CS357S: Formal Methods for Computer Systems

Winter 2025, Mon/Wed 3:00 PM PDT - 4:20 PM PDT, Gates B12

Instructor: Caroline Trippel
Teaching Assistant: Rachel Cleaveland
Links: edstem, Gradescope, Canvas

  To achieve performance scaling at manageable power and thermal levels as Moore's Law fades, computer systems frequently combine parallelism, hardware specialization, hardware/software heterogeneity, and data- dependent optimization. To reduce costs, improve resource utilization, and scale applications, multi-tenancy and hyperscale systems are also commonplace. Meanwhile, computers routinely perform complex tasks with stringent assurance requirements—correctness, security, and reliability— like driving cars, managing health records, controlling infrastructure, and providing security services. This convergence of factors has brought about two major challenges in computer architecture. First, traditional instruction set architectures (ISAs) lack the detail needed to inform programmers of how hardware may undermine software assurance. Second, hardware design projects already spend 80% of their time on verification, and critical bugs escape pre-silicon verification in 70% of these projects [Wilson Research Group, 2022]. Next-generation ISAs, which resolve the first challenge, will exacerbate the second.
  This research seminar will cover industry and academic work on using formal methods techniques to resolve the challenges above, towards producing high assurance computer systems. A short sequence of introductory lectures, readings, and homeworks will expose students to important formal methods techniques/tools (e.g., SAT and SMT solving, finite model finding, model checking, symbolic execution, program synthesis, interactive theorem proving). For the rest of the course, students will read and lead discussions on research papers, do a quarter-long research project in groups of 2-3 students, and participate in guest lectures from leading experts in the field. The course syllabus can be found here.
  CS 357S is appropriate for PhD, Masters, and advanced undergraduates looking to explore the rich intersection of formal methods and computer architecture/systems. Students should have experience in either computer architecture (EE 282 or equivalent, or EE 180 or equivalent with instructor consent) or formal methods (CS 257 or equivalent).

Grading: The largest component of your grade in CS 357S is the course project. The purpose of homework is to guide you through using some formal tools in preparation for the project. Aside from the project and homework, each student will read, summarize, present, and discuss technical papers. Grades will be computed as follows: 10% homework, 20% paper summaries/presentation, 20% participation, 50% project.

Online Discussions: We will use edstem for both online discussion and announcements. We recommend keeping email notifications on (https://edstem.org/us/settings/) to avoid missing time-sensitive announcements. Contact Rachel if you have trouble accessing edstem.

Gradescope: We will use Gradescope for electronic submission of all deliverables (homework, paper summaries/presentation, project deliverables). Please do not email submissions to the course staff unless asked. Project summaries are due before class. Homework is due at 11:59 PM on the announced due date.

Presentation Signup: Please sign up for paper presentations here.

Schedule

Date [Lecture]TopicAssigned Reading DueRelated/Optional
Mon 1/6 [1] Introduction, Propositional Logic, & SAT I: Syntax & semantics, satisfiability & validity, normal forms, resolution (Slides) [SIGARCH21] Applications of Formal Methods in Computer Architecture
Wed 1/8 [2] SAT II: DPLL, model checking (Slides)

