ReQWIRE: Reasoning about Reversible Quantum Circuits

TL;DR

This paper introduces ReQWIRE, a framework for verifying that ancilla qubits in quantum circuits are correctly returned to their initial state before being discarded, enhancing correctness and enabling verified compilation.

Contribution

It provides novel methods for verifying ancillae disposal in quantum circuits and implements a verified compiler from classical functions to quantum oracles.

Findings

Developed verification techniques for ancillae in quantum circuits

Implemented a verified compiler for classical to quantum functions

Enhanced correctness assurance in quantum circuit programming

Abstract

Common quantum algorithms make heavy use of ancillae: scratch qubits that are initialized at some state and later returned to that state and discarded. Existing quantum circuit languages let programmers assert that a qubit has been returned to the |0> state before it is discarded, allowing for a range of optimizations. However, existing languages do not provide the tools to verify these assertions, introducing a potential source of errors. In this paper we present methods for verifying that ancillae are discarded in the desired state, and use these methods to implement a verified compiler from classical functions to quantum oracles.

Equations

$$[[\text{One}]]=0[[\text{Qubit}]]=[[\text{Bit}]]=1[[W_1\otimes W_2]]=[[W_1]]+[[W_2]]$$

$$denote\_safe\mathtt{U}\rho$$

$$denote\_safe\mathtt{ini}{\mathtt{t}}_0\rho$$

$$denote\_safe\mathtt{ini}{\mathtt{t}}_1\rho$$

$$denote\_safe\mathtt{meas}\rho$$

$$denote\_safe\{\mathtt{discard},\mathtt{asser}{\mathtt{t}}_0,\mathtt{asser}{\mathtt{t}}_1\}\rho$$

$$denote\_unsafe\mathtt{asser}{\mathtt{t}}_0\rho$$

$$denote\_unsafe\mathtt{asser}{\mathtt{t}}_1\rho$$

$$b::=x\mid t\mid f\mid \neg b\mid b_1\wedge b_2\mid b_1\oplus b_2$$

Full text

1 Introduction

Many quantum algorithms rely heavily on quantum oracles, classical programs executed inside quantum circuits. Toffoli proved that any classical, boolean-valued function $f(x)$ can be implemented as a unitary circuit $f_{u}$ satisfying $f_{u}(x,z)=(x,z⊕f(x))$ [17]. Toffoli’s construction for quantum oracles is used in many quantum algorithms, such as the modular arithmetic of Shor’s algorithm [13]. As a concrete example, Figure 1 shows quantum circuits that implement the boolean functions and ($\wedge$) and or ($\vee$).

Unfortunately, Toffoli’s construction introduces significant overhead. Consider a circuit meant to compute the boolean formula $(a\vee b)\wedge(c\vee d)$. The circuit needs two additional scratch wires, or ancillae, to carry the outputs of $(a\vee b)$ and $(c\vee d)$, as seen in Figure 2. The annotation [math] at the start of a wire means that qubit is initialized in the state $\ket{0}$. When constructed in this naive way, the resulting circuit no longer corresponds to a unitary transformation, and cannot be safely used in a larger quantum circuit.

The solution is to uncompute the intermediate values $a\vee b$ and $c\vee d$ and then discard them at the end of the quantum circuit (Figure 3). The annotation [math] at the end of a wire is an assertion that the qubit at that point is in the zero state, at which point we can safely discard it without affecting the remainder of the state. (If we measured and discarded a non-zero qubit, we would affect whatever qubits it was entangled with.)

How can we verify that such an assertion is actually true? We cannot dynamically check the assertion, since we can only access the value of a qubit by measuring it, collapsing the qubit in question to a [math] or $1$ state. However, we can statically reason that the qubit must be in the state $\ket{0}$ by analyzing the circuit semantics.

The claim that a qubit is in the [math] state is a semantic assertion about the behavior of the circuit. Unfortunately, this makes it hard to verify—computing the semantics of a quantum program is computationally intractable in the general case. Circuit programming languages often allow users to make such assertions but not to verify that they are true. For example, Quipper [7] allows programmers to make assertions about the state of ancillae, but these assertions are never checked. Likewise, in Q# [15] the assertion will be checked by a simulator but cannot be checked when a program is run on a quantum computer. Hence, when the qubit is reused, a common use for ancillae which Q# emphasizes, it may be in the wrong state. The QCL quantum circuit language [18] provides a built-in method for creating reversible circuits from classical functions, but the programmer must trust this method to safely manage ancillae. In a step in the right direction, the $R\textsc{e}V\textsc{er}C$ compiler [2] for the (non-quantum) reversible computing language $R\textsc{evs}$ [9] provides a similar approach to compilation and verifies that it correctly uncomputes its ancilla. However, other assertions in $R\textsc{evs}$ that a wire is correctly in the [math] state are ignored if they cannot be automatically verified.

