AutoQ: An Automata-Based Quantum Circuit Verifier

Recently, quantum computing has received much attention, driven by several technological breakthroughs [7] and increasing investments. Prototype quantum computers are already available. The opportunities for the general public—particularly students, researchers, and technology enthusiasts—to access quantum computing devices are rapidly increasing, e.g., through cloud services such as Amazon Braket [1] or IBM Quantum [2]. Due to the complexity and probabilistic nature of quantum computing, the chance of errors in quantum programs is much higher than that of traditional programs, and conventional means for correctness assurance, such as testing, are much less applicable in the quantum world. Quantum programmers need better tools to help them write correct programs. Therefore, researchers anticipate that formal verification will play a crucial role in quantum software quality assurance and have, in recent years, invested significant effort in this direction [5, 11, 21, 41,42,43, 45, 46]. Nevertheless, practical tools for automated quantum program/circuit verification are still missing.

This paper introduces AutoQ^{Footnote 1}, a fully automated tool for quantum circuit verification based on the approach proposed in [14]. In particular, AutoQ checks the validity of a Hoare-style specification $\{\mathtt{P}\mathtt{r}\mathtt{e}\}\mathtt{C}\{\mathtt{P}\mathtt{o}\mathtt{s}\mathtt{t}\}$, where C is a quantum circuit (a sequence of quantum gates) in the OpenQASM format [17] and the precondition $\mathtt{P}\mathtt{r}\mathtt{e}$ and postcondition $\mathtt{P}\mathtt{o}\mathtt{s}\mathtt{t}$ represent sets of (pure) quantum states. The check is done by executing the circuit with all quantum states satisfying $\mathtt{P}\mathtt{r}\mathtt{e}$ (using a symbolic representation) and testing that all resulting quantum states are in the set denoted by $\mathtt{P}\mathtt{o}\mathtt{s}\mathtt{t}$.

AutoQ combines two main techniques to efficiently and effectively represent and reason about (potentially infinite) sets of quantum states:

1. 1.

   As in [14], we use tree automata (TAs), finite-state automata accepting languages of trees, to efficiently represent sets of quantum states: Each quantum state over n qubits can be seen as a binary decision tree over n variables such that, e.g., in a 3-qubit circuit with qubits $|x_1{x}_2{x}_3⟩$, if the computational basis state $|010⟩$ in a quantum state has the probability amplitude $\frac{1}{4}$, then there will be a branch $x_1\stackrel{0}{\to }{x}_2\stackrel{1}{\to }{x}_3\stackrel{0}{\to }\frac{1}{4}$ in the corresponding tree. The use of TA-based representation of a set of quantum states has several advantages: (a) It is concise: e.g., in order to represent the set of all $2^n$ basis states of an n-qubit quantum circuit, we suffice with a TA with $\mathcal{O}(n)$ states and transitions. (b) It allows to efficiently perform quantum gate operations on the whole set of quantum states represented by a TA at once [14].

2. 2.

   In this work, we further consider symbolic quantum states, represented by assigning symbolic values to computational basis states (and having an additional formula to relate these symbolic values). For instance, we can represent the set of all n-qubit quantum states where the computational basis $|0\dots 0⟩$ has a strictly larger probability of measurement than all other basis states by a symbolic quantum state assigning $|0\dots 0⟩\mapsto v_h$ and $|y_1\dots y_n⟩\mapsto v_{\ell }$ for all $y_1\dots y_n\ne 0\dots 0$, together with the formula $|v_h{|}^2>|v_{\ell }{|}^2\wedge |v_h{|}^2+(2^n-1)|v_{\ell }{|}^2=1$, where $v_h$ and $v_{\ell }$ are symbolic variables ranging over complex numbers

By combining these two techniques, i.e., using TAs with symbolic variables in leaves, we can have a representation of all n-qubit quantum states where an arbitrary basis has a strictly larger amplitude than other basis states using $\mathcal{O}(n)$ states and transitions.

