CS357S: Formal Methods for Computer Systems

Winter 2026, Tue/Thu 3:00 PM - 4:20 PM PT, CoDa B60

Instructor: Caroline Trippel
Teaching Assistant: Nick Mosier
Links: edstem, Gradescope, Canvas

  To achieve performance scaling at manageable power and thermal levels as Moore's Law fades, computer systems frequently combine parallelism, hardware specialization, hardware/software heterogeneity, and data- dependent optimization. To reduce costs, improve resource utilization, and scale applications, multi-tenancy and hyperscale systems are also commonplace. Meanwhile, computers routinely perform complex tasks with stringent assurance requirements—correctness, security, and reliability— like driving cars, managing health records, controlling infrastructure, and providing security services. This convergence of factors has brought about two major challenges in computer architecture. First, traditional instruction set architectures (ISAs) lack the detail needed to inform programmers of how hardware may undermine software assurance. Second, hardware design projects already spend 80% of their time on verification, and critical bugs escape pre-silicon verification in 70% of these projects [Wilson Research Group, 2022]. Next-generation ISAs, which resolve the first challenge, will exacerbate the second.
  This research seminar will cover industry and academic work on using formal methods techniques to resolve the challenges above, towards producing high assurance computer systems. A short sequence of introductory lectures, readings, and homeworks will expose students to important formal methods techniques/tools (e.g., SAT and SMT solving, finite model finding, model checking, symbolic execution, program synthesis, interactive theorem proving). For the rest of the course, students will read and lead discussions on research papers, do a quarter-long research project in groups of 2-3 students, and participate in guest lectures from leading experts in the field. The course syllabus can be found here.
  CS 357S is appropriate for PhD, Masters, and advanced undergraduates looking to explore the rich intersection of formal methods and computer architecture/systems. Students should have experience in either computer architecture (EE 282 or equivalent, or EE 180 or equivalent with instructor consent) or formal methods (CS 257 or equivalent).

Grading: The largest component of your grade in CS 357S is the course project. The purpose of homework is to guide you through using some formal tools in preparation for the project. Aside from the project and homework, each student will read, summarize, present, and discuss technical papers. Grades will be computed as follows: 10% homework, 20% paper summaries/presentation, 20% participation, 50% project.

Online Discussions: We will use edstem for both online discussion and announcements. We recommend keeping email notifications on (https://edstem.org/us/settings/) to avoid missing time-sensitive announcements. Contact Nick if you have trouble accessing edstem.

Gradescope: We will use Gradescope for electronic submission of all deliverables (homework, paper summaries/presentation, project deliverables). Please do not email submissions to the course staff unless asked. Project summaries are due before class. Homework is due at 11:59 PM on the announced due date.

Presentation Signup: Please sign up for paper presentations here.

Schedule

Date [Lecture]TopicAssigned Reading DueRelated/Optional
Tue 1/6 [1] Introduction, Propositional Logic, & SAT I: Syntax & semantics, satisfiability & validity, normal forms, resolution (Slides) [SIGARCH21] Applications of Formal Methods in Computer Architecture
Thu 1/8 [2] SAT II: DPLL, model checking (Slides)


