ࡱ> n_\nlvPNG  IHDR?L4 pHYs\F\FCAtEXtSoftwareAFPL Ghostscript 8.14" IDATx9̑yt A3 Sj)ZLY*^2dx@rLwq/+̏9DNR>Z"V ;EJa^y;;cϔb^)=nLگzp/_IB@+2|~yvvA+'ayvvo[0a[쾷+ұ%cu ;{k"~E.Ns{k"ms\+vf/s2׳)ߠirOgM~vÎd2kvo$iZxT{Ŏ=ad s;OZa}A{1٢Y%Y=agd-21?jmaG%N:+Q:ة_i;Qvz'4_k/r:Rmc'(#A{ӳ9ɋ Lf5˜vDN(v#}UyݯpA{ӓZ}f*6-Z؞ Kcݖw7h/sz7KE[~l 0 #Ct[SZѭ!Mxl3+4ri;&ZYorìMB-2 UANNOGƭb'CvvTP1zߠ鹃LfZi:H BvuaMөe:=uvsw}i׈QIT:=u'",SJΡ>6?(;',b`թm-->օuf%(N7lKW6BVǺVeI\)7?/n9]e'4ji;;Ǻv|+R%$]n9y!=| Gr~ M G^@杓1B)l0@TNu_7vwKةns]b`׷?;9cJ~e=[0Z^ әv&,Et,Op c#E UrTƈg\nc*ՉeX\-X4 }$c*P\Y& hϛi |ʄsi$=fgح^&u|fS <;;1BBvo} ten8!';!UAnHU#4BM| mjau䀪Ccv!;*ʱt;\=TZ3h*ˎêT(eG\>=6S?hU>)Le&qay3;;l::c&;Ҋˎ^'SZA v>\vӬImɋLlb3vnig+7yvni,fGX`ͧg!Tv8SPURd[q2vM3#{CG - rvfĎUiuKoϱI2QvZ!@:v\&1nPzΧS9O!sl:~WΜyfb}奋Y%?h_v:NErq XC&Bvs{;vvfNKy`cBvv曌cY^F]9%-<\I7e;Q#FVvn2,  Eݾ8t0\Dj65%zN#dNY!;Ϙ޲*`'iח-dgrl*uh-/:DfRYaG+vpvd6gL ZMiaf&ȎSO w3y;vvTjueU$?~{;*`23W[[a3Livړ96͋PO>Ĺcghȋ8NjUi*w[ O(fG:w ; _*>R{>tah;̂;4Q'fYv-;+ٹ*ưX;ky96>)BVsq )3;P̓d6fGaC6~o 4;a M?Îp"v>Ev͢㓝8#vkZXz8^S[ώ !aCv`\'睄3}WlqDvrl*7WHtI6QWAFccf%ov.q Iӭ|bq'Nt<>v4϶;M`O(aG616fQ0z x|?l4+*vOrZux>$m-)]ٱ{^9sqwMF)c0C ñ)O$v$B~J #p'#L1])U41;- ;^sv[^c'd١Yu2;I0:);G綡 L8Ʊc'˱_hqvs'%7!Qp=+)P̎lɰjNY=;V fWdBҀ'ΝcEzhϓ2U[]e="=`gr=:兲#Qv>M߀pouԓԉecKIISh5׏ϡnV Iiؙ^d9v3Rv NWvumfǟ1N+fǐƳ?8vr`e%i ϳ|[[$=Nk{&1glӸ-;sHP쌦vN!1bG\'&|xh˃c݂*\/+agN՜~|ZR{kR9kgUNHVD/VKGU4Avi;.ng&O֮χ966s&iY"WzUg:}+oߟH{\k C"ڽvWC*;R;UWhuvʎR0jpiBJ`cڴrBe}r]ϱCevNO;r(~nb?/˄cgoeGRt{쿽s̎ˢAxuxl^zLɱc^ 1;iLB,;|BMz"vPOK?8%SN;xs#)gԦMIn=(<;7jH$$p }sC6؁}''s%icg8Ϻlj+ t/%e ߕf=HH]9NC䧵P=;Մ*!-l6E선;5}8TtmN. ;oPlA z'H9kCUj3ֈYv!lDvgG="v$nVz?ǎmcGGʍo5߄By:-iQ }Wmжl[i""ծ?YYvj2⼁g.<6sAB $,ߠh·tȥAv~f"U_O1;BrCο 4أ)Hi߁!2\Z- mMĕ j5Ž^n1ӅR-N; m򓙏.'˲,xRƳ̎r'٩Gl[ɉdIiUvK֘9v>_xͳBfİΏ^2 y]c$ bvuWuBg'ͺ!\Ṥ*.5NRtxm)&nDv~73̦t}3'{B_C-^Z;Z<` &k1;dqYwuHZIiر2uv>NfA;Hzr,rxv^PtBV8#}vVjEaCezNA,;/bGw;6X/wB&3$?ؙWٙMR902B*ƍdNY2.R?u쐄%aos4BuIQ8vv󰺼y1鬯g.C`ӾӦZ2TvDbWsJr{t I`,; #|i7%԰3-ogNgBuZN%ZUfG?5$x+IsIj8o`g );?LF3^Ύ^l v)| fi*GԘI7}*;ig;Ǧ$t7;.0;sȎD6IG*d[aV vbZ3Tܰ{0;وc0;$׋k0 u4օQ~#.x6 vz9;fz1}i95۲vuѽI&K$U@~%԰Π '^Cى ;nN+ggXcQ<;gSN*vLX::]pՄa}1;W3wҮcl#pH4YI/w2گXM ة;AvܲMةM<;gAwNb_fKi_N}^twwف']6f69%!;cm;Q\ *uήl~K`%wa'v؄=ٕرѴUeݝuvةՄb熶Ș1;ru㵭7Nc)*I]V?"`n:\,Q}3jB ;z`n;95TWx{onbnc77jeLHв7rv:Ce%{r ?K=N8{ՓYт9bn)7٥gJ&t7;ƭ }XH]8' m2c&;Sxk6Y7?yiٱݢʧC =̎LPuGaŽLoAaEvI,Yz㯱C+7OVUvrڛ2<甞7 ;Tc}|)=o6vb[1`gi/"b,Yz^ƨ㜤jBOBG2&=;αi14yt9zcwK$Pֵ74vNx6JBD AS/ؙ]J_IKN g ;t_=>N-}ga뾖PN[ hUՋ> ̎y'x]B'< !;FMrݲ)|zv uX82vl=dq?H &%c+}i=6P﵆i;ړ& cS2pce'|m"kXvz9;SYivpg_cR&˳3ڀ6Sq=|*>xv| ucgjر%ؙ1;lB=;.Mٙ/"vuvPNNMBΰ؄@>,ѾP ]egL5˰s[M(*b5˰@vl_͇:w q8X>RʧipA sv&;(:P{رV-N%gG!ffuȢ1:+uYƧuw<;{AAgLc6䴏GmemNߏ>` z°cB㍦ y\wgPi6 m59;zf)%cgIMLflDm`ʳcB꯳C7݋i*ܹ_[MiJaٱ͏cg '1&XhT^Kms1fi7&,$;i94@FgXѣgI1Ee4~;Nm‹Uʏq3;5 cB* ;aU%1!;:3wSG&w8I՝{ibN0 {?F6nx#;y,6W,;::@v~bS㩰\d'aHt6VΰNxI<NPxqeFLW)vڛƱ~WuA؄G{7+N\сuO.1bǷ$!ώ iIg3#لnH=Pi6y͵&IK}V{gtdp Q?O"){ÖU-~8$,*Xz?Iՠi@H/7dPR|w}%Xt:v0f3.a}Qvm!EdcN M6T -PM&v:acvPR|wGYht,*9PS(`^WfK&ώj%eԚiYS Fc];lm]Nma ;4SةaPRJIEXG8'Dp&`r|z` PL(X*Nzw;`~TOY*T1#̇+ag2.ً:=Ҍ n,-BÄt*r,iMce4U&nKhظ|ײf.kﹲf⦕W6*#"JL[ h˰6 {]ES`TRKT-* ߪ,&g'*U `'n><5؀I.-`uhM&Wn~<\ ;ݽ;z6SDaAQOtN Sq0R㨜@C1; 5{/nIʚhpoaEn{ɳ>]_v 3E~(vߩלL\󓇂!w_v IDAT'%,d$:H@WD 1Y 0AsO "˺; ETa2NƏ+;/׷A0\Δa4ާ p8>˧yHƪ%Q@\!ʘt gyCH[%K(`>W^FpɀԦ~S6paŲsC"b+  (u3+c]?1ʘtŧw/V8 i;}jC ǎW =ag5ut R w0,;UzbrX)̥Ot7X|FOȎVwe8 |Wo]lRvh1um bvi[-vz2ɒgǏ t]ĎV ~xLx8u3+c5T)mYQƤiޠ.~rٹ ;d]P]nj0`Ҥe{-}o>L_n*~]635$Va>ke584EgV|)GSx]'; ;+kK3*dбɾ0.eG,;J&v82$;abָZ3/7~-n`=7yPlc/KpC-C'[-hA[+Ac4%:4L'CͲ}'uD \` tSBWx=}]p虶)HOAKفwQ~PpÎpJeM(?I t:螩<ļ.T> ޺!^oQ_Κ| ;[Z[-@SdA{)Iy$ ;xvvKf$H{evVu۠=4Cꊤ?Nv{R;DigzA{)t?IOxvvNꇬҹ<ؠ=52IP駯bg˽0;lf:|;;O$[Iϟ0vv_Yg[쾷+%ORٳ ;{k"~E.Ns{k"mtkvW>U9rʬ.hp'&}L[tͪl.ξmeyA{oɳ#?kUۧsؽ}_([?ro˳#oU' BڿPV^}_蜎@[~$ʑ@F{ʜ~OXcGrOԔGBڿ~tV^}?zQԽkrGcݖzCӛ)͎F>UGzhh/7̲?y~!63)'ІiPnʡ5 v1ڋ?ݼs"6I"ʅ'uvuam_AŸ$v{9wN6ābӢB>,0:օ*K_xgPzyF<6XBd2֓q ks_JKؑ杓qV١0*l:C;>F_IU;'-K'(jLf2ԝz.dnvZ0%v}[hر+ƻ0Qq̠<ֽ]|jw`Y'X|:΄Skgg~mn0Ukv閴mpSa/V{ quk^v CI?in+&Vٱ >KA!}[i`P!YLB{Ζ[L$& Wvcb,X%aGVN^l(h]1ԫ3Lj?IqO3vCڬ2}$F/Q97}0:r@ WrpC{vWvV#t*@wk.z(]AI(eG\>=6S=гN N6,ێu֭-[Qv*1^{XN\5f#r aGnX~Ͻw'y`j8ЈaYtmmvc"Mbݝws{Ik@{Ux_v7ng.X\$j~$vh4!J~Z^>c&;ˎ^ Q'S$4 xRoy;'ggDm1P vj[Z{=wuˀo+1&u}q0]*S8v;ɶjuv,{W}lBvQU^wQ)>'uDid!@:vz޳S/,w+\}KijiNcVWSQ@l;aǦ>v>lq6&;3`%ɾ#4s M>,I+-H{0#|BE6?+ÎG`+kXZoHv#qg.ɱM#vԉY.FJv1|.VsK׫CK:ЎLM{k~-wCOkϝ5hq '#HCfVzv+aOW嗳3$۬skIvWf0WUY£;^m=;xPO4;a5f$bDX8Oє;qGrl*7W,_kt1m<;6ۘyz~3d` A;ijc$>hkQ6>Y%?l аv1vdcI{ԒY ;v HeYZ;0bTЬv~*pjb62ne9gEО~ c`ǏmvAc'VqqL_ D/G!;G~;߄HLѰ߅y7bvdLLU$tX-_vjaρ"vaq6T;]`g'g.Uk&LعCPv,KoSm/$F;"vN~>G0ULvڞcgIC0YʝűcC<&uf~Aɳm%Ivڻ#<;|BwوcM#4{73c' e(kW>eo"bZ!J~J2f'PŽl;:;Nv/xLp\axJIws%reC2ki|9x3bImfVA3he޹uD;4;C ٙ<ٱCAi*"g*Q%%5^[MvڛTBv$;\BUE4.xxˎ;W[Cy3+|1;!_);lKؙ ȇ{7 W?i0tI +_ ?ώޔly51;>ٙ-J+ 7_sfϰ dru:Ƈ{G\߅,;t]]?5`O{KSIbg[em*vƈFgpJ%Bkyh{ΫAv*t[n;dyΜ`uw/* 3КYAf&(ء7Nh`M'I?l *mpla8Glwkmؙ?.dJX;*y9)vڷ9v:PT3QO}5͢ߖ<;"՟n"';nu uw6PH4i 6/j-~jEbuF_c&NoW]Pa ")\?ϳOe~c?)Vu5L#RR2!cٴ2BbDÜ^ /=dPR,+!YFb(q?3ί'l1;ҤY X6#m;}r]ϱQ)u6S)`;B3UQ?=C : eqIQ}Yf˄O'uxj:7=P NZ{'0 0 ]\z"v:Wɲcvr~P",zz7yvnƐos#7:W. <0%ȱ7i2]e'JٹAQ;!~O7f)OPc%OdF<;mTQ̹VTwgGDE'vnaY `bCvgyd} EªONʱSۇCEqI!hVvnhX)Fع/xՀtC" <. a4\aޥIIjeg0 վFdqvt#bCf4vjҴc*8jO5߄BxHr20"m>& `WX(;i7c:8vc-aj_N>ݜm;5sYm K;5VqdX"vobtgIѾ5v80;\% }Y=0;Bu0uM)F_uX/N*dX(;icL5maG/ast+HvDHCf@*wO3Kpw E ,;)Ba,;ia/Q!Mfv{;x6&'Ӎ}*4-S0u6QvpUjVIfcNRtشNSmDv~73̦t}3ͰTvW?vʥ:΀.c0K}Z$;K#&vxeXuPN)پXն15'nk("2eqY+i @Uv2 A9n uvRo" :g'7aGv ;d1I`D ib'Yt_μ *li:IYgjNY2(HyFWCp?WDJa6(̎xƆdB%׺vrv ;iC3)b'9 NGdW"emf]Ft&;'}4A'k*̎hsYʛbO'N,Cfn:^b'IdxeDzlΠߡD;6 gvvLX<;qgi0 `v.:NWܺf=;>l`Ax;\>2Y>RXL>E(hc5/`Ftgֹ{;;Z͉gb4}Fn7(yWrv`sd;ajKW~=;鳹z9;`MٱkK$[q19@fTIeBEӢ&ivЮ)h6fGrv~vzQ4I8OsHk2v86S =mאAθֽ1~$aA~ N55Q45vsNXSz :ll?;dE/g'=Ҵ!U ˧|-{&ó2IJMk*i14O(GG}"έgy ;Nb'{F.UF²C;<+U&۴&ɰpzWf''Y}O`'iIr:r1 ;ó^*gܦg{>rڛ?sWJ~iE|fr?Y ǕVNV-Όqzodg cA}a3ٱ#o 5 %бU^b'=ka綞v] ; dCjJĎtEO jr|J9Kŵ)v8;9}|Oq`g[JΎvCع'̎{J'RgZLu \gK`|쐳T;u Zc3ڳ 9o$#eٱ_,4RS>; hw@3T,}\I;m3TZE줵_e'aGπ67d ;i۠m?>T/a˞!;.m6ܯ: (b':;8vpcdIIND);wcNhvsObA 63zl;Li=;vlyȎw\쬪^*`F-q3;5 !iv/b9M@޹ctƝsp.=6=- -YgȎvy6لodG;eGGȎoQ`g;_y;SWFb=ig-#rvL?g1[Rv :xv4bWGww3n`J(!VA~%*7yQ: `TlBC=ѕc^l@ puagȲr=UQ l\S>K~;nIG?#Rެ27/ȱ 6~x1M[Lq"{K/b*Tp;BM}4-w]`'dP>$cCzOqk:k2vZ0fiKhnS_D;LLms 1.";sn F?PMFvhΉ^P= ˧B޵<;3E;Y*h)Tgm5&fnVEԂzؙ.lYBἆ8mAy;`N) ]"L"vIUk:iUZSUrO;pMN{MO^ ٹj=D;ʲSވz <;z`bh3SGr[蕀 Bf/udT7S/՗ jщas9 ce)U&nKhX"|FDTm̓T-`l yO? 4zo4.8[BN|iB:|aNX4O,l-bN) rLY;YuWv߭L"p m; (FkJ7rS4&9ىqݡ/;ج_/2!rU0̗WPZ5Sc=a)UNhj[Ҷ&f+G8e%4[C&r[L5m"(b7+]p/cB/"vhX"A2J=@҅YByנO&NA<*L Y@qe%6Hc;GXs(t`߸'|4uHX)WhOB \F8˓~be@q ދRl Hm* ;M?Uaaɴvn.S70w9PdKGʎ6(y ("NAlcOI ;>}_IQ.y ;VwЧg8t^ꭋMN--٣4A.ň7gҌvZߵstJ[[~(`éK Ԭl"v.~喛L@v A ێ2g鄀&-ߣom[Y.SNعC%Jwi#vN] ؙhƅTR2(b?=ި5L)t m4!`G#'`KN:2 ~j(VFWxSҼp虶)Ϛ D?sVʆ6lvS*kO|:*p=W>?1Ϛۖ!;DA[/m9kYءagK]u+Xqw6h:e9)Sa/Ύpt^U6h:M"ϲ _&9/,%Y JX'=;9]JnB`S6{D$$clB/%Hd;xvv rČ:[Yl&9 ;x};C?q?[ڳNyvl9v>#r/̎`|O>08;9ƌE9<;'o<S!?шz`S3M2ҖFNJ+%'%&Z$sGO_Ď˽0;f(;5Ԛ8N )I sEg=65֌S{4tI/d:k;/3'% &%؁#s )m$/kX12;w4؏Ȭ3Q_ְ,yΩScgvNhKDY㠨q8vNmēlsO;9Q_8(q:xH~Hip;a t؛ENM9;-DhsbÎ|ʬH|H񤴗9:BHN*I|̻9-5{ԡͪ_a;xNnj Y'\}9;Hx8'Xu_͎0G ѱaxb fgVw>qh67볹W/\I;;3SaJ N_@.uo7\ ;N'egV=i[{6Y>d[ع2lzՋnAuwSv${qgqPd#V33vPi/}eV"P[縙mTع`gyc̎xbv⟤X̎zbag,\Jv.r6V/RعvF);u׋;!6[. Υ$3Q d(ȫd;;*+*/)A ;גN_ɺݏvyyt"/Kl2=bGaR7K!;)_.v> ;OBv|[&v.%O;Nm=̅keVvFO.v{aRfvDXa!މrv#n&TE[d="_c-cvs)pP_;J[ov.%@Wo fW-Rعeٙv%4EN`3;aLkVv /A|iNylSFwwgS`#;=`gv%٩fv/@bǎ:+Hc;=}eDAӽs-9vZTl<%qεı3ԽWȯcabW2v>Jr`_mT Hjxp@gᛷCk'H}*\@eQ&YRvv#j.6>TعTcGVᷛq=2=Hv. q6)=#]GAeqa,Jvmq๤7Oe;`ڑz?v.)8Cر<Rv }As!xvp s@Îv0ycVP ʀ;^_VعT؞{. uw[c>^x.NWUL*\@Aay跮H[T[!ggPv=Wn]C@s W*MnV+ۋٙT*`w20(tK N֖ 1;OHVv.*+w}}D-k _"y7)lV$+08)\@2^֑k*, 夰sa`H%ZءW9esa`[n`hcqoEN rìX#fRعeH#fRعeZv$Y)\@2V;*\A2VّIa•j3r9 ;=9O2XcJa•"ώd/:/ WIt{Y+WG=*\A2X?*\A27N2fD^EN nPع0eu伛ì)ìfv Ll-촻Y+S[t7;Y+H\G{8ms`3 {9R H\e/;aVa Hˎ;`$.WfO[!mQȫ$f<%m1*9Ebvm2gkSdfz?;saR"{SdY,8鳌X,~w9:HTE^%>[dvNe:\dIENDB``!az]BL&9?`0xcdd`` @c112BYL%bpu` RU p~:'6TySfT5y;Nt70~py@|w88_XA@8*#n逃m`G ? 98_W.S >zp{DS\1b(PkcdbR ,.It00a Onf &\JeR}FPNG  IHDR?3 pHYs\F\FCAtEXtSoftwareAFPL Ghostscript 8.14" IDATx=`aLȬ`/iЫx[z`BoAU*P9:G?{gPnO$!nA`M/*M/*jsӋ]~bqxy\ZX!P E'H!kؐ qG]۟xǒx<&(]'e;=Yoۿ89WKyqݞ!v.ng;bCu r\%(4fsxDd|@[ ]*AaHR>LVnPd8vB ".QSsXqqn[bE6ǐ`*^81tHrY!4\C".6h1Ż/yKI\4~x.D0ѱ Kҕb8 ,fbA M>X@b1]Mzk'Ř^%b{ON W+XԇՄe8]Z?qU+LNlCԚKʪhXܸ1-;Ŋ;OID<6lnf Q#yQ]5V 9aDŒnݒҌ˶ HzI=/חžJZt`՛/jD/7$nݞ _eG"^eՀ%cO4C+$GX%\Fb7VډMlՋ{˦ދ1-a:Ky 6ETWn_%Į&!s?+7 6\x絴-ôcn\>6/u"WmGnй!Aڕ2~X< qX,J.n4rCc[xk+[íôA1bvWbF%K.q:!\,h5"Q\̑w\_8 LO:& n.rqUXb&(Ӗox\~<-?S\ MQ̑zݰ&Mx2>O01^"ź{sX]xQnJ"x-8*}}TDIqwP="śtlG'j_qJ_ubCb=xqXy=ln6Lyj%!