Using such a symbolic encoding is essential to allow us to describe relational specifications, e.g., it allows us to express properties like “the probability amplitude of the basis state $|000⟩$ is increased after executing the circuit C” (for this, in the postcondition, we use TAs accepting trees with predicates in leaves, a subclass of symbolic tree automata of [36]). Such a property can then be verified by executing the quantum circuit symbolically in the spirit of symbolic execution [27] (i.e., such that the values of amplitudes are not complex numbers but, instead, symbolic terms) and checking whether all trees in the language of the resulting TA satisfy the desired property (using a modified antichain-based algorithm for testing TA language inclusion [4, 10]). Combining TAs and symbolic variables as the language for quantum predicates allows full automation and can be used to express many crucial properties of quantum circuits, as we will demonstrate later. AutoQ is the first tool implementing this approach.

Related Work. Our work belongs to the line of Hoare-style verification of quantum programs, which has been widely discussed in the past [22, 29, 35, 40, 44]. This family of approaches follows D’Hondt and Panangaden’s suggestion of using various Hermitian operators as quantum predicates, resulting in a very powerful yet complete proof system [20]. However, specifying properties using Hermitian operators is often not intuitive and is inconvenient for automation due to their enormous matrix sizes. Therefore, often these approaches are implemented on top of proof assistants such as Coq  [9] and Isabelle  [37] and require significant manual work in proof search. The Qbricks  [12] approach alleviates the difficulty of the proof search by combining state-of-the-art theorem provers with decision procedures building on top of the Why3 platform [24]. The approach, however, still requires a significant amount of human intervention.

Regarding other quantum program/circuit/protocol verification tools, circuit equivalence checkers [5, 11, 15, 26, 39] are often quite efficient but less flexible in specifying the desired property (only equivalence). They are particularly useful in compiler validation; notable tools include Qcec  [11], and Feynman  [5]. Quantum model checking supports a rich specification language (flavors of temporal logic [23, 30, 38]) and is more suitable for verifying high-level protocols due to the quite limited scalability [6]. One notable tool in this category is QPMC  [23]. Quantum abstract interpretation [32, 43] is particularly efficient in processing large-scale circuits, but it grossly over-approximates the state space (it cannot verify basic properties of, e.g., Grover’s algorithm) and cannot conclude anything when verification fails. In contrast, AutoQ can be conveniently used for quantum program development and debugging since it automatically computes the exact set of reachable states^{Footnote 2}. The mentioned tools are fully automated but have different goals or address different parts of the software development cycle than AutoQ.

Contributions. AutoQ evolved from a simple prototype used for performance evaluation in [14] into a robust tool. In addition, we added the following major extensions:

1. 1.

   We combined the TA specification with symbolic variables, allowing users to specify advanced relational properties of quantum circuits.

2. 2.

   We developed a new entailment-checking algorithm for the symbolic TA specification based on the antichain algorithm for automata language inclusion testing.

3. 3.

   We introduced a high-level language to simplify writing TA specifications.

These improvements are pushing the capabilities of AutoQ, and also of practical quantum circuit verification itself, much further.

Outline. In Sect. 2, we describe our approach to TA-based specification and verification of quantum circuits. In Sect. 3, we discuss the new entailment-checking algorithm for the symbolic TA representation. We discuss the architecture of AutoQ in Sect. 4 and demonstrate the use of the specification language and AutoQ for automated verification of several case studies in Sect. 5.

Verification of a circuit C amplifying the amplitude of $|00⟩$ w.r.t. the specification $\{\mathcal{P},\text{φ}\}C\{\mathcal{Q}\}$ with $\text{φ}:|v_h+3v_{\ell }|>|2v_h|$. $\mathcal{R}$ is the TA obtained by executing $\mathcal{P}$ on C.

Full size image

We will begin with minimal formal definitions of the TA-based specification and demonstrate how to use them to verify quantum circuits in AutoQ with examples. We assume a basic knowledge of quantum computation (see, e.g., the classical textbook [31]).

Let us fix a finite set of quantum variables $\mathbb{X}=\{x_1,\dots ,x_n\}$ with a linear ordering (we assume $x_1<\dots <x_n$) and a disjoint non-empty leaf alphabet $\text{Σ}$. We will, in particular, work with $\text{Σ}={\text{Σ}}_t\uplus {\text{Σ}}_p$ where ${\text{Σ}}_t$ is the alphabet of terms and ${\text{Σ}}_p$ is the alphabet of predicates in a suitable first-order theory (discussed later).