In this paper, we develop verification techniques for safely working with ancillae. Our approach allows the programmer to discard qubits that are in the state $\ket{0}$ or $\ket{1}$, provided that she first formally proves that the qubits are in the specified state. Inspired by the $R\textsc{e}V\textsc{er}C$ compiler [2], we also provide syntactic conditions that the programmer may satisfy to guarantee that her assertions are true. However, circuits do not need to match this syntactic specification: a programmer may instead manually prove that her circuit safely discards qubits using the denotational semantics of the language. This gives the programmer the flexibility to use ancillae even when the proofs of such assertions are non-trivial.

We develop these techniques in the context of $\mathcal{Q}\textsc{wire}$ (as in “require”), a domain-specific programming language for describing and reasoning about quantum circuits [10]. $\mathcal{Q}\textsc{wire}$ is implemented as a embedded language inside the Coq proof assistant [4], which allows us to formally verify properties of $\mathcal{Q}\textsc{wire}$ circuits. These properties can range from coarse-grained (“this circuit corresponds to a unitary transformation”) to precise (“this teleport circuit is equal to the identity”) [12]. $\mathcal{Q}\textsc{wire}$ is an ongoing project and available for public use at https://github.com/inQWIRE/QWIRE.

This paper reports on work-in-progress that makes the following contributions:111Section 7 elaborates on the state of the Coq development that underlies this work.

• •

We extend $\mathcal{Q}\textsc{wire}$ with assertion-bearing ancillae.

• •

We give semantic conditions for the closely related properties of (a) when a circuit is reversible and (b) when a circuit contains only valid assertions about its ancillae.

• •

We provide syntactic conditions that guarantee the correctness of assertions with respect to these semantic conditions.

• •

We present a compiler to turn boolean expressions into reversible $\mathcal{Q}\textsc{wire}$ circuits and we prove its correctness using our syntactic correctness conditions.

• •

Finally, we use our verified compiler to implement a quantum adder.

2 The $\mathcal{Q}\textsc{wire}$ Circuit Language

$\mathcal{Q}\textsc{wire}$ [10] is a small quantum circuit language designed to be embedded in a larger, functional programming language. We have implemented $\mathcal{Q}\textsc{wire}$ in the Coq proof assistant, which provides access to dependent types and the Coq interactive proof system. We use these features to type check $\mathcal{Q}\textsc{wire}$ circuits and verify properties about their semantics [12]. In this section we give a brief introduction to the syntax and semantics of $\mathcal{Q}\textsc{wire}$, including the new ancilla assertions.

A $\mathcal{Q}\textsc{wire}$ circuit consists of a sequence of gate applications terminated with some output wires222For simplicity, this presentation elides a communication protocol called dynamic lifting discussed in prior work on $\mathcal{Q}\textsc{wire}$ [10, 12]..

[TABLE]

The parameter W refers to a wire type: Bit, Qubit or some tuple of Bits and Qubits (including the empty tuple One). A pattern of wires, denoted p, can be a bit-valued wire bit v, a qubit-valued wire qubit v, a pair of wires (p1,p2) or an empty tuple (). Gates g are either unitary gates U, drawn from a universal gate set, or members of a small set of non-unitary gates:

[TABLE]

The init and meas gates initialize and measure qubits, respectively; meas results in a bit, which can be discarded by the discard bit or used as a control. The assert_0 and assert_1 gates take a qubit as input and discard it, provided that it is in the state $\ket{0}$ or $\ket{1}$ respectively. We will discuss the semantics of these gates, and how to verify assertions, in Sections 3 and 4.

As an example, the following $\mathcal{Q}\textsc{wire}$ circuit prepares a Bell state:

⬇

gate p1 $\leftarrow$ init_0 ();

gate p2 $\leftarrow$ init_0 ();

gate p1 $\leftarrow$ H p1;

gate (p1, p2) $\leftarrow$ CNOT (p1, p2);

output (p1,p2)

[math][math]$H$

$\mathcal{Q}\textsc{wire}$ also includes some more powerful functionality for constructing circuits. Circuits can be composed via a let binding let_ p $\leftarrow$ C; C', where the output of the first circuit C is plugged into the wires p in C'. It’s worth highlighting two useful instances of composition: The inSeq (;;) function takes a Box W W' and a Box W' W'' and composes them sequentially to return a Box W W''. The inPar function likewise takes a circuit c1 of type Box $\mathtt{W}_{\mathtt{1}}$ $\mathtt{W}_{\mathtt{1}}$' and c2 of type Box $\mathtt{W}_{\mathtt{2}}$ $\mathtt{W}_{\mathtt{2}}$' and composes them in parallel, producing c1 $\|$ c2 of type Box ($\mathtt{W}_{\mathtt{1}}$ $\otimes$ $\mathtt{W}_{\mathtt{2}}$) ($\mathtt{W}_{\mathtt{1}}$' $\otimes$ $\mathtt{W}_{\mathtt{2}}$').

Circuits can also be boxed by collecting the input of a circuit in an input pattern box_ p $\Rightarrow$ C, creating a closed term of type Box W W' in the host language. Here, the input wire type W matches the type of the input wire p, and the output type W' is the same as that of the underlying circuit. Such a boxed circuit can be unboxed to be used again in other circuits.

Boxing, unboxing, and composing circuits is illustrated by the teleport circuit, where alice, bob, and bell00 are simple circuits whose definitions are not shown:

⬇

Definition teleport : Box Qubit Qubit :$=$

box_ q $\Rightarrow$

let_ (a,b) $\leftarrow$ unbox bell00 () ;

let_ (x,y) $\leftarrow$ unbox alice (q,a) ;

unbox bob (x,y,b).

bell00[math][math]$H$aliceH$$meas$$measbobX$$Z

3 A Safe and Unsafe Semantics

As in prior work, $\mathcal{Q}\textsc{wire}$’s semantics is given in terms of density matrices, denoted $\rho$, that represent distributions over pure quantum states known as mixed states. A $\mathcal{Q}\textsc{wire}$ circuit of type Box W W' maps a $2^{⟦W⟧}×2^{⟦W⟧}$ density matrix to a $2^{⟦W^{\prime}⟧}×2^{⟦W^{\prime}⟧}$ density matrix, where $⟦W⟧$ is the size of a wire type:333In practice, the semantics must be “padded” by an additional type so that it can be applied in a larger quantum system.

[TABLE]

In this work we use mixed states only to refer to total, as opposed to partial, distributions. This means that all mixed states in our semantics have traces equal to $1$.

In this work, we give two different semantics for quantum circuits that differ in how they treat assertions. The safe semantics corresponds to an operational model that does not trust assertions, where an $\mathtt{assert}_{\mathtt{x}}$ gate first measures the input qubit before discarding the result. The unsafe semantics assumes that all assertions are accurate, so an $\mathtt{assert}_{\mathtt{x}}$ gate simply discards its input qubit without measuring it. The two semantics coincide exactly when all assertions in a circuit are accurate, in which case we call the circuit valid.

In the safe semantics, assertions are identical to the discard gate, which measures and then discards the qubit.

[TABLE]

Here $\llbracket U\rrbracket$ is the unitary matrix corresponding to the gate U; multiplying by $\llbracket U\rrbracket$ and $\llbracket U\rrbracket^{\dagger}$ is equivalent to applying $\llbracket U\rrbracket$ to all the pure states in the distribution. The initialization gates $\mathtt{init}_{\mathtt{0}}$ and $\mathtt{init}_{\mathtt{1}}$ both add a single qubit to the system in the $\ket{0}$ and $\ket{1}$ state respectively. The meas gate produces a mixed state corresponding to a probability distribution over the measurement result ($\ket{0}$ or $\ket{1}$). The discard gate removes a classical-valued bit from the state.

Under the safe semantics, the assertions $\mathtt{assert}_{\mathtt{0}}$ and $\mathtt{assert}_{\mathtt{1}}$ are treated as a measurement followed by a discard. This is semantically the same as the denotation of discard, except that discard is guaranteed by the type system to only throw away a classically valued bit. This operation on qubits is safe (i.e., results in a total density matrix) even if the qubit is in a superposition of $\ket{0}$ and $\ket{1}$.

The unsafe semantics is the same as the safe semantics, except for $\mathtt{assert}_{\mathtt{0}}$ and $\mathtt{assert}_{\mathtt{1}}$:

[TABLE]

This is unsafe in the sense that, if $\rho$ isn’t in the zero state, then an $\mathtt{assert_{0}}$ produces a density matrix with a trace less than 1. Operationally, this corresponds to the instruction “throw away this qubit in the zero state”, which is quantum-mechanically impossible in the general case. However, this semantics corresponds to the intended meaning of assert_x when we know the assertion is true. It also ensures that the composition of init_x with assert_x is equivalent to the identity, which allows us to optimize away qubit initialization and discarding.

We can define what it means for the ancilla assertions in a circuit to be valid by comparing these two different semantic interpretations.

⬇

Definition valid_ancillae W (c : Circuit W) : $\mathbb{P}$ :$=$ (denote c $=$ denote_unsafe c).

An equivalent definition states that the unsafe semantics preserves the trace of its input (which is always $1$) and therefore maps it to a total probability distribution.

⬇

Definition valid_ancillae' W (c : Circuit W) : $\mathbb{P}$ :$=$

$\forall$ \rho, Mixed_State ${\tt\rho}$ $\rightarrow$ trace (denote_unsafe c ${\tt\rho}$) $=$ 1.

The second definition follows from the first because the safe semantics is trace preserving. The first follows from the second since denote_unsafe c ${\tt\rho}$ corresponds to a sub-distribution of denote_safe c ${\tt\rho}$. If its trace is one then they must then represent the same distribution.

These two definitions precisely characterize what it means for circuits to have always correct assertions. In the next section, we define syntactic conditions that are sufficient but not necessary for validity. Programmers will often write syntactically valid circuits like those produced by compile function in Section 5), but when needed the semantic definition of validity is still available.

An important property related to the validity of a circuit is its reversibility. We say that c and c' are equivalent, written c $\equiv$ c', if both their safe and unsafe denotations are equal. (If c and c' are valid, this is equivalent to denote c $=$ denote c', but otherwise it is a stronger claim.) Reversibility says that a circuit has a left and right inverse:

⬇

Definition reversible {$\mathtt{W}_{\mathtt{1}}$ $\mathtt{W}_{\mathtt{2}}$} (c : Box $\mathtt{W}_{\mathtt{1}}$ $\mathtt{W}_{\mathtt{2}}$) : $\mathbb{P}$ :$=$

(exists c', c' ;; c $\equiv$ id_circ) $/$\ (exists c', c ;; c' $\equiv$ id_circ)

In Section 5, the compiler produces circuits that are their own inverse:

⬇

Definition self_inverse {W} (c : Box W W) : $\mathbb{P}$ :$=$ c ;; c $\equiv$ id_circ.

We can now show that in any reversible circuit, all the ancilla assertions hold.

Lemma 3.1**.**

If $c$ is reversible, then it is valid.

Proof.

Let $c^{\prime}$ be $c$’s inverse. By the second definition of validity, it suffices to show that the trace of denote_unsafe c ${\tt\rho}$ is equal to $1$ for every initial mixed state $ρ$. We know that the trace of

denote_unsafe id_circ ${\tt\rho}$ is $1$, hence

⬇

1 $=$ trace (denote_unsafe (c;;c') ${\tt\rho}$) $=$ trace (denote_unsafe c' (denote_unsafe c ${\tt\rho}$))

Because the unsafe semantics is trace-non-increasing, it must be the case that the trace of

denote_unsafe c ${\tt\rho}$ is $1$ as well. ∎

4 Syntactically Valid Ancillae

Let $c$ be a circuit made up only of classical gates: the initialization gates, the not gate X, the controlled-not gate CNOT, and the Toffoli gate T. Let $c^{\prime}$ be the result of reversing the order of the gates in $c$ and swapping every initialization with an assertion of the corresponding boolean value. Then every assertion in $c;;c^{\prime}$, where semicolons denote sequencing, is valid.

Unfortunately, every circuit of this form is also equivalent to the identity circuit, so as a syntactic condition of validity, this is much too restrictive. In practice, the quantum oracles discussed in the introduction are mostly symmetric, but they introduce key pieces of asymmetry to compute meaningful results. In ReVerC, this construction is called the restricted inverse; QCL [18] and Quipper [7] take similar approaches.

Let $c$ be a circuit with an equal number of input and output wires whose qubits can be broken up into two disjoint sets: the first $n$ qubits are called the source, and the last $t$ qubits are called the target. That is, c : Box (n$+$t $\bigotimes$ Qubit) (n$+$t $\bigotimes$ Qubit). The syntactic condition of source symmetry on circuits guarantees that $c$ is the identity on all source qubits. In addition, it guarantees that assertions are only made on source qubits with a corresponding initialization.

A classical gate acts on the qubit i if it affects the value of that qubit in an $m$-qubit system: X acts on its only argument, CNOT acts on its second argument (the target), and Toffoli acts on its third argument.

The property of source symmetry on circuits is defined inductively as follows:

• •

The identity circuit is source symmetric.

• •

If g is a classical gate and c is source symmetric, then g ;; c ;; g is source symmetric.

• •

If g is a classical gate that acts on a qubit in the target and c is source symmetric, then both g ;; c and c ;; g are source symmetric.

• •

If c is source symmetric and i is in the source of c, then

init_at b i ;; c ;; assert_at b i is source symmetric.

The key property of a source symmetric circuit is that it does not affect the value of its source qubits. We say that a circuit c is a no-op at qubit $i$ if, when initialized with a boolean $b$, the qubit is still equal to $b$ after executing the circuit. We could define this as $\llbracket c\rrbracket(\rho_{1}\otimes\ket{b}\bra{b}\otimes\rho_{2})=\rho_{1}^{\prime}\otimes\ket{b}\bra{b}\otimes\rho_{2}^{\prime}$ for some $\rho_{1},\rho_{2},\rho_{1}^{\prime},\rho_{2}^{\prime}$, but this would require $\rho_{1}$ and $\rho_{2}$ (and $\rho_{1}^{\prime}$ and $\rho_{2}$’) to be separable, which is an unnecessary restriction. Instead, we use the valid_ancillae predicate and say if we initialize an ancilla in state $x$ at $i$, apply $b$, and then assert that $i=x$, our assertion will be valid:

⬇

Definition noop_on (m k : $\mathbb{N}$) (c : Box (Qubits (1 $+$ m)) (Qubits (1$+$m)) : $\mathbb{P}$ :$=$

$\forall$ b, valid_ancillae (init_at b i ;; c ;; assert_at b i).

We similarly define a predicate, noop_on_source n, that says that a given circuit is a no-op on each of its first $n$ inputs.

These inductive definitions allow us to state a number of closely related lemmas about symmetric circuits:

Lemma 4.1**.**

If the classical gate $g$ acts on the qubit $k$ and $i≠k$, then $g$ is a no-op on $i$.

Lemma 4.2**.**

Let c be a circuit such that c ;; assert_at b i is a valid assertion.

c ;; assert_at b i ;; init_at b i ≡ c*  i.e.,*

bbc**c

Lemma 4.3**.**

If c and c’ are both no-ops on qubit $i$, then c ;; c’ is also a no-op on qubit $i$.

Conjecture 4.4**.**

If c is source symmetric, then it is a no-op on its source.

These lemmas have been admitted, rather than proven, in the Coq development (Symmetric.v). 4.4 is labeled as a conjecture rather than a lemma, since we do not yet have a paper proof of the statement. It may be the case that we need to strengthen our definition of no-op for this conjecture to hold.

Since all ancillae in a source symmetric circuit occur on sources, we can prove from the statements above that source symmetric circuits are valid.

Theorem 4.5**.**

If c is source symmetric, then all its assertions are valid.

Source symmetric circuits also satisfy a more general property—they are reversible. The inverse of a source symmetric circuit is defined by induction on source symmetry:

• •

The inverse of the identity circuit is the identity;

• •

The inverse of g ;; c ;; g is g ;; ${\tt c}^{\mathtt{-1}}$ ;; g;

• •

The inverses of c ;; g and g ;; c are g ;; ${\tt c}^{\mathtt{-1}}$ and ${\tt c}^{\mathtt{-1}}$ ;; g; and

• •

The inverse of init_at b i ;; c ;; assert_at b i is init_at b i ;; ${\tt c}^{\mathtt{-1}}$ ;; assert_at b i.

Clearly, the inverse of any source symmetric circuit is also source symmetric, and the inverse is involutive, meaning $(c^{-1})^{-1}=c$.

Theorem 4.6**.**

If c is source symmetric, then ${\tt c}^{\mathtt{-1}}$ ;; c is equivalent to the identity circuit.

Proof.

By induction on the proof of source symmetry. The only interesting case is the case for ancilla, showing

⬇

init_at b i ;; ${\tt c}^{\mathtt{-1}}$ ;; assert_at b i ;; init_at b i ;; c ;; assert_at b i $\equiv$ id_circ.

From Theorem 4.5 we know that the circuit init_at b i ;; ${\tt c}^{\mathtt{-1}}$ ;; assert_at b i is valid. Then Lemma 4.2 tells us that init_at b i ;; ${\tt c}^{\mathtt{-1}}$ ;; assert_at b i;; init_at b i is equivalent to init_at b i ;; ${\tt c}^{\mathtt{-1}}$. Thus the goal reduces to init_at b i ;; ${\tt c}^{\mathtt{-1}}$ ;; c ;; assert_at b i. This is equivalent to the identity by the induction hypothesis as well as the fact that init_at b i ;; assert_at b i is the identity. ∎

We can now say that any circuit followed by its inverse is valid. But this theorem is easily extensible. For instance, we can add the following to our inductive definition of symmetric, and the theorem will still hold:

• •

If c is source symmetric, and c $\equiv$ c', then c' is source symmetric.

This extension allows us to use existing (semantic) equivalences to satisfy our (syntactic) source symmetry predicate, which in turn proves the semantic property of validity. For example, because teleportation is semantically equivalent to the identity circuit, we know trivially that it is valid, even though it is not source symmetric. The Coq development provides many useful compiler optimizations in the file Equations.v that can now be used in establishing source symmetry.

5 Compiling Oracles

Now that we have syntactic guarantees for circuit validity, we can consider a compiler from boolean expressions to source-symmetric circuits, producing the quantum oracles described in the introduction to this chapter. The resulting circuits are all source symmetric, so it follows from the previous section that they are valid.

We begin with a small boolean expression language, borrowed from Amy et al.[2], with variables, constants, negation ($\neg$), conjunction ($\wedge$), and exclusive-or ($\oplus$).

[TABLE]

The interpretation function ${\mathtt{\llbracket b\rrbracket_{f}}}$ takes a boolean expression b and a valuation function f : Var $\rightarrow$ bool and returns the value of the boolean expression with the variables assigned as in f.

The compiler, shown in Figure 4, takes a boolean expression b and a map ${\tt\Gamma}$ from the variables of $b$ to the wire indices444In the Coq development, these maps are represented by linear typing contexts.. The resulting circuit compile b ${\tt\Gamma}$ has \mathtt{\left|\Gamma\right|}$$+1 qubit-valued input and output wires, where $\mathtt{\left|\Gamma\right|}$ is the number of variables in the scope of b.

The compiler uses init_at, assert_at, X_at, CNOT_at, and Toffoli_at circuits, each of which applies the corresponding gate to the given index in the list of $n$ wires. It makes heavy use of the sequencing (;;) and parallel (||) operators. The TRUE case in Figure 4 outputs the exclusive-or of true with the target wire, which is equivalent to simply negating the target wire; the FALSE case reduces to the identity. The variable case b_var applies a CNOT gate from the variable’s associated wire to the target, thereby sharing its value.

The AND case (Figure 5) is more interesting. We first initialize a qubit in the [math] state and recursively compile the value of b1 to it. We then do the same for b2. We apply a Toffoli gate from b1 and b2, now occupying the $1$ and $2$ positions in our list, to the target qubit at [math]. We then reapply the symmetric functions compile b2 ${\tt\Gamma}$ and compile b1 ${\tt\Gamma}$ to their respective wires, returning the ancillae to their original states and discarding them. We are left with the target wire z holding the boolean value $b_{z}\oplus(b_{1}\wedge b_{2})$ and $\mathtt{\left|\Gamma\right|}$ wires retaining their initial values.

Finally, we have the XOR case. Here we borrow a trick from ReVerC [2] and allocate only a single ancilla instead of the two we used in the AND case. Instead of calculating $(b_{1}\oplus b_{2})\oplus t$, where $t$ is the target, we calculate the equivalent $b_{2}\oplus(b_{1}\oplus t)$, taking advantage of the associativity and commutativity of $\oplus$. Hence, as soon as we’ve computed $b_{1}$, we can apply a $CNOT$ from $b_{1}$ to the target and immediately uncompute $b_{1}$. This frees up our ancilla, which we then use as a target for compile b2.

Note that our entire compile circuit is source symmetric, and therefore our assertions are guaranteed to hold by Theorem 4.5.

We can now go about proving the correctness of this compilation.

⬇

Theorem compile_correct : $\forall$ (b : bexp) (${\tt\Gamma}$ : Ctx) (f : Var $\rightarrow$ bool) (z : bool),

vars b $\subseteq$ domain ${\tt\Gamma}$ $\rightarrow$

$\llbracket$compile b {\tt\Gamma}$$\rrbracket (bool_to_matrix t $\otimes$ basis_state ${\tt\Gamma}$ f) $=$

bool_to_matrix (z $\oplus$ ${\mathtt{\llbracket b\rrbracket_{f}}}$) $\otimes$ basis_state ${\tt\Gamma}$ f.

The function basis_state takes the wires referenced by $\Gamma$ and the assignments of $f$ and produces the corresponding basis state. This forms the input to the compiled boolean expression along with the target, a classical qubit in the $\ket{0}$ or $\ket{1}$ state. The statement of compile’s correctness says that when we apply $\llbracket$compile b {\tt\Gamma}$$\rrbracket to this basis state with an additional target qubit, we obtain the same matrix with the result of the boolean expression on the target. The proof follows by induction on the boolean expression.

6 Quantum Arithmetic in $\mathcal{Q}\textsc{wire}$

In this section, we show how to use the compiler from the previous section to implement a quantum adder, which has applications in many quantum algorithms, including Shor’s algorithm. A verified quantum adder is therefore an important step towards verifying a variety of quantum programs.

The input to an adder consists of two $n$-qubit numbers represented as sequences of qubits $x_{1:n}$ and $y_{1:n}$, as well as a carry-in qubit $c_{in}$. The output consists of the sum $sum_{1:n}$ and the carry-out $c_{out}$.

To begin, consider a simple 1-bit adder that takes in three bits, $c_{in}$, $x$, and $y$, and computes their sum and carry-out values. The sum is equal to $x\oplus y\oplus c_{in}$, and the carry is $(c_{in}\land(x\oplus y))\oplus(x\land y)$. The expressions can be compiled to $4$- and $5$-qubit circuits adder_sum and adder_carry, respectively, where the order of qubits is $c_{out}$, $sum$, $y$, $x$, and $c_{in}$.

⬇

Definition adder_sum : Box (4 $\bigotimes$ Qubit) (4 $\bigotimes$ Qubit) :$=$

compile ((c_in $\wedge$ (x $\oplus$ y)) $\oplus$ (x $\wedge$ y)) (list_of_Qubits 4).

Definition adder_carry : Box (5 $\bigotimes$ Qubit) (5 $\bigotimes$ Qubit) :$=$

compile (x $\oplus$ y $\oplus$ c_in) (list_of_Qubits 5).

Definition adder_1 : Box (5 $\bigotimes$ Qubit) (5 $\bigotimes$ Qubit) :$=$

adder_carry ;; (id_circ || adder_sum).

Here, adder_sum computes the sum of its three input bits and adder_carry computes the carry, ignoring the result of adder_sum. Semantically, the adder should produce the appropriate boolean values; the operation bools_to_matrix converts a list of booleans to a density matrix.

⬇

Lemma adder_1_spec : $\forall$ (cin x y sum cout : bool),

$\llbracket$adder_1$\rrbracket$ (bools_to_matrix [cout; sum; y; x; cin])

$=$ (bools_to_matrix [ cout $\oplus$ (c_in $\wedge$ (x $\oplus$ y) $\oplus$ (x $\wedge$ y));

               ; sum $\oplus$ (x $\oplus$ y $\oplus$ c_in)

               ; y; x; cin]).

Next, we extend the 1-qubit adder to $n$ qubits. The $n$-qubit adder contains two parts—adder_left and adder_right—defined recursively using padded adder_1 and adder_carry circuits. The left part computes the sum and carry sequentially from the least significant bit, initializing an ancilla for the carry in each step. When it reaches the most significant bit, it computes the most significant bit of the sum and carry-out using the 1-qubit adder. The right part of the adder uncomputes the carries and discards the ancillae. The definitions of the circuits are shown below and illustrated in Figure 6.

⬇

Fixpoint adder_left (n : $\mathbb{N}$) : Box ((1$+$3n) $\bigotimes$ Qubit) ((1$+$4n) $\bigotimes$ Qubit) :$=$

match n with

| S n' $\Rightarrow$ (id_circ || (id_circ || (id_circ || (adder_left n')))) ;;

       (init_at false (4*n) 0) ;;

       (adder_1_pad (4*n'))

end.

Fixpoint adder_right (n : $\mathbb{N}$) : Box ((1$+$4n) $\bigotimes$ Qubit) ((1$+$3n) $\bigotimes$ Qubit) :$=$

match n with

| O $\Rightarrow$ id_circ

| S n' $\Rightarrow$ (adder_carry_pad (4*n')) ;;

       (assert_at false (4*n) 0) ;;

       (id_circ || (id_circ || (id_circ || (adder_right n'))))

end.

Fixpoint adder_circ (n : $\mathbb{N}$) : Box ((2$+$3n) $\bigotimes$ Qubit) ((2$+$3n) $\bigotimes$ Qubit) :$=$

match n with

| O $\Rightarrow$ id_circ

| S n' $\Rightarrow$ (id_circ || (id_circ || (id_circ || (id_circ || (adder_left n')))));;

       (adder_1_pad (4*n')) ;;

       (id_circ || (id_circ || (id_circ || (id_circ || (adder_right n')))))

end.

We now prove the correctness of the $n$-qubit adder:

⬇

Lemma adder_circ_n_spec : $\forall$ (n : $\mathbb{N}$) (f : Var $\rightarrow$ bool),

let li :$=$ list_of_Qubits (2 $+$ 3 * n) in

$\llbracket$adder_circ_n n$\rrbracket$ (ctx_to_matrix li f)

$=$ (ctx_to_matrix li (compute_adder_n n f)).

Like bools_to_matrix above, ctx_to_matrix takes in a context and an assignment $f$ of variables to booleans and constructs the corresponding density matrix. The function compute_adder_n likewise takes a function $f$ that assigns values to each of the $3*n+2$ input variables and returns a boolean function $f^{\prime}$ representing the state of the same variables after addition (computed classically). The specification states that the $n$-bit adder circuit computes the state corresponding to the function compute_adder_n for any initial assignment.

Note that the lemma gives a correspondence between the denotation of the circuit and functional computation on the assignment. This can reduce the time required to verify more complex arithmetic circuits. A natural next step is to verify the correspondence between our functions on lists of booleans and Coq’s binary representations of natural numbers, thereby grounding our results in the Coq standard library and allowing us to easily move between numerical representations.

7 Related and Future Work

The area of reversible computation well predates quantum computing. Bennett [3] introduced the reversible Turing machine in 1973, with the intent of designing a computer with low energy consumption, since destroying information necessarily dissipates energy. Toffoli designed the general approach for converting classical circuits to reversible ones presented in our introduction. While these ideas strongly influenced quantum computation, reversible computation is a subject of great interest in its own right, and we refer the interested reader to a standard text on the subject [5, 11].

This work builds heavily on the Quipper quantum programming language [7, 6], which includes ancillae terminations that are optimized away by joining them to corresponding initializations. Unfortunately, as is noted in the introduction, the language has no way of checking its “assertive terminations”:

The first thing to note is that it is the programmer, and not the compiler, who is asserting that the qubit is in state $\ket{0}$ before being terminated. In general, the correctness of such an assertion depends on intricacies of the particular algorithm, and is not something that the compiler can verify automatically. It is therefore the programmer’s responsibility to ensure that only correct assertions are made. The compiler is free to rely on these assertions, for example by applying optimizations that are only correct if the assertions are valid. [7]

This work was motivated precisely by the desire to fill in this gap, and by Quipper’s demonstration of the power of assertive terminations.

The other important work in this space is Amy et al.’s ReVerC [2], which builds upon the Revs programming language [9], a small heavily-optimized language for reversible computing. ReVerC verifies many of the optimizations from Revs and includes a compiler from boolean expressions to reversible circuits. The validity of this compilation is verified in the F⋆ programming language [16]. One key challenge in this paper was to port that compiler from a language that uses only classical operations on numbered registers (and whose semantics are therefore in terms of boolean expressions), to a language using higher-order abstract syntax whose denotation is in terms of density matrices (representing pure and mixed quantum states).

The State of $\mathcal{Q}\textsc{wire}$

This paper, and the whole $\mathcal{Q}\textsc{wire}$ project, is a work in progress. $\mathcal{Q}\textsc{wire}$ has been used to verify some interesting programs, including quantum teleportation, superdense coding, Deutsch’s algorithm and a variety of random number generators (see HOASProofs.v in the Coq development). It can also be used to prove the validity of a number of circuit optimizations, such as those of Staton [14] (see Equations.v). However, much remains to be done. The authors’ goal is to formally verify all of the claims in this paper, though some work still remains.

In particularly, the following lemmas remain to be proved in Coq, by section:

• •

In Section 3, the proof of the equivalence of the two definitions of valid_ancillae (though the this paper does not build on that equivalence); and the proof of Lemma 3.1.

• •

In Section 4, Lemmas 4.1, 4.2, 4.3 and 4.4.

• •

In Section 5, that the CNOT_at and Toffoli_at circuits, as well as sequencing ;; and parallel $\|$ combinators, match their intended semantics.

The next step for $\mathcal{Q}\textsc{wire}$ is to implement and verify circuit optimizations. We already have a number of equivalences we can in principle use to rewrite our circuits, and this work introduces new possible optimization, like reusing ancillae. It also allows us to treat circuits that properly initialize and dispose of ancilla as unitary circuits, allowing for further optimizations. Given that much of the progress towards practical quantum computing comes from increasingly clever optimizations (in tandem with more powerful quantum computers), verified compilation should play an important and exciting role in the near future.

We can also expand our boolean expression language to allow us to compile a broader range of classical functions. This would allow us to program the adder from the previous section entirely within this language and then compile it to a quantum circuit. Such a program would require the following features:

Pairs would allow us to represent binary numbers, where (true,(true,(false,true))) could represent $1101$ or $13$. 2. 2.

Projection operators would allow us to extract values from pairs. 3. 3.

Let bindings would allow us to reuse sub-circuits for efficiency.

We could then make our bexps dependently typed, which would allow us to associate bexps with the number of wires entering and exiting the corresponding circuit. We could even include types for $n$-bit numbers that correspond to product types. And naturally, there is much more that we could do with the bexp language, including adding lambdas, branching, recursion, and other common programming language idioms.

We would also like to optimize our current compiler. Our compile function borrows a trick from ReVerC [2], in that it doesn’t use additional ancilla to compile exclusive-ors. However, there are many optimizations that remain to be done, and, given the limitations of today’s quantum computers, they are worth implementing.

Finally, a recent innovation in the area of quantum computing concerns so-called dirty ancillae. We call an ancilla “dirty” if it may be initialized in an arbitrary state, not only $\ket{0}$. Haner et al.[8] show that these can take the place of our “clean” ancillae in many quantum circuits, and Q# [15] allows us to “borrow” a qubit, use it, and then return it to its initial state. Extending the work in this paper to verify that dirty ancillae are uncomputed would require substantial additional machinery but it would have a significant payoff in terms of expressivity without sacrificing reliability.