CC: Chapter 1
(No summaries/presentations)
DP: Chapter 2 (CDCL)
[TACAS99] Symbolic Model Checking without BDDs
[FMCAD02] Checking Safety Properties Using Induction and a SAT-Solver
[NeurIPS24] Neural Model Checking
Tue 1/13 [3] First-order Logic & SMT I: Syntax & semantics, SMT, DPLL(T), finite model finding (Nick guest lecture) (Slides) CC: Chapter 2.1-2.4
CC: Chapter 3.1-3.2
DP: Chapter 3.1-3.3
(No summaries/presentations)
CC: Chapter 3.3-3.6 (First-Order Theories)
DP: Chapter 3.4 (DPLL(T) cont.)
Thu 1/15 [4] SMT II: Symbolic execution, program synthesis Slides (Nick Guest Lecture)
[CSUR18] A Survey of Symbolic Execution Techniques
[Blog15] Program Synthesis Explained
(No summaries/presentations)
[FTPL17] Program Synthesis
[Sec20] Symbolic execution with SymCC: Don't interpret, compile!
Watch: Analogical Reasoning Engines: Flash Fill vs GPT-4
Fri 1/16 [--]
Mon 1/19
[--]
Martin Luther King Jr. Day
Tue 1/20 [5] Memory Consistency I Watch: Quick start: Memory consistency models
[MICRO14] PipeCheck: Specifying and Verifying Microarchitectural Enforcement of Memory Consistency Models (Presentation)
[MICRO21] Synthesizing Formal Models of Hardware from RTL for Efficient Verification of Memory Model Implementations (Presentation)
[TOPLAS14] Herding Cats: Modelling, Simulation, Testing, and Data Mining for Weak Memory
[MICRO15] CCICheck: Using µhb Graphs to Verify the Coherence-Consistency Interface
[ASPLOS17] TriCheck: Memory Model Verification at the Trisection of Software, Hardware, and ISA
[MICRO17] RTLCheck: Verifying the Memory Consistency of RTL Designs
[MICRO18] PipeProof: Automated Memory Consistency Proofs for Microarchitectural Specifications
Thu 1/22 [6] Interactive Theorem Proving (Thomas Bourgeat)
(No summaries/presentations)
Tue 1/27 [7] Memory Consistency II [ASPLOS17] Automated Synthesis of Comprehensive Memory Model Litmus Test Suites (Slides)
[ASPLOS23] MC Mutants: Evaluating and Improving Testing for Memory Consistency Specifications (Slides)
[ASPLOS16] COATCheck: Verifying Memory Ordering at the Hardware-OS Interface
[ISCA18] Non-Speculative Store Coalescing in Total Store Order
Thu 1/29 [8] Memory Consistency III

[MICRO18] PipeProof: Automated Memory Consistency Proofs for Microarchitectural Specifications (Slides)
[ASPLOS25] Robustness Verification for Checking Crash Consistency of Non-volatile Memory (Slides)
[ASPLOS19] A Formal Analysis of the NVIDIA PTX Memory Consistency Model
[ISCA22] Mixed-Proxy Extensions for the NVIDIA PTX Memory Consistency Model
Mon 2/2
[--]
Tue 2/3 [9] Cache Coherence [ISCA18] ProtoGen: Automatically Generating Directory Cache Coherence Protocols from Atomic Specifications
[ISCA24] Determining the Minimum Number of Virtual Networks for Different Coherence Protocols (Slides)
[CAV22] Hemiola: A DSL and Verification Tools to Guide Design and Proof of Hierarchical Cache-Coherence Protocols
[ISCA20] HieraGen: Automated Generation of Concurrent, Hierarchical Cache Coherence Protocols
[HPCA22] HeteroGen: Automatic Synthesis of Heterogeneous Cache Coherence Protocols
[FMCAD24] Memory Consistency Model-Aware Cache Coherence for Heterogeneous Hardware
Thu 2/5 [10] Security I Watch: Quick Start: Cache Attacks
[MICRO24] RTL2MµPATH: Multi-µPATH Synthesis with Applications to Hardware Security Verification
[ASPLOS25] RTL Verification for Secure Speculation Using Contract Shadow Logic (Slides)
[DAC22] Towards a Formally Verified Hardware Root-of-Trust for Data-Oblivious Computing
[CCS23] Specification and Verification of Side-channel Security for Open-source Processors via Leakage Contracts
[SP24] CONJUNCT: Learning Inductive Invariants to Prove Unbounded Instruction Safety Against Microarchitectural Timing Attacks
Tue 2/10 [11] Security II [ASPLOS25] H-Houdini: Scalable Invariant Learning
[SP24] Serberus: Protecting Cryptographic Code from Spectres at Compile Time
[MICRO18] CheckMate: Automated Synthesis of Hardware Explloits and Security Litmus Tests
[SP20] Spectector: Principled Detection of Speculative Information Flows
[SP21] Hardware-Software Contracts for Secure Speculation
[NDSS22] SynthCT: Towards Portable Constant-Time Code
[ISCA22] Axiomatic Hardware-Software Contracts for Security
Thu 2/12 [12] Security III [ASPLOS22] DAGguise: mitigating memory timing side channels
[ISCA23] Pensieve: Microarchitectural Modeling for Security Evaluation
[ASPLOS17] Verification of a Practical Hardware Security Architecture Through Static Information Flow Analysis
[MICRO18] End-to-End Automated Exploit Generation for Validating the Security of Processor Designs
[ASPLOS24] Formal Mechanised Semantics of CHERI C: Capabilities, Undefined Behaviour, and Provenance
[CCS24] Specification and Verification of Strong Timing Isolation of Hardware Enclaves
Mon 2/16 [--] Presidents' Day
Tue 2/17 [13] Functional Correctness I [CAV16] End-to-End Verification of ARM Processors with ISA-Formal
[DAC23] G-QED: Generalized QED Pre-silicon Verification beyond Non-Interfering Hardware Accelerators
[DAC20] A-QED Verification of Hardware Accelerators
[DAC21] AutoSVA: Democratizing Formal Verification of RTL Module Interactions
[ASPLOS25] SylQ-SV: Scaling Symbolic Execution of Hardware Designs with Query Caching