We use $\{0,1{\}}^{\le n}$ to denote $\bigcup _{0\le i\le n}\{0,1{\}}^i$. A (symbolic binary decision) tree over $\mathbb{X}$ and $\text{Σ}$ is a function $\tau :\{0,1{\}}^{\le n}\to (\mathbb{X}\cup \text{Σ})$ such that for all positions $p\in \{0,1{\}}^i$ with $i<n$, we have $\tau (p)=x_{i+1}$ and for all positions $p\in \{0,1{\}}^n$, we have $\tau (p)\in \text{Σ}$. An example of a tree $\tau$ can be found in Fig. 1b, where $\text{Σ}=\{v_h,v_{\ell }\}$, $\tau (ϵ)=x_1$, $\tau (0)=\tau (1)=x_2$, $\tau (00)=v_h$, and $\tau (p)=v_{\ell }$ for $p\in \{0,1{\}}^2\setminus \{00\}$.

A (symbolic) tree automaton (TA) is a tuple $\mathcal{A}=(S,\text{Δ},F)$ where S is a finite set of states, $\text{Δ}\subseteq (S\times \mathbb{X}\times S\times S)\cup (S\times \text{Σ})$ is a transition relation, and $F\subseteq S$ is the set of root (final) states. We denote transitions from $\text{Δ}$ as $s\stackrel{x_i}{\to }(s_0,s_1)$ and $s\stackrel{a}{\to }()$ respectively. An example of a TA with the set of root states $\{s\}$ can be found in Fig. 1a.

A run of $\mathcal{A}$ on $\tau$ is a function $\rho :\{0,1{\}}^{\le n}\to S$ s.t. for all positions $p\in \{0,1{\}}^i$ with $i<n$, it holds that $\rho (p)\stackrel{\tau (p)}{\to }(\rho (p.0),\rho (p.1))\in \text{Δ}$ and for all positions $p\in \{0,1{\}}^n$, it holds that $\rho (p)\stackrel{\tau (p)}{\to }()\in \text{Δ}$. The run $\rho$ is accepting iff $\rho (ϵ)\in F$ and the language of $\mathcal{A}$ is $\mathcal{L}(\mathcal{A})=\{\tau \mid \mathcal{A}\text{ has an accepting run on }\tau \}$. Observe that the tree in Fig. 1b is in the language of the TA $\mathcal{P}$ in Fig. 1a with the run $\rho$ such that $\rho (ϵ)=s$, $\rho (0)=s_1$, $\rho (1)=s_0$, $\rho (00)=s_3$, and $\rho (p)=s_2$ for $p\in \{0,1{\}}^2\setminus \{00\}$.

Now we are ready to demonstrate how to write specifications of quantum circuits with TAs using a running example. We assume that C is a 2-qubit circuit that amplifies the amplitude of the basis state $|00⟩$ (under some constraint $\text{φ}$ over input states) and reduces the amplitudes of other basis states. We first prepare the precondition of C, which consists of a pair $(\mathcal{P},\text{φ})$, where $\mathcal{P}$ is a TA with the root state s, a set of terms ${\text{Σ}}_t$ as the leaf alphabet, and the set of transitions from Fig. 1a, and $\text{φ}$ is a first-order constraint over the variables used in ${\text{Σ}}_t$. In ${\text{Σ}}_t$, we use two variables over complex numbers, $v_{\ell }$ and $v_h$, to denote the corresponding amplitude (low and high). The constraint $\text{φ}$ states that $|v_h+3v_{\ell }|>|2v_h|$ (required by this circuit C, cf. Sect. 5.4). Recall that the TA $\mathcal{P}$ from Fig. 1a accepts the tree from Fig. 1b, which in turn represents the quantum state

