sequential equivalence with more than one multi bit register - yosys

Question

extremely simple sequential logic equivalence test case:
module memory1(
input wire clk,
input wire srst,
input wire [15:0] addr,
input wire din,
input wire wr,
input wire rd,
output reg [15:0] out
);
reg [15:0] mem;
always_ff #(posedge clk) begin
if (srst) begin
mem <= 'd0;
out <= 'd0;
end
else begin
if (wr) mem[addr] <= din;
out <= mem;
end
end
endmodule
And then:
module memory2(
input wire clk,
input wire srst,
input wire [15:0] addr,
input wire din,
input wire wr,
input wire rd,
output reg [15:0] out
);
reg [15:0] mem;
always_ff #(posedge clk) begin
if (srst) begin
mem <= 'd0;
out <= 'd0;
end
else begin
if (wr) case (addr)
'd0 : mem[0] <= din;
'd1 : mem[1] <= din;
'd2 : mem[2] <= din;
'd3 : mem[3] <= din;
'd4 : mem[4] <= din;
'd5 : mem[5] <= din;
'd6 : mem[6] <= din;
'd7 : mem[7] <= din;
'd8 : mem[8] <= din;
'd9 : mem[9] <= din;
'd10 : mem[10] <= din;
'd11 : mem[11] <= din;
'd12 : mem[12] <= din;
'd13 : mem[13] <= din;
'd14 : mem[14] <= din;
'd15 : mem[15] <= din;
endcase
out <= mem;
end
end
endmodule
using the yosys script:
read_verilog -sv example_mem.sv
proc
memory
miter -equiv -flatten memory1 memory2 miter
hierarchy -top miter
sat -maxsteps 50 \
-set in_srst 0 -set-at 1 in_srst 1 \
-show-ports \
-seq 1 \
-tempinduct \
-prove trigger 0 \
miter
I can get an equivalence match, all is good.
However if I change both designs such that
out <= mem;
is replaced with:
else if (rd) out <= mem;
I get a non-equivalence.
however if I use the following method, I get a pass......
read_verilog -sv example_mem.sv
proc
memory
equiv_make memory1 memory2 equiv
hierarchy -top equiv
flatten
equiv_induct -seq 1
equiv_status -assert
Can anybody shed any light for me?
why does the miter method fail with the simple mod?

Answer 1

In temporal induction, this is essentially trying to prove that after starting in random states, assuming they are equal (with equal inputs) for N cycles, then they will always be equal at cycle N+1. When you add the read enable, there are paths through the design where state never "leaks" to the output so this technique no longer works.
A 50-cycle bounded model check (removing -tempinduct and -maxsteps, and setting -seq to 50), does pass as expected.
The second script passes because the equiv_ commands look into the design, and adds an extra check that the two mem registers are identical, which then allows induction to start off "synchronised" and pass.
This is in the context of assertion verification, rather than equivalence checking, but https://zipcpu.com/blog/2018/03/10/induction-exercise.html also discusses a similar problem with temporal induction.