Thu 2/19 [14] Functional Correctness II [ASPLOS24] RTL-Repair: Fast Symbolic Repair of Hardware Design Code
[ICSE26] Automating Requirements Formalization: Using LLMs and Low-Complexity Distinguishing Traces for Semantic Validation
[ASPLOS17] An Architecture Supporting Formal and Compositional Binary Analysis
[CAV23] nl2spec: Interactively Translating Unstructured Natural Language to Temporal Logics with Large Language Models
[ASPLOS22] EXAMINER: Automatically Localizing Inconsistent Instructions Between Real Devices and CPU Emulators for ARM
[FMCAD24] Translating Natural Language to Temporal Logics with Large Language Models and Model Checkers
Fri 2/20 [--]
Tue 2/24 [15] Performance
[ASPLOS22] RecShard: Statistical Feature-Based Memory Optimization for Industry-Scale Neural Recommendation
[ASPLOS26] CounterPoint: Using Hardware Event Counters to Refute and Refine Microarchitectural Assumptions
[EuroSys24] Model Selection for Latency-Critical Inference Serving
[ASPLOS24] SEER: Super-Optimization Explorer for High-Level Synthesis using E-graph Rewriting
Thu 2/26 [16] Specialized Hardware [MICRO22] RipTide: A programmable, energy-minimal dataflow compiler and architecture
[ASPLOS23] APEX: A Framework for Automated Processing Element Design Space Exploration using Frequent Subgraph Analysis
[ISCA19] Statistical Assertions for Validating Patterns and Finding Bugs in Quantum Programs
[ASPLOS24] FPGA Technology Mapping Using Sketch-Guided Program Synthesis
[ASPLOS23] CaT: A Solver-Aided Compiler for Packet-Processing Pipelines
Fri 2/27 [--]
Tue 3/3 [17] Specialized hardware, Reliability [ASPLOS25] ElasticMiter: Formally Verified Dataflow Circuit Rewrites
[ASPLOS25] Proactive Runtime Detection of Aging-Related Silent Data Corruptions: A Bottom-Up Approach
[MICRO99] DIVA: A Reliable Substrate for Deep Submicron Microarchitecture Design
Thu 3/5 [18] Formal Methods in Industry (John O'Leary) (No summaries/presentations)
Tue 3/10 [19] Project presentations
Thu 3/12 [20] Project presentations
Reading assignments for each lecture will be posted at least 1 week in advance and are to be completed before the lecture. All reading materials will be accessible via links provided on the course webpage when you are on the Stanford network. Instructions for accessing readings off-campus can be found here: https://library.stanford.edu/services/off-campus-access. We will mainly read recent academic papers, but we will also read excerpts from the following textbooks:

Office Hours

If you cannot make these hours or need to join virtually please reach out directly to the course staff member you intend to meet.

Assignments

The assignments for this class consist of: homework, paper summaries, a paper presentation, and a project.

Homework

There will be 2 homework assignments, where you will gain hands-on experience using formal tools. You will work on the homework assignments individually. Homeworks will be due at 11:59 PM on the announced due date and submitted on Gradescope.

Paper Summaries

For lectures with assigned readings (except for five lectures explicitly noted on the schedule), every student will submit a paper summary for each assigned paper on Gradescope prior to the start of class. Paper summaries should include Motivation, Novelty, Insights, FM Approach, Strengths, and Critiques (see “Paper Presentations” for details).

Paper Presentations

For lectures with assigned readings (except for five lectures explicitly noted on the schedule), 2-3 students will be assigned to present each paper and lead the class discussion. Student presenters will spend ~10 minutes presenting the assigned paper before leading the subsequent ~25 minute discussion. Cover each of the following in your presentation, using the provided Presentation Template:

Project

You will carry out a quarter-long project, ideally in teams of 2-3 students. You may use your existing research project if it is relevant to the course and the instructor approves. But, there will have to be a piece of your existing project that is explicitly carved out for the course project. Please find a list of project ideas here. Alternatively, you may devise a completely original project. The course project deliverables include:

Please find more details on the project deliverables here.

Adapted from a template by Andreas Viklund.