Formal proof that two register-transfer-level implementations produce identical external behavior despite different internal structures.