CC: Chapter 1
(No summaries/presentations)
DP: Chapter 2 (CDCL)
[TACAS99] Symbolic Model Checking without BDDs
[FMCAD02] Checking Safety Properties Using Induction and a SAT-Solver
[NeurIPS24] Neural Model Checking
Mon 1/13 [3] First-order Logic & SMT I: Syntax & semantics, SMT, DPLL(T), finite model finding (Slides) CC: Chapter 2.1-2.4
CC: Chapter 3.1-3.2
DP: Chapter 3.1-3.3
(No summaries/presentations)
CC: Chapter 3.3-3.6 (First-Order Theories)
DP: Chapter 3.4 (DPLL(T) cont.)
Wed 1/15 [4] SMT II: Symbolic execution, program synthesis
[CSUR18] A Survey of Symbolic Execution Techniques
[Blog15] Program Synthesis Explained
(No summaries/presentations)
[FTPL17] Program Synthesis
[Sec20] Symbolic execution with SymCC: Don't interpret, compile!
Program Synthesis Explained
Watch: Analogical Reasoning Engines: Flash Fill vs GPT-4
Fri 1/17 [--]
Mon 1/20
[--]
Martin Luther King Jr. Day (No Class)
Wed 1/22 [5] Memory Consistency I
Watch: Quick start: Memory consistency models
[MICRO14] PipeCheck: Specifying and Verifying Microarchitectural Enforcement of Memory Consistency Models
[MICRO21] Synthesizing Formal Models of Hardware from RTL for Efficient Verification of Memory Model Implementations
[TOPLAS14] Herding Cats: Modelling, Simulation, Testing, and Data Mining for Weak Memory
[MICRO15] CCICheck: Using µhb Graphs to Verify the Coherence-Consistency Interface
[ASPLOS17] TriCheck: Memory Model Verification at the Trisection of Software, Hardware, and ISA
[MICRO17] RTLCheck: Verifying the Memory Consistency of RTL Designs
[MICRO18] PipeProof: Automated Memory Consistency Proofs for Microarchitectural Specifications
Mon 1/27 [6] Memory Consistency II [ASPLOS23] PipeSynth: Automated Synthesis of Microarchitectural Axioms for Memory Consistency
[ISCA23] Imprecise Store Exceptions
[ASPLOS16] COATCheck: Verifying Memory Ordering at the Hardware-OS Interface
[ISCA18] Non-Speculative Store Coalescing in Total Store Order
Wed 1/29 [7] Memory Consistency III
[ASPLOS19] A Formal Analysis of the NVIDIA PTX Memory Consistency Model
[ASPLOS23] MC Mutants: Evaluating and Improving Testing for Memory Consistency Specifications
[ISCA22] Mixed-Proxy Extensions for the NVIDIA PTX Memory Consistency Model
Thu 1/30
[--]
Mon 2/3 [8] Interactive Theorem Proving (Thomas Bourgeat) (No summaries/presentations)
Wed 2/5 [9] Cache Coherence [ISCA18] ProtoGen: Automatically Generating Directory Cache Coherence Protocols from Atomic Specifications
[ISCA24] Determining the Minimum Number of Virtual Networks for Different Coherence Protocols
[CAV22] Hemiola: A DSL and Verification Tools to Guide Design and Proof of Hierarchical Cache-Coherence Protocols
[ISCA20] HieraGen: Automated Generation of Concurrent, Hierarchical Cache Coherence Protocols
[HPCA22] HeteroGen: Automatic Synthesis of Heterogeneous Cache Coherence Protocols
[FMCAD24] Memory Consistency Model-Aware Cache Coherence for Heterogeneous Hardware
Mon 2/10 [10] Security I Watch: Quick Start: Cache Attacks [MICRO24] RTL2MµPATH: Multi-µPATH Synthesis with Applications to Hardware Security Verification
[ASPLOS25] RTL Verification for Secure Speculation Using Contract Shadow Logic
[DAC22] Towards a Formally Verified Hardware Root-of-Trust for Data-Oblivious Computing
[CCS23] Specification and Verification of Side-channel Security for Open-source Processors via Leakage Contracts
[SP24] CONJUNCT: Learning Inductive Invariants to Prove Unbounded Instruction Safety Against Microarchitectural Timing Attacks
Wed 2/12 [11] Security II [ISCA23] Pensieve: Microarchitectural Modeling for Security Evaluation
[SP24] Serberus: Protecting Cryptographic Code from Spectres at Compile Time
[MICRO18] CheckMate: Automated Synthesis of Hardware Explloits and Security Litmus Tests
[SP20] Spectector: Principled Detection of Speculative Information Flows
[SP21] Hardware-Software Contracts for Secure Speculation
[NDSS22] SynthCT: Towards Portable Constant-Time Code
[ISCA22] Axiomatic Hardware-Software Contracts for Security
Mon 2/17
[--]
Presidents' Day (No Class)
Wed 2/19 [12] Security III [ASPLOS22] DAGguise: mitigating memory timing side channels
[CCS24] Specification and Verification of Strong Timing Isolation of Hardware Enclaves
[ASPLOS17] Verification of a Practical Hardware Security Architecture Through Static Information Flow Analysis
[MICRO18] End-to-End Automated Exploit Generation for Validating the Security of Processor Designs
[ASPLOS24] Formal Mechanised Semantics of CHERI C: Capabilities, Undefined Behaviour, and Provenance
Thu 2/20 [--]
Mon 2/24 [13] Functional Correctness I [CAV16] End-to-End Verification of ARM Processors with ISA-Formal
[DAC23] G-QED: Generalized QED Pre-silicon Verification beyond Non-Interfering Hardware Accelerators
[DAC20] A-QED Verification of Hardware Accelerators
[DAC21] AutoSVA: Democratizing Formal Verification of RTL Module Interactions
Wed 2/26 [14] Functional Correctness II [ASPLOS22] EXAMINER: Automatically Localizing Inconsistent Instructions Between Real Devices and CPU Emulators for ARM
[ASPLOS24] RTL-Repair: Fast Symbolic Repair of Hardware Design Code
[ASPLOS17] An Architecture Supporting Formal and Compositional Binary Analysis
[CAV23] nl2spec: Interactively Translating Unstructured Natural Language to Temporal Logics with Large Language Models
[FMCAD24] Translating Natural Language to Temporal Logics with Large Language Models and Model Checkers
Mon 3/3 [15] Performance
[ASPLOS22] RecShard: Statistical Feature-Based Memory Optimization for Industry-Scale Neural Recommendation
[ASPLOS24] SEER: Super-Optimization Explorer for High-Level Synthesis using E-graph Rewriting
[EuroSys24] Model Selection for Latency-Critical Inference Serving
Wed 3/5 [16] Specialized Hardware [ASPLOS24] FPGA Technology Mapping Using Sketch-Guided Program Synthesis
[ASPLOS23] CaT: A Solver-Aided Compiler for Packet-Processing Pipelines
[MICRO22] RipTide: A programmable, energy-minimal dataflow compiler and architecture
[ISCA19] Statistical Assertions for Validating Patterns and Finding Bugs in Quantum Programs
Mon 3/10 [17] Reliability [MICRO99] DIVA: A Reliable Substrate for Deep Submicron Microarchitecture Design
[ASPLOS25] Proactive Runtime Detection of Aging-Related Silent Data Corruptions: A Bottom-Up Approach
Wed 3/12 [18] Project Presentations
Tue 3/18 [--]
Reading assignments for each lecture will be posted at least 1 week in advance and are to be completed before the lecture. All reading materials will be accessible via links provided on the course webpage when you are on the Stanford network. Instructions for accessing readings off-campus can be found here: https://library.stanford.edu/services/off-campus-access. We will mainly read recent academic papers, but we will also read excerpts from the following textbooks:

Assignments

The assignments for this class consist of: homework, paper summaries, a paper presentation, and a project.

Homework

There will be 2 homework assignments, where you will gain hands-on experience using formal tools. You will work on the homework assignments individually. Homeworks will be due at 11:59 PM on the announced due date and submitted on Gradescope.

Paper Summaries

For lectures with assigned readings (except for five lectures explicitly noted on the schedule), every student will submit a paper summary for each assigned paper on Gradescope prior to the start of class. Paper summaries should include Motivation, Novelty, Insights, FM Approach, Strengths, and Critiques (see “Paper Presentations” for details).

Paper Presentations

For lectures with assigned readings (except for five lectures explicitly noted on the schedule), 2-3 students will be assigned to present each paper and lead the class discussion. Student presenters will spend ~10 minutes presenting the assigned paper before leading the subsequent ~25 minute discussion. Cover each of the following in your presentation, using the provided Presentation Template:

Project

You will carry out a quarter-long project, ideally in teams of 2-3 students. You may use your existing research project if it is relevant to the course and the instructor approves. But, there will have to be a piece of your existing project that is explicitly carved out for the course project. Please find a list of project ideas here. Alternatively, you may devise a completely original project. The course project deliverables include:

Please find more details on the project deliverables here.

Adapted from a template by Andreas Viklund.