AutoQ will execute the gates in C to transform the TA $\mathcal{P}$ to another TA $\mathcal{R}$ capturing the effect of executing C over all quantum states encoded in $\mathcal{P}$. The algorithm for gate operations is almost the same as the one in [14], except that now the update of leaf symbols works symbolically (similarly to symbolic execution [27]: each leaf symbol is a term over $v_h$ and $v_{\ell }$ and quantum gates change the terms by accumulating the operations that would be performed on them, potentially simplifying them). In this example, the TA $\mathcal{R}$ will accept only one tree representing the quantum state

Observe that under the precondition $\text{φ}=|v_h+3v_{\ell }|>|2v_h|$, the probability of $|00⟩$ is indeed increased ($|\frac{v_h+3v_{\ell }}{2}{|}^2>|v_h{|}^2$). The tree representation of $s^{\prime }$ can be found in Fig. 1c. The TA $\mathcal{Q}$ of the postcondition can be found in Fig. 1a. The leaf alphabet of $\mathcal{Q}$ is the set of predicates ${\text{Σ}}_p=\{|◻|>|v_h|,|◻|<|v_{\ell }|\}$ where $◻$ denotes a free variable. Observe that $\mathcal{Q}$ accepts the tree from Fig. 1e.

2.1 High-Level Specification Language

In AutoQ, we provide a simple specification language that can be automatically translated to TAs. The language allows users to focus on the properties they want to express without the need to specify details of the TA structure. Our language is particularly suitable for describing sets of states with one high probability branch and other branches with uniformly low or zero probability, a very common pattern of quantum circuit’s correctness properties. For example, in the language, we can use $(|00⟩:v_h,|\ast ⟩:v_{\ell }),$ where “$|\ast ⟩$” denotes “other basis states,” to define the tree language of the TA in Fig. 1a, which accepts a single tree representing the quantum state $v_h|00⟩+v_{\ell }|01⟩+v_{\ell }|10⟩+v_{\ell }|11⟩$ from Fig. 1b. Similarly, we can use $(|00⟩:|◻|>|v_h|,|\ast ⟩:|◻|<|v_{\ell }|)$ to represent the language of the TA in Fig. 1d. The set of all 2-qubit basis states $\{|i⟩\mid i\in \{0,1{\}}^2\}$ is expressed as $\mathrm{\exists }i\in \{0,1{\}}^2:(|i⟩:1,|\ast ⟩:0)$ (we can see it as a predicate that is satisfied by the described quantum states). We also allow the tensor product $\otimes$ operator, which multiplies the amplitude of the product basis states. For example, $(|00⟩:1,|\ast ⟩:0)\otimes (|00⟩:v_h,|\ast ⟩:v_{\ell })\otimes (|00⟩:1,|\ast ⟩:0)$ represents the (singleton) set of states compactly $\{v_h|000000⟩+\sum _{j\in \{01,11,10\}}{v}_{\ell }|00j00⟩\}.$

A more challenging example is to represent the set of states

Such a set can be described with the help of the $\otimes$ and $\mathrm{\exists }$ operators as follows:

Below is the grammar of specification spec:

A spec is ill-formed when a free variable i appears in state, if some basis is repeated in the rule $(|c_1⟩:t,\dots ,|c_k⟩:t,|\ast ⟩:t)$, or if the previous rule contains two bases of different lengths. If all basis states of the given length are specified in $(|c_1⟩:t,\dots ,|c_k⟩:t,|\ast ⟩:t)$, the $|\ast ⟩:t$ part is not required any more. The specification is then converted into a TA using a straightforward algorithm; in the following we often confuse a TA and its specification.