(Չ \σ Awl,zi}$;Lc3QCaj܉iX ƥEZd@Ҥyv-^1.cZC[cikt>Y\//="`?e13/tK v9@ђr~Z"Y:;")<Ci"’؆vK~):8fDqۡX[wKsb/><Ýˎ $l BUà3{忋l]*,h1Z} a>YQsՊk7H+|^|T _j2C,=| ~u5Z`9?;sDUTcbVLM?5-MMH2 @UXW-?z@NQY)wZѢba-6b-p9b-p9b-p9e";B? V/k)/&t^ٓPNG  IHDRf} pHYs\F\FCAtEXtSoftwareAFPL Ghostscript 8.14">IDATxM*rW]t-䩗#wࡗK^x^鑇EX!,H~H$DIs*sJ>A@L\|a(6Skpf|gykw/eؙPӾA/{+{4)C}`l\A 6g耳w+l8KyL^I GgfOlfnNr:8Jm7x=t ZqÜd5yQ;lf! fYShs&2mN&F}2h,:|aHɀ8s_5)c3ʠYc/eP*l䇐!1D{l"]`6a!Pғn Gʝ[-5MبjAx*N~>K؄T B66#ʄΓ-!f:Tdu:~~b5տlBIdRa(#B_yMzUrx/:IRQlʫ\t[Z&͈L2;CJ7D;R`,ڰI=6P$u tPwԭ]0d/Fv @nr AysͯI6;7=64LBqH6ߵ^+`SPja3)Uvnl\#EbTHjq<6C669Ԙ\K|)3 1@(FóX㍽8Bb W*pf@l NN ԝ;wQl,t:Yo0ԌTmU`diٹM'ݢv '˲>[KS0cө 3l"uu`l\Ĕ6ux%߆lULaj_3v؎xt1fc ul.IE6/=MWĦ5EBM(]IPl3NoBƄTɂ;Zw3|fcLlr' 6ވu$ذ18Th*ž̍]{7g6M$&GաuZ&s. $(n&MP ]&lbMWnJ-{wQ֏[ElȳqdU^fHIM"-aNڻbk{5[-RPq0UȳE0HV7DMfػB1b)bH(aW>)!:eӽ($ph %l"[7%X&Ϩ۽m鑭EjpOt5بKJEZ&nPQYjTܖ`֑EŽZP:"lL ~8 Ɂ,+ȑV4RP "-ai3g5h?V뜥wQ9ِf V&:rA +M6fCʁ+bZu-.m%O:4C;3a;'У/]E2T\?=1BAPX1TG]@v\ ҃mӆnm'OmshdKkwFY}={OH9屙-5WMBʮ`]tav[ElzPM휃PWűQN-"6L67n 'uaMbCI&:rVoN}Vad?tdnM,OW!{(6eDشdnb6i..UN5Mqz+lSH27u&SC?<66P~Z+NB6M&VSr?)#0b/ѾBԾL&+d~:3. lȤJZcCbeTX.A34_g: Iu8etVǡMFFYĪ=d,|2+EM\Tb@:ge3j6|fݽy"gRPFA|MyUyWЊG&~\kdC 'Ӛl H!+kݏ 9A~aWoQXjDg!Mv7ÆM(6{dC@Kv(dg<Ƅz=(])4JGzC!Ԍ_a(k"UU#ÆR8lnBl2P[nX6ܰqoNN`-AU@|F/QkI)=^]Lq)4݈WAޙ-|ԁlw;Xp?.e3z}8(vac@\!lH s[,e#~M2?ِ8/+fƽH u S1_/ׄ0(|t^^3P#Oh6^Kql;PhfLmM1M)ab`_h-)6Sj8c&3Fa!5dݒQoeUЦ|IK}oԳfl{-Ɇ 3DtQxaC (TKMp+fɏ":l{.>M)KDE('|L4KeWJ&eU %@LD Bi>d2Zlj/`&+ 6m*HM|6B_w|bͧm#?RrƆlDLfrm.6dx/v{l dE+>bCk"g(d\t!|g=<BjSW VP\_^c.ba6(6^.T(:1jYk؅$;CvQlJb:h"c6_\Mly023THk"šBZ4r_#i)M*?CP~-7F\{My$‘lef_ ҋHhޝ_eljj@7^rRI#5pdSׇ@5C€3S2oh6Ⱥ"OxN_a3)R!tl~㚿&@oZ:(Ӓl6л{tQͱ2w^o覷uRۺ%fJ  gzGG.;u4'Rg3T54Yn<8WH6b ?u 뺐lZb al $̆J]b6bWl zEzB ( 6(cfOXN2c)/8E-IVcFڰddެ?d*a}Cr\cfF[},wGb; buf31 g6*7h6KOx(@Șŭfj2l`z-=obZ%DZ6sukaue^: :N}6:EKm>4^K#lqLg1UсG2];Ts9˫mU) Zyսtܨb 1ȓ:}#? =6No7#!hHձ]uq3ޡ#[=vU5=m}%+Fc1,(j h{m`*N+#1D>29#|DܰqzA-%#},1AJ\Mp('OBT(W-NԀAڪR_w~q]} {H-\盖}vߵ`6 'S3l:u>Ml\R^ټ8+Aj/9M!BvQ.隣cHOfxQgӯ$&3*9C^`@{H'A/ lߵ#ؼf#yO`sP3365?1l8CRrPf6fSrPf6-fs*uQ|p?A]9&OuQ|B~T3lfG9~YO`sP3ؔN_`#2A?QrI&-\lrI&-\lrI&-\lrI&-\lrI&-\lrI&-\lrI&-6؈F*\lDjAzAĚMqYMZ_lwfzfCRkg3G0{A9 aroۈk(N^TNj>!db3l[= bEo_=\,Xf#weS~ɲo¦!XF{d=06UFRؤv PrI P1Tbf6S>7bk=iQ6@l&b?g?f]vɲ鷲InJ'Z6 KY6|+.]}6dzis+JM,/sؤ68BGljql&7l6*!M#^od]Q(L6<#lmdo2+8Mz-m)f-`_ 71r]V泱^lf6*/ΦZ/6Jh65\h/6 .UAgI~_N6% ؼMb/fKU)lውHe*6tgF$*l|6} =MbjF$7*lt5&6t$M҄7u6sٴ:ෲ6Ϛb>\$^f`w`iMlfˆ7CJٴ0l,B TشfҠ}Fs̨vV3͆tڰщ=Ms#+` ܖq閃Fg IBah6ίgT(6&ë6L,wIM{^6pC7g3h-t {a[6\1J墐tUrKgu]X5^D*2`Lt6N3fc?UTv6Kz gu;Mh"!(66s!͘yĊ˟*?_15OT*iPOc37lX+)&w]#!F'L"+4a9lnܛH2P%Ħwlo!b#=:]]3g6*fn(ll8 l$of F؈Zm}>YO!PA6s˿66wlFf:il#KE$bil`#t6b=QzM7O>G|65hmYP'0E,`m74HyzB);]O~EsS%ϭlChݾNeeO`^Eo9dy<6͉d#"6?̇:ϧíMo<6fړMGuIxl8f =lɦKo<6Rv$VVF-Ŋ}ִMvdžɲXSfOfRKm<=ZOͤuĦf*f4]fT#}lF#6*;sfP_lՔـIR`Y|f@E\B<6c1ۋ<,1t6^1fe-d3KFlܢ"T: ogਭ 0!smM#؀W`Ov8X1FlMlbsblx㚘$1d4pbB6ڋ`n|xf,0Be6#c6ʅ[,QֺJik=666_٨9@"f3ff@lXF&"M fӈolԛ@"6c#Uпml`#ljIJ &d8l`7&]i6KŦĦ#ؤm?]dzYK/cs /I'mGPG٨F6^:2x/ήۍl]]Aޝ&?A~c=6Xl5ׇVޅ`ޱM}׼;ņC'l*ͿuveS>{k0fS*f3P|}y/s)ӡʪnGlL|<_wV-vTކl&Y5yHylC :r5 6Fцaf:Ä*)6C%cß1S4mn{ \s\_F+)9Fϳt,'fVxƃeQP>]ވl6 ۝ydL0!iI6*Ʀe>雧b9_wa@l&'Vl'j-dX}\-4<6 7ku.37|fmTFMrdө9lB;rwJ?بyuYmsL\l_T LӚ`nLf6&Zo ^}Pm`5lJlٟAEF9IJQim 66*_uGٜwEL]f +yl?Fe1bß;M.LبOh`_g',ٚ 7/c0}ͧygd +H!QVTxrȠ8Pğ^#A+oϜ[C+Sp<p?N&\ I l̚)b;3:Be,cQMVSf qc> p{9%<ݢ $e{ tk[e)ũ~鼊N@ubE]=t $ yq؜&vGg-u ;ok6Zg=Mۼ&-ͦ{f\lrI&-\lrI&-\lrI&-\lrI&-\lrIbDZA`S~,;6x#X~]4DzCwes)ZƐAL!{^*g#ۏތ|i}ؼM.6iؤbMZdͶIENDB`n&BӔf$PNG  IHDR fXpT pHYs\F\FCAtEXtSoftwareAFPL Ghostscript 8.14" IDATxK丑NًAg/hXs/{1|0,jc(/"ËY4 FTT3`wI  Rǔ)O`ڔP26) eSBU4G uJ7G$bg}|9F<ljM~竮՟-=EO6Aؕi?I~ÑVb0af*Rs )ȧUVŴ[D>}VV0}̱)_QTo"+](PԊLCF d)TV@ӌ儢4d65 P+`o?Ɗ.4cKƎ1`|M1켬{~7ݽLG*Эn^I^Ut*B-:İN!&o$G#`m̉Yh S{.2&ƀQHsR)*kcاQ$ݯ.1Rν3xWE@c[nT>} !OgKֵ WirDv4=h#e t@ ݭ.J(#N;`h]sZ !=Key-Jv$"H#b}1;hN꺰w2}!ۃ΄qQzքCg!_XARW/=2%ÍnD65*yp+Kw Sx`9++on.$!C;OwzAOΞ!'P wH.]"g"#:cE\OqCqΉ >-"}xhGት8< coB\2=7DZi|U< > $]F<&vAZ,G>C 5]=`O&^cvAZ>W`J!mxjTZl/1쭈Pa9_QaXcOVt\ Zr9wfԳ})pdwP'B6G`(6k,`Nc<'+)/vٺ^=-d"#Rv#e#4vAZ#5MM {pWA׽ƶ9T8vτ k {O`wb"+W{i'Kos}.=$+DB]ċ܂_kC/g}F=Ke,Mayorٍ#M;]jO` OڮO%2v%nwm@Ka՗Lg1K?]f" v.'C]vsTe="{pR1K?]_$> vUi,`W/cbݬ*[XuQxRSi܃=4 {xR5̒0ck$Xמ}F{^u!2vkP Sð{{낧Bv!!_I| %^VOjcMb>FLHM!?"Y2.W:dR?^?Ba:v5 `:EKW_ZBb=Ǯtɴ*XF`_;5Zń` u =&`ކf}jrD0aw"ۨ|HkRL#yzhlU F:XǻQ)1!{ pXUN"O}W{k*_cP`L(*`=5%qÎ.챵0{pׄbإ7 vr8&vP`.0! |M욝a4,vPUAc(IU.v/h= "X]c^xvP5v=~W Ia}4oG&v)yqyg`Aa*滰n&7-޷&!8WX1k2eoð +/'hnq`g59򱣅?츟;n&,TCaA&4S ;snS! 7Me“Madؖ^ "^0;?F; 2ܧS|_۝sVVb!v+ oLF]$! ;³/'mo< klu°[]kvv`xjEl̑1=Y:v7&|/Ua)RC!a& /icGxa ʵ+[0Wl+lbkN2S}2S**);%ͩ^]_v#!l;٩U_-qZЦ/ԐaVQI9F{uVa0>[±z2 n@{#kNQe(7^d%y;jر}v0)]+wbwiS;hYHޭ~mmVW @c:'oinL؝'hcGvɼj)^aLNq+x,.-o]~_覰l!U_81(x%\JY} ;mt29 ănq_ ߋJO>Gv|b5' ghbKIL6Qxcw%)4~cw*``@bn7}!M}܍x ]=KᐕE#yㅩ؛WgLa m~j?ܪ8vXJ:vbǞĎ5bM&a),7J'`cr&>8v'q+u/)4/^'.p]1[;aDر=iqDZ[Nd%U؍L)VbDGuNEaTƱ۪ Q3+ɱ߾yST&5͙|13#NQK0CGܼ)E1ح -ZMҹ;=$8]FTV&HC><gm" *nRNؑ=;s=ayxmvj9+:O2nkiT.j$>A#JqhSkfKUR3ySMRb_vu\("Ml)?UN%k:ر(7&]!;LCy fcyӕϧ7&~4vw[1Ž6!LPk1ۅMWRBv4d毾5WmU.GOV֑#cv| a@ZyӦnyZ nwxSeބAhD2TXqf*IGc׽GNNcO;9W^HM! ;xTR{%pC g֗Ө>v}#Оڿ ^)&CC`0eyPeرͨ'(SLufaWkgvǐ#xCON)tY[e5PI^v젰+vj°N,k[bW7Q'AF{R %jm:ur>-/Ev2؅*2  .Q5ɬb!o æ@{nkDz.yZU>*y7ghFJ m/[?UlY:ao&n%!mu:kJ6NύoJ((v'Hl8$R5hCoVv: mtt[@㎧N#[Z1ՑlutGLӳ3+a؏/f̒Lo2C&.76LRД\\Mof޷7"?#=xmo`?E t) _"-R")R")R")R")R")R")R")R")R")R")R")R")R")R")R")R")R")R")R")R")R")R")R" .Ζ{5:g˩;S.GDUD#^jDۃ TMz`O1rE{{z'Ic_H޳;*2hL=9et׎e8-|Nz4죸7M{9ӳ+(b=fG 4YD׾.:b4,eV^I`OQ;{_ɠ^BocoMBީu*ؓdќ 7͏`_~S'ɤґm0(ˏ{:>}.dа>`O^;`t:9ݘMu>$؇`ٞ|kmznknINk ݘ9')ؓwa'j`OJZ8`Gk7fT`Ǥk7=1nNwV>y} ~2? vD~cQޠ_'\*+ ~2;" 3fej vDF8ߋ84LlqC[#b vTf8j""66ؽW~B>IX+aY `'iݿqm;*pvi{-98G 89Ձ`NsN4u~3nX( '~wcGϰNoM[OM j/vX~\ vB/n mdiߖ*#ɍCF- (?!Z+/ (?!ւ] X sīX+μ C `G,<9VM؝d"uF/a";,UMCDV",'/0Kɛ H>i4::O\12ou!r} Fkț6T ."o09hI$`"&j]A#EMgK{WO~'ޮa(`źw*&ݯ/TF>M$atWw9dOqLuon{v{%u>`DyvK>V})yv,`!Qŷ;c7mma%LxzŅ͗~^y;6SX'p]q"Q7۰'ܗ5}B Zmwmg{ BF}±:M=Naoď.eڷ$G"xeXر0 3_uQCyK5*cwg/`TT# IDAT$`|xI[r/E Xt^0v8OBL`u L~^a/a^~p!ρxaءY#>GhC{+2=;ʈvGofѨ>J-d4vf$62Φ^p}X1nM&tv BtW;jooݶnc,A5H狊R`A3,}8szǪg;l\\ؗʹկn#t >k9ڍ>=O{^RNs@SaF.K;e3'kielEvbnumc^n3}h?H,#J{jط~hCcF3oqI}_Wޢ'{FQ]aS-?9iS{{G-jA]mL^/F7?wy vHKsHlb'`jƛC怴Z<2;f;⍐;+>]'.yhaıw*f~c[?1/5Ml('Mw>Vz'sv[}V mo_cׯ<9o+J1&6duaV`&af%ٗuo?=f6v{7Ljb~n9 LJUӱkV.;+--%_?,pڵ&q]ut[ƔW5^hpթAlrVbOzخ޺^qV&_~<钬Shyz4v8{tVOz_lZ+?5dNz;< loCyĵI=%Z{ci,Ћ#{ҋ-5dN/Ga7yaCؓhY>$9e߅t2)R'`!"2'`OkFz%[w†wnL}:7v~YG&Wr ~4\ؐv^pcl\xIc!b_l\]_RvV|{l\\PǾn56d}|pQgLwK2>}W6dsn؇΋!sr]6 ;9`o\ې 0/3'V|/Y__.6g{ ;G]ŗ_RңƤɆV:˾T؟˯rC/IJmM_tz&}s<*Q|U~w6}hg%`KM%X^Nu"{\kFc})=.LSUO` {̨|aD)K>LCٍJuRboXv~ ;j+L r@zrN SrՓ|IENDB`n| _VdPNG  IHDR* pHYs\F\FCAtEXtSoftwareAFPL Ghostscript 8.14"IDATxݝMfG<zhaص$J(˱`yyI('냔htҼڟf)H#i$9deM7!LX~R iP/(-`FX& %;iU> bB= KI_nAZHz7 bHRmD܂FHʵtG ̲Ώm)E| H#Y,HtYnAx(6C?"?Iw^+^ ,a%ԘaڲY8܂4f"im,R3ijJJƾʸc2dUepnKqD?IzRA,l͡:-HkI43"QCԺFȌҨ,lef5kj"CSHAXFC"uiWH)^Whdy.E \1Ej5\uO])}kIM4wmO#əSD]RITDc 9$ ʑ)H eb{J躜Ʒȹ.A^ti}݂,ErRi $x)kHFI/K "HH }GM!ŁeZc"ť iV#KkRHj@yffi ZH?U#EHDB.)4Ɵjx[r~$r1&gj$VcHҰ;1!.HRg ~j$VcܲHBZ%oI.xK"pH4iK4K99dW ioK[R,EH=yfFtk$kMFTeg!ƭ\,4ƖADB'ХJ 7\12| >iSHS'iRH^C%H/7VɣH})t|k<"4%vB7)\5nM 7\iHyj^!(Cz!,{KUXǓnkra :(5Az&U-t|kȼ2#ɡdڜJ^\̄~Ƈ\HCWSk>7kWr,*6љx#HBRG}ƔlAZ}$R$4ҶUƀƢRJ[Y I15*b@^GBFH_4w殪v&Wˀ@jO}$uXcY(Za+%j8jo%@ܐ*TLZf%kD.bF峐T2zmQ$R7-:?**`5ރLz$*q^:R>L24wB"{>Z֒ܜ[IX Qqg@GHeI%`zSU1 !Um>!$}$3HҒ!@YpN<={*<=CVŀhT-V &<>jtPiUAR+F   r} N12H37Zp(n8@R *ߟlO4N$yU!jn3Fy4ڭq=A궈hF%H0&*b@^cBEw9o1bHBZ|WV#BBhә(z|$B"5 I7-zR$@=r+&^c@H5Rݛ)uI7 ڝuH5 %'c <ꊀN4ZA{zY$S$$h8!u=\!"K+B{`YEjHz;!z0\0HEbHGV`u@ݞ "d5DL\A??uC! |TC&3Hr$C81 }iH]!4RE j@_&dWb.VI6ֱ2 ""d5/D07VfzPIb`a5|C2]m|Ƒn,D2<d5N=XrHv#B|"aB2*H7]%4z/m $E(ygtK!U y85.@rŞ\Hvu)YpyABeDdUAkP0&Q0ל3x{U #4Ԋ'YEz8$3!I <(,Xb!nCt99D,ɽj+Lp!9 o%ș0s U0 `TzJi4#Z "29dM#i Etr:@f4ٴyUk)mEGsH({\ *ӰHCz$}Ik Y\0فKFcOd}osW)8pH^\=nev3f6=$h EK. 1 u!H^@Đ޸Nbz(옝lD{ 9aƸˢ| \x$7Fs2H+ 82#H}C h7UM9$c[?j83[a,pm1&eM&78$4l!i$N\8Tz$ؾ[S )4$7kٙ,h8T6^f$;; Z[lM#qdֺrͯV< <s=84xQHnu^Ar4fQ0EjNOQD_h^aC G"=97(h,66;;U~} Ft>R^l*[r$=34Ln/rPm*A X%22i5HꝗBT YV$SL>{>i|i'0:AI&UYu)) QGt'F7NF s[i} )I f%+G܂41mǑ"Cxu"y?VT-N$!9Yk}.0$h__kѝEM߰[pwV.F\׷? W>2?4f{&RdaR>%vk33r&Y0Rda 﫽Bd%z] #E&ػ"itIoNZx'q"u.W<dJ.sԲ|çr\ P4a8?NBnMlC`lXpu ϗɵ`M ߽E]!%EOvv0{c3t'{Iv6yז4AX0+B9RT^X"%IENDB`n[uXoy*BgPNG  IHDR15C pHYs\F\FCAtEXtSoftwareAFPL Ghostscript 8.14" IDATx;캑R)TmfMM QC!)C!r6djg*Tav^x$ `{ăZ$EN1)1)T8~O隳B*Ti!PtYYAQ1 YAQ =^q)2?7^jIP~r1W]ǿor_==θ}9u/i9;dqqWOO-qޜ6++cu1GHSuךNƢM0.BOEr\>q~4.פg@믘"9|z ǻH[0i8h%D |Mwg"Gp$Q'xS(dGw {W㚊dz8NWS.6)דe!L ףVSfN#]G2 L8:mB=UrAyecclgդGZUM2i%;LzY_qۄU.ؙ]B Pdm8F}9O!>]tXU 5JtdSF3Dr]8VG:0U'r(vT06*p!.FZr6G>8cY#s>q$Fc^qFq 6Ťi/qcLQ/_Gy\/+b.ND'$pX ƄuG,^18)9:Z6d l$xc;d1#cupe͗9x2S]ڻFq0!^rR<߹ G$\qX0+~S pc8Ə4cW=tdulFeǟsNʹ~cx㼽rDI4/#%9r)8~^؁3Lxu2ǟc8PVjOmg#G}M^B̬GgˤJ LٱOG G<$c;~sdqsd !=sk̚%n"qgNHJtv7$14P)'KKhf1GJBKV1uJCG2 .t1U .EEd(B~`p(GpDO%s\ǀL>GC|a8#ZY p2F t`᝗E-6)GSq%g,GxierT8ݍ8^4a]U>G &>t x,88*JH 1㠩Z'Qs#9T%X18#zfn91ܨQZjךm.