec and implementation, with strict type and schema matching.
• Format Export: The constructed miter can be emitted as SMT-LIB, BTOR2, or AIGER, enabling compatibility with state-of-the-art SMT/SAT engines.
• Debug Support: Solver-derived counterexamples are captured and reported back, supporting precise error tracing and debugging.

Performance Results

Case studies demonstrate robust functional equivalence discovery and bug localization:

• Ascending/Descending Sort Check: With a C++ bubble sort and a Chisel bitonic sort, EquivFusion correctly deems implementations equivalent (UNSAT) or discovers deliberate direction mismatch (SAT) and provides counterexamples.
• PyTorch to Netlist Dot Product: Eight-bit implementations are verified equivalent; subtle sign-extension bugs at increased precision are precisely flagged.

Strong numerical runtime results are provided, demonstrating modest overhead for the full translation and checking pipeline (tens of seconds for moderately complex modules, significantly less for detection of counterexamples).

Implications and Future Directions

EquivFusion delivers the first open approach enabling systematic, early-stage, cross-abstraction formal equivalence checking for datapath-oriented designs. This enables significant practical advances in hardware/algorithm co-design, with the potential to standardize formal integration within HLS and deep learning hardware flows. The modularity of the MLIR-based approach paves the way for expansion to further modalities, direct floating-point reasoning (e.g., via SoftFloat library integration), and enhanced solver orchestration using ML model-driven heuristics for backend strategy selection. Active avenues include support for user-supplied invariants and assumes to address semantic misalignments or aggressive architectural optimizations.

Conclusion

EquivFusion unifies hardware equivalence checking from high-level algorithms to gate-level netlists through a verification-oriented MLIR-based pipeline, supporting a flexible, multi-modal frontend and solver-agnostic backend. Its demonstrated ability to trap semantic mismatches early and rigorously—across diverse languages and abstraction levels—establishes a standardized infrastructure for "shift-left" verification in modern hardware design. This paves the way for robust, early, and systematic equivalence assurance in increasingly heterogeneous, algorithm-driven hardware environments (2604.16571).