2.2 Complex Number Representation

In a (pure) quantum state, the amplitude of a basis computational state is a complex number, and the corresponding probability is the square of the absolute value of the amplitude. For verification, we need an exact representation of complex numbers that can be used in computers. In AutoQ, we use a subset of complex numbers that can be expressed by the following algebraic encoding (cf. [14, 34, 46]):

where $a,b,c,d\in \mathbb{Z}$, $k\in \mathbb{N}$, and $\omega =e^{\frac{i\pi }{4}}=\cos {45}^{\circ }+i\sin {45}^{\circ }=\frac{\sqrt{2}}{2}+i\frac{\sqrt{2}}{2}$, the unit vector that makes an angle of ${45}^{\circ }$ with the positive real axis in the complex plane. A complex number is then represented by a quadruple (a, b, c, d) of integers and a normalization factor k. Although the considered set of complex numbers is only a small subset of all complex numbers (it is countable, while the set of all complex numbers is uncountable), the subset is sufficient to describe various standard quantum gates. Currently, AutoQ supports the set of quantum gates X, H, Y, Z, S, T, Rx($\frac{\pi }{2}$), Ry($\frac{\pi }{2}$), CNOT, CZ, Toffoli (cf. the list in [14]), which already includes a set of universal quantum gates. From the Solovay-Kitaev theorem [18], gates performing rotations of $\frac{\pi }{2^n}$, used, e.g., in Shor’s algorithm [33] and quantum Fourier transform (QFT) [16], can be approximated with an error rate $ϵ$ by $\mathcal{O}({\mathrm{l}\mathrm{o}\mathrm{g}}^{3.97}(\frac{1}{ϵ}))$-many H, CNOT, and T gates. The algebraic representation is also sufficient to represent all reachable states in OpenQASM circuits with the set of supported gates, where the initial basis state is $|0\dots 0⟩$.

AutoQ operates on the introduced representation of complex numbers. More precisely, for a specification $\{\mathcal{P},\text{φ}\}C\{\mathcal{Q}\}$, the leaf symbols of $\mathcal{P}$ are quadruples of integer terms (a, b, c, d). We assume that all leaf symbols of $\mathcal{P}$ share a common normalization factor k, so we do not store the value of k explicitly since it can be inferred from the fact that the probability sum over all basis states is one. Instead, we remember a constant natural number value $k_c$, the difference of the k value between $\mathcal{P}$ and $\mathcal{R}$, and use it to normalize the amplitudes. Recall that $\mathcal{R}$ is the TA accepting all states after executing C from some states accepted by $\mathcal{P}$. The initial value of $k_c$ is zero, and each application of H, Rx($\frac{\pi }{2}$), or Ry($\frac{\pi }{2}$) gates will increase it by one (cf. [14]). We normalize all quadruple leaf symbols (a, b, c, d) of $\mathcal{R}$ by multiplying them with ${(\frac{1}{\sqrt{2}})}^{k_c}$ once $\mathcal{R}$ is computed.

Next, we show how to compose a specification of our running example from Fig. 1 using the algebraic representation. The specification can now be written as

2.3 Precise Semantics of the Specification

As mentioned above, for verifying $\{\mathcal{P},\text{φ}\}C\{\mathcal{Q}\}$, we start with a TA $\mathcal{P}$ representing the set of all quantum states satisfying the precondition and compute a TA $\mathcal{R}$ representing the set of states reachable after executing the circuit C. Then, we test whether $\mathcal{R}$ entails $\mathcal{Q}$ (w.r.t. $\text{φ}$), i.e., whether all reachable states satisfy the postcondition.

Formally, we say that a tree ${\tau }_1$ is entailed by a tree ${\tau }_2$ w.r.t. a first-order formula $\text{φ}$, denoted as ${\tau }_1{\models }_{\text{φ}}{\tau }_2$, if for all positions $p\in \{0,1{\}}^n$ it holds that either (i) ${\tau }_1(p)={\tau }_2(p)$ or (ii) ${\tau }_1(p)=(t_1,\dots ,t_k)\in {\text{Σ}}_t$, ${\tau }_2(p)=\psi \in {\text{Σ}}_p$, and $\text{φ}\Rightarrow \psi [t_1/{◻}_1]\dots [t_k/{◻}_k]$. We lift the entailment to TAs: ${\mathcal{A}}_1{\models }_{\text{φ}}{\mathcal{A}}_2$ iff for all trees ${\tau }_1\in \mathcal{L}({\mathcal{A}}_1)$ there exists a tree ${\tau }_2\in \mathcal{L}({\mathcal{A}}_2)$ s.t. ${\tau }_1{\models }_{\text{φ}}{\tau }_2$.^{Footnote 3}