#͎"܁㤉QTc4;G‰b8M+<9t@kPn'R^I 6 oqruu(9BC%5dӴ#UJ6qdUj;238ѹ(~Ri \x3(#I8_>G?z}بyE. ǭ&c8v MȹttU\`bdr.K׫HlAL ok481becѨ9 &pln-3:`]x8Ύ)&Q f͢kHs$(NY)Odc#8g8N.VN.G] "?Ԯw:qq#l)j4D#Q&O,,ߵO1]^qle{O"SөRqö1<;}zǕ z4cLNabGw!Qw2jmSV=t [':EX6Kc4Gi%L7Jiq4==q pMXX,DZ )z7#Gr$yLq}+3a0f:ԬGnY.VOӭɥP=ԇ+ cpE@8;՝}c- 9OlX1h9Mq"*9n)*s5tT%iCw"Әnڹ< Gd92Hr#1{l9~C%"T n9 8<h]ec$wS'q @nuNlsiddpZEw90G*#4rYPM~6U\?Wp#m#ϺqsQq9#@տW_p8ʑ,lr*4H~b}q45Q>FU7!:\^)Wo*G:p+cU9WT,Ǯ8>ltD\ bȂ.gUS2䥗k N-mr*]ͱc9GǞ8V,_hloozp#@N cgz`Tq!͔#yǹb9V,G:}1ĩY\祗k '5ܙ>̑bw7:sL7'K9q q|ܘȱ1WN\Ƭb8.˱;crGѫݛ۔2Up+8r4;/H_8N,GDGrR86c}~O/*u2^MNJ/j{Xq%G=q$65oJ;*r}~`(qGc82]IHfqXQiucr5MZ[sCqpYewrR (Rcszp4zhsG9{u`}t;p #(Ssΐ<]mQkZq.cmyՃ`뗵z?r.G\oqHs]G(>-|3Spڹ̑YǤ/kbQS_S9Ү5'2#VG6y@&b99{5:V,Gm#7V) At71'S#6LJUsZyؘG9*7R A9N^z:^#'rPsbs9brK9b( 69ΉgGpH6T/uehx'k6A9brsms&ȱpjYlc5սjU"Gk,V.GHr\YFSOe8qkƌl6"/=1=wǛyNq|nTG:߁osؚ8rj 宖u$ptHu)ZNGp刏Gq G2.G.qݍ:9L6- &rNnhNg✇Wt8ZZ1<JH=& VDrtʚHŹ+ρ&$%V@Ocx{tr9>{VXoe9߭g^yV9|{cN>Z'"}#u)_K~}wnkc)1(XO8sԻI8\֑ꌆ89qq!*N'pWMɡ(^~fN\5WCIv_]|p,-p\pv?.K#Yg5񎯌$m r;Hͽd7בSj-s2b?GsUCs9̣(Op(ǧbS],M)^@7jFI,ɯc z\$Uv#\ǪSǫ8`qHpU|63ӄ͹p!/Gg~LqR-2%YkL/i 8~AIIKǥPA$DU5#֒*G$Ƶ0osݖEq0w+}{aɗFe~z}OG,$GXP8>VٜUϯz4b^A&\Y{+?^-oҞf0d =|sF,&:eFrhvUOs@XQZYt#%08JQka! ZG@Z\cq0rV|v3OH>3ר{y 2N?G;¸i_US\arWdYT$/222#S}d`tk&CWrQ~"N@Soqmsl;ϵcC+)\ar 떃 &ޗaֳi( <QdeAĞ]?GAZD;"uvs=qHűz0#C̈́GxR^wIϜ͸ƻ^,[$(Π978E.$؟T rleC4xkAft#%"`Mo<®{uIAzhuBqDDX.p&Ek ^rlW9^.QT/y`lrܯ?J m*cw*HttFɳBn._(9Q-"򑇶`gC4$1Y#g8Iy@wGKhg8^-I^ 3dKܹZ 3d\))|ICȗ|R8"K(1)1)1)1)1)]QU_Y GW:ʱ8Ӥp§R_iR8z5{˅w*\/)9>3:]^'*]8Q:w!BJ?ѕul. 1;\)~N <ԫy=:'=:R8r2qzf-ܒ‘-"ޅed F.(x5_j{,)իhsKzy=^g.)uȱA1g.0(2 /[YV\jooD7=C Q?>q1\Q~b8jY<9Q5W2Dq\7 q0 o}C8F*Dr_Cu)Y~hz?b_.4}'9rܲI+0ֻ;;j~y"9u Ga#ű# 8v"IAq2DcW}/Aohzu|Z?'R8>Oq|_ziQM/ BuY~'9rĩ嶾HdA<{Ȅ+=icǏF 8-(ݫ%.GK tD]˱^ 9.2C~[ڙwx9mXc4q"|^$c& G>~:cڢ>v{H }( ;Ԯv@UbsZeץs9*cqr9jN8ȰWXLյ+q ũ8/!N>ͱy}rͩ= i^7,s>q2#Oz ̂8c Ǥ_1z$|/qmatGNup'9|<%Q8p<zZE PyF=&8e IDATԶDI2|f1\qʿ;|Y\3;4.8~q^Q,9}liGkQa{ƻ3Ojq(2GS W#=.G-g٭9xs\z|\Gӽ爞VIsw}Γr/8./9[Js]Qy7YgkO8!Α.xrB8ڷ'xm%hK稟G>#czժ{/.hݕase;JHK9v62f/9*Q΅55 ߜ15޺>L! ;C9xN&+;4's];A|-G8?_r p S۵fnE:8^˱[2IeIQ)G Glϱ}ϑYw)iQ*tgm`#*,܂jS2zFq#D arL jb8wxv7õs c3(4hb#mɂQLd>jb{[P=c`G|ˑo!aț:t6HrIR'?8Ofrtu8BϡxvQ'ˑB†{^f8bxx]vWvle G(~qpp}H$wA] ]x݅a"3=j}_9c1z]&]2ญCy2Ǥ$Gl`H(1.j]Ϛ8NpG\C]ƅ/ܘq2Uj<90arL< W. \BLr KEY^nފY8;e]NqN2pBUAէ0SeuR\_a~kFĹ{'?GTo\1.&I BAl L31~9&j?zw.5FQ_Nqh92+Dr) ybqt[[OVP9BSi`q[I!GywVda8B8H@&6}h' |8C8yM''9q_qT.?pK1zͯ~_K-x_G} fpp*-[_bEtF(N9*}m]_b8I͙; t8:qq\#±}8?"*GqpS]9B(kJ[2'S le8ZxcDOp~4(r qg=F_}m0IZj8nkcYx~$=$v>xO('9s 82;/v8z u99~[}chC޸R+ޒX7eBq:7v}8'g֎!y`3B+~g6S2GQ{aR>ة9['oɒy>#q v96OkbHeEZǰ>&K4zSr5qX>1ycG pled8!-93ϱ:R9˜Y-Up:8'Ǒ8W!W[{+̱ZǥrH~ʭJWIfg9.ǁ8d8'Xo+b8=G-̇9tW!5*cq ?c9auCqr*GfYN<Һ(cǏԜf{ȕQEqxE?gYòqgԝ݃ qdwTށ{@9Ԝq;Ψ8Bmq'[8}ul=g)/k[AO9VAMU88VS9.#no9N1)yWDwPsB!8NTJ.G-, cQ.;51 CV#5'd#*bs|qlrDW$Ǒ(}95hi#k aS;sdZ@ e(Wr;tw9,GsNw(τms lBrH6TuX PsB8br)G6Xb֖rDaۜ2[^IS-mzR ce8b]bh*#zj19qԚǝ@9 ͑Z@{6Pq֯vs8scm:hq|qFy#qze>>m YG![p(Z(ȄL}m6V'`2gV;$F Igt?R ե;QKqA?{܊ Jaq'>l~%qtHc>Vh>ɱ]mQ./^W]Gww@Z1VBO+k0%8j̾8yJc&q0g#U8e8ܕZGQ.Pg1:QqXg*bUqc+~{kΊ,p53rYǐ錎,ʭH8(p -Yna?QsOw|EƯ3!Oe("9.GÅd5 q9we4ȱ9jle8nBujԭ=vYC4`{㎆>xQq~w9Ԧ)QScĹd8ˡ$ccP/<X]є,z8Zs>86:Iw\ѬiHxO*7%K/j 3F8jsrceq\#sWH O%s38K4\R3Y#OasCc*<ͱQM2hq9gDXvxGC#9wwCji(l8(*GD9*Drjsɞ:lq\Aoݣ<\*%[|p$8Rqt6;;P,Uݨj9*|w H]?^8gsɱL8ŒMuVj[p{a@Êc-+dq-utp ~a uDd}eu د#r,ǡuV?9JO ztlp#9N#,R!Trc#fQwJخ"#OҬBMQc^Opap}GEptΣ st ~ nJ)kH"y>9Y#9Y8>I*,?8~[5B`Bz9J~}rS__[)7%Gmz9BͱV۴DvjY~H~9^pn_4wO98@ (HF{СRw!zޱ cÁ(t-j(V'&9BuĚ! >Nvas"W؋u+rN* nMCxG̀zKG7!T +WjAཪMz!M8[pv9z8W?1GErP`1L|4Kj9Rz5ᨎop$~z1p|zgn;=3yqm`L 6gErĺuOy[ޮl຺+v9U@am_IJ6Gya,N wmrgZ@'O戮-P:&9?-~j{m^{];ꡒP34~M#:dn7/u""3C~tщf#Ϋm9U9#I$ tL30 nB:xRpJѫ޻:.o-ɴWOseA1ٜB;2 vꡎ縂blX6򒚲,;Nv{zb5T}*U=:$3Nz!2W8l\X<:RϜ3#0U+a!9qur7U_HNs<ۏ4{uYkt/ɱƫ-F;jUKX$s:S \?tS_Evx8`ߘOIh{@(K2ݝ`6{ޥ!Fs$)f8+f5,~Ց4,}b1U|,-s6knܮ]V--sb%QgpXbQ]7gj ,9=RxLc|QK&_#|r)/D$cR8!cR8!cR8!cR8!cR8!cXOa}')Z|gH a-c|i{egVOt1r{63xdw;Xt?p/=pڬZVm4`yHW{u`Oy/c^*2nܑU觅.f<"hIᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyHᘇyqy|\"2{vEޓq|qR~I{jRԓǡp%slRw#cʱ/TcαJH q f%+ , L{a8xHq9*Q6+_}Cߴow<_ͱM+o8NI)ь$s)h+ JqǁrIh~/lvǙ=#:I>U>Q59cX?/8Kp:#+ow|QcGQ4c'9SGM~QvǞr\'QMK*|.`"GkF/ he :-(Ǘ1 qwK`8Ucβ|<.r\?@)#pq19*qجzw5k15ud*r˹4)G5A@D'I2%;8.*q?㫦L=^jQ Q)},FFs/.L_M3Ls7l8Zt!9qz1҂y-GyQp|)R_hm+տ͌8$xH 9z#Y~=Vݱ8NZ};ט[|68V_~-9Ưh+qτ^3qO|ฅ?xg4 9.#[>c8zj8:r8WOfVr,ոw-|7kq DZ8U54Iuse035A] !+5c}cq앃N98jhJeLxc4ǰYǎq=8_#1i8dy<ȱjW.đU27u^'58U_ֿqgCfa\x8j?PʑmZctq Qr."bA/eՒb".#ƅ΃y;ͱq_p`VMN@4Mر`hhԲH1ϑfCs1X;8R2.C}떅kTnP\T1 ]LU7[=#غT4*wCN?RT*&ԖH7~pԀ ?;HU S[\͔#Y)kq~iiЅrt)8R/G:tT_t9^AR|<u6QNtLeq{0e6A:MG]s{8k|ܖ$%dÑos9qs`Lt6"cA9Gb({71*5FZE9NarG{#U ۩Zm6MCc_o?hA .8LN}z!"9(*m:ڋrw8Gp.o38Gti79m,rW݁r\|qa`8,5q.okG_rN)G[9.Gyho=oue`BWVy"nexŌU`O7mkOQCyk:pC_f@E+qmcXTCGA9*C&uD >Gsj* :-m@pG>>Wcwcc%}N5AW!r)8.G N=Q&/s:Gy\xG9R\YyE,Q"O>n0+^=^F88(ϕômqOx:]x9ZmmƈP[p_!8zg䬢 (4Z/8VOln510F9ϱ:V8J}iQs8k:G9ieS8rPR-cCgwءỤ8'#5D^Np #q9n79kVS`[[=f/99jCDrcJ Ň1:O.SD.ktcma!| ehOTG9r9$Fj8zD+/(ܫ)aCzRDϋLUpwE\w=n]j0GK!89{>RD.*{*o!`Vᶸv 59VEȑ"tcnQTCXDb6fry9Lc_q:v%!q*.iHZ57ի-Q*@r&BA hQv%!p+cs4[|n]5 \,~#@vuv/r$ q8v,hǞ8bEQt{$p1!uܪB:Wd&1YJ96F{ʿXUypTg9co ~R'1t6Ǒ8_Q ƣ~97AK8#I<36ǎ88VLuHxE]W~UjKWSʈkqD&b9n4&P!N(|c.^5Xi1orj?Rsbqpy!AGMs ~)ص8z~ı1is[9^PР*UlC 4Psb}rĒgq YB:mGQ+L6G}ȱsvok a:4zɱ"p9ba8UYWT˿q1y@.εǖrd_rvű]9r{i86+&QqhA;ptHu ZN(G.G4{M#fh 6jq&Vӛ@Bn&{/:ZN8ń*"9|X 8ZHH>0b5OUK 2BWB+M(tGd9ܧc^vY";@m5*#G2@5ث`9E '{oK5jܫ8}Za4(" Gj(+8xJDZFX8eEItFG3ޯ1z2)AA,>G޲9ߔ:Y'rl0jp4G=`I8V'p|\_q0 8.Fp.G":T8]֠8:wEyzؠ[I&#qp9jv#q:rr|* h;9JCD=X9 _: ]svo5ijJX8k.qUN!p:/ LE|=8B,ǩ>G4Ut5?훎tgrtu>5D+.Gz>@9=8(ׇj E9sPPP($p9̣(q9 J.XP^9Zdáq\k9+U0՞r|'msZ<NGɼ UM-4ݲsm` $Lሆնnݲ]T8^Sűw8T0$=l]Տ6ǎҮ:pxfql!b9 *SkL:~AHOਲk**O++h=EÉG&9vFӣs8*Cr G|f,I޷`q)tw=خ׫ҩqj"RK>`*c{2D,Ga;r՛JMЈ_˱γͱ9; G|{F]4T#ҴfWT NכUl!(JCrFu_w9#~qGԲ)87qaVԺZYYnj;Yfo0,m }V׫rp؈N]YtzűEݤO ‹AO\VGɱ6?@Tʱ^[3+mU-CDs)T8=O=j8HEVɢ:nj_Ix +AG>oFPʸ-Tzµe-"0}>`"#]PBs1VoO xcsԋdkÏz U] ʰmAG 1U|G#~&'8]Sі9Zdc`{@p#x)ϐ2R c*fp-)))Op̂OKx5FKᘇyHᘇyHᘇyHᘇy/w]%c /:魵_Gf+ֺk|H~i_@9^eӥptG.p~{,^#pcs Ǔdq.([/GgC|1G2cJᘇz58^պOǦpq8=K'_'r%rtSÍ yr? cl Gr_nR:5\,X_r4 8Ά#rJpޭl9FӋK^=#wR;EjJV75=g3wPc9I]q9 ɾUJ#ƙ#tEqd{~";v>GģIy؜H#8U"d˄2Fyuֽ8y$s4cc4ZZ_ +cj=/'^Xӏ#!S9z0Gc vb qrQR9VWrmSG~|/DXxo4sY;Xq M6hI)l(=G^{cḄWxVyɱ9yQ̱*bñ s4mV_G'p|8t79$YbYqyZxMq8FZLѝ$Ǖ Gz HizwLk7?;d#q=K#odv>Gi}Qyő_QUP8ͱpUr]9GpÏ+#h7GnY[݉γWԉk9bq"LGاE7Ĭ s]xpoA5ǑCSm"os}ew 0Gos=U_Y&&^~#<,>ZqF2G1pdW690`;.pd;6p>ɱ;OȎE5riNbѸOHS6TGs_|[)l|"9r DQEѓGӽ{زm±S;#s\vJv<\DT39CQD@8xGY,G1'G2peIDAT*#:at7d1kF/c`ܡ9&Nlg9R|/' OuK`;eIMn Tq*r7!^%Da*c:ai_qlN%ϑӚݥ`fŲ;5эG"6RɿGr,GQc6Q _`Ҫ#mn^#yw)ӸhDM iO,ReQWB&r~+[e}#^p)Ju1Ng9'eNyG18#,!=)H*]ñS=x0iURy_] 8רOjM}}D 9=8NBJHU;cKR@S3QG8G]EqHU9ƃL5w٩Oށtp|Ǜ|Tjj]~k8/t/xpiqab8n5Vn2gݥ٭+<9c+Mo lJU{*GrtV?G`e}qvAY9jJqXwh[އ9u\x)Wp?h:Ie4Gr$GX8bɳ]kO1ę#8zみւ ;d% pq KEYjw˥?5Ñ`͠86~^>q ZvVb]Z_֐T5c pwr "7Iue6KDGrG Ǒ88nMfwGHyfc6xRzGȖm:LvW^q.lpk2~lkFb8?ɪtc#Q9ٞqtll5@ArlZ/t$q~])<N`جUǘ兞CWe{dG^S8N<״FtpAIԞq~dpi~0cms1AsLwT[SkȅwG;"r\0Q<߹quY`خzbpA<^ܮ(ϕ13fwAJAbpñO1*Upߵq;5Fe~tج䫟د/89[<`s N؆%\8xʑ$kAqP8"7Em{1fnu8r)+`;Eq8R8S$87v۰:Aof$%FkgdsQqKc;k6kiSr=BZ4Hx#O[*Gq\|H[X1x#tY)FvTO-С{ Gk|L,hT/rX ٗwnU#<3Վk*L\xarh|5DZjEȮ({sK`r;QDU (dqz/ְf zJd98rcgn78o0ru9;,< = K}"Gr fn7kPh #f;lt~Y>Ѩ?|li:,zn]e6ҧ_txr8ǡ2g]qV%Xl9W^|fNmHw9`#nΊ8T6Gr$G FWDZ8j:?őm wJh9Q{;p$*Uǡ8ׂ4kP*K5B^scmsd3\֩EӡԫtA\6ǁwhD#NJ,@]QJzےѭ rC-qG2ϱs8Z*hL9,G>]?0!un5q,^SZXh4⨎pٞ8;(G~@2Kر9,4+QtC&*ɫ#9X\<${?1jq± q46:-ǧ(LҷU"E֫R|oljx-9vu9R)b,űYy>m YqKѨ&* }r{3W #8±oKxź.Wք Q^VS&r:f)U#Eb9z.%Ua$KcX1FJC?9Z j[OʸǪNicTp&tF@BF~2)=őDZs9c9핹^_srUTSY}$cSX~`o WYJ7g?Gq@XEr]a+].{٧WnsQNAG0pE96`O8*qq(Z<1Y׻|0Xp,i⚃k nq F+J~H0.|,!-#JuGf}QO$'q\nrYJV"Ɛ[4VJ[xG`9ܼ V=vQP䁬&#Xj8Y^!9c9jG;9+pdIvQF϶g8sv *VPgslKGXQUz=jZ,>5'os{Q;Q[PnRbudl_'}7u,GtsUA#@PQqɓt)T8"="Qd.l%GPY/FC|1Fոt4(S==0+ˑ.uvmN9tQťgKn.GT9#[i};u(I{0p;}ű݇I:ya;n@Fs\'%n‡{70A m#=4cvRPx`\kG9q> ˒Ǟ5/\oJ(e*M`[oXsD6Gr$Gez4y,*ݯnZiBVyMfGX~Ãu?!lK*#Ax -΄s*G6ށ#'5Gr$GarDjz}qJ7g4Yg'Sq8؜iH5>G9D>3Ws9j#9‘9{򙹧zz;~%G~ !F!ZjgEz7Y^ʑ O[>`(bͮCpU('rz*lUӹua?h9 L8+phv9,Y]pP NW&G>hQ(ՌĻ]uS2Z?[^bX"^s(ez4NttuL@FswL .,k4[k$TIgB_I/\Ņzi%9 3R##ϕÈ_3Y&XFhQT.r@e[.5gZ,9ZBĊ:PR~OqN{xbX\PF?@2lzqdX*Ghs<<$ 8FՂL5Z}|`4^M9a2-I|G+/GwHZ#K`{9r1GKb8~I87c0W]+#$,"qD͉j{Xp<,8'Q G"?.ǡp$rNnߓ,' GEz|H GEz|H GEz|H GEz|H GEz|H GEz|H GEz|H GEz|H GEz|HWJxJpE#i p\;ʷz%l0?R8ptk.f/1܅~2kdpO-)evyN]G|P qevMskp@ <ԫy=:'=:ѲpFnܱ|/h'ߗ/1)1N WNUIENDB` h(8 L  *Equation Equation.30 Microsoft lQ_ 3.0hT285,20,Example  Unbounded Thread Creation60"303,23,ModularityD[0297,33,The CMAP ApproachD\0297,33,The CMAP ApproachD^0297,33,The CMAP ApproachJ6304,22,Changing EnvironmentD0297,33,The CMAP Approach/ 0DArialngs 3Sntt0 0D[SOalngs 3Sntt0 0 DHelvetica3Sntt0 0 "0DTahomaca3Sntt0 0"@DWingdings3Sntt0 0PDTimes New Romantt0 0`DCourier Newmantt0 01pDComic Sans MSntt0 0BDSymbolans MSntt0 0DWingdings 3Sntt0 0 C(.n  @n?" dd@  @@`` 0e6<. ! '!   #%"0 ! ()' &K3#%, +45 :;<=>@ABCb$\nlv_$2$az]BL&9?_$b$&\JeR}Fn uab$[K#*8>ٓmb$BӔf$&b$| _Vdob$Xoy*Bgcu 0e0e    A@  A5% 8c8c    ?1 d0u0@Ty2 NP'p<'pA)BCD|E||s" 0e@        @ABC DEEFGHIJK5%LMNOPQRSTUWYZ[ \]^_ `abN E5%  N E5%  N F   5%   !"?N@ABC DEFFGHIJK5%LMNOPQRSTUWYZ[ \]^_ `ab0 @8 ʚ;_6ʚ;g4`d`d 0ppp@ <4dddd@k 0t  <4!d!d@l 0t<4BdBd@l 0tg4CdCd! 0Ppl p2DEFAULTFONTSIZE10.DEFAULTWIDTH3480DEFAULTHEIGHT200___PPT10D[SOrier Newtt< 0DCourier Newtt< 01pp ___PPT90[\^z?H%2005-9-16 NJPLS@StevensO =MO?]Modular Verification of Concurrent Assembly Code with Dynamic Thread Creation and Termination^^6Xinyu FengYale UniversityJoint work with Zhong Shao(7H"VB MotivationProof-carrying code (PCC)In principle: verify any property on any codeReal binaries & no loss of efficiencyEmbedded OS, device drivers& All safety & liveness properties& Formal, machine-checkable proofsIn reality: only works for sequential codev.+  YWC ChallengesChallenges for Proof-carrying concur. codeA general framework for concurrent assembly code verificationLack of structures (e.g. cobegin/coend blocks)Specification/proof generationSpec inference, proof assistant, theorem prover+>/0+> 0  XDPrevious workRely-Guarantee (R-G) MethodShared memory concurrencyThread modular verificationOnly for higher-level code: cobegin/coendCCAP[Yu&Shao, ICFP 04]The first PCC framework supporting concurrent assembly codeR-G methodOnly support static threadsP1 || & || PnPaPPcPP6+G      ,} y^IConcurrency Programmingcobegin/coendS::=& | cobegin P1 || P2 codend | & Higher-level, well-structuredOnly support properly nested concurrent codefork/joinS::=& | tid := fork f(a) | join tid | & More flexible: improperly nested codeOSes/Java/& n YCCG GP CGG7b a+ Our Contributions(A new PCC framework: CMAPVerification of general propertiesDynamic thread creation/terminationGeneralize the Rely-Guarantee methodModular verificationRealistic featuresMultiple instantiations of thread codeThread argument passing, thread-local datapG%(R#$%(R Outline of This TalkBackground: the Rely-Guarantee MethodChallenges for Dynamic Thread Creation/TerminationOur ApproachThe CMAP FrameworkConclusion and Future Work&nThe Rely-Guarantee Method The Rely-Guarantee Method~Thread + Thread EnvironmentRely and GuaranteeA, G: State State PropThread ModularityNon-Interference (interface compatibility):"i,j. ij Gi AjSafety of each thread Ti: (Ai, Gi)/ZZZ,ZZZZ/ , >!0GCD Example [Yu&Shao 04]   Outline of This TalkBackground: the Rely-Guarantee MethodChallenges for Dynamic Thread Creation/TerminationOur ApproachThe CMAP FrameworkConclusion and Future Work*&3;Concurrency Programmingcobegin/coendS::=& | cobegin P1 || P2 codend | & Higher-level, well-structuredOnly support properly nested concurrent codefork/joinS::=& | tid := fork f(a) | join tid | & More flexible: improperly nested codeOSes/Java/& n YCCG GP CGG7b a+ Static and Dynamic Threads   ChallengesFirst attemptCheck NI between all static threadsTi: (Ai, Gi)"i,j. ij Gi Aj$! F;%Challenges: Changing Env. IA-B: initialize data dno other threads will change dA : d = d B-C: collaborate with T3 to process dT3 may change dStill do not allow other threads change dC-D: T3 terminatesNo other threads can change d*&:   8    'Challenges: Changing Env. I (Challenges: Changing Env. IIT2 and T3 have no overlap in their lifetimenon-interference between all threads?Only check those that overlap?How to specify the overlapping?l,E   #E ;0#Challenges: multiple instantiations$$( :/Challenges: Modularity )Outline of This TalkBackground: the Rely-Guarantee MethodChallenges for Dynamic Thread Creation/TerminationOur ApproachThe CMAP FrameworkConclusion and Future Work*Y.#Our Approach (1)rProblems for checking NI of static threadsChanging environmentMultiple instantiationsModularity issuesCMAP:  lazy checking At each step, all live (dynamic) threads do not interfered+?:+?$Our Approach (2) Our Approach (3)6Borrow ideas from typechecking data heaps (as in TAL):77 + Our Approach (4)Thread Termination: exitA,!Our Approach (5)Thread Creation: fork f(a) A2'Our Approach (6) 3(Our Approach (7)Queue Extension=2Our Approach (8) Queue Update?3Our Approach (9) 4)Our Approach (10)Check static threads Lazy CheckChanging Env. Changing (A, G)Multiple instantiation Not careModularity Certify only onceGeneral EnoughLanguage (higher-level/assembly)Thread Model (preemptive/non-preemptive)"dJ J+B5FExample  Unbounded Thread Creation C6FExample  Unbounded Thread CreationGSpecification of Child:Ax: Gx: Non-interference between children:R0)"(D7FExample  Unbounded Thread CreationHow to specify the main thread?E8  YEOutline of This TalkBackground: the Rely-Guarantee MethodChallenges for Dynamic Thread Creation/TerminationOur ApproachThe CMAP FrameworkConclusion and Future Work*f[GThe CMAP FrameworkThe abstract machineThe verification logicSpecification languageInference rulesSoundness proofExample programsUnbounded dynamic thread creationReaders/Writers problemLock-free programAll implemented in Coq!t,P7PPLPP,7L@4The CMAP Framework - Machine( ]HThe CMAP FrameworkThe paper on CMAP (Feng&Shao ICFP 05):http://flint.cs.yale.edu/publications/cmap.html\(0G)G, (6+ ConclusionjProblems for unbounded dynamic thread creationChanging environment (fork/exit)Multiple instantiation of thread codeNo previously known modular verification methodOur approachINV: active threads in the system do not interfereCombine the type-based proof technique with R-G methodUnify thread s assumption/guarantee with env. s guarantee/assumptionThread modularity + code/proof reuseThe CMAP framework and its Coq implementation/ZwZZ3Z|Z%Z.ZZ/w3|%  .    "FiM> Future WorkCertified Thread Librariesfork, yield, exitjoin, lock, monitorsSurface languageHigher-level specificationsPartially infer A and GCertifying compilation to CMAP'S,K= Assembly Code VerificationWhy assembly code?Higher assurance (remove compiler from TCB)Critical components of OS kernel, embedded sys.Proof-Carrying Code (machine code + safety proof)Verification of general propertiesType Safety (no stuck)Resource Consumption& Partial/Total CorrectnessT#H#HAssembly Code VerificationHarder than higher-level program verificationLack of abstractionsLack of structures (while, if& then& else, cobegin/coend)Many PCC frameworks Most of them only support sequential programsNone of them support dynamic thread creation.M[.)CG.-Concurrency VerificationMultiple Control Flow (threads)interleaved executioninterference on shared resource Cannot check all possible interleavingThe number of possible traces is exponential in the number of threadsExisting WorkMost of them are at higher-levelcobegin/coend Z7Z'ZFZZ/Z 7'F!  A  %Concurrent Assembly Code VerificationCCAP [Yu and Shao, ICFP 04]The first PCC framework supporting concurrent assembly codeRely-Guarantee Method (Jones, 1983)The best-studied concurrency verification method for shared memory modelOnly support static threadsP1 || & || Pn`I`I     ,>1 Related WorkRely-Guarantee MethodModel CheckingPre-fixed upper bound of number of threads (SPIN, Java Pathfinder,& )Not compositional (3VMC, SPIN, Java Pathfinder,& )No dynamic thread creation (CIRC& )Type Systems [Flanagan et al.]race-free, safe-lock, atomicity%ZZZ Z%, 5* Related WorkRSeparation Logic [O Hearn 04, Bornat et al. 05]Not as general as R-GNo dynamic thread creationDepends on the language constructs: conditional critical sections (ccs)J0yy4SAMotivation - Previous workBPCC systemsMostly for sequential codeCCAP [Yu&Shao, ICFP04]Only static threads: P1 || & || PnShared memory concurrency verificationRely-Guarantee methodOnly for properly-nested code: cobegin/coendModel CheckingNo explicit formal proofVarious limitations, e.g. non-compositional Z2Z$Z'ZZ.ZZEZZ     '  .E  4-*/AIQTU\ B  0` 33PP` 3333` ___MMM` 13` 333fpKNāvI` j@v۩ῑ΂H` Q_{>?" dd@,?n<d@ `7 `2@`7``2 n?" dd@   @@``PR    @ ` ` p>> | t   (     <O"H"0C   TRd"H"0C   <U"U_H"0C   TZd">&H"0C   N<^"PH"0C   <`"pH"0C   C x,f?d?"bUvH"0C   6(i "U LUSQdkYkHrh7h_    0k "  8USQdkYkHre,g7h_,{N~,{ N~,{V~,{N~   6+B#style.visibility<*\%(D' =-o6Bdissolve*<3<*\+8+0+\0 + 0 `(  `r ` S  U  r ` S       ` 0  ,$D0ZConcurrent assembly code verificationNo directly applicable logicTraditional Hoare-logic: only sequential codeType Systems: no Concurrent Typed Assembly Language (TAL)~&0n<Z0n7Zh0n2Z&CChCH ` 0޽h ? 3333___PPT10+EjDO' =@B D ' =@BA?%,( < +O%,( < +DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*`%(+8+0+`0 +m 0 d$(  dr d S ç U  r d S ç    H d 0޽h ? 3333y___PPT10Y+D=' =@B + 0 0|T(  |~ | s *ϧ U   | s *`   $\H | 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B + 0 H<(  H~ H s * U  ~ H s *    H H 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B + 0 P<(  P~ P s *$ U  ~ P s *    H P 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B +0 0 &47(  4r 4 S p͵ U  b 4 6?"0@NNN?N  4@ 0?"6@`NNN?N` j 4 0?"6@`NNN?NpP pFThread 1" 0(2 C 4 04?"6@`NNN?NZP ZFThread 2" 0(2 C 4 6p?"6@`NNN?NpPj,$D0(A1,G1)0(2gogog  4 6$?"6@`NNN?NZPT,$D0(A2,G2)0(2gogog 4 6+?"6@`NNN?N p0KShared Memory"0(2C 4@ 0?"6@`NNN?N` JF l `L @  &4L `@ ,$D0 4 61?"6@`NNN?N L {L H"0(2C  4 64?"6@`NNN?NP L L H"0(2C  4 68?"6@`NNN?NL L H"0(2C  4 6x;?"6@`NNN?NL L H"0(2C  4B 0?"6@`NNN?N``  4 0>?"6@`NNN?N l @ ^S1@0(2CKC 4 0(C?"6@`NNN?N l 0 @ ^S2@0(2CKC 4 0hH?"6@`NNN?N l @ ^S3@0(2CKC 4 0M?"6@`NNN?N0l P@ ^S4@0(2CKC 4 0R?"6@`NNN?Nl @ ^S5@0(2CKC  4 0  P @,$D0\ZA1: S2  S3, S4  S5,& G1: S1  S2, S3  S4,& . n<GOGOGOGOGOGOGOGOGOGOG !4 0  0 @,$D0\ZA2: S1  S2, S3  S4,& G2: S2  S3, S4  S5,& . n<GOGOGOGOGOGOGOGOGOGOGz Ppp "4 Pp@,$D0 #4 0<?"6@`NNN?NppLG1 A2G2 A10(20822gogogogo $4 HG?"6@`NNN?NPp@J$0G  H 4 0޽h ? 3333___PPT10`+'.Dd' =@B D' =@BA?%,( < +O%,( < +D' =%(D' =%(D3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<*&4%(D' =-o6Bdissolve*<3<*&4D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*4%(D' =-o6Bdissolve*<3<*4D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<* 4%(D' =-o6Bdissolve*<3<* 4D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<* 4%(D' =-o6Bdissolve*<3<* 4D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*!4%(D' =-o6Bdissolve*<3<*!4D' =%(D' =%(D3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<*"4%(D' =-o6Bdissolve*<3<*"4++0+40 ++0+ 40 ++0+ 40 ++0+!40 + 0 TT(  T~ T s *hF U   T s *L   $\H T 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B + 0L0 \~(  \~ \ s * U   \ 0dp` 1Thread1:while(a<>b){ if(a > b) a := a-b;}j20 2CGCGC \ 0mp` 1Thread2:while(a<>b){ if(b > a) b := b-a;}j20 2CGCGC  \ ^Atxp_fig v   f SOURCEJ\documentclass{slides}\pagestyle{empty} \usepackage{latexsym} \usepackage{amssymb} \usepackage{latexsym} \usepackage{amssymb} \usepackage{amsmath} \usepackage[dvips]{color} \usepackage{../../share/proof} \let\cmttdfl\ttdefault \let\cmsfdfl\sfdefault \input bnf \input ../../share/infrule %% generic axiom & inference rule stuff \input ../../share/fontname %% New Font Names \input local \begin{document} $$ \begin{array}{l@{\equiv}l} A_1 & (\var{a}=\var{a}') \land (\var{a}\ge\var{b} \Rightarrow \var{b}=\var{b}') \land (\GCD(\var{a}, \var{b}) = \GCD(\var{a}', \var{b}'))\\ G_1 & (\var{b}=\var{b}') \land (\var{a}\le\var{b} \Rightarrow \var{a}=\var{a}') \land (\GCD(\var{a}, \var{b}) = \GCD(\var{a}', \var{b}'))\\ A_2 & G_1 \HGAP G_2 \equiv A_1 \end{array} $$ \end{document} 6EXTERNALNAMEtxp_fig$ BLEND False0TRANSPARENT False,KEEPFILES False.DEBUGPAUSE False*RESOLUTION600*TIMEOUT (none)&BOXWIDTH348(BOXHEIGHT200"BOXFONT10(BOXWRAP FalseL2WORKAROUNDTRANSPARENCYBUG FalseD*ALLOWFONTSUBSTITUTION False6BITMAPFORMATpngmono0ORIGWIDTH547.8758PICTUREFILESIZE 24465H \ 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B + 0 h<(  h~ h s *ā U  ~ h s *E    H h 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B + 0 pdT(  d~ d s *t U   d s *<   $\H d 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B +Z 0 XPt(  tr t S l U   t  `??@ X f(a)...2 0CC t C ^0e0e BCpDE(F@ jJ8c8c    ?1d0u0@Ty2 NP'p<'p@A)BCD|E? 8Xdp @   P x@ t C ^0e0e BCpDE(F@ jJ8c8c    ?1d0u0@Ty2 NP'p<'p@A)BCD|E? 8Xdp @   P @ t C ^0e0e BCpDE(F@ jJ8c8c    ?1d0u0@Ty2 NP'p<'p@A)BCD|E? 8Xdp @   P x@B  t@  `D?? B  t@  `D??P B  t  `D?? P  t T( ??\ 0 j fork f(a1)D 0 2CKC t Tt ??0   j fork f(a2)D 0 2CKC t T ??  j fork f(an)D 0 2CKC t T ??@ 0 @& "0 2C  t Tp ??0P,$D0b  Static Threads &0 2G t T ??p   ,$D0d" Dynamic Threads &0 2GH t 0޽h ? 3333___PPT10+c=D' =@B D' =@BA?%,( < +O%,( < +D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*t%(D' =-o6Bdissolve*<3<*tD' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*t%(D' =-o6Bdissolve*<3<*t+p+0+t0 ++0+t0 +@ 0  $(  $r $ S  U   $ S x   <$0  I $ 0 7 p,$D0!Too rigid to handle changing env.@" LP!GGH $ 0޽h ? 3333___PPT10.+Pڬ'DO' =@B D ' =@BA?%,( < +O%,( < +DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*$%(+8+0+$0 + 0L0 d \  (  ~  s * U    s *p  ~<$0 $\^B  6DjJ  P.z 0P  0P,$D 0fB  6DjJ00P`B  0D0fB  6DjJ `B  B 0D0    0`= bT1D0 2CKC  0 bT2D0 2CKC  0 @0?A"0 2C  0@@0: ?B"0 2Cz @  @,$D0  0$ bT3D0 2CKC  0@p 0j ?C"0 2C  0L @ 0?D"0 2C^B  6DjJP00   f jJ?? 8  T ??,$D0Use pc to mark stages?N0 2GGGH  0޽h ? 3f3f̙3f3f ___PPT10 .+D '  =@B DE ' =@BA?%,( < +O%,( < +D' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =+4 8?\CB#ppt_xBCB#ppt_xB*Y3>Bppt_x<*D#' =+4 8?nCB!#ppt_y-#ppt_h/2BCB#ppt_yB*Y3>Bppt_y<*D' =+4 8?\CB#ppt_wBCB#ppt_wB*Y3>Bppt_w<*D' =+4 8?RCBBCB#ppt_hB*Y3>Bppt_h<*D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =-o6Bdissolve*<3<*+8+0+0 +m" 0 0(  ~  s *H U    0@p %Umain: int i:=0; while (i<100){ data[i]:=f(i); fork child(i); i++; }V0 2CCCCCCCCK  0(p@PGlobal data: int data[100]B0 2CCC ^B  6DjJP.z 0P  P,$0fB  6DjJ00P`B   0D0fB   6DjJ `B  B 0D0    01a bT1D0 2CKC  0|6` bT2D0 2CKC  0;?A"0 2C  0?@: ?B"0 2Cz @  p,$D0  0C bT3D0 2CKC  0DI@p 0j ?C"0 2C  0F@ 0?D"0 2C  S BCDEF1xHxL@  P ,$D 0tz     ,$D 0fB  6DjJ   0|Q`  D& &0 2G`B  0D`B  0D  ^B  6DjJP   f jJ??@  <?"  ^0H  0޽h ? 3f3f̙3f3f___PPT10++:D' =@B Dm' =@BA?%,( < +O%,( < +DT' =%(%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =+4 8?\CB#ppt_xBCB#ppt_xB*Y3>Bppt_x<*D#' =+4 8?nCB!#ppt_y+#ppt_h/2BCB#ppt_yB*Y3>Bppt_y<*D' =+4 8?\CB#ppt_wBCB#ppt_wB*Y3>Bppt_w<*D' =+4 8?RCBBCB#ppt_hB*Y3>Bppt_h<*D' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D#' =+4 8?nCB!#ppt_x-#ppt_w/2BCB#ppt_xB*Y3>Bppt_x<*D' =+4 8?\CB#ppt_yBCB#ppt_yB*Y3>Bppt_y<*D' =+4 8?RCBBCB#ppt_wB*Y3>Bppt_w<*D' =+4 8?\CB#ppt_hBCB#ppt_hB*Y3>Bppt_h<*+7 0 ^V@(  ~  s * ] U  ~  s *]    ^B  6DjJ00  0_ bT1D0 2CKCXB  0Dp0p^B  6DjJpP XB @ 0DP 0P XB  0D@ 00@ ^B  6DjJ@ 00 XB  @ 0D 00   0fP bT2D0 2CKC  0+B#style.visibility<*%(D' =-o6Bdissolve*<3<*+8+0+0 + 0   ` (  r  S  U  G   `<¢?? T1:...jmp fj0AIIAAA    `ˢ?? @`ef:...exit<0AAAG   `Т??@ T2:...jmp fj0AIIAAA B   `D?? p B @  `D?? @   Tڢ ??@(A1, G1)\ 0 2AIAIA  Tߢ ??@ (A2, G2)\ 0 2AIAIA  T ?? @0 ,$D0_Certify once,use everywhere?&0 2G2  B{ ?"(8,$D02  By ?":n~ J,$D0  6?"  [0H  0޽h ? 3333___PPT10r+(2D' =@B D' =@BA?%,( < +O%,( < +D' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =-o6Bdissolve*<3<* +8+0+ 0 + 0 p<(  ~  s * U  ~  s *    H  0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B +m 0 |$(  |r | S X  U  r | S 0!    H | 0޽h ? 3333y___PPT10Y+D=' =@B +5  0 "o(  r  S ( U  2   `??p`  C ^0e0e BCpDE(F@ jJ8c8c    ?1d0u0@Ty2 NP'p<'p@A)BCD|E? 8Xdp @   p  TL- ?? B& "0 2C  C ^0e0e BCpDE(F@ jJ8c8c    ?1d0u0@Ty2 NP'p<'p@A)BCD|E? 8Xdp @      T1 ??0 *bt0D0 2CKC  TL0 ??0*|tnD0 2CKC  T; ?? pCQ&0 2G"l p  !p ,$D02   `??`   T@ ??` G (A0, G0)` 0 2AIAIAA  TG ?? B& "0 2C2  TK ??` ` 0G (An, Gn)` 0 2AIAIAA  TS ?? 0 pP ZQ<0 2G!  T$ ??p,$D0i'How to track the changing thread queue?&(0 2(G+l @  "@ ,$D0n  s *A ??0 p    T ?? p~WF(Q, Q):P 0 2GGr   ` ??p P  Tt ?? @ ` each ti satisfies (Ai, Gi) 0 2CCKCKCKC,H  0޽h ? 3333___PPT10+̧7Dv' =@B D1' =@BA?%,( < +O%,( < +D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*!%(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*"%(D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =-o6Bdissolve*<3<*+8+0+0 +9 0  0@ (  0r 0 S X̛ U    0 Tś ?? ,$0RQ'40 2C   0 T4 ?? ,$0TQ'40 2Cl P @ 0 P @,$D 0  0 ZT ??  @R$40 2CB 0  fD??PP Pl   0 ,$D 0B  0 # lD??6 6  0 Z  ?? DWF&0 2Gl p 0p,$D0 0 T ??` ?Q"0 2C 0 T ??p  DWF&0 2G  0 Tp ??` BQ$0 2B 0 # lD??  l P@ `  0@P ` ,$D 0B 0  `D??P` `  0 Z` ?? @` Ri40 2C 0 T ??,$0^FInitial condition: $Q0 . WF(Q0, Q0)$0 2CGOGG 0 H+ ?" P ,$ 0&ji ::= add | sub | jd f |& | exit | fork | yieldt60 2$" 0 <6     l - I  0- I,$D 02 0 H 1?"6@`NNN?N- I2 0 H 1?"6@`NNN?N  H 0 0޽h ? 3333%%___PPT10$+U\ÝD#' E=@B D#' =@BA?%,( < +O%,( < +DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*0%(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*0%(D@ ' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*0%(D#' =+4 8?nCB!#ppt_x-#ppt_w/2BCB#ppt_xB*Y3>Bppt_x<*0D' =+4 8?\CB#ppt_yBCB#ppt_yB*Y3>Bppt_y<*0D' =+4 8?RCBBCB#ppt_wB*Y3>Bppt_w<*0D' =+4 8?\CB#ppt_hBCB#ppt_hB*Y3>Bppt_h<*0D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*0%(D' =-o6Bdissolve*<3<*0D@ ' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*0%(D#' =+4 8?nCB!#ppt_x-#ppt_w/2BCB#ppt_xB*Y3>Bppt_x<*0D' =+4 8?\CB#ppt_yBCB#ppt_yB*Y3>Bppt_y<*0D' =+4 8?RCBBCB#ppt_wB*Y3>Bppt_w<*0D' =+4 8?\CB#ppt_hBCB#ppt_hB*Y3>Bppt_h<*0D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<* 0%(D' =-o6Bdissolve*<3<* 0D' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*0%(D' =+4 8?\CB#ppt_xBCB#ppt_xB*Y3>Bppt_x<*0D#' =+4 8?nCB!#ppt_y-#ppt_h/2BCB#ppt_yB*Y3>Bppt_y<*0D' =+4 8?\CB#ppt_wBCB#ppt_wB*Y3>Bppt_w<*0D' =+4 8?RCBBCB#ppt_hB*Y3>Bppt_h<*0D' =%(D' =%(D3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<* 0%(D' =-o6Bdissolve*<3<* 0DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*0%(++0+00 ++0+ 00 ++0+00 ++0+00 +' 0 f^(  r  S V U  r  S W    2  # l\Y???Q"0C  T] ??0Ct&0 2G2   f ??P 2  # lla??@ 0 RQ40C  Ttf ??@ P: G(A,G)&0 2G2   f ?? P l `  0   ` 0 ,$D02  # lj??@ 0 Q\{(Ai, Gi)}0C$K  Tr ??` @ : (Ai,Gi)z0 2GOGOG2   f ??`     T@z ??@p 0j BQ$0 2B   `D??0    T~ ??`   DWF&0 2Gl  0 `  0 ` ,$D 0B   `D?? 0    T| ??P` ` EWF!&0 2Gl  P p P p,$D 0B   `D?? @` @  T$ ?? P pBexit"0 2Cl ` 0  ` 0 ,$D0,2   # l<??Q\{ti}D0CKC   T ?? ntiP0 2GOG2    f ??`    T ??@0AQ$0 2H  0޽h ? 3333 ___PPT10+hD' =@B D' =@BA?%,( < +O%,( < +D' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D#' =+4 8?nCB!#ppt_x-#ppt_w/2BCB#ppt_xB*Y3>Bppt_x<*D' =+4 8?\CB#ppt_yBCB#ppt_yB*Y3>Bppt_y<*D' =+4 8?RCBBCB#ppt_wB*Y3>Bppt_w<*D' =+4 8?\CB#ppt_hBCB#ppt_hB*Y3>Bppt_h<*D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =+4 8?\CB#ppt_xBCB#ppt_xB*Y3>Bppt_x<*D#' =+4 8?nCB!#ppt_y-#ppt_h/2BCB#ppt_yB*Y3>Bppt_y<*D' =+4 8?\CB#ppt_wBCB#ppt_wB*Y3>Bppt_w<*D' =+4 8?RCBBCB#ppt_hB*Y3>Bppt_h<*+ 0 %(  x  c $ U  x  c $    2  # l0???Q"0C  T ??0Ct&0 2G2   f ??P   T ??@ P: G(A,G)&0 2G2   f ?? P 2  C x( 1??pH"0C   Tl ?? Ct&0 2G2   f ??`  2  # l|?? `  ??"0CB   `D??0    Tp ??` P DWF&0 2GB   `D??0     T~ ??` P` DWF&0 2GB   `D??@ ` @  T4 ??P 0 pBfork"0 2CW  Tܨ ??t$D0@8___PPT9 WG t' does not interfere with Q t does not interfere with the new env.H1 2GGGGGGG%G"B8X2  # l??p 0 BQ$02  # lx??w?Q"0C  0p ?"`Ht (0 2gH  0޽h ? 3333___PPT10+DO' =@B D ' =@BA?%,( < +O%,( < +DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(+8+0+0 +hL 0 n"f"'/!(  r  S Y U    T ??0Ct&0 2G2   f ??P   T覛 ??@ P: G(A,G)&0 2G2   f ?? P %l `   *`  ,$D042   # lp??p Q{t }h0CCGC   T ?? Ct&0 2G2    f ??`  B   `D??0  l  P` p )P ` p,$D 0B   `D?? @` @  T0[ ?? P0 pBfork"0 2C  T$ ??@vHG i Ai i Gi A%0 2C  Rz p   p ,$D0  N)??pZ@<0 2G  N-?? p Z@<0 2Gl 0    + 0  ,$D02  # l2??`   =? 0C,@ 0    0   2  3 r7??`   H"0C   Z; ??0 f 0` P(A ,G )&0 2G2  # l>??@ 0 lQ{A  ,G  }: 0 z  Tdu ??@,$0LG' (i Ai)A'' (i Gi)G'' A'8'0 2C   C  Tx ??` P DWF&0 2Gl  0 `  ,0 ` ,$D 0B   `D?? 0     TV ??P` ` EWF?&0 2G2 ! # lv???Q"0C2 " # l]??p 0 BQ$0X # Tc ?? @,$0PG'' i Ai i Gi A'')0 2CC   % BF?" @,$D 0CG&0 2G & Ba?",$D 0CG&0 2G ' B?" @,$D 0EA(0(2G ( B#?"zS p ,$D 0EA(0(2GVz p  - v,$D0 . N`??p`(0 2 / NH?? p X(0 2 H  0޽h ? 3333))___PPT10z)+|@D(' =@B D'' =@BA?%,( < +O%,( < +D' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*)%(D#' =+4 8?nCB!#ppt_x-#ppt_w/2BCB#ppt_xB*Y3>Bppt_x<*)D' =+4 8?\CB#ppt_yBCB#ppt_yB*Y3>Bppt_y<*)D' =+4 8?RCBBCB#ppt_wB*Y3>Bppt_w<*)D' =+4 8?\CB#ppt_hBCB#ppt_hB*Y3>Bppt_h<*)D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<**%(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*+%(D' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*,%(D' =+4 8?\CB#ppt_xBCB#ppt_xB*Y3>Bppt_x<*,D#' =+4 8?nCB!#ppt_y-#ppt_h/2BCB#ppt_yB*Y3>Bppt_y<*,D' =+4 8?\CB#ppt_wBCB#ppt_wB*Y3>Bppt_w<*,D' =+4 8?RCBBCB#ppt_hB*Y3>Bppt_h<*,DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*#%(DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =%(D' =%(D3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =-o6Bdissolve*<3<*D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%%(D' =-o6Bdissolve*<3<*%D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*&%(D' =-o6Bdissolve*<3<*&D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*'%(D' =-o6Bdissolve*<3<*'D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*(%(D' =-o6Bdissolve*<3<*(D' =%(D' =%(D3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<*-%(D' =-o6Bdissolve*<3<*-+P+0+0 ++0+#0 ++0+%0 ++0+&0 ++0+'0 ++0+(0 + 0  [(  r  S 7 U  r  S 7      T E* ?? 0K WF(Q{t}, Q{(A, G)}) WF(Q{t',t}, Q{(A  , G  ), (AG  , GA  )}) vG0 2CC CC fCCGCCB   `D?? 00   T ^ ??` Y fork f(a)4 0 2 C  04} ?" ``  A A  , G  Gf0 2G GH  0޽h ? 3333y___PPT10Y+D=' =@B + 0 R(  x  c $ U  x  c $    d  T ?? 0K bWF(Q{t}, Q{(A, G)}) WF(Q{t}, Q{(A , G )}) b20 2CC CC fCCCCB   `D?? 00   HD ?"& 0 .AA , G G; t: (A , G )N0 2G H  0޽h ? 3333y___PPT10Y+D=' =@B + 0    6 (  x  c $L U  G   `?? T1:...jmp fj0AIIAAA    `?? @`ef:...exit<0AAAG   `Ʀ??@ T2:...jmp fj0AIIAAA B   `D?? p B @  `D?? @   TϦ ??@(A1, G1)\ 0 2AIAIA  T@֦ ??@ (A2, G2)\ 0 2AIAIA  Tܦ ??0,$0_Certify once,use everywhere?&0 2G  Th ?? p ,$D0F(A, G)$0 2E  H ?"  ,$D0AiA, GGiz 0 2GOCH  0޽h ? 3333___PPT10+kZD' =@B D' =@BA?%,( < +O%,( < +D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =-o6Bdissolve*<3<* D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =-o6Bdissolve*<3<* +p+0+ 0 ++0+ 0 + 0  :(  r  S H U  r  S        H??":P 0  N??"u :  00  N??">< 0H  0޽h ? 3333y___PPT10Y+D=' =@B + 0  {(  ~  s * U    0Y@p %Umain: int i:=0; while (i<100){ data[i]:=f(i); fork child(i); i++; }V0 2CCCCCCCCK.  0p`  .void child(x:int){ data[x] = g(x, data[x])}b/0 2CCCCC   0hp@PGlobal data: int data[100]B0 2CCC H  0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B +; 0 bZ0(  ~  s *6@ (  ~  s *Е U  ~  s *      0L "Rmain: int i:=0; while (i<100){ data[i]:=0; fork(child, i); i++ }S0 2CCCCCCCCH  0` `kDo we need a G such that:60 2CG  ^Atxp_fig  zr SOURCE\documentclass{slides}\pagestyle{empty} \usepackage{latexsym} \usepackage{amssymb} \usepackage{latexsym} \usepackage{amssymb} \usepackage{amsmath} \usepackage[dvips]{color} \usepackage{../../share/proof} \let\cmttdfl\ttdefault \let\cmsfdfl\sfdefault \input bnf \input ../../share/infrule %% generic axiom & inference rule stuff \input ../../share/fontname %% New Font Names \input local \begin{document} $G \Rightarrow (A_{0} \land \ldots \land A_{99})$ \end{document} 6EXTERNALNAMEtxp_fig$ BLEND False0TRANSPARENT False,KEEPFILES False.DEBUGPAUSE False*RESOLUTION600*TIMEOUT (none)&BOXWIDTH348(BOXHEIGHT200"BOXFONT10(BOXWRAP FalseL2WORKAROUNDTRANSPARENCYBUG FalseD*ALLOWFONTSUBSTITUTION False6BITMAPFORMATpngmono(ORIGWIDTH2016PICTUREFILESIZE3986  H ?"P V ,$D0c!But main cannot satisfy such a G!&"0 2"GH  0޽h ? 3f3f̙3f3f___PPT10+.ΰDO' =@B D ' =@BA?%,( < +O%,( < +DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(+8+0+0 +|( 0 P~(    0農 "Rmain: int i:=0; while (i<100){ data[i]:=0; fork(child, i); i++ }S0 2CCCCCCCCHl    ,$D0  Bɲ` R(A , G )& 0 2 GfB B 6D> ` l    ,$D0  BͲ` H(A, G)&0 2GfB B 6D> @` @l  J `0  J `0 ,$D0  HҲ` J `0 H(A, G)&0 2GlB  B <D> `     ^A txp_fig9@   SOURCE|\documentclass{slides}\pagestyle{empty} \usepackage{latexsym} \usepackage{amssymb} \usepackage{latexsym} \usepackage{amssymb} \usepackage{amsmath} \usepackage[dvips]{color} \usepackage{../../share/proof} \let\cmttdfl\ttdefault \let\cmsfdfl\sfdefault \input bnf \input ../../share/infrule %% generic axiom & inference rule stuff \input ../../share/fontname %% New Font Names \input local \begin{document} $$ \begin{array}{l} A \equiv \forall k. \var{i} \le k < 100\Rightarrow \var{data}[k] = \var{data}'[k] \\ G \equiv \forall k. 0\le k < \var{i}\Rightarrow \var{data}[k] = \var{data}'[k] \\ \\ A' \equiv \forall k. \var{i+1} \le k < 100 \Rightarrow\var{data}[k] = \var{data}'[k] \\ G' \equiv \forall k. 0\le k < \var{i+1} \Rightarrow \var{data}[k] = \var{data}'[k] \\ \end{array} $$ \end{document} 6EXTERNALNAMEtxp_fig$ BLEND False0TRANSPARENT False,KEEPFILES False.DEBUGPAUSE False*RESOLUTION600*TIMEOUT (none)&BOXWIDTH348(BOXHEIGHT200"BOXFONT10(BOXWRAP FalseL2WORKAROUNDTRANSPARENCYBUG FalseD*ALLOWFONTSUBSTITUTION False6BITMAPFORMATpngmono(ORIGWIDTH4368PICTUREFILESIZE 30026l  `   ` ,$D0  B` ` ,$D0H(A, G)&0 2GfB B 6D> b ` b z  `    ` ,$D0  Bd` ` ,$D0H(A, G)&0 2GfB B 6D> b ` b H  0޽h ? 3f3f̙3f3f*"___PPT10+J*tD' =@B D' =@BA?%,( < +O%,( < +DX' =%(D' =%(D' =4@BBBB%(E' =1B B`BPB1:Bhidden*3>+B#style.visibility=`B<*D' =1:Bvisible*o3>+B#style.visibility<*%(DX' =%(D' =%(D' =4@BBBB%(E' =1B B`BPB1:Bhidden*3>+B#style.visibility=`B<*D' =1:Bvisible*o3>+B#style.visibility<*%(DX' =%(D' =%(D' =4@BBBB%(E' =1B B`BPB1:Bhidden*3>+B#style.visibility=`B<*D' =1:Bvisible*o3>+B#style.visibility<*%(DX' =%(D' =%(D' =4@BBBB%(E' =1B B`BPB1:Bhidden*3>+B#style.visibility=`B<*D' =1:Bvisible*o3>+B#style.visibility<*%(DX' =%(D' =%(D' =4@BBBB%(E' =1B B`BPB1:Bhidden*3>+B#style.visibility=`B<*D' =1:Bvisible*o3>+B#style.visibility<*%(+ 0 h<(  h~ h s * R U  ~ h s *|S    H h 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B +}  0 p$(  pr p S , U  r p S     H p 0޽h ? 3333___PPT10i.20X+D=' =@B +G 0 55`CJ]5(  ~  s *0 U  l @  C@ ,$D0  <8?"6@`NNN?N0F 0C    B8?"0@NNN?NmVI180ck   0o?"0@NNN?N0kf1:L0(2ckc  Bs?"0@NNN?N&mVI280ck   0x?"0@NNN?N0kf2:L0(2ckc   0(}?"0@NNN?N ]D& &0(2c   0Hz?"0@NNN?N@ c(code heap) C:0(2 cg  0?"6@`NNN?N`sl 0 J0,$D0   0h?"0@NNN?N 0a (program) P: 0(2 cg ! 0?"0@NNN?N 0N::=(C,T,S,Q,I)$0(2Cl @* E@*,$D0   6̎?"6@`NNN?N C0&0(2c  6?"6@`NNN?N` ` Xr1:0(2ck  0?"6@`NNN?N   6ܗ?"6@`NNN?N  C1&0(2c  0?"6@`NNN?N    6?"6@`NNN?N  C2&0(2c  0?"6@`NNN?N    6 ?"6@`NNN?N D& &0(2c  6?"6@`NNN?N @  6$?"6@`NNN?N ` ` Xr2:0(2ck  6Ш?"6@`NNN?N ` ` Xr3:0(2ck  6|?"6@`NNN?N ` ` X& :0(2ck  6p?"6@`NNN?N ` @` Xrn:0(2ck  0Ե?"0@NNN?Nppjc(data heap) H:0(2 cg  0?"0@NNN?N p g(register file) R:0(2cg  0?"6@`NNN?N@   0Ⱦ?"0@NNN?N@0 0 *_ (state) S: 0(2cg " 0T?"0@NNN?N 0 *H::=(H,R)$ 0(2 Cl @  D @,$D0 $ <P?"6@`NNN?N0  F 0C   % BD?"0@NNN?N m VI180ck  & 0?"0@NNN?N0  kh1:L0(2ckc ' BD?"0@NNN?N, m VI280ck  ( 0?"0@NNN?N0  kh2:L0(2ckc ) 0?"0@NNN?N  D& &0(2c( * 0?"0@NNN?N@ (thrd entries) T:0(2cg l @ F@,$D0~  BP?"0@NNN?N@ .add& fork hyieldexit0ckck ck  0p?"0@NNN?N e(instr. seq.) I:0(2cg - T?"t l ` G`,$D0 . B?"r@ @ 4 0 B?"@ 2 B?"P0AI$0c 3 B?"pAR$0cN @ 5 ` 6 B?"@ 7 B?"P0AI$0c 8 BT?"pAR$0cN @ 9 P : B?"@ ; B?"P0AI$0c < BX?"pAR$0c = 08a ?"`P B& $0 2c& > 0Pb?"0@NNN?N`(dyn. queue) Q:0(2cg ll `  H` ,$D 0tB ? 6D?"` tB @ 6D?"@p` ll P`@ I`P@,$D 0tB A 6D?"P`@tB B 6D?"`@H  0޽h ? ̙33___PPT10m.v࣫+?`lDA' =@B D' =@BA?%,( < +O%,( < +D' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*H%(D' =+4 8?\CB#ppt_xBCB#ppt_xB*Y3>Bppt_x<*HD#' =+4 8?nCB!#ppt_y+#ppt_h/2BCB#ppt_yB*Y3>Bppt_y<*HD' =+4 8?\CB#ppt_wBCB#ppt_wB*Y3>Bppt_w<*HD' =+4 8?RCBBCB#ppt_hB*Y3>Bppt_h<*HD' =%(DH' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*I%(D' =+4 8?\CB#ppt_xBCB#ppt_xB*Y3>Bppt_x<*ID#' =+4 8?nCB!#ppt_y+#ppt_h/2BCB#ppt_yB*Y3>Bppt_y<*ID' =+4 8?\CB#ppt_wBCB#ppt_wB*Y3>Bppt_w<*ID' =+4 8?RCBBCB#ppt_hB*Y3>Bppt_h<*ID' =%(D' =%(D3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<*J%(D' =-o6Bdissolve*<3<*J+} 0  x$(  xr x S n U  r x S n    H x 0޽h ? 3333___PPT10i.8PE+D=' =@B +m 0 $(  r  S z U  r  S x{    H  0޽h ? 3333y___PPT10Y+D=' =@B + 0 0\(  0r 0 S  U  r 0 S     0 0 <X ?#" `} <],$0|6Where is the threads ?User-level thread + thread lib.*7 n7GH 0 0޽h ? 3333zr___PPT10R+oD' =@B D' =@BA?%,( < +O%,( < +D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*0%(D' =-o6Bdissolve*<3<*0+8+0+00 +7 0 ^V (      0  ?": H Thank you!" 0 2 c(H   0޽h ? 3333y___PPT10Y+D=' =@B + 0L0 @<<(  <~ < s * U  ~ < s * P  H < 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B + 0L0 Pl$(  lr l S  U  r l S     H l 0޽h ? 3333y___PPT10Y+D=' =@B + 0L0 `$(  r  S Ļ U  r  S     H  0޽h ? 3333y___PPT10Y+D=' =@B + 0L0 DT(  D~ D s *Tʞ U   D s *О   $\H D 0޽h ? 3f3f̙3f3fy___PPT10Y+D=' =@B + 0L0 p$(  r  S L U  r  S 8A    H  0޽h ? 3333y___PPT10Y+D=' =@B + 0L0 $(  r  S @ U  r  S     H  0޽h ? 3333y___PPT10Y+D=' =@B + 0L0 P$(  Pr P S T U  r P S ,    H P 0޽h ? 3333>0 (  ^  S RH     c $Ȟ L!  pTheir execution interleaves in a non-deterministic wayIf they have shared resource, they may have interferenceH  0jB ? ̙33>0  `(  `d `c $RH    `3 rgkgk L!  0GCD: Greatest common divisorH ` 0jB ? ̙33l40 0|(  d c $RH    3 r葥gkgk !   H  0jB ? 3380___PPT10.v0 f(  ^  S RH     c $H L!  \From each thread point of view, there are only two entities in the system: its environment and itselfThe thread environment is the collection of all threads in the system except the thread under concern.Rely and guarantee are interfaces for thread interaction:jH  0jB ? ̙33?0 PD8(  Dd Dc $RH    Ds *u L!  " H D 0jB ? ̙33A0 T%(  TX T C RH    T S  L!  'Limitations for model checkers: (1) pre-fixed upper-bound of the no. of threads (SPIN family); (2) not modular (not based on R-G method) (3VMC, SPIN family); (3) Unlimited threads, but no dynamic thread creation (CIRC)Other related work: type systems for specific propertiesH T 0jB ? ̙330 Xh(  XX X C RH    X S \ L!  jVModularity issues is solved in CMAP as a by-product for allowing the change of A and GH X 0jB ? ̙33/G0 t?(  tX t C RH    t S  L!  A-Machine: instructions + operational semanticsH t 0jB ? ̙3380___PPT10.3FqxMKTQy~O*"Y"2iFuLf!ҬPZA Ԣ\%AhaI"ʙιǼq7}qq9sνrwGAT SC@Wx*NWí j~n aHdBf_₾('3ec3׮T4Lb ѩ&ȤHjeO!ǚdkJ=}$oZRj/@l-BBx=Sa ^y&Ewq[^!_g?TrDPh[wY݁e  S@[xPEg,V ^#0^'`/kR\x2PA)u`G: RyZ=]}f^Ij;JIlK0Q+JOQoSpcqottѠ7[@v EFB?|^1S(8 L  Oh+'03 hp $0 P \ht|4Modular Verification of Concurrent Assembly Codexf28LC:\Program Files\Microsoft Office\Templates\Presentation Designs\Blends.pot Xinyu Feng191Microsoft PowerPoint@\YH@KW@` ;3 G(2;   9  y--$xx--'33--$,4 4 ,,--'-::--$ , 5 5 , ,--ff--$ , 55, ,----$,55,,----$,55,,----$,55,,----$,55,,---'--$4<<44--'---$3<<33--X--$3<<33--݌--$3<<33----$3<<33----$3<<33----$3<<33----$3<<33---'9A  2(ss]]GG22||ffPP;;ooYYxx*+,-./01"#$%&'() !  '--$ * = = * *--'---$89988-- --$89988--"""--$89988--$$$--$89 9 88--&&&--$ 8 9 9 8 8--)))--$ 8 9 9 8 8--+++--$ 8 9 9 8 8-------$ 8 998 8--000--$89988--222--$89988--444--$89988--666--$89988--888--$89988--:::--$89988--===--$89988--???--$89988--AAA--$89988--CCC--$89988--EEE--$89988--HHH--$89988--JJJ--$89988--LLL--$89988--NNN--$89988--QQQ--$89988--SSS--$89 9 88--UUU--$ 8 9!9!8 8--WWW--$!8!9"9"8!8--YYY--$"8"9#9#8"8--[[[--$#8#9$9$8#8--]]]--$$8$9%9%8$8--___--$%8%9&9&8%8--aaa--$&8&9'9'8&8--ddd--$'8'9(9(8'8--fff--$(8(9)9)8(8--hhh--$)8)9*9*8)8--jjj--$*8*9+9+8*8--lll--$+8+9,9,8+8--nnn--$,8,9-9-8,8--ppp--$-8-9.9.8-8--sss--$.8.9/9/8.8--uuu--$/8/90908/8--www--$0809191808--zzz--$1819292818--|||--$2829393828--~~~--$3839494838----$4849595848----$5859696858----$6869797868----$7879898878----$8889999888----$9899:9:898----$:8:9;9;8:8----$;8;9<9<8;8----$<8<9=9=8<8----$=8=9>9>8=8----$>8>9?9?8>8----$?8?9@9@8?8----$@8@9A9A8@8----$A8A9B9B8A8----$B8B9C9C8B8----$C8C9D9D8C8----$D8D9E9E8D8----$E8E9G9G8E8----$G8G9H9H8G8----$H8H9I9I8H8----$I8I9J9J8I8----$J8J9K9K8J8----$K8K9L9L8K8----$L8L9M9M8L8----$M8M9N9N8M8----$N8N9O9O8N8----$O8O9P9P8O8----$P8P9Q9Q8P8----$Q8Q9S9S8Q8----$S8S9T9T8S8----$T8T9V9V8T8----$V8V9W9W8V8----$W8W9Y9Y8W8----$Y8Y9Z9Z8Y8----$Z8Z9[9[8Z8----$[8[9]9]8[8----$]8]9^9^8]8----$^8^9`9`8^8----$`8`9a9a8`8----$a8a9c9c8a8----$c8c9d9d8c8----$d8d9f9f8d8----$f8f9h9h8f8----$h8h9j9j8h8----$j8j9l9l8j8----$l8l9n9n8l8----$n8n9p9p8n8----$p8p9r9r8p8----$r8r9t9t8r8----$t8t9w9w8t8----$w8w9y9y8w8----$y8y9{9{8y8----${8{998{8----$89988----$89988----$89988----$89988----$89988----$89988---'@"Helvetica-. 33O2 /0Modular Verification of Concurrent Assembly Code. "System:-@"Helvetica-. 33I2 7,with Dynamic Thread Creation and Termination.-@"Helvetica-. 2 JCXinyu.-@"Helvetica-. 2 JQFeng.-@"Helvetica-. 2 R?Yale University .-@"Helvetica-. 2 ]6Joint work with .-@"Helvetica-. 2 ]TZhong.-@"Helvetica-. 2 ]aShao.-՜.+,D՜.+,    On-screen Show Yale University) 5Arial HelveticaTahoma WingdingsTimes New Roman Courier NewComic Sans MSSymbol Wingdings 3BlendsMicrosoft ʽ 3.0^Modular Verification of Concurrent Assembly Code with Dynamic Thread Creation and Termination Motivation ChallengesPrevious workConcurrency ProgrammingOur ContributionsOutline of This TalkThe Rely-Guarantee MethodThe Rely-Guarantee MethodGCD Example [Yu&Shao04]Outline of This TalkConcurrency ProgrammingStatic and Dynamic Threads ChallengesChallenges: Changing Env. IChallenges: Changing Env. IChallenges: Changing Env. II$Challenges: multiple instantiationsChallenges: ModularityOutline of This TalkOur Approach (1)Our Approach (2)Our Approach (3)Our Approach (4)Our Approach (5)Our Approach (6)Our Approach (7)Our Approach (8)Our Approach (9)Our Approach (10)%Example C Unbounded Thread Creation%Example C Unbounded Thread Creation%Example C Unbounded Thread Creation Slide 34Outline of This TalkThe CMAP FrameworkThe CMAP Framework - MachineThe CMAP Framework Conclusion Future Work Slide 41  Fonts Used Design TemplateEmbedded OLE ServersSlide Titles)< 8@ _PID_HLINKSA*+285,20,Example  Unbounded Thread Creation303,23,Modularity297,33,The CMAP Approach297,33,The CMAP Approach297,33,The CMAP Approach304,22,Changing Environment297,33,The CMAP Approach304,22,Changing Environment297,33,The CMAP Approach"_} 0Xinyu FengXinyu Feng  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~     !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~     !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuRoot EntrydO)`D;3  Pictures}9Current User)>SummaryInformation(\3PowerPoint Document(DocumentSummaryInformation8 *Equation Equation.30 Microsoft lQ_ 3.0hT285,20,Example  Unbounded Thread Creation60"303,23,ModularityD[0297,33,The CMAP ApproachD\0297,33,The CMAP ApproachD^0297,33,The CMAP ApproachJ6304,22,Changing EnvironmentD0297,33,The CMAP Approach/ 0DArialngs 3SnTT0ܖ 0ܖD[SOalngs 3SnTT0ܖ 0ܖ DHelvetica3SnTT0ܖ 0ܖ "0DTahomaca3SnTT0ܖ 0ܖ"@DWingdings3SnTT0ܖ 0ܖPDTimes New RomanTT0ܖ 0ܖ`DCourier NewmanTT0ܖ 0ܖ1pDComic Sans MSnTT0ܖ 0ܖBDSymbolans MSnTT0ܖ 0ܖDWingdings 3SnTT0ܖ 0ܖ C(.n  @n?" dd@  @@`` 0e3. ! '!   #%"0 ! ) &K3#%, +45 :;<=>@ABCb$\nlv_$2$az]BL&9?_$b$&\JeR}Fn uab$[K#*8>ٓmb$BӔf$&b$| _Vdob$Xoy*Bgcu 0e0e    A@  A5% 8c8c    ?1 d0u0@Ty2 NP'p<'pA)BCD|E||s" 0e@        @ABC DEEFGHIJK5%LMNOPQRSTUWYZ[ \]^_ `abN E5%  N E5%  N F   5%   !"?N@ABC DEFFGHIJK5%LMNOPQRSTUWYZ[ \]^_ `ab0 @8 ʚ;_6ʚ;g4`d`d 0ppp@ <4dddd k 0T  <4!d!d l 0T<4BdBd l 0Tg4CdCd! 0Ppl p2DEFAULTFONTSIZE10.DEFAULTWIDTH3480DEFAULTHEIGHT200___PPT10D[SOrier NewЕЕTTԕ 0ԕDCourier NewЕЕTTԕ 0ԕ1pp ___PPT90[\^z?H%2005-9-16 NJPLS@StevensO =9O?]Modular Verification of Concurrent Assembly Code with Dynamic Thread Creation and Termination^^6Xinyu FengYale UniversityJoint work with Zhong Shao(7,,VB MotivationProof-carrying code (PCC)In principle: verify any property on any codeReal binaries & no loss of efficiencyEmbedded OS, device drivers& All safety & liveness properties& Formal, machine-checkable proofsIn reality: only works for sequential codev.+  YWC ChallengesChallenges for Proof-carrying concur. codeA general framework for concurrent assembly code verificationLack of structures (e.g. cobegin/coend blocks)Specification/proof generationSpec inference, proof assistant, theorem prover+>/0+> 0  XDPrevious workRely-Guarantee (R-G) MethodShared memory concurrencyThread modular verificationOnly for higher-level code: cobegin/coendCCAP[Yu&Shao, ICFP 04]The first PCC framework supporting concurrent assembly codeR-G methodOnly support static threadsP1 || & || PnPaPPcPP6+G      ,} y^IConcurrency Programmingcobegin/coendS::=& | cobegin P1 || P2 codend | & Higher-level, well-structuredOnly support properly nested concurrent codefork/joinS::=& | tid := fork f(a) | join tid | & More flexible: improperly nested codeOSes/Java/& n YCCG GP CGG7b a+ Our Contributions(A new PCC framework: CMAPVerification of general propertiesDynamic thread creation/terminationGeneralize the Rely-Guarantee methodModular verificationRealistic featuresMultiple instantiations of thread codeThread argument passing, thread-local datapG%(R#$%(R Outline of This TalkBackground: the Rely-Guarantee MethodChallenges for Dynamic Thread Creation/TerminationOur ApproachThe CMAP FrameworkConclusion and Future Work&nThe Rely-Guarantee Method The Rely-Guarantee Method~Thread + Thread EnvironmentRely and GuaranteeA, G: State State PropThread ModularityNon-Interference (interface compatibility):"i,j. ij Gi AjSafety of each thread Ti: (Ai, Gi)/ZZZ,ZZZZ/ , >!0GCD Example [Yu&Shao 04]   Outline of This TalkBackground: the Rely-Guarantee MethodChallenges for Dynamic Thread Creation/TerminationOur ApproachThe CMAP FrameworkConclusion and Future Work*&3;Concurrency Programmingcobegin/coendS::=& | cobegin P1 || P2 codend | & Higher-level, well-structuredOnly support properly nested concurrent codefork/joinS::=& | tid := fork f(a) | join tid | & More flexible: improperly nested codeOSes/Java/& n YCCG GP CGG7b a+ Static and Dynamic Threads   ChallengesFirst attemptCheck NI between all static threadsTi: (Ai, Gi)"i,j. ij Gi Aj$! F;%Challenges: Changing Env. IA-B: initialize data dno other threads will change dA : d = d B-C: collaborate with T3 to process dT3 may change dStill do not allow other threads change dC-D: T3 terminatesNo other threads can change d*&:   8    'Challenges: Changing Env. I (Challenges: Changing Env. IIT2 and T3 have no overlap in their lifetimenon-interference between all threads?Only check those that overlap?How to specify the overlapping?l,E   #E ;0#Challenges: multiple instantiations$$( :/Challenges: Modularity )Outline of This TalkBackground: the Rely-Guarantee MethodChallenges for Dynamic Thread Creation/TerminationOur ApproachThe CMAP FrameworkConclusion and Future Work*Y.#Our Approach (1)rProblems for checking NI of static threadsChanging environmentMultiple instantiationsModularity issuesCMAP:  lazy checking At each step, all live (dynamic) threads do not interfered+?:+?$Our Approach (2) Our Approach (3)6Borrow ideas from typechecking data heaps (as in TAL):77 + Our Approach (4)Thread Termination: exitA,!Our Approach (5)Thread Creation: fork f(a) A2'Our Approach (6) 3(Our Approach (7)Queue Extension=2Our Approach (8) Queue Update?3Our Approach (9) 4)Our Approach (10)Check static threads Lazy CheckChanging Env. Changing (A, G)Multiple instantiation Not careModularity Certify only onceGeneral EnoughLanguage (higher-level/assembly)Thread Model (preemptive/non-preemptive)"dJ J+B5FExample  Unbounded Thread Creation C6FExample  Unbounded Thread CreationGSpecification of Child:Ax: Gx: Non-interference between children:R0)"(D7FExample  Unbounded Thread CreationHow to specify the main thread?E8  YEOutline of This TalkBackground: the Rely-Guarantee MethodChallenges for Dynamic Thread Creation/TerminationOur ApproachThe CMAP FrameworkConclusion and Future Work*f[GThe CMAP FrameworkThe abstract machineThe verification logicSpecification languageInference rulesSoundness proofExample programsUnbounded dynamic thread creationReaders/Writers problemLock-free programAll implemented in Coq!t,P7PPLPP,7L@4The CMAP Framework - Machine( ]HThe CMAP FrameworkThe paper on CMAP (Feng&Shao ICFP 05):http://flint.cs.yale.edu/publications/cmap.html\(0G)G, (6+ ConclusionjProblems for unbounded dynamic thread creationChanging environment (fork/exit)Multiple instantiation of thread codeNo previously known modular verification methodOur approachINV: active threads in the system do not interfereCombine the type-based proof technique with R-G methodUnify thread s assumption/guarantee with env. s guarantee/assumptionThread modularity + code/proof reuseThe CMAP framework and its Coq implementation/ZwZZ3Z|Z%Z.ZZ/w3|%  .    "FiM> Future WorkCertified Thread Librariesfork, yield, exitjoin, lock, monitorsSurface languageHigher-level specificationsPartially infer A and GCertifying compilation to CMAP'S,K=/AIQU\ r}}^1  !"#$%&'(՜.+,D՜.+,    On-screen Show Yale University) 5Arial HelveticaTahoma WingdingsTimes New Roman Courier NewComic Sans MSSymbol Wingdings 3BlendsMicrosoft ʽ 3.0^Modular Verification of Concurrent Assembly Code with Dynamic Thread Creation and Termination Motivation ChallengesPrevious workConcurrency ProgrammingOur ContributionsOutline of This TalkThe Rely-Guarantee MethodThe Rely-Guarantee MethodGCD Example [Yu&Shao04]Outline of This TalkConcurrency ProgrammingStatic and Dynamic Threads ChallengesChallenges: Changing Env. IChallenges: Changing Env. IChallenges: Changing Env. II$Challenges: multiple instantiationsChallenges: ModularityOutline of This TalkOur Approach (1)Our Approach (2)Our Approach (3)Our Approach (4)Our Approach (5)Our Approach (6)Our Approach (7)Our Approach (8)Our Approach (9)Our Approach (10)%Example C Unbounded Thread Creation%Example C Unbounded Thread Creation%Example C Unbounded Thread Creation Slide 34Outline of This TalkThe CMAP FrameworkThe CMAP Framework - MachineThe CMAP Framework Conclusion Future Work Slide 41  Fonts Used Design TemplateEmbedded OLE ServersSlide Titles)< 8@ _PID_HLINKSA*+285,20,Example  Unbounded Thread Creation303,23,Modularity297,33,The CMAP Approach297,33,The CMAP Approach297,33,The CMAP Approach304,22,Changing Environment297,33,The CMAP Approach"_ Xinyu FengXinyu Feng