We will now describe how we perform the entailment check $\mathcal{R}{\models }_{\text{φ}}\mathcal{Q}$. Since we operate with trees and tree automata over symbolic values, we cannot establish entailment by running a classical TA language inclusion test based on complementing the automaton $\mathcal{Q}$ first. Instead, our algorithm for testing the entailment $\mathcal{R}{\models }_{\text{φ}}\mathcal{Q}$ is based on an on-the-fly TA inclusion checking algorithm [4, 10], which avoids complementation. The on-the-fly inclusion-checking algorithm can be seen as an optimization of the classical construction, which would establish $\mathcal{L}(\mathcal{R})\cap \overline{\mathcal{L}(\mathcal{Q})}\stackrel{?}{=}\mathrm{\varnothing }$ by first computing the complement ${\mathcal{Q}}^{\complement }$ of $\mathcal{Q}$ (using a bottom-up TA determinization), followed by computing the intersection ${\mathcal{A}}_{\cap }$ of ${\mathcal{Q}}^{\complement }$ and $\mathcal{R}$, and, finally, checking language emptiness of ${\mathcal{A}}_{\cap }$. In particular, the on-the-fly inclusion checking algorithm can be seen as doing all the operations at once. Furthermore, the algorithms in [4, 10] also make use of the so-called antichains and TA simulation to prune the explored state space.

Our modification of the inclusion algorithm to test TA entailment, given in Algorithm 1, mainly differs from [4, 10] in the way initial sets of state pairs are computed on Line 3. In particular, we match a state $s_r$ that can perform a leaf transition over $t_r$ in $\mathcal{R}$ with the set $U_q$ of all states in $\mathcal{Q}$ that can perform a leaf transition either over $t_r$ or over a predicate $p_q$ such that $\text{φ}\Rightarrow p_q[t_r/◻]$ (we use $p_q[t_r/◻]$ for a tuple $t_r$ to denote the substitution of the tuple’s components into the corresponding free variables of $p_q$).

After that, the algorithms perform a simultaneous bottom-up traversal through $\mathcal{R}$ (represented by states $s_r$) and the determinized version of $\mathcal{Q}$ (represented by sets of states $U_q$). For each such pair $(s_r,U_q)$, the algorithm first checks whether $s_r$ is a root state and $U_q$ does not contain any root state (cf. Line 6; this would mean that $\mathcal{R}$ accepts some tree that is not accepted by $\mathcal{Q}$). If this does not hold, then the algorithm tries to find all already processed pairs that can make a transition with $(s_r,U_q)$ (cf. Line 8) and continue from all such pairs. Each bottom-up successor $(s_r^{\prime },U_q^{\prime })$ is then added to $Worklist$ in the case it has not been seen previously (cf. Line 13).

The algorithm uses the function $Min$ (cf. Lines 3, 7, and 13) to minimize the sets $Worklist$ and $Processed$ w.r.t. a subsumption relation, and the downward closure for $\lceil Processed\cup Worklist\rceil$ on Line 12 to prune the explored state space. Due to lack of space, we refer to the works [4, 10] for more details about these optimizations.

The architecture of AutoQ. The input verification problem is $\{\mathcal{P},\text{φ}\}C\{\mathcal{Q}\}$.

Full size image

We illustrate the architecture of AutoQ in Fig. 2. The tool is written in C++ and uses the following external tools: the TA library Vata  [28] for efficient testing of TA inclusion (when the postcondition uses only the term alphabet ${\text{Σ}}_t$) and the SMT solver Z3 for entailment checking of leaf symbols in Algorithm 1. We allow any theory solver supported by Z3. In our experiment, we use QF_NIRA. AutoQ takes as an input a quantum circuit in the OpenQASM format accompanied with the specification written as tree automata (.aut files) or the high-level specification language (.hsl files) introduced in Sect. 2.1.

Preprocessor reads the input files (.aut, .smt, .qasm, and .hsl files), translates specifications in the .hsl files into tree automata, and stores them using AutoQ ’s internal data structures. Circuit Executor then reads the circuit C and the TA $\mathcal{P}$ and generates another TA $\mathcal{R}$ obtained as the result after executing C from states in $\mathcal{P}$, using the approach of [14] with the symbolic extension discussed in Sect. 2. AutoQ can also output the TA $\mathcal{R}$ for further analysis. Finally, Entailment Checker checks whether $\mathcal{R}{\models }_{\text{φ}}\mathcal{Q}$ and reports “verified” when the entailment holds and “bug found” otherwise.

In this section, we describe several use cases of quantum algorithms and their important properties that we were able to verify using AutoQ fully automatically. We focus on the use of symbolic TA in this set of experiments and refer the readers to [14] for other experimental results. A selection of the obtained results is given in Table 1. An artifact that allows reproduction of the results is available as [13].

5.1 Hadamard Square is Identity

Our first use case shows that the single qubit gate C that runs two consecutive H gates has the same effect as an identity matrix. We use the specification $\{\mathcal{P},\text{φ}\}C\{\mathcal{Q}\}$ with

In this simple example, the precondition $\mathcal{P}$ encodes an infinite number of quantum states, which is not expressible using the technique in [14]. We also included a buggy version by altering one of the H gates, and AutoQ managed to detect the injected bug. The results can be found in rows H${}^2$ in Table 1.

5.2 Zero Imaginary Part of Amplitudes

One property, which is shared by multiple algorithms, e.g., Bernstein-Vazirani’s [8] and Grover’s algorithm [25], is that the imaginary part of all amplitudes of the result is zero.

Let us focus on Bernstein-Vazirani’s algorithm [8], which finds a secret bit-string s from an oracle using a single query. The algorithm begins with the quantum state $|0^n⟩$, where n is the length of s, and ends with the quantum state $|s⟩$. The amplitudes of all basis states are either zero or one, the imaginary part of the amplitudes is, therefore, always zero. For a three-qubit circuit C implementing the algorithm, we can therefore use the specification: $\{\mathcal{P},\text{φ}\}C\{\mathcal{Q}\}$ with

where ${\psi }_{\mathrm{\Im }}\equiv ({◻}_b=-{◻}_d\wedge {◻}_c=0)$ (it will also be used later). In the definition of $\mathcal{P}$, recall that we use the integer-quadruple representation of complex numbers (cf. Eq. (5)). In the postcondition $\mathcal{Q}$, the free variables ${◻}_a,{◻}_b,{◻}_c,{◻}_d$ are to be substituted by the corresponding terms in the obtained integer term quadruple (a, b, c, d) in the entailment check. Note that (a, b, c, d) represents the complex number $(a+b\frac{\sqrt{2}}{2}-d\frac{\sqrt{2}}{2})+i(b\frac{\sqrt{2}}{2}-c+d\frac{\sqrt{2}}{2})$ (obtained from Eq. (5)). Because a, b, c, d are all integers, for the imaginary part to be zero, it must hold that $c=0$ and $b=-d$.

When we run C from $\mathcal{P}$, we obtain a TA $\mathcal{R}$ encoding $(|010⟩:(1,0,0,0)$, $|\ast ⟩:(0,0,0,0))$ and the entailment $\mathcal{R}{\models }_{\text{φ}}\mathcal{Q}$ holds. See the rows BV$(n)$ in Table 1 for the results of verifying the algorithm for circuits with secrets of size n. As in the previous example, we also included a buggy version to demonstrate AutoQ ’s bug-finding capability. We can see that AutoQ could verify the algorithm for secrets of a quite large size.

5.3 Probability of Measuring the Correct Answer

Grover’s algorithm [25] assumes a Boolean function f over n bits with only one satisfying assignment s and an oracle that evaluates f for a given input. The algorithm finds s with a high probability, say $>0.9$, using only $\mathcal{O}(\sqrt{2^n})$ oracle queries. The algorithm works iteratively, where each Grover iteration queries the oracle once and amplifies the amplitude of $|s⟩$. First, let C be a 6-qubit circuit implementing Grover’s search with the satisfying assignment $s=010$, where the first three qubits of C are the work tape, and the following three are the ancillae. We use the following specification: