Formal Approaches to Testing of Softwarecsstrmh/concur2002/Fates02_proceedings.pdf · Rob Hierons...

Rob Hierons and Thierry Jéron (Eds.)

Formal Approaches toTesting of Software

FATES’02A Satellite Workshop of CONCUR’02Brno, Czech Republic, August 24th 2002Proceedings

Preface

Testing is an important technique for validating and checking the correctness of soft-ware. However, the production and application of effective and efficient tests is typi-cally extremely difficult, expensive, laborious, error-prone and time consuming. For-mal methods are a way of specifying and verifying software systems by applying tech-niques from mathematics and logic. This enables the developer to analyze systemmodels and reason about them with mathematical precision and rigour. Thus bothformal methods and software testing can be used to improve software quality.Traditionally, formal methods and testing have been seen as rival approaches. How-ever, in recent years a new consensus has developed. Under this consensus, formalmethods and testing are seen as complementary. In particular, it has been shown thatthe presence of a formal specification can assist the test process in a number of ways.The specification may act as an oracle or as the basis for systematic, and possibly au-tomatic, test synthesis. In conjunction with test hypotheses or a fault model, formalspecifications have also been used to allow stronger statements, about test effective-ness, to be made. It is possible that the contribution to testing will be one of the mainbenefits of using formal methods.The aim of the workshop FATES — Formal Approaches to Testing of Software— is tobe a forum for researchers, developers and testers to present ideas about and discussthe use of formal methods in software testing. Topics of interest are formal test theory,test tools and applications of testing based on formal methods, including algorithmicgeneration of tests from formal specifications, test result analysis, test selection andcoverage computation based on formal models, and all of this based on different formalmethods, and applied in different application areas.

This volume contains the papers presented at FATES’02 which was held in Brno(Czech Republic) on August 24, 2002, as an affiliated workshop of CONCUR’02. Outof 17 submitted papers the programme committee selected 9 regular papers and 1 posi-tion paper for presentation at the workshop. Together with the keynote presentation byElaine Weyuker, from AT& T Labs, USA, they form the contents of these proceedings.The papers present different approaches to using formal methods in software test-ing. The main theme is the generation of an efficient and effective set of test casesfrom a formal description. Different models and formalisms are used as the startingpoint, such as (probabilistic) finite state machines, X-machines, transition systems,

iii

categories, B, Z, Statecharts, UML, and different methodologies and algorithms arediscussed for the test derivation process, ranging from formalization of the manualtesting process to the (re)use of techniques from model checking.The papers give insight in what has been achieved in the area of software testing withformal methods. Besides, they give clear indications of what has to be done before wecan expect widespread use of formal techniques in software testing. The prospects forusing formal methods to improve the quality and reduce the cost of software testing aregood, but still more effort is needed, both in developing new theories and in makingthe existing methods and theories applicable, e.g., by providing tool support.

We would like to thank the programme committee and the additional reviewers fortheir support in selecting and composing the workshop programme, and we thank theauthors for their contributions without which, of course, these proceedings would notexist.Last, but not least, we thank Antonin Kucera for arranging all local matters of orga-nizing the workshop, and the Masaryk University of Brno for giving the opportunityto organize FATES’02 as a satellite of CONCUR’02, INRIA for supporting the printingand distribution of these proceedings, and the EPSRC Formal Methods and Testingnetwork.

Brunel and Rennes, August 2002Rob Hierons

Thierry Jéron

iv

Programme committee

Ed Brinksma (University of Twente, The Netherlands)Rocco De Nicola (Università degli Studi di Firenze, Italy)Marie-Claude Gaudel (Université de Paris-Sud, France)Jens Grabowski (Universität Lübeck, Germany)Dick Hamlet (Portland State University, United Kingdom)Robert Hierons (Brunel University, United Kingdom), co-chairThierry Jéron (INRIA Rennes, France), co-chairDavid Lee (Bell Labs, Beijing, China)Brian Nielsen (Aalborg University, Denmark)Jeff Offutt (George Mason University, USA)Doron Peled (University of Texas at Austin, USA)Alexandre Petrenko (CRIM, Canada)Jan Tretmans (University of Nijmegen, The Netherlands)Antti Valmari (Tampere University of Technology, Finland)Carsten Weise (Ericsson Eurolab Deutschland GmbH, Germany)Martin Woodward (Liverpool University, United Kingdom)

Referees

Boroday Serge, (CRIM, Canada)Ebner Michael, (Universität zu Lübeck, Germany)Jard Claude, (IRISA/CNRS Rennes, France)Le Traon Yves, (IRISA/University Rennes I, France)Marchand Hervé, (IRISA/INRIA Rennes, France)

Local organization

Antonin Kucera,Masaryk University,Brno,Czech Republic

v

Contents

1 Thinking Formally About Testing Without a Formal Specification . . 1Elaine Weyuker

2 Generating Formal Specifications from Test Information . . . . . . . 11Thomas J. Ostrand

3 Testing from statecharts using the Wp method . . . . . . . . . . . . . 19Kirill Bogdanov, Mike Holcombe

4 Testing Nondeterministic (stream) X-machines . . .. . . . . . . . . 35Florentin Ipate, Marian Gheorghe, Mike Holcombe, Tudor Balanescu

5 Complete Behavioural Testing (two extensions to state-machine testing) 51Mike Stannett

6 Formal Basis for Testing with Joint Action Specifications . . . . . . . 65Timo Aaltonen, Joni Helin

7 Queued Testing of Transition Systems with Inputs and Outputs . . . . 79Alex Petrenko, Nina Yevtushenko

8 Optimization Problems in Testing Probabilistic Finite-State Machines 95Fan Zhang, To-yat Cheung

9 BZ-TT: A Tool-Set for Test Generation from Z and B using ConstraintLogic Programming . . . . . . . . . . . . . . . . . . . . . . . . . . . 105F. Ambert, F. Bouquet, S. Chemin, S. Guenaud, B. Legeard, F. Peureux,N. Vacelet, M. Utting

10 Using a Virtual Reality Environment to Generate Test Specifications . 121Stefan Bisanz, Aliki Tsiolakis

11 Towards a formalization of viewpoints testing . . . . . . . . . . . . . 137Marius Bujorianu , Manuela Bujorianu, Savi Maharaj

vii

�� "!$#%�&��(' �)�*��+��,�� -�.��/10 !324�)5624�7�&��

8:9<;>=<?A@CBEDGFH@JILKNM>@POQ3R�S�RUT ;WVAX7Y7Z[@JX�@P;\O�]_^`PaWbdc ;WO�M Qfe @P?AKA@

g49ihAO�^N;Wj c ;WOkMElNm�B bWnWoWp\qr @JINKNMs@PO�t�O)@JX�@P;WO�]JûDv;sw�wxDy]Jhzj

{}|-~J�P�x�E�s�

�u��J��i��P�W��[��k�P��z��W��z��x��P�[�W��k�i��P�W��J�A�P \�¡�4�A�J�3��s¢�W��£s W��u��[ W��[��¤��-��k��*�z��¥�\¦N§4�W��u¨z�JÄ��*�W�� W��-�4�z�J�u��E�,�©�J�W�%��x�E�x�W��-�z��¥��k¤i�k��P�ª��i��x��A�f��P��«N��i�x��z�J��W�P��W��¦1¬>��P��J¤*¨\��PÄ�P��}��x��¨z��x��k¤<��P�\��¨W��k��}�J�W�C�W��k W��E¦3®$��¯z�k�i�k�W��J��¡�\�i°x�W¤��°P�s��%±W�J�W��f�W��k W��i�x��J�4�W�J�²��\��C��k¤<��P�\��P�x¤��P��}��¨W��k��E¦}§4�\�� W��³ W¤��W��3��¨\�i��©�J¤u�� W�W��f��J¤��x�W��W�k��E¦

´ µ ��E *��¶d��2-�&�k��

·[O�@J]J@P?\w�9�I";s¸N¸EO�@JXkX�@J¸¹;�j6@J@Jw�=º?A»�hs¼¡O)hzKA»zÂ9�I�½ bWb X�hs¼�w r ;WO�@fw�@JX�w�@PO�XxD Q 9�9-hs¼4w©Â@Pj r @PO�@�VNO)=i»A^WwPl@J¾N¿N@PO)=i@P?A]J@J¸*l4MA?Ah r 9�@J¸N»W@P;WVA9�@Wlu@J¸EKA]P;sw�@J¸*DfÀÁhWX�w r @PO�@�¼�O�hzjÂw�Â@�wk@J9i@J]JhAj�jCKN?A=i]P;>w�=�hz?AX r hzO�9�¸ÃY9º;W?A¸Chs¼uw©Â@3Xkw©;sw�@[j�;s]JÂ=<?A@WD$·*;sX©Ms@J¸CÂh r j�;W?\I�hs¼Ew©Â@PjÄO�hzKAwk=<?A@J9�ICX©; r ;[¼�hzO�j�;>9WX©¿N@J]J=ÆÅE]P;swk=ihA?uD·f=º?A]J9ºKA¸N@J¸ÇX©KA]J^Hw�Â=<?A»\X6;>X e ;\O�=�hzKAX�w�IN¿N@JXChs¼�X�w©;swk@6jd;s]_Â=º?A@JXPl$ÈAw©;sw�@J]J^N;WO�w�Xxl*É�À T l T*Ê�R�Ê Èul8:X�w�@J9�9�@WlNÈAË T lN;W?A¸ÍÌÎX©¿N@J]J=ÆÅE]P;swk=ihA?AXPlNhzO$;W?WIAw©Â=º?A»C@J9�X�@�w�Â@JI�w©Â@PjCX�@J9 e @JX[]J9º;sX�Xk=vÅE@J¸";>X¡;f¼�hzO�jd;s9X�¿N@J]J=ÆÅE]P;sw�=�hz?uD[·�?AX�wk@P;s¸Chs¼&X�@J@J=º?A»C;fX�@P;fhs¼Ï^N;\?A¸NX4=<?6w©Â@�;s=ºOJlW· r ;sX�=º?AX�wk@P;s¸�»zO�@J@Jwk@J¸6V\I�;f]JÂhzO�KAXh>¼Ï9º;WKA»A^Ww�@PO�D3ÈNKNO�@J9�IÍ·4^N;>¸}w�hW9�¸Í;,»zO)@P;sw*Ð�hzMs@WD4·-w©Â@P?dw©ÂhzKA»z^\w[w©^N;sw[¿N@PO�^N;W¿AXf· r ;>X¡;sX©M\=º?A»�w�hAhjCKA]J^ r Â@P?Á·�KAXk@J¸¹w�Â@�w�@PO�jÒÑ©O�hAKAw�=º?A@J9iIAÓ";W?A¸ÁX�h�·�jChz¸N=ÆÅE@J¸Hw�Â@�ÔNKA@JX�w�=�hz?Ãw�hEÕCÑ©Ö�h r j�;W?\I^N; e @}×xØP×PÙ[Xk@J@P?H;d¼ÚhAO�j�;s9*X�¿N@J]J=ÆÅE]P;sw�=�hz?NÛ�Ó Ê ?A@�9�hz?A@�¿G@PO�X�hz?ÜO�;s=�X�@J¸Áw©Â@J=ºO�^N;W?A¸ÃY�Â@�KAX�@J¸Áw�hr hzOkM"=º?Üw©Â@ªX r =�w�]JÂ=<?A»H;WO)@P;¹;\?A¸ÝX©; r =�wC=º?Þw©^N;sw�;\O�@P?N;ND R Â=�X r ;sX�=º?A¸N@J@J¸²;W?Á@JIW@�Y�hz¿G@P?A=º?A»@J¾N¿N@PO)=i@P?A]J@WD·ßw�=�X e @PO�IÁ]Jhzj�j6hz?Á=º?Hw�Â@�w�@J9�@J]Jhzj�jCKN?A=�]P;sw�=�hz?AX r hzO)9i¸Üw�h¹^N; e @ e @PO�IHÂ=i»A^ÝO�@J9�=º;WVA=�9�=�w¥IàO)@�Y

ÔNKA=ºO�@PjC@P?\w�X�á�¿G@Jhz¿A9�@�hs¼�w�@P?,X©¿N@P;WM�hs¼¡Ñ)Å e @�?A=<?A@JXkÓ�hzO[D oWoWo\oWo O�@J9�=º;WVA=�9�=iw�IWlE;>9iw�ÂhzKA»z^,@J¾L;>]Jw�9�I r ^N;sww�^N;sw�jC@P;W?AX�=�X[¼�O�@JÔNKA@P?Ww�9�I}KN?A]J9�@P;WO�âf;W?A¸ e @PO�I�Â=�»z^Ã; e ;s=�9º;WVA=�9�=iw�I"O�@JÔNKA=ºO�@PjC@P?\w�X�á³X�hsY�]P;s9�9�@J¸ q ½sY nhAO�;s9 r ;xIzXC; e ;s=�9º;WVA9�@PâJD"FÜ@�X©¿N@P?A¸à;Î»zO�@P;sw,¸N@P;s93h>¼7wk=<j6@Í;W?A¸ÇjChz?A@JIH;W?A¸Þ@�ã*hzO�w�w�@JXkw�=º?A»¹w�Â@Xkhs¼Úw r ;WO�@WDfFH@�^N; e @�j�;W?\I}w�@JX�wk=<?A»}Xkw©;s»W@JXPÕfKN?A=�wPlu¼�@P;sw©KNO�@Wlu=º?\w�@J»zO�;>w�=�hz?uluX�IAX�w�@Pj}lu9�hz;s¸*läX�w©O�@JXkXPl¿G@PO�¼�hzO�j�;W?A]J@WlA@P?A¸AY�w�h>Y�@P?A¸*lNhz¿N@POk;sw�=�hz?AX�O�@P;s¸N=º?A@JX�X[w�hC?N;WjC@$Ð)KAX�w[X�hAjC@�hs¼�w�Â@�9�@ e @J9�XPlE;\?A¸�w©Â@PO)@=�X�;CO�@JX�@P;WO�]J^ª9�=�w�@PO�;sw©KNO)@�w©^N;sw�w�@J9�9iX�KAX�Âh r »WhAhA¸}=iw r hzKA9�¸"VN@C;W?A¸ r ^N;sw�wkh�¸Nh r =�w©^};,¼�hzO�jd;s9X�¿N@J]J=ÆÅE]P;sw�=�hz?ul4;W?A¸ÃIW@Jw�w©Â@�O�@P;s9 r hzO�9�¸"w©^N;>w�X©¿G@P?A¸NX�w©Â@Cw�=ºjC@�;W?A¸HjChA?A@JI"¸NhW=º?A»}w©Â@Cw�@JX�wk=<?A»¸NhA@JX©?uåyw�9ihAhzMª;sw�w©^N;>w�9�=iwk@PO�;sw©KNO�@�V\I};W?A¸"9º;WO�»\@WlE;W?A¸}hs¼�w�@P?ª=�X©?uåyw�@ e @P?"; r ;WO�@fhs¼�=�wPD$ÈAh�w©Â@PO�@�=�X;6¸N=iXk]Jhz?N?A@J]Jw1;\?A¸"=�w�=�X1?Ah\w�]J9�@P;WO r Â@P?ÎhzO r Â@Jw©Â@PO7w©Â=�X�»z;\¿ r =�9i9-VN@�VNO)@P;s]_Â@J¸*DR Â@PO�@�¼ÚhAO�@Wl*w©Â=�XC¿N;W¿N@PO,=�X�æ%çWè3;WVGhzKAw r ^N;>w�¿N@JhA¿A9i@ªw©O�;>¸N=iwk=ihA?N;s9�9iIÞw©Â=º?NMÁ;WVNhAKAw r Â@P?Üw©Â@JI

Â@P;\O�w©Â@,w�@PO�jÒÑ�¼�hzO�j�;s9-jC@Jw©ÂhA¸NX�ÓÍ;>X�X�hA]J=<;>w�@J¸ r =�w©^ÃX�h>¼Úw r ;WO�@fw�@JX�w�=º?A»EÕ�?N;\jC@J9�I"w�@JX�wk=<?A»}KAX�=º?A»;é¼�hzO�j�;s9fX©¿G@J]J=vÅE]P;>w�=�hz?uDê·�?AX�wk@P;s¸²=iw r =�9�9�VN@Ý;WVGhzKAw}hWw©Â@POdw©Â=º?A»WXÃw©^N;swÁë�ìÆíWîAè1VG@Á¼�hzO�j�;s9�9�I;>X�X�@JX�X�@J¸ r =�w©ÂhzKAw�;f¼�hzO�j�;>9NX©¿N@J]J=ÆÅE]P;sw�=�hz?ul%;W?A¸�w�^N;sw4¸N@JX©¿N@POk;sw�@J9�IÍ?A@J@J¸ªw�hCVN@�;sX�X�@JX�Xk@J¸�O�@J9º;sw�= e @wkh�X�h>¼Úw r ;WO�@,w�@JX�wf]P;sX�@CX�@J9�@J]Jw�=�hz?ÜX�w©O�;swk@J»W=�@JXPD�·�?Ü¿N;WO�w�=�]PKA9º;WOJl*· r =�9�94¼�hz]PKAX�hz?ÁÂh r w�hª]Jhzj�¿N;WO)@w�Â@�@�ã*@J]Jw�= e @P?A@JX�X�hs¼*w�@JX�w�=º?A»CX�w©O�;>w�@J»W=�@JX[w�h�Â@J9º¿}KAX[¸N@Jw�@PO�jC=º?A@ r Â=�]J^ª=�X�w©Â@�VN@JX�w�;W¿N¿NO�hA;s]_^�¼ÚhzO;Î»W= e @P?Þ¿NO�hW»zO�;\j}l*hzO1¼ÚhAO�;s9�97¿NO)hW»zO�;Wj6X�=<?Ü»W@P?A@PO�;>9ÚDÃ· r =�9i9[¸N@JX�]PO)=<VG@ e ;WO)=ihAKAX�¼�;s9�X�@};sw�w�@Pjd¿Aw�X

1

;>w�¸N@�Å&?A=º?A»}]Jhzj�¿N;WO�=�X�hA?}O�@J9º;sw�=�hz?AXPlu;W?A¸}¸N@JX�]PO�=ºVG@ r Â@PO�@ r @�;WO�@�?Ah r D$· r =i9�9-¸N=�X�]PKAX�X r ^\I�w�Â@¿NO)hz¿NhWXk@J¸¹O�@J9º;sw�=�hz?AX r @PO�@�?AhWw�X�;sw�=�X�¼�;s]Jw�hzO�IWD4·[Âhz¿G@�w©Â=�X r =�9i9-]J^N;s9�9i@P?A»\@�XkhzjC@�hs¼4IWhzKªw�hdw©Â=º?NM;\VNhzKAwfw©Â=�X�=ºj�¿GhzO�w©;\?Wwf=�X�X©KA@C=º?¹?A@ r r ;xIzXPl%;W?A¸Á9i@P;>¸"w�h};�O)@P?A@ r @J¸Ã=º?Ww�@PO)@JX�w�=º?Ãw©Â@�¿NO�hzVA9�@Pj}l;\?A¸}X�hzjC@�@J¾A]J=�w�=º?A»"?A@ r =º?AX�=�»z^WwkXPD

� � �� 0 �[ *��#u��Ä!$��[�u��#

c O�hzVN;WVA9�I,w©Â@[Å&O�X�w4X�KA»W»W@JX�w�=�hz?�¼�hzO-Âh r wkh�]Jhzj�¿N;WO�@[X�h>¼Úw r ;WO�@4w�@JXkw�=º?A»�X�w©O�;swk@J»W=�@JX3KAX�@J¸�w©Â@[X©KNV\YX�KNj�¿Aw�=�hz?}O�@J9º;sw�=�hz?uD$·�?\w©KA=�w�= e @J9�IWlEX©KNVAX�KNj�¿Aw�=�hz?}=�X�; e @PO)IÍ?N;sw�KNO�;s9 r ;xI�w�h,]Jhzj�¿N;WO)@�X�w©O�;swk@J»W=�@JXPD·ßw¡O�@P;>9i9�I�Xk@J@PjCX39�=ºMs@f=iw[]P;W¿Aw�KNO�@JX3w©Â@�@JX�X�@P?A]J@fhs¼ r ^N;sw r @�jC@P;W? r Â@P? r @�X�;PI,w©^N;sw$hz?A@�w�@JX�wk=<?A»Xkw©O�;sw�@J»\I�=�X�jChzO�@�@�ã*@J]Jw�= e @,hzO[jChzO�@�]JhAj�¿NO�@PÂ@P?AX�= e @Cw©^N;W?};\?AhWw©Â@POJDg%hzO�j�;>9i9�IWlu]PO�=�w�@PO)=ihA?�� zëC×��]PO)=iwk@PO�=�hz?��=Æ¼[¼ÚhAO�@ e @PO)I"¿NO�hW»zO�;\j��Clu@ e @PO)I"w�@JX�wfX©KA=�w�@

w�^N;sw[X©;sw�=�X�ÅE@JX��;s9�X�h�X©;swk=iX)ÅE@JX��xD·�?�� `W`�� ;\?A¸�� `Pq�� l*Z�;W¿N¿AX�;W?A¸ÁFH@JINKNMs@PO�=º?Ww©O)hz¸EKA]J@J¸Ý;}?A@ r ¼�;WjC=�9�I"h>¼3¸E;sw©;��Eh r Y¥VN;sXk@J¸"w�@JX�w

]P;>X�@�X�@J9�@J]Jw�=�hz?éX�w©O�;swk@J»W=�@JXPl&;\?A¸"X�@ e @POk;s9�]JhA?Ww©O)hW9��Eh r Y¥VN;sX�@J¸¹;\?A¸"¸E;sw©;��Eh r Y¥VN;sX�@J¸"]PO)=iwk@PO�=º; r @PO)@]JhAj�¿N;WO�@J¸�KAX�=º?A»�w�Â@¡X�KNVAX©KNj�¿Aw�=�hz?�O)@J9<;>w�=�hz?uD4FH@$Å&O�jC9�I�VN@J9�=�@ e @J¸ªw©^N;sw4w©Â=�X3O�@J9º;swk=ihA?C=º?A¸N=i]P;>w�@J¸w�^N;sw[w©Â@�X©KNVAX�KNjC@J¸¹O�@J9º;swk=ihA?AX r @PO�@�9�@JX�X�»\hzhA¸}w©^N;W?ªw©Â@,X©KNVAX©KNjC=º?A»}O�@J9º;sw�=�hz?AXPDÖ�h r @ e @POJls=�w r ;>X39º;sw�@PO$O�@J]JhW»z?A=! J@J¸}w©^N;sw$X©KNVAX©KNj�¿Awk=ihA?�^N;s¸ª¸N@�Å&?A=�w�@�¸N@�ÅE]J=�@P?A]J=�@JX r Â@P?ªKAX�@J¸

wkh"]Jhzj�¿N;\O�@�wk@JX�w�=º?A»ÁX�w©O�;swk@J»W=�@JXPD R Â@ªÅ&O�X�w�¸N@�ÅE]J=�@P?A]JI r ;sX�O�@J]JhW»A?A=" J@J¸à;\?A¸ ¿GhW=º?Ww�@J¸ÇhAKAw6V\IZ�;W¿N¿AX�;W?A¸}FH@JINKNMs@PO$=º?�� `W`�� lz?N;WjC@J9�I}w©^N;>w¡j�;W?\I�w�@JXkw�=º?A»�]PO�=�w�@PO�=º;�;WO)@1?AhWw[]Jhzjd¿N;WO�;WVA9�@�KAX�=º?A»X�KNVAX©KNj�¿Aw�=�hz?ul%=º?}w©Â@�X�@P?AXk@�w©^N;sw�?A@J=�w©Â@PO�X©KNVAX©KNjC@JXfw©Â@�hWw�Â@POJDQ ?Á@ e @P?ÞjChzO)@�X�@PO�=�hzKAXC9�=ºjC=�w©;sw�=�hz?Þ;sX�X�hA]J=º;sw�@J¸ r =�w©^ÜX©KNVAX©KNj�¿Aw�=�hz?Ü=�XCw©^N;sw�=�wC]P;W?HVN@}jC=�X�Y

9�@P;s¸N=º?A»ED[·�w[=�X[@P;sX�I�wkh�]JhzjC@�KN¿ r =�w©^d@J¾L;\j�¿A9�@JX�hs¼*w�@JX�w�=º?A»CX�w©Ok;sw�@J»W=�@JX[X©KA]J^�w©^N;>w#��3X�KNVAX©KNjC@JX��VNKAw�w�Â@PO�@�;WO�@Cw�@JX�w�X©KA=�w�@JX�w�^N;sw�X©;sw�=�X�¼�I$��Pluw©Â@dX©KN¿N¿NhWXk@J¸ r @P;WMs@POfX�w©Ok;sw�@J»WIWl%w©^N;swf@J¾L¿GhWX�@¼�;WKA9�w�XPl r Â=�9�@�w�@JX�w[X©KA=�w�@JX�w©^N;sw3X�;sw�=�X�¼�I%� � lzw�Â@1jChAO�@�¸N@Pjd;W?A¸N=º?A»�X�w©O�;>w�@J»WIWlW¸Nh�?AhWw[@J¾N¿NhWXk@1;W?\I¼�;WKA9�w�XPD R Â@"¿NO�hzVA9�@Pj ;\O�=�X�@JX�VN@J]P;\KAX�@"w©Â@PO)@";WO�@ªw¥IN¿A=�]P;s9�9�Iàj�;W?\IH¸N=ÆãÏ@PO)@P?Ww�wk@JX�wCX©KA=�w�@JX�w�^N;swX�;sw�=�X�¼�Ié;Î»W= e @P?ÁX�w�O�;sw�@J»WIÁ;W?A¸Þ»W@P?A@PO�;s9�9�IHw©Â@PO�@d=iXC9�=�w�w�9�@}hzO�?AhÃ»zKA=�¸E;W?A]J@";sX�wkh r Â=�]_^Ühz?A@�w�h]JÂhAhWX�@WD R Â@PO�@�¼�hzO�@WläIWhzKHjd;PIÁVN@�9ºKA]JMWI r Â@P?ÁX�@J9�@J]Jw�=º?A»Áw©Â@�w�@JXkw�X©KA=�w�@�¼�hzO��C;W?A¸ÞKN?A9<KA]JM\Ir Â@P?�X�@J9�@J]Jw�=º?A»ªw©Â@�� w�@JX�w[X©KA=�w�@WlAhzO$=�w�j�;xIC@ e @P?}VN@fw©^N;sw[w©Â@ªÑ©?N;sw©KNOk;s9�Ó�w�@JX�w[X©KA=�w�@�wkh�X�@J9�@J]Jw¼�hzO&��¸Nhz@JX�;CVN@Jw�wk@PO4Ð�hzVdhs¼:KN?A]Jh e @PO)=<?A»6¼ß;WKA9�w�X�w©^N;W?ª¸NhA@JX�w©Â@}Ñ�?N;sw©KNO�;s9�ÓCw�@JX�w�X©KA=�w�@�w©^N;sw�hA?A@r hzKA9�¸}X�@J9�@J]Jwfw�h�X©;>w�=�X�¼ÚI'��JDF²=�w©^Îw©Â=�X1¿NO�hAVA9i@Pj =º?ÁjC=º?A¸*l)(�hzKNO�9º;xI*� n�� =º?\w©O�hA¸EKA]J@J¸Hw©Â@�¿Gh r @PO�O�@J9º;sw�=�hz?uD Q ]PO)=iwk@PO�=�hz?}=�X

X�;s=�¸�w�h'+W×Pè�×�,Pèu;�¼ß;>=i9ºKNO�@�=Æ¼¡×xØP×xÙ.-�w�@JX�w3Xk@Jw¡w�^N;sw3X©;>w�=�X�ÅE@JX[w©^N;sw3]PO)=iwk@PO�=�hz?ª]Jhz?\w©;s=º?AX�;W?�=º?N¿NKAw�w�^N;sw]P;\KAX�@JX�Âw�hª¼�;s=�9�l�;W?A¸Hw�Â@PO�@C=iXC;swf9i@P;>X�w�hz?A@Cw�@JXkw�X�@Jw�X©;sw�=�X�¼�IA=<?A»Ãw©Â@C]PO�=�w�@PO�=�hz?Ã¼�hzO��CD R Â@P?ul]PO)=iwk@PO�=�hz?'��[=iXf;sw[9i@P;>X�w�;sX0/Lç214×PÙ435�76z;sX�]PO�=�w�@PO�=�hz?'��=Æ¼�¼�hzO4@ e @PO�IÍ¿NO)hW»zO�;Wj8�ClN=Æ¼9��¸N@Jw�@J]JwkX7;¼�;s=�9ºKNO�@�=º?��ClNw©Â@P?}Xkh�¸Nhz@JX:��PDQ 9�w©ÂhzKA»z^ w©Â@"=º?\w�@P?\w}hs¼1w�Â=iX"O)@J9<;>w�=�hz? r ;sXªw�hÝ;s¸N¸EO)@JX�X�X�KNVAX©KNj�¿Aw�=�hz?uåyX}¸N@�ÅE]J=�@P?A]J=�@JXPl�w�Â@

¿Gh r @POfO�@J9º;sw�=�hz?ÃX�wk=i9�94^N;sX r @P;\Mz?A@JX�Xk@JXPD�·�?¹¿N;\O�w�=�]PKA9º;WOJluw©Â@C=º?A]Jhzj�¿N;WOk;WVA=�9i=�w�I¹¿NO)hzVA9�@Pj�O�@Pj�;s=º?AXXk=<?A]J@Áj�;W?\IÝ]PO)=iwk@PO�=º;Ç;WO�@}X�w�=�9�9f=<?A]JhAj�¿N;WO�;WVA9�@ÁKN?A¸N@PO�w©Â@Á¿Nh r @PO�O�@J9º;sw�=�hz?uD²·�? ;s¸N¸N=�w�=�hz?ul�w�Â@¿Gh r @PO�O)@J9<;>w�=�hz?Á¸NhA@JX�?AhWw�@P?\w�=ºO�@J9�IÁ@J9i=ºjC=º?N;swk@}w©Â@CX�=�w©KN;sw�=�hz?Á=º? r Â=i]J^Üw©Â@ÁÑ r @P;WMs@PO�Ó}O�@J9º;sw�=�hz?@J¾N¿Nh\X�@JX$¼ß;WKA9�w�X r Â=�9�@�w©Â@�Ñ�X�w�O�hz?A»W@PO�Ó�hA?A@�¸Nhz@JX�?AhWwxD Ê ?A@�¿NO�hzVA9�@Pj�=�X[w©^N;sw4w©Â@�¿Gh r @PO$O�@J9º;sw�=�hz?=�X�VN;sX�@J¸Áhz?Îw©Â@�¸N@�Å&?A=�w�=�hz?Áh>¼1Ñ�¸N@Jwk@J]Jw�=º?A»WÓ";,¼�;s=�9<KNO)@ r Â=�]_^Ã=�X�; e @PO)I}¸N@Pj�;W?A¸N=º?A»}hz?A@WD�·³¼0��=�X�;sw�9�@P;sX�w�;sX�¿Gh r @PO¥¼ßKA9�;>X��xlNw©Â@PO)@�j�;xIªX�w�=�9�9�VG@�¼�;s=�9ºKNO�@JX�w©^N;sw r =�9i94jChzO)@�hs¼Úwk@P?"VN@,@J¾L¿GhWX�@J¸V\I'��w�^N;W?'��@ e @P?ªw©ÂhAKA»z^}?A@J=�w©Â@POf]PO�=�w�@PO�=�hz?Î¸N@Jw�@J]Jw�X�w©Â@Pj =<?Îw©Â@f¼�hzO�j�;s9uX�@P?AXk@WD·ßw1jd;PI};s9�X�h}^N;W¿N¿N@P?Ãw©^N;>w��Ä]Jhz?\w©;s=º?AX�¼ß;\KA9iwkX1VNKAw�?A@J=�w©Â@PO��?AhzO0��f¸N@Jw�@J]Jw�X�;W?WIª¼�;s=�9ºKNO�@JX

VG@J]P;WKAX�@ªhs¼¡w�Â@�X�w©O�=º?A»W@P?\w�O)@JÔLKA=ºO�@PjC@P?\w�XChs¼[w©Â@�?AhWw�=�hz?éhs¼�¸N@Jw�@J]Jw�=�hz?uD Q X,¸N=�X�]PKAX�X�@J¸ÇO�@J9º;sw�= e @wkh}w©Â@CX©KNVAX©KNj�¿Aw�=�hz?ÜO�@J9º;sw�=�hz?ul4jChWX�wfw�@JX�w�Xk@J9i@J]Jwk=ihA?H]PO�=�w�@PO)=<;Î¸Nh"?AhWw�O�@JÔNKA=ºO�@�w©Â@�Xk@J9i@J]Jwk=ihA?Áhs¼

2

X�¿N@J]J=ÆÅE]"w�@JXkw�]P;sX�@JXPl:X�hH;Á]PO�=�w�@PO�=�hz? r =�9�9�VG@"X©;swk=iX)ÅE@J¸àVWIÇj�;W?\IH¸N=Æã*@PO�@P?Wwdw�@JX�wCX�@Jw�XPl:X�hzjC@ªhs¼r Â=i]J^ r =i9�9f=º?A]J9<KA¸N@Á=º?N¿NKAw�X}w©^N;>w�¼�;s=�9�l r Â=�9�@¹h\w©Â@PO�X r =�9�9�?AhWwd=<?A]J9ºKA¸N@Ý;\?WIÞ=º?N¿NKAw�X�w�^N;sw,¼ß;s=�9�DÈA=º?A]J@,w©Â=�X�=�X�w©Â@�]P;sX�@WlA=�w�=�X�¿GhWX�X�=ºVA9�@�w©^N;>w¡w�Â@�w�@JXkw¡Xk@Jw�X�@J9�@J]Jw�@J¸}¼�hzO:w©Â@ r @P;WMs@PO$]PO�=�w�@PO�=�hz? r =�9�9@J¾N¿Nh\X�@�jChAO�@�¼�;WKA9�w�Xfw©^N;W?ªw©Â@�hA?A@�X�@J9�@J]Jw�@J¸Ã¼ÚhzO$w©Â@,X�w©O�hA?A»W@PO$hz?A@WDc @POk^N;W¿AX�w©Â@�jCh\X�w�=ºj�¿NhAO�w©;W?\w�¸N@�ÅE]J=�@P?A]JI"=�Xfw©^N;sw�w©Â@PO)@�=iX�?Ah}O�@JÔLKA=ºO�@Pj6@P?Wwfw©^N;sw[w©Â@�¼ß;WKA9�w�X

KN?A]Jh e @PO)@J¸ V\I��;W?A¸��CVN@ªw©Â@ªX©;WjC@WD R Â@PO�@�¼ÚhAO�@Wl ��CjC=�»z^Ww,¸N@Jw�@J]Jw�?AhWw©Â=º?A»HVNKAwCw©O�= e =º;s9¼�;WKA9�w�X r Â=i9�@ ��¸N@Jw�@J]Jw�X�]P;>w©;sX�w©O)hz¿NÂ=�]f¼ß;WKA9�w�XxDÊ ?A]J@Á;s»z;s=º?ul[;W?Ç;sw�wk@Pj�¿Aw r ;>X�j�;s¸N@}w�hH;s¸N¸EO)@JX�X�w�Â@ r @P;\Mz?A@JX�Xk@JX�;sX�X�hA]J=º;sw�@J¸ r =�w©^ VNhWw�^

w�Â@�X©KNVAX©KNj�¿Awk=ihA?Ý;W?A¸Ç¿Nh r @PO�O)@J9<;>w�=�hz?AXPD}·�?ÞZ[@�¼�@PO�@P?A]J@*� `�� läFH@JILKNM>@POJl-FH@J=�X�XPl4;W?A¸ÇÖ�;Wj69i@Jw=º?\w©O�hA¸EKA]J@J¸²w©Â@��[8 R�R 8$Z O)@J9<;>w�=�hz?uD R Â@JIÞÅ&O�X�w�¸N@�Å&?A@J¸²w©Â@Á?AhWw�=�hz?Çh>¼�;Áwk@JX�w�]P;sX�@ÁVN@J=º?A»Ù�×�� Aì�Ù�×�+}VWIÇ;Á]PO�=�w�@PO�=�hz? ��w�hHw�@JXkw6;Ü¿NO�hW»zO�;\j �Cl$=Æ¼1@ e @PO�IÝwk@JX�w�X�@JwCw©^N;swdX©;sw�=�X�ÅE@JX%� jCKAX�w=º?A]J9ºKA¸N@Hw©^N;>w�wk@JX�w�]P;sX�@WD R Â@P?ul[]PO�=�w�@PO)=ihA? ��=�X�� w�^N;W?Þ]PO�=�w�@PO�=�hz? ��d=Æ¼�¼ÚhzO6@ e @PO�I¿NO)hW»zO�;Wj �Cl[=Æ¼�;W?\IÁ¼�;s=�9<KNO)@�Y�]P;WKAX�=º?A»à=º?N¿NKAwÁÙ¥×�� Aì³Ù¥×�+"V\I ��Pl$=�XÍ;s9�X�h Ù¥×�� Aì³Ù¥×�+"V\I � �_D R Â@JIX�Âh r @J¸}w©^N;>wPÕ

á �� ©â�� á �� ! "�$# ��©â��á �� %'&()��%*��& %*� +�,.-/��0.12��(�%*��â

R Â@JIÍ;s9�X�hª¿NO�h e @J¸}w©^N;sw�w�Â@�]Jhz? e @PO�X�@�¸N=�¸¹?AhWwfÂhW9�¸*D¡·ßw�w©Â@PO�@�¼�hzO�@f¼�hW9�9�h r X�w©^N;>w¡w�Â@JX�@�w©^NO)@J@O)@J9<;>w�=�hz?AX1;\O�@1;>9i9-¸N=�X�w�=º?A]Jw�O�@J9º;sw�=�hz?AXPDQ »z;s=º? w©Â@¹?A@ r 9�I\Y�¸N@�Å&?A@J¸ O)@J9<;>w�=�hz? w©^N;sw r ;sX�¸N@JXk=i»A?A@J¸Uw�hHX�h\9 e @¹w�Â@¹¿NO�@ e =�hzKAX�9�IWY�¸N@�Å&?A@J¸

O)@J9<;>w�=�hz?AXPåu¿NO�hzVA9�@PjCXPl*^N;s¸Ã=�w�X�h r ?}¿NO�hzVA9�@PjCXPD Q X1VG@�¼ÚhAO�@Wluw©Â@�=º?A]Jhzjd¿N;WO�;WVA=�9�=�w¥IH¿NO�hAVA9i@Pj�^N;>¸?Ah\w7VG@J@P?}X�h\9 e @J¸*lL;\?A¸ e @PO�IC¼�@ r ]PO�=�w�@PO�=º;�;s]Jw©KN;>9i9�IHÙ�×�� Aì�Ù�×[w©Â@fX�@J9�@J]Jw�=�hz?}h>¼�X©¿N@J]J=ÆÅE],w�@JX�w[]P;sX�@JXPDR Â=iXfjC@P;W?AX�w©^N;>w¡w�Â@�X�@Jw�hs¼*¼�;s=�9ºKNO�@�Y�]P;WKAX�=º?A»}=º?N¿NKAw�X�Ù�×�� Aì�Ù�×�+�V\I�;C]PO�=�w�@PO�=�hz? r =i9�9-w�IL¿A=�]P;s9�9�I"VN@@Pjd¿Aw¥IWlG@ e @P?ªw©ÂhzKA»z^ � ]Jhz?\w©;s=º?AX[¼�;WKA9�w�XPD[·�w�=�X�;s9�X�h e @PO�Iª¸N=43�]PKA9�w�w�hCX©Âh r w©^N;sw�hz?A@�]PO�=�w�@PO�=�hz?=�X"�[8 R�R 83Z w©^N;\?};W?AhWw©Â@PO$¸N=ºO�@J]Jw�9�IWD Ê ¼Úw�@P?ªw�Â@�@P;sXk=i@JXkw�hzO$hz?A9�I r ;xICw�hCX©Âh r w©Â=�X�=�X�w�h�X�Âh rw�^N;sw�w�Â@¡X�KNVAX©KNj�¿Aw�=�hz?�O)@J9<;>w�=�hz?�ÂhW9�¸NXPlA;W?A¸�Â@P?A]J@�VWI,w©Â@�;WVGh e @3w©Â@JhAO�@Pj}lsw©^N;sw4w�Â@5�[8 R�R 83Z;\?A¸"¿Nh r @PO�O�@J9º;sw�=�hz?AX�ÂhW9�¸"w�hAhEDÈAh r @�X�@J@Cw©^N;>w1;s9�w©ÂhAKA»z^}X�@ e @PO�;s9ä¼ÚhzOkj�;s9 r ;xIzXfhs¼3]Jhzjd¿N;WO�=º?A»�Xkhs¼Úw r ;WO�@�wk@JX�w�=º?A»�Xkw©O�;sw�@J»\=i@JX

^N; e @�VG@J@P?Á¿NO�hz¿Nh\X�@J¸H;W?A¸¹KAX�@J¸Ãw�h�¸Nhªw©Â@�]JhAj�¿N;WO�=�X�hz?uluO�@��E@J]Jw�=�hz?Ã=º?A¸N=�]P;sw�@JX�w©^N;>w�w©Â@JI}¸Nhz?uåywO)@P;s9�9iIÁw�@J9�9[KAX r ^N;sw r @Wåy¸Á9�=<M>@�w©Â@Pj wkh}w�@J9�93KAX�;WVGhzKAw�w©Â@�O�@J9º;swk= e @�@�ã*@J]Jw�= e @P?A@JX�X�h>¼¡¸N=Æã*@PO�@P?WwXkw©O�;sw�@J»\=i@JXxDR Â@PO�@[=iX[;W?AhWw©Â@PO r ;xI�hs¼&?AhWwk=i]J=º?A»Cw©^N;sw-w©Â@�;WVGh e @�Y�]J=iwk@J¸�w�IL¿G@JX4hs¼&]Jhzjd¿N;WO�=�X�hz?CO�@J9º;sw�=�hz?AX:¼ß;>9i9

X�ÂhzO�wfhs¼¡=�¸N@P;s9�l4;W?A¸Áw©Â=�X�Â@J9º¿N@J¸ÇKAX�¼�hA]PKAX�hzKNO�;sw�w�@P?\w�=�hz?Ã=º?H;ª¸N=Æã*@PO�@P?Ww�¸N=ºO�@J]Jwk=ihA?uD76[hz?AX�=�¸N@POw�Â@3¼�hW9�9�h r =º?A»�X�=ºj�¿A9�@f@J¾L;Wjd¿A9i@WD T @Jw0�²VN@�;�¿NO�h\»zO�;Wj r =�w©^,¸Nhzj�;s=º?78:9<; b l ` l q l p ly½>=zD Q X�X©KNj6@w�Â@PO�@�=�X�hz?A9�I}hz?A@f¼�;s=�9ºKNO�@�Y�]P;WKAX�=º?A»}=º?N¿NKAwf=<?Îw©Â@�¸NhAj�;s=º?ulE?N;WjC@J9�I b DQ X�X©KNj6@�w©^N;>w � � O�@JÔNKA=<O)@JX�w©Â@ªX�@J9�@J]Jw�=�hz? hs¼�hz?A@ªw�@JX�wC]P;sX�@d¼�O�hzj(w©Â@}X©KNVG¸Nhzj�;s=º??; b l ` l q =

;\?A¸"hz?A@Cw�@JX�w�]P;sX�@�¼�O�hzj w©Â@,X©KNVN¸Nhzjd;s=º?@; p ly½A=zl r Â=�9i@ ��,O�@JÔNKA=<O)@JX�w©Â@�X�@J9�@J]Jw�=�hz?Ãhs¼3hA?A@�w�@JX�w]P;>X�@,¼ßO�hAj w©Â@CX©KNVN¸Nhzjd;s=º?B; b l ` l q =C;W?A¸Áhz?A@�w�@JX�w�]P;>X�@,¼ßO�hAjêw©Â@dX©KNVN¸Nhzjd;s=º?C; b l p ly½A=zD R Â@P?Xk=i¾Üw�@JX�w�X�@Jw�X,X©;sw�=�X�¼�IÁ]PO�=�w�@PO�=�hz? ��JÕ7; b l p =zl�; b ly½A=zl�; ` l p =zl�; ` ly½A=zl�; q l p =zl*;W?A¸D; q ly½A=Aluhs¼ r Â=�]_^w r hEluáE; b l p =�;\?A¸F; b ly½A=sâJlWhzO7hz?A@�Y�w©Â=ºO�¸"@J¾N¿Nh\X�@�w©Â@f¼�;WKA9�wPD3m�=<?A@Cw�@JXkw¡Xk@Jw�X�X©;swk=iX)¼ÚIª]PO�=�w�@PO�=�hz? ��PÕ; b l b =zl>; b l p =zl�; b ly½A=AlA; ` l b =zl�; ` l p =zl�; ` ly½A=AlA; q l b =zl�; q l p =zlz;W?A¸G; q ly½>=zlWhs¼ r Â=�]J^ªÅ e @,@J¾L¿GhWX�@�w�Â@¼�;WKA9�wPlAhzO$jChzO�@�w�^N;W?�hA?A@�Y¥^N;s9Æ¼�hs¼*w©Â@�¿Nh\X�X�=ºVA9�@�w�@JX�w$X�@Jw�XPD R Â@PO)@�¼ÚhzO)@Wl ��3X�KNVAX©KNjC@JX ��VNKAw¡w�Â@/uÙ¥ç7 IH �ì 6�ì³è -�w©^N;swf;�w�@JXkw�X�@JwfX�@J9�@J]Jw�@J¸ÝKAXk=<?A» � � r =�9i94@J¾N¿Nh\X�@�;C¼�;WKA9�w�=�X�Â=i»AÂ@POfw©^N;W?}w�^N;sw[¼�hzO�;wk@JX�w�Xk@Jw�X�@J9�@J]Jw�@J¸ÞVWI ��JD R Â@�O�@P;sX�hA?}w©^N;swfw©Â=�X�^N;W¿N¿G@P?A@J¸ r ;sX�w�^N;sw b l%w©Â@Chz?A9�I"=º?N¿NKAw�w�^N;sw¼�;s=�9�@J¸*l4hA]J]PKNO�O�@J¸Ç=º?ÇVNhWw�^Áhs¼��xåyX,X©KNVN¸Nhzjd;s=º?AXPl¡VNKAw r ;sX�=º?Þhz?A9�IHhz?A@ªhs¼�� _åyX,X©KNVN¸NhAj�;s=º?AXPDR Â@PO�@�¼ÚhAO�@ b ]JhzKA9�¸"VG@�X�@J9�@J]Jw�@J¸";sX[w©Â@�O�@P¿NO�@JX�@P?\w©;sw�= e @fhs¼�@J=�w©Â@PO7hzO3VGhWw©^ªhs¼ � � åyX$X©KNVN¸NhAj�;s=º?AXPlVNKAwf;sX�w©Â@�O�@P¿NO)@JX�@P?Ww�;sw�= e @�hs¼4hz?A9�I}hz?A@�hs¼ ��JåyX�X©KNVG¸Nhzj�;s=º?AXPD

3

� � #&�_��Ç *�f��k��#%�&��2�� !3��#*�� *!3#R Â@�hzVAX�@PO e ;sw�=�hz?ª¸N@JX�]PO�=ºVG@J¸é;>w¡w�Â@�@P?A¸"hs¼�w�Â@�¿NO�@ e =�hzKAXfX�@J]Jw�=�hz?ª9�@J¸Ãg&O�;W?NM\9*;W?A¸"FÜ@JILKNMs@PO$w�h]JhA?AX�=�¸N@PO*¸N@�Å&?A=º?A»�O�@J9º;sw�=�hz?AX-w©^N;sw r hAKA9i¸C;s¸N¸EO�@JX�X-¿NO�hzVA9�@PjCX-hs¼Lw�Â=iX4?N;sw©KNO)@WD�ÈA@ e @PO�;>9zO�@JX�@P;WO)]_Â@PO�X^N;>¸�¿NO�@ e =ihAKAX�9�IÍKAX�@J¸};�¿NO)hzVN;WVA=�9�=iXkw�=�]�jC@P;sX�KNO�@�� w�h�;>X�X�@JX�X$w©Â@�;WVA=�9�=�w¥Iªhs¼�;�wk@JX�w�=º?A»�;W¿N¿NO)hz;s]J^wkh�KN?A]Jh e @POä¼ß;WKA9�w�X[;W?A¸ÇN@Jw�@PO�jC=º?A@ r Â@Jw©Â@PO:hz?A@[]PO�=�w�@PO�=�hz? r ;>X�jChAO�@[@�ãÏ@J]Jwk= e @�;sw-Å&?A¸N=º?A»,¼ß;WKA9�w�Xw�^N;W?";W?Ah\w©Â@POJlN=º?A]J9ºKA¸N=º?A»�� ½Ll a l ` ½ � D�·�?"Z7@�¼Ú@PO�@P?A]J@�� lNg&Ok;W?NMW94;W?A¸ÃFH@JILKNM>@PO�=º?\w©O�hA¸EKA]J@J¸¹w�Â@]Jh e @PO)X¡;W?A¸}KN?A= e @PO�X©;s9�9�I}]Jh e @PO�X[O�@J9º;sw�=�hz?AX�;W?A¸"KAX�@J¸�� ;sX�; r ;xIChs¼�;sXkX�@JX�X�=º?A» r Â@Jw©Â@PO$w�@JX�wk=<?A»Xkw©O�;sw�@J»\=i@JXCO�@J9º;sw�@J¸àV\IHw©Â@JX�@}O�@J9º;sw�=�hz?AX r @PO)@�»zKN;\O�;W?\w�@J@J¸Hw�hHVN@"j6hzO�@�@�ã*@J]Jw�= e @";sw,¸N@Jw�@J]Jw�=º?A»¼�;WKA9�w�XPD�� r ;sX�¼ÚhzOkj�;s9�9�I¹¸N@�Å&?A@J¸é¼ÚhzOf¿NO�hW»AO�;Wj � r ÂhWX�@CX©KNVG¸Nhzj�;s=º?AXC;WO�@ ; 8'� 8%�� 8��'=zlX�¿N@J]J=ÆÅE]P;sw�=�hz?��Ç;W?A¸}w�@JXkw�X�@J9�@J]Jw�=�hz?}]PO)=iwk@PO�=�hz? �Â;sX$¼ÚhW9�9�h r XPÕ4Ë�@P?Ah\w�=º?A»�w©Â@�X�=! J@�h>¼�X©KNVG¸Nhzj�;s=º?8��V\I��lL;\?A¸"9�@Jw�w�=º?A»��VG@�w©Â@�?AKNjCVN@PO�hs¼*¼�;s=�9<KNO)@�Y�]P;WKAX�=º?A»}=º?N¿NKAw�X�=º?�8��lGw©Â@P?

� á ��3â 9 `�� á `��

� �� â�

Q X�X©KNj6=<?A»�w�Â@3=º?A¸N@P¿N@P?A¸N@P?\w3X�@J9�@J]Jw�=�hz?,hs¼EhA?A@3w�@JX�w-]P;sX�@:¼ßO)hzj²@P;s]J^�X©KNVG¸Nhzj�;s=º?CKAX�=º?A»�;�KN?A=Æ¼�hzO�j¸N=�X�w�O�=ºVNKAw�=�hz?ul!� =�X�w�Â@�¿NO�hzVN;\VA=i9�=�w�I}w©^N;sw�;Cw�@JXkw�X©KA=�w�@ r =i9�9-@J¾L¿GhWX�@�;sw�9i@P;>X�w�hz?A@�¼ß;WKA9�wPDguO�;W?NM\9&;W?A¸}FÜ@JILKNMs@PO:¼�hzO�j�;>9i9�Iª¸N@�Å&?A@J¸}w©Â@�]Jh e @PO�X[O�@J9º;sw�=�hz?};sX$¼�hW9�9ih r XxÕ T @Jw ��¡;W?A¸ ��VN@

]PO)=iwk@PO�=º;Nlz;W?A¸d9i@Jw�"$#�%[á ��$â-¸N@P?AhWw�@�w©Â@f?Ahz?A@Pj�¿Aw�I�jCKA9�w�=�X�@Jw[hs¼&X�KNVN¸Nhzj�;>=<?AX$¼�O�hzj r Â=�]J^Cw�@JX�w]P;>X�@JX�;WO�@fX�@J9�@J]Jw�@J¸"w�hCX©;>w�=�X�¼ÚId]PO�=�w�@PO�=�hz?'� ¼�hzO[¿NO�hW»zO�;\j �Ä;W?A¸}X©¿G@J]J=ÆÅE]P;sw�=�hz?&��D �� ,�çWØx×PÙ�#��¼�hzO�')(+*-,/.�=Æ¼3¼�hzOf@ e @PO)I"X©KNVG¸Nhzj�;s=º?C8102"$# % �Wá ��3�3â�w©Â@PO�@�=�X�;ª]Jh\9i9�@J]Jw�=�hz?D; 8'� �4� �5�8��*=�hs¼X�KNVN¸Nhzj�;>=<?AX�VG@J9ihA?A»W=º?A»�w�h6"+# % �>á ��3�3âäX©KA]_^dw©^N;sw 8 �879� �4�:7�8�� 9 8ÃD �� zæ%ì�Øx×PÙ� H 6 6!-,�çWØP×xÙ ��=Æ¼4¼�hzO$@ e @PO�I"¿NO�hW»AO�;Wj}l\X©¿N@J]J=ÆÅE]P;sw�=�hz?Á¿N;s=ºOCá ��$âJl � ��]Jh e @PO�X0��[¼�hzO�á ��3â�DR Â@JI�X©Âh r @J¸C=<? � �� lsw©^N;sw3;�?AKNjCVN@PO-hs¼ r @J9�9ÆY¥MA?Ah r ?C]PO�=�w�@PO�=º;�;\O�@�O�@J9º;sw�@J¸�VWICw©Â@[]Jh e @PO�X4O�@J9º;xY

wk=ihA?ulWVNKAw4w©^N;sw*@ e @P?,=Æ¼ � ��]Jh e @PO�X ��-¼�hzO3á ��3â�lP=�w4=�X3¿NhWXkX�=ºVA9i@7¼ÚhzO;�Âá ��.��$â=<>�Âá ��4.��3�3âJDR Â@JI}X©Âh r @J¸Ãw©^N;sw�w�Â=iX�XkhzO�w�hs¼3=º? e @PO�X�=�hz?Á^N;W¿N¿G@P?AX r Â@P?";dX©KNVG¸Nhzj�;s=º?Ãhs¼3w©Â@,]Jh e @PO�=º?A»�]PO�=ÆYwk@PO�=�hz?ª=�X1KAX�@J¸Ãw�hC]Jh e @PO�jChzO)@�w©^N;W?ªhz?A@�X©KNVG¸Nhzj�;s=º?Îhs¼�w�Â@�]Jh e @PO�@J¸}]PO�=�w�@PO�=�hz?uDR Â=iX�9i@J¸}guO�;W?NM\9*;W?A¸}FH@JINKNMs@PO$w�hÇN@�Å&?A@�;C?A@ r O�@J9º;sw�=�hz?ulAw©Â@�¿NO)hz¿N@PO�9�Iª]Jh e @PO�X�O�@J9º;sw�=�hz?ulN=º?

Z7@�¼Ú@PO�@P?A]J@�� D R h}X�hW9 e @ªw©Â@�¿NO�hzVA9�@Pj(hzVAX�@PO e @J¸Á¼�hzOfw©Â@�]Jh e @PO�X�O)@J9<;>w�=�hz?ul-w©Â=�X6?A@ r O�@J9º;sw�=�hz?O)@JÔLKA=ºO�@JXfw©^N;sw[w©Â=�Xf]P;W?uåyw�^N;W¿N¿G@P?uD3g%hzO�j�;>9i9�I r @�^N; e @WÕT @Jw?"$# % �>á ��3�3â�9 ; 8 �� 4� �4�5 8 �@ =zls;W?A¸�"+# % �Wá ��$â 9 ;.8 � � �4� �5�8 �� =zD ��)/&Ù�ç�/L×xÙ.6!-�,�çWØP×xÙ

�� 3JçWÙA')(+*-,/.�=Æ¼3w©Â@PO�@�=�X�;�jCKA9�w�=ÆY�X�@JwB 9 ; 8 ��DC � �4� �5�8 ��5C E3F 4� �4�5 8 ��C � 4� �4�5 8 ��C E5G =

X�KA]_^ªw©^N;>w B =�X�;CX©KNV\Y¥jCKA9�w�=ÆY�X�@Jw�hs¼?"$# % �á ��3â[;W?A¸8 � � 9 8 ��DC � 7��4� ��7�8 ��5C E3F

DDD8 �� 9 8 ��C � 7�� 4��7�8 ��/C E5G

·�?\¼ÚhAO�j�;s9�9�ICw©Â=�X¡X�;PIAX4w©^N;sw4=Æ¼ ��3¿NO�hz¿G@PO�9�I�]Jh e @PO�X ��$w©Â@P?6@P;s]_^6hs¼ ��På X4X©KNVN¸Nhzjd;s=º?AX¡]P;\?�VN@Ñk]Jh e @PO�@J¸NÓ�VWI ��4X©KNVN¸NhAj�;s=º?AX1á³@J¾N¿NO�@JX�Xk@J¸�;sX3;�KN?A=�hz?6hs¼&X�hAjC@ ��-X©KNVN¸Nhzjd;s=º?AX©âJD3·�?�;s¸N¸N=�w�=�hz?ul=�wCj�KAXkw�VN@�¸Nhz?A@d=<?ÜX©KA]J^H; r ;xI"w©^N;sw�?AhA?A@�hs¼ � �PåyX�X©KNVN¸NhAj�;s=º?AXChz]J]PKNO�XCjChzO�@Chs¼�w�@P?Ã=º?Hw�Â@]Jh e @PO)=<?A»Üw©^N;W?Ü=iwª¸NhA@JX�=º?H"+#9% � l3w©Â@PO)@PVWIÇ¿NO�@ e @P?\w�=º?A»Hw©Â@}X�hAO�wChs¼1jC=�X�9�@P;s¸N=º?A» e =i@ r hs¼1w�Â@]PO)=iwk@PO�=º;NåyX�@�ã*@J]Jw�= e @P?A@JX�Xfw©^N;sw r @fX©; r =º?}w�Â@�@P;WO�9�=�@PO�@J¾N;Wj�¿A9�@WD� � �AæEì³ØP×xÙ �H 6 6!- /uÙ¥ç5/L×PÙ�6!-,�çWØP×xÙ ��7=v¼ä¼ÚhzO:@ e @PO�I�¿NO)hW»zO�;Wj �Ä;\?A¸�X©¿N@J]J=ÆÅE]P;swk=ihA?&��l2��¡¿NO�hA¿\Y

@PO)9iI}]Jh e @PO)X � � ¼�hzO�á ��3�3âJD

4

·ßw r ;sX�¿NO�h e @J¸Ã=<? � �� w©^N;>w�=Æ¼ � �1¿NO�hz¿G@PO�9�I"]Jh e @PO�X��1¼ÚhzOf¿NO�hW»AO�;Wj c ;\?A¸¹X�¿N@J]J=ÆÅE]P;sw�=�hz?HÈulw�Â@P?�� á � � ��3â � �Âá ��4.��3�3âJDR ^zKAX r @�]P;W?ªX©;xI�=º?};,]Jhz?A]PO�@Jw�@ r ;xI�w©^N;>w¡]PO)=iwk@PO�=�hz?'��[=iX�jChzO)@�@�ã*@J]Jw�= e @�;sw$Å&?A¸N=º?A»d¼ß;WKA9�w�X

w�^N;W?Ç]PO�=�w�@PO)=ihA? � � l$¼�hzOª;ÁX©¿N@J]J=ÆÅE]Ý¿NO)hW»zO�;Wj �CD (�@P?A@PO�;s9�=! J=º?A»àw©Â=�Xªw©Â@JhzO�@Pj�VWIàKAXk=<?A»Çw�Â@KN?A= e @PO)X©;s9�9�IÝ¿NO�hz¿G@PO�9�I¹]Jh e @PO)X�O�@J9º;sw�=�hz?Ãw©Â@JIÁX©Âh r @J¸¹w�^N;sw�w�Â@PO�@ r @PO)@6jd;W?WI r @J9i9ÆY¥MA?Ah r ?Áw�@JX�wXk@J9i@J]Jwk=ihA?ª]PO�=�w�@PO�=º;Cw©^N;sw r @PO�@1O)@J9<;>w�@J¸ÍV\I�w©Â@�KN?A= e @PO�X©;>9i9�I}¿NO�hz¿G@PO�9�I�]Jh e @PO�X[O�@J9º;sw�=�hz?ulE;\?A¸ÍÂ@P?A]J@w�Â@JX�@�]PO�=�w�@PO�=º;d]JhzKA9�¸"=º?";CXk@P?AX�@�VG@�O�;W?NM>@J¸*D·�?Ý;Î¼�hW9�9�h r Y¥KN¿Ç¿N;W¿N@PO �� l4g&O�;\?NMW9[;W?A¸ÝFÜ@JILKNMs@POd?A@J¾zwC=º? e @JX�w�=�»z;sw�@J¸ r Â@Jw©Â@PO6w©Â@PO�@ r @PO)@

h\w©Â@PO�;\¿N¿NO�hz¿NO�=º;sw�@ r ;xIzX-hs¼&;sXkX�@JX�X�=º?A»�w©Â@$¼�;WKA9�w�Y�¸N@Jw�@J]Jw�=º?A»�;\VA=i9�=�w�IChs¼&;�]PO)=iwk@PO�=�hz?ulz;W?A¸Cw©Â@PO)@�¼ÚhzO)@]JhA?AX�=�¸N@PO�@J¸ �ªl�w©Â@Ç×�� /L×�,Pè�×�+Þæ �Aë k×PÙÁç 3 3 H\ì 6!�AÙ¥×� +W×xè�×.,xè�×.+\D Q »A;s=º?ul�9�@Jw�wk=<?A» "$# % á ��3�3â�9;.8 � 4� �4� 8 � =zl�;\?A¸ ;sX�X�KNjC=º?A»Ý=º?A¸N@P¿N@P?A¸N@P?\wHO�;W?A¸Nhzj X�@J9�@J]Jw�=�hz?²hs¼�hz?A@Ãw�@JX�w�]P;>X�@}¼�O�hzjÒ@P;s]J^X�KNVN¸Nhzj�;>=<?uluKAX�=º?A»};�KN?A=Æ¼ÚhzOkjÂ¸N=�X�w©O�=ºVNKAw�=�hz?ul � r ;>X¡¸N@�Å&?A@J¸Áw�hªVN@WÕ

�Íá ��3â29��

� ��

guO�;W?NM\9W;W?A¸�FH@JINKNMs@PO-¿NO�h e @J¸�w©^N;swu=�w-=iX4;s9�X�hfw©O�KA@4w©^N;>w*=Æ¼ ��Ï¿NO)hz¿N@PO�9�I,]Jh e @PO�X)��ä¼ÚhAO*¿NO�hW»zOk;Wj��;W?A¸}X©¿G@J]J=vÅE]P;>w�=�hz?��lAw©Â@P?��}á � ��.��3�3â � �}á �� 3â�DR Â@JI";s9�X�h�¿NO�h e =i¸N@J¸Á@J¾N;Wj�¿A9�@JXfw©^N;sw�X©Âh r @J¸"w�^N;sw�=º?}w©Â@,]P;sX�@,=<? r Â=�]_^��X�KNVAX©KNjC@JX��Pl

VNKAw +WçP×��æEçWè*¿NO�hA¿N@PO�9�I}]Jh e @PO0��xlNw©Â=�X�=�X�?AhWw�?A@J]J@JX�X�;WO�=�9�I"w©Â@�]P;sXk@WDR ^zKAXPlAVWI�KAX�=º?A»Cw©Â@�KN?A= e @PO�X©;s9�9�I}¿NO�hz¿N@PO)9iId]Jh e @PO�X¡O�@J9º;swk=ihA?ulzguO�;W?NM\9E;W?A¸ªFH@JILKNM>@PO r @PO�@�;WVA9�@

wkh6Ok;W?NMCw�@JX�wk=<?A»d]PO�=�w�@PO�=º;�KAX�=º?A»}VNhWw©^dw©Â@�¿NO�hAVN;WVA=�9i=�w�I}hs¼�¸N@Jwk@J]Jw�=º?A»Í;sw[9�@P;sX�w[hz?A@f¼�;WKA9�w�;W?A¸}w�Â@@J¾N¿N@J]Jwk@J¸ ?AKNjCVN@PO�h>¼¡¼�;WKA9�w�X,@J¾L¿GhWX�@J¸*l4;W?A¸H¸N=�¸ÞX�h}¼�hzO�O�hzKA»AÂ9iIÞ;ª¸Nh J@P? r @J9�9ÆY¥Mz?Ah r ?Üw�@JX�wk=<?A»]PO)=iwk@PO�=º;ND

� � ��.�)�&�[�u��#��H,�� -��"� ��#u��#

Q 9�w©ÂhzKA»z^dw©Â@�KN?A= e @PO�X�;s9�9iI}¿NO�hz¿G@PO�9�I�]Jh e @PO)X¡O�@J9º;sw�=�hz?ª=�X�w�Â@1jCh\X�w¡?N;sw�KNO�;s9&;\?A¸Í¿NO�hAjC=�X�=º?A» r ;PIh>¼G;sXkX�@JX�X�=º?A»fw©Â@4@�ã*@J]Jw�= e @P?A@JX�X-hs¼Lwk@JX�w�=º?A»�Xkw©O�;sw�@J»\=i@JX-¿NO�hz¿Nh\X�@J¸�w�h�¸E;sw�@Wlxw©Â@PO�@3;WO�@4Xkw�=�9i9N;f?zKNjCVN@POh>¼�9�=ºjC=�w©;sw�=�hz?AX�;sX�Xkhz]J=º;sw�@J¸ r =�w©^};W?\I�X�KA]_^};W?N;>9iIAX�=�Xfw©^N;sw�X©ÂhAKA9i¸ÁVN@CO�@J]JhW»z?A=! J@J¸*DÊ ?A@[=ºj�¿GhzO�w©;W?\w�¿NO�hAVA9i@Pj w�^N;sw r ;sX4?AhWw*]Jhz?AX�=�¸N@PO�@J¸ª;WVNh e @$=iX-w©^N;sw4;s9�9Ahs¼Lw�Â@JX�@�O�@J9º;sw�=�hz?AX r @PO)@

;\¿N¿A9i=�@J¸Ãw�hC]Jhzj�¿N;WO�@f=�¸N@P;s9�=! J@J¸ e @PO�Xk=ihA?AX�hs¼�w�@JXkw�=º?A»�Xkw©O�;sw�@J»\=i@JX r Â=�]_^Ã;WO�@ e =ºO�w©KN;s9�9�I"?A@ e @PO[KAX�@J¸=º?Þ¿NO�;s]Jw�=�]J@WD}·�?Ü;}X�@P?AX�@Wl-w©^N;>w�=iX,w©Â@ª]_^NO�hA?A=i]ª¿NO�hzVA9�@Pj ;sX�X�hA]J=º;sw�@J¸ r =�w©^¹¼ÚhzOkj�;s93;W¿N¿NO�hA;s]_Â@JXwkh�X�hs¼�w r ;\O�@1¿NO)hz]J@JX�Xk@JXPD�·[VN@J»z;W?Îw©Â=�X�w�;s9ºM}VWI}¸N=�X�]PKAX�Xk=<?A»"j,I}@J¾N¿N@PO�=�@P?A]J@ r =iw�^}w�@JX�wk@PO�X�X©;xIA=<?A»w�^N;sw3w©Â@JIª?A@ e @PO[X©; r ¼�hzO�jd;s9EX©¿G@J]J=ÆÅE]P;sw�=�hz?AXf=<?}¿NOk;s]Jw�=�]J@WlN;W?A¸}w©Â@PO�@�¼�hzO�@WlA?Ah6jd;sw�w�@PO$Âh r »WhAhA¸;�¼ÚhzOkj�;s9&;\¿N¿NO�hz;s]J^ªw�hCw�@JX�w�=º?A»�j6=i»A^Ww�;\¿N¿N@P;WO[wkh�VN@WlN=�w r ;sX�?AhWw�hs¼�=º?\w�@PO�@JX�w�w�hCw©Â@PjÂ=Æ¼�=�w r ;sX¿NO)@J¸N=i]P;>w�@J¸"hz?};�¼ÚhzOkj�;s9uX©¿N@J]J=ÆÅE]P;swk=ihA? r Â=i]J^}¸N=�¸Á?AhWw�j�;swk]_^ªw©Â@J=ºOfO�@P;s9�=�w�IWDÈA=ºjC=�9º;WO�w¥IN¿N@JX,hs¼3=�X�X©KA@JXC;WO�@�;sX�X�hA]J=º;sw�@J¸ r =�w©^H;>9i94h>¼¡w©Â@C]Jhzj�¿N;\O�=�X�hz?ÁO�@J9º;sw�=�hz?AX,w©^N;sw�·�¸N=�X�Y

]PKAXkX�@J¸";WVNh e @WD:gEhzO$@J¾N;Wj�¿A9�@WlNhz?A@�]JhzjdjChz?A9�I�]JhA?AX�=�¸N@PO�@J¸Áw�@JX�w�=º?A»�]PO�=�w�@PO)=ihA?ª=iX% JÙ HWæ ,Jî�è�×�_è�ì³æWíAl;>9iXkh"Mz?Ah r ?Ã;sX%+W×�,Pì4_ì³çWæ�,©ç\ØP×PÙ HJíA×PD�·�?\¼�hzO�jd;s9�9iIWl-VNO�;W?A]J^Ãw�@JX�w�=º?A»"O�@JÔNKA=ºO�@JX�w©^N;>w�X©K'3ª]J=i@P?\w�w�@JX�w]P;>X�@JX3VN@�=º?A]J9ºKA¸N@J¸}X�h�w©^N;>w4@ e @PO�I�VNOk;W?A]_^,hzO-hAKAw�]JhzjC@[hs¼*;f¸N@J]J=iXk=ihA?�X�w�;sw�@PjC@P?\w�=º?dw©Â@�¿NO�hW»zOk;WjKN?A¸N@PO7w�@JX�w�VG@�@J¾z@PO�]J=�X�@J¸Á;sw[9�@P;sX�w�hz?A]J@WD$m�h�j6@P?Ww�=�hz?ª=�X�jd;s¸N@�hs¼�Âh r w©Âh\X�@�wk@JX�w[]P;sX�@JX�;WO)@�w�hVG@�X�@J9�@J]Jw�@J¸*D[ÀÁhzO)@f¼ÚhzOkj�;s9�9�IWlE=º?}hAO�¸N@PO[w�h�¿NO)h e @�w©Â@�X�hAO�w�X[hs¼3w©Â@JhzO)@PjCX�w©^N;sw r @Wå e @�¸N=�X�]PKAXkX�@J¸;\VNh e @Wl*=�w r ;sX�?A@J]J@JX�X©;\O�IÁw�h¹j�;\Ms@�w©Â@�¿NO)hz]J@JX�X�jChAO�@�¿NO�@J]J=�X�@WD}gEhAO�w©Â=�X�O�@P;sX�hA?ul*w©Â@C¼�hzO�jd;s9¸N@�Å&?A=�w�=�hz?Þh>¼1VNO�;W?A]J^Hwk@JX�w�=º?A»¹;sXkX©KNjC@JXCw©^N;sw,w©Â@�¸NhAj�;s=º?H=�X,Å&O�X�wÇN= e =i¸N@J¸Ç=º?\w�hÁX©KNVN¸NhAj�;s=º?AXPl@P;>]_^d]Jhz?\w©;s=º?A=º?A»�@J¾N;s]Jw�9�I�w�ÂhWX�@�jC@PjCVN@PO�X[hs¼*w©Â@f=º?N¿NKAw¡¸NhAj�;s=º?ªw©^N;sw$]P;WKAX�@�;�»W= e @P?ªVNO�;W?A]J^�=º?w�Â@�¿NO�hW»zO�;\j+wkh�VN@,@J¾z@PO�]J=�X�@J¸*D R Â@P?Î=iwf=�X�;sX�X�KNjC@J¸"w©^N;>w¡hA?A@�@J9�@PjC@P?\w�hs¼4@P;s]J^ªX©KNVN¸NhAj�;s=º?}=�XOk;W?A¸NhzjC9�IªX�@J9�@J]Jw�@J¸HKAX�=º?A»Í;�KN?A=Æ¼�hzO�jÂ¸N=�X�w�O�=ºVNKAw�=�hz?uD

5

·ßw3=�X3¸N=43�]PKA9�w�wkh�=<jd;s»W=º?A@�w�^N;sw4w©Â=�X¡¿NO�hA]J@JX�X r hzKA9�¸�@ e @PO$VN@[¼�hW9�9�h r @J¸ª=º?�¿NO�;s]Jw�=�]J@WD c O�;s»zjd;sw�Y=�]P;s9�9�IWluVNO�;W?A]J^�w�@JXkw�=º?A»�wk@P?A¸NX¡wkh�VN@�KAXk@J¸ÍjChAO�@�h>¼Úw�@P?d;sX�; r ;xIChs¼�;sX�X�@JXkX�=º?A»�w�Â@�w©ÂhAO�hzKA»z^N?A@JX�Xh>¼¡w�@JX�wk=<?A»%l*O�;sw©Â@POfw©^N;\?¹;>X�;}VN;sX�=�Xf¼ÚhAOfX�@J9�@J]Jw�=º?A»"w�@JX�w�]P;>X�@JXPD Q w�@JX�wk@POfw¥IN¿A=�]P;s9�9�I¹Xk@J9i@J]JwkX�w�@JX�w]P;>X�@JX�VN;sX�@J¸Ãhz?}=º?\w©KA=�w�=�hz?Á;W?A¸}@J¾N¿N@PO�=�@P?A]J@�KN?\w�=�9�w�Â@JIÍVG@J9i=�@ e @dw©Â@JI"^N; e @�¸Nhz?A@�;6]Jhzj�¿NO�@PÂ@P?\YXk= e @�Ð�hzVuD R Â@JI"jC=�»z^\w�w©Â@P?}KAX�@C;�VNO�;W?A]J^ª]Jh e @PO�;s»W@�wkhzhW9uw©^N;>w¡¸N@Jwk@PO�jC=º?A@JX�w©Â@�¿N@PO)]J@P?Ww©;>»W@�hs¼w�Â@�VNO�;W?A]JÂ@JX3hs¼*w©Â@f¿NO�hW»zO�;\j w©^N;sw3^N; e @�VG@J@P?�@J¾A@PO�]J=�X�@J¸}VWICw©Â@�wk@JX�w3X©KA=�w�@fw©Â@JIuå e @�;sX�Xk@Pj�VA9�@J¸XkhC¼ß;\OJD4·³¼3w©Â@C¿N@PO�]J@P?\w©;s»W@�=�X�Â=�»zûlEw�Â@�w�@JX�w�@PO�j6=i»A^Ww�w�Â@P?}X�@J@ r Â=�]J^ÁVNO�;W?A]JÂ@JX�^N;s¸¹?Ah\w�VN@J@P?]Jh e @PO)@J¸";W?A¸}w©O�I�wkh�¸N@Jw�@PO�jC=º?A@C;W?ª=º?N¿NKAw�w©^N;>w r hzKA9�¸Ã]P;WKAX�@�@P;s]J^ªhs¼4w©Â@�KN?A]Jh e @PO�@J¸¹VNOk;W?A]_Â@JXwkhÍVG@�@J¾A@PO�]J=�X�@J¸*DC·³¼3w©Â@�¿G@PO�]J@P?Ww�;s»W@ r ;sX�9�h r l%w©Â@P?Ãw©Â@Cw�@JX�w�@PO r hzKA9�¸Á9i=ºMs@J9�IÁ]Jhz?\w�=º?zKA@dw�hÍKAXk@;>¸éÂhA]�jC@Jw�Âhz¸NX�hs¼[X�@J9�@J]Jw�=º?A»"w�@JXkw�]P;sX�@JX�;W?A¸Áw©Â@P?HO)@P;sX�X�@JX�X�w�Â@6VNOk;W?A]_^Ã]Jh e @PO�;>»W@�;s]JÂ=�@ e @J¸*l=�w�@POk;sw�=º?A»�KN?Wwk=i9Aw©Â@�¿N@PO)]J@P?Ww©;>»W@3hs¼&VNOk;W?A]_Â@JX4]Jh e @PO)@J¸�@J¾A]J@J@J¸N@J¸�;�¿NO)@JX�]PO�=ºVN@J¸�9�@ e @J9NhAO*w©Â@$w�@JX�w�@POVG@J9�=i@ e @J¸¹w�^N;sw�w©Â@JI}^N;s¸"¸NhA?A@�@P?AhzKA»zûD·Ú¼�VNO�;W?A]J^ w�@JX�w�=º?A»Þ=iX}KAX�@J¸²=º? w©^N;sw}j�;W?N?A@POJl[w©Â@P? r @¹MA?Ah r æEç\è³îzì�æ\í 1-î HWè JçP×xØP×xÙ�;WVNhzKAw

Âh r =�w�X�@�ã*@J]Jw�= e @P?A@JX�X�]Jhzj�¿N;WO�@JX�w�hChWw©Â@PO$w�@JX�w�=º?A»�Xkw©O�;sw�@J»\=i@JXxlLVG@J]P;WKAX�@ r @�¸N=�¸¹?AhWw�;sXkX�@JX�X�è³î HWèe @PO�X�=�hz?Ühs¼1VNO�;W?A]J^Üw�@JX�w�=º?A»El r @};sX�X�@JXkX�@J¸ ;\?H@P?\w�=ºO�@J9�IÝ¸N=Æã*@PO�@P?\w�w�@JX�wk=<?A»HjC@Jw�Âhz¸*D R Â@ªX©;Wj6@=�X�w©OkKA@�¼�hzO�;s9�9-hs¼3w©Â@Cw�@JX�w�=º?A»ªX�w©O�;>w�@J»W=�@JX�]JhAj�¿N;WO�@J¸ÎY¡w©Â@JI r @PO�@C?AhWw�w�Â@�Ù�× H26NX�w©O�;>w�@J»W=�@JX�w�^N;swwk@JX�w�@PO�X�KAX�@,w�h�X�@J9�@J]Jwfw�@JX�w[]P;sX�@JXPlGw©Â@JI r @PO�@�=�¸N@P;s9�=! J@J¸ e @PO)X�=�hz?AXPDQ ?AhWw©Â@PO:9�=<j6=iw�;sw�=�hz?dhs¼*w©Â@ r hzO�M�¸N@JX�]PO�=ºVN@J¸";WVGh e @�=�X3w©^N;>w3w©Â@PO�@�=iX�?AhC¿NO�h e =�X�=�hz?,¼�hzO$^zKNj�;\?

e ;WO�=º;WVA=�9�=�w¥IWDf83;s]J^}wk@JX�w�@PO[]Jhzj6@JX�w�h�w©Â@,w©;WVA9�@ r =iw�^}w©Â@J=ºO�h r ?ªX�@Jw�h>¼�@J¾N¿N@PO�=�@P?A]J@JXPlu@J¾N¿N@PO)w�=�X�@JXPl;\?A¸é;>]JÔLKA=ºO�@J¸H=º?\w©KA=�w�=�hz?ul�;\?A¸¹Xkh�w r h�¸N=Æã*@PO�@P?Ww�wk@JX�w�@PO�X�KAX�=º?A»"@J¾N;s]Jw�9�I"w�Â@�X�;WjC@�;\¿N¿NO�hz;s]J^}w�hwk@JX�w�;d»W= e @P?ÃX�hs¼�w r ;WO)@�X�IAX�w�@Pj r =�9�94»W@P?A@PO�;s9�9�I"Xk@J9i@J]Jw�¸N=Æã*@PO�@P?\w�X�@Jw�X�h>¼3w�@JX�wf]P;sX�@JXPD R Â=�X�=�X�æEç\èVG@J]P;WKAX�@fhs¼*w©Â@ e ;WO�=º;WVA=�9�=iw�Iª¸EKA@�wkh�O�;W?A¸NhAjÄX�@J9�@J]Jw�=�hz?6Y�=�w$=iX�VG@J]P;WKAX�@fhs¼*=<?A¸N= e =�¸EKN;s9�= J@J¸H^zKNj�;\?VG@P^N; e =�hzO[;W?A¸�w�Â@�9º;sw�=�w©KA¸N@�¿NO�h e =i¸N@J¸ª=º?�w�Â@�X�@J9�@J]Jw�=�hz?ªh>¼Ï@J9�@PjC@P?\w�X[hs¼�;�X�KNVN¸Nhzj�;>=<?uD$Ö�h r ]P;\?r @,]Jhz¸N=Æ¼�I"w©Â=�X�VN@P^N; e =�hzOfX�hªw©^N;sw r @,]P;W?}X�;PI"j6@P;W?A=º?A»s¼ßKA94w�Â=<?A»\X�;WVNhzKAwfw©Â@,@�ãÏ@J]Jwk= e @P?A@JX�X�hs¼KAXk=<?A»ª¸N=Æã*@PO�@P?Ww�w�@JX�w�=º?A»�jC@Jw�Âhz¸NX©ÛQ ¸N=ÆãÏ@PO)@P?Ww�M\=º?A¸Hhs¼¡=�X�X�KA@�=�XCO�@J9º;sw�@J¸Áw�h}w©Â@�;W¿N¿NO�hA¿NO�=º;sw�@P?A@JX�X�hs¼�O�@J9�Iz=º?A»Ãhz?Ãw©Â@�jC@P;sX©KNO�@JX

� ;W?A¸ �Ä;>X7;CVN;sXk=iX$¼�hzO:¼Ú@J@J9�=º?A»�]Jhz?\ÅE¸N@P?\w�w©^N;>w3hz?A@fw�@JX�w�=º?A»CX�w©Ok;sw�@J»WIÇNhA@JX7;CVG@Jw�w�@POäÐ¥hAV�w©^N;\?;\?AhWw©Â@POJD3m�@J=�w©Â@POfhs¼4w©Â@JX�@CjC@P;sX©KNO�@JX�¸N=vã*@PO�@P?\w�=º;sw�@JX�;sw�;>9i94VN@Jw r @J@P?}Â=�»z^Ã]Jhz?AX�@JÔNKA@P?A]J@,¼ß;WKA9�w�X;\?A¸"w©O�= e =º;s9-¼ß;\KA9iwkXPD R Â@PO)@�¼ÚhzO)@WlE=Æ¼¡]PO)=iwk@PO�=�hz?��_l%w©Â@C]PO�=�w�@PO�=�hz?Ãw©^N;>w�¿NO�hz¿G@PO�9�I"]Jh e @PO�Xf]PO�=�w�@PO�=�hz?��Pl$@J¾L¿GhWX�@JX�w�O�= e =º;s9[¼�;WKA9�w�X r Â=i9�@��@J¾N¿Nh\X�@JX�]P;>w©;sX�w©O)hz¿NÂ=�]�¼�;WKA9�w�XPl$w©Â@P?Þw©Â@ª¼�;s]Jw�w©^N;>w�w�Â@¿NO)hW»zO�;Wj r ;sX[w�@JX�wk@J¸"KAX�=º?A» ��¸NhA@JX�?AhWwfO�@P;s9�9�I}=<?A¸N=�]P;swk@�w�^N;sw[=iwf=�X�jChzO)@�¸N@P¿N@P?A¸E;WVA9�@�w©^N;\?ª=iwr hzKA9�¸�^N; e @fVN@J@P?d=v¼*=�w¡^N;>¸�VN@J@P?dw�@JX�w�@J¸ªKAX�=º?A» ��PD R Â=�X[=�X3w©O�KA@�=<?dX©¿A=�w�@�h>¼Ïw�Â@[¼ß;>]Jw4w©^N;sw3jChzO)@¼�;WKA9�w�X r @PO�@�KN?A]Jh e @PO�@J¸�KAX�=º?A»� �_lW;W?A¸Cw©Â@PO)@ r ;sX3;fÂ=�»zÂ@PO49�=ºMs@J9�=ºÂhzhA¸}hs¼E@J¾N¿NhWXk=<?A»�¼ß;\KA9iwkXPlWX�=º?A]J@w�Â@�hz?A@JX�IWhzK r @PO�@�@J¾N¿Nh\X�=º?A» r @PO�@�hs¼49�=�w�w�9�@C]Jhz?AX�@JÔNKA@P?A]J@WDQ ?A¸ r ^N;sw�;WVNhzKAw�w©Â@�]JhWXkw¡h>¼�¸NhW=º?A»ªw©Â@�w�@JX�wk=<?A»ª=�w�X�@J9Æ¼_Û c @PO�^N;W¿AX:� � +WçP×�¡¸Nhª;CX�hzjC@ r ^N;sw

VG@Jw�w�@POfÐ�hzVÜhs¼�w�@JXkw�=º?A»Hw©^N;W?��xl3;W?A¸Ç@J¾N¿Nh\X�@JX�jChzO)@�¼�;WKA9�w�X�hs¼f@JÔLKA= e ;>9i@P?\w}X�@ e @PO)=iw�IHw�^N;W?��¸NhA@JXPDB�[KAw r ^N;swd=v¼��C]JhWX�w�XdhzO�¸N@PO�X�h>¼1j�;s»z?A=�w©KA¸N@ÁjChzO�@ªw�hHKAX�@Ãw©^N;W?��Û ·ßX�w©Â@";s¸N¸N@J¸VG@P?A@�ÅEw r hzO)w©^�w�Â@�;s¸N¸N@J¸}]JhWXkw©Ûc @POk^N;W¿AX�w©Â@"VA=�»W»\@JX�w�¿NO�hzVA9�@Pj(=iXdw©^N;sw r Â@P? r @};WO�@ª¸Nhz?A@�wk@JX�w�=º?A»Áw©Â@�Xkhs¼Úw r ;WO�@�KAX�=º?A»Ý;

»\= e @P?C]PO�=�w�@PO�=�hz?ulA@ e @P?C=Æ¼�=�w[O�@P;s9�9�I�=�X[w©Â@�VG@JX�w3h>¼&w©Â@�hA?A@JX¡VN@J=º?A»C]Jhz?AX�=�¸N@PO�@J¸*l r ^N;sw4¸Nh r @�MA?Ah r;\VNhzKAw�w©Â@d¸N@P¿N@P?A¸E;WVA=�9�=ºw�IÝh>¼¡w©Â@�wk@JX�w�@J¸ÁX�hs¼�w r ;\O�@PÛ R ^N;sw�¿NO�hzVA9�@Pj ^N;sX�?AhWwCVN@J@P?H;>¸N¸EO�@JX�X�@J¸;>w7;>9i94V\I�w©Â=�X r hzOkMED Q O�@�w©Â@PO�@,]Jhz?A]PO�@Jw�@ r ;xIzX[w©^N;>w r @�]P;W?ª¸N@Jw�@PO�jC=º?A@,w©^N;sw�=º?\¼�hzO�j�;swk=ihA?NÛ

� � �� 0 �[ *�� Ï�)�&!4 *��Ç� 0 �� *��24��k�

ÈAhd¼�;WO r @�^N; e @�¸N=�X�]PKAX�Xk@J¸"¼�hzO�jd;s9�;W?N;s9�IAw�=�] r ;xIzX�hs¼�]JhAj�¿N;WO�=º?A»ªX�hs¼�w r ;WO)@�w�@JXkw�=º?A»�]PO�=�w�@PO)=<;GD�·�w=�X�;s9�X�h�¿GhWX�X�=ºVA9�@Cw�h�]Jhzj�¿N;\O�@�w©Â@JX�@,]PO�=�w�@PO�=º;�@Pjd¿A=<O)=i]P;>9i9�IWl-;W?A¸*lN=º?ª¼�;s]JwPlNw�Â@PO�@�;WO�@,w r hÇN=�X�w�=º?A]Jw

6

XkhzO�w�XChs¼�@Pj�¿A=ºO�=�]P;s9fX�w©KA¸N=�@JX�w�^N;swC]JhzKA9�¸ VN@Á¿N@PO�¼�hzO�j6@J¸*D R Â@ªÅ&O�X�wd=<? e hW9 e @JXª¸NhW=º?A»Ý;Ã¼�hzO�jd;s9Xk]J=i@P?\w�=ÆÅE]C@J¾L¿G@PO�=ºjC@P?\wPl r Â=i9�@,w©Â@�X�@J]JhA?A¸}=<? e hW9 e @JX�;,¼�;WO$9�@JX�X�¼�hzO�jd;s9u]P;sX�@�X�w©KA¸NIWDg%hzO�j�;>9N@J¾L¿G@PO�=ºjC@P?WwkX�»W@P?A@POk;s9�9iIª=º? e hW9 e @1;\¿N¿A9iIA=º?A»�w�Â@�w�@J]J^N?A=�ÔLKA@CKN?A¸N@PO[]Jhz?AX�=�¸N@PO�;>w�=�hz?ªw�h�;

X�KNVAX�w©;W?\w�=º;s94¿Nhz¿NKA9º;sw�=�hz?Ühs¼3X�h>¼Úw r ;WO�@,X�IzXkw�@PjCX�;W?A¸ÁhzVAX�@PO e =º?A» e ;\O�=�hzKAX�]_^N;\O�;s]Jw�@PO�=�X�wk=i]JX,hs¼3w©Â=�X;\¿N¿A9i=�]P;swk=ihA?ul�X�KA]_^²;sX�]Jh\X�wPl[@�ã*@J]Jw�= e @P?A@JX�XPl�hzOd@P;sX�@"h>¼�KAX�@WD gEhzO�jd;s9�@J¾N¿N@PO�=ºjC@P?\w�X"^N; e @"w�Â@;>¸ e ;W?\w©;s»W@�w�^N;sw�I\hzKª]P;W?}@J¾Aw©O�;\¿NhW9º;sw�@�¼ßO)hzjÂw©Â@CO�@JX©KA9�w�X�hzVAX�@PO e @J¸"¸EKNO�=º?A»ªw©Â@�@J¾N¿N@PO)=<j6@P?Ww�w�hh\w©Â@PO$X�IzXkw�@PjCXPlNVN@J]P;\KAX�@�w©Â@�X©KNVAÐ�@J]Jw�X[hs¼�w�Â@�@J¾L¿G@PO�=ºjC@P?Ww r @PO)@�X©KN¿N¿NhWXk@J¸N9iI"O)@P¿NO�@JX�@P?\w©;sw�= e @fhs¼w�Â@�9º;WO�»W@PO[¿NhA¿NKA9<;>w�=�hz? r Â=�]_^d=�X[IWhzKNO3KN?A= e @PO)X�@WD �[KAw[w©O�KA@�X�]J=�@P?\w�=ÆÅE]�@J¾L¿G@PO�=ºjC@P?\w�X�;WO�@fO�;WO�@J9�IC=Æ¼@ e @PO-¸Nhz?A@[=<?6w©Â=�X3;WO�@P;�X�=º?A]J@�=�w r hAKA9i¸�O�@JÔNKA=ºO�@�w©^N;>w�w©Â@PO)@7VG@�;�]J9i@P;\O3KN?A¸N@PO�X�w�;W?A¸N=º?A»�hs¼ r ^N;>w�=�Xj6@P;W?Ww�V\IÍ;éÑ�w�IL¿A=�]P;s9�Ó�¿NO�h\»zO�;Wj�]Jhz?\w©;s=º?A=º?A»ÝÑkw¥IN¿A=�]P;s9�ÓC¼�;WKA9�w�XPlE;W?A¸ r @�»W@P?A@POk;s9�9iI}¸Nhª?AhWw�^N; e @w�^N;sw4X�hzO�w4h>¼Ï=º?\¼�hzO�j�;>w�=�hz?ulW@ e @P?6=<?d9�=ºjC=�w�@J¸}¸Nhzj�;s=º?AX$X©KA]_^d;sX¡jC@J¸N=�]P;s9%hzO4wk@J9i@J]JhAj�jCKN?A=i]P;>w�=�hz?AXPD·�?C]Jhz?\w©O�;sXkw4w�h�w©Â=�XPlA;�]P;sXk@�X�w�KA¸NI�@J¾N;WjC=º?A@JX[w©Â@�;\¿N¿A9i=�]P;swk=ihA?ªhs¼Ï;�w�@JX�w�=º?A»CX�w©O�;>w�@J»WI�hzO:]_^N;WO¥Y

;>]Jw�@PO�=�X�w�=�]JX�hs¼4w�@JX�w�=º?A»ªX�w©O�;>w�@J»W=�@JX�¼�hzO�hz?A@�hAO�;,¼�@ r X©¿N@J]J=ÆÅE]�X�IAX�w�@Pj6XPD Q 9�w©ÂhzKA»z^Î=iw�=�Xf¸N=43�]PKA9�wwkh�¸Nh}w©Â@Pj r @J9�9Úl-;W?A¸Á@J¾L¿G@P?AX�= e @�w�hª¸N@JX�=�»z?H;\?A¸é¿G@PO�¼�hzO�j w©Â@Pj}lu=�w�=�X�?Ahz?A@Jw©Â@J9�@JX�X�»\@P?A@PO�;s9�9�IjCKA]J^Ýj6hzO�@C¼�@P;sX�=ºVA9�@}w�h¹¿G@PO�¼�hzO�j(]P;WO�@�¼�KA9�9iIÞ]PO�;x¼�w�@J¸H]P;>X�@�Xkw©KA¸N=�@JX�w�^N;W?Á¼�hzO�jd;s94@J¾L¿G@PO�=ºjC@P?\w�XPDÉf?\¼�hzO�w©KN?N;swk@J9iIWl4Âh r @ e @POJlu=º?ÞjChWX�w�]P;sXk@JX�=�w�=�XC@J=�w©Â@PO�¸N=43�]PKA9�w�hzOf=ºj�¿GhWX�X�=ºVA9�@"wkh}@J¾zw©Ok;W¿NhW9º;swk@¼�O�hzjÄO)@JX©KA9�w�X[hzVAX�@PO e @J¸d¼�hzO-w©Â@fX©¿N@J]J=ÆÅE]�X�IAX�w�@PjCX$w©^N;sw$X�@PO e @J¸�;>X3X©KNVAÐ�@J]Jw�X$hs¼*w©Â@�]P;>X�@�X�w©KA¸NICw�hXkIzX�wk@PjCX[=<?ª»\@P?A@PO�;s9uX�=º?A]J@�w©Â@�X©KNVAÐ�@J]Jw�X r @PO�@fw¥IN¿A=�]P;s9�9�IHæEçWè%X�@J9�@J]Jw�@J¸¹VG@J]P;WKAX�@�w©Â@JI r @PO�@f@JX©¿N@�Y]J=º;s9�9�I�O�@P¿NO)@JX�@P?Ww�;sw�= e @WlzVNKAw3Ok;sw©Â@PO4VN@J]P;\KAX�@�w©Â@PO�@ r @PO)@7¿NO)hWÐ�@J]Jw3¿N@PO�X�hA?N?A@J9 r Âh r @PO�@ r =�9�9�=<?A»Cw�h¿N;\O�w�=�]J=º¿N;sw�@C=º?"w�Â@�Xkw©KA¸NIWlEhAO�j�;\?N;s»W@PjC@P?\w�X�KN¿N¿NhzO�wxlEhzOfVN@J]P;\KAX�@�w©Â@C¿NO�hWÐ�@J]Jw�=�w�Xk@J9v¼[=º?A=iwk=<;>w�@J¸w�Â@�X�w©KA¸NIªw�hCÅ&?A¸"hAKAw�=º?\¼ÚhzOkj�;sw�=�hz?};WVGhzKAw�è³îz×xì�Ù�¿NO)hWÐ�@J]JwPDFUÂ@P?Ã¸NhW=º?A»";ª]P;sX�@CX�w�KA¸NI}¼�hzO�;ª9º;WO)»W@C=<?A¸EKAXkw©O�=º;s93Xkhs¼Úw r ;WO�@�XkIzX�wk@Pj}lE=�w,=iX�h>¼Úw�@P?Á?A@J]J@JX�X�;WO�I

wkhÍëCç�+W× 6Aw©Â@�X�IAX�w�@Pj r Â=�]J^}=º? e hW9 e @JX�¸N@JX�=�»z?A=º?A»";,X�=ºj�¿A9�=ÆÅE@J¸ e @PO�Xk=ihA?ªhs¼�w©Â@�X�IAX�w�@Pj r Â=�]_^ª=�X]J9�hWXk@�@P?AhzKA»z^dw�h�O�@P;s9�=�w¥Iªw©^N;sw$w©Â@�hzVAX�@PO e ;sw�=�hz?AX�j�;>¸N@�;WVNhzKAw[w©Â@�jChA¸N@J9*;WO�@ e ;s9�=�¸}¼�hzO$w©Â@f¼�KA9i9XkIzX�wk@Pj}lNIW@Jw�Xk=<jd¿A9i@C@P?AhzKA»A^}w�h�VG@�w©Ok;s]Jw©;WVA9�@WD Ê KNO�@J¾N¿N@PO�=�@P?A]J@�^N;>X�VN@J@P?Ãw©^N;swfjChWX�w�Xkhs¼Úw r ;WO�@wk@JX�w�@PO�X$Å&?A¸¹j6hz¸N@J9�=º?A» e @PO�Iª¸N=43�]PKA9�w�w�hd¸NhED4·�?";>¸N¸N=iwk=ihA?ul r Â@P?Îw©Â@�]P;sX�@�Xkw©KA¸NI�=�Xf]Jhzj�¿A9�@Jw�@J¸¼�hzO$w©Â@,X�=ºj�¿A9�=vÅE@J¸ÁX�IAX�w�@PjÎlNIWhzKd¸Nhz?uåyw�?A@J]J@JXkX©;WO�=�9�I"^N; e @�;W?};s]J]PKNO�;>w�@�¿A=�]Jw©KNO�@�h>¼:Âh r w©Â@�O)@P;s9XkIzX�wk@Pj r =�9�9�VN@P^N; e @WD·�?Ý;>¸N¸N=iwk=ihA?Þw�h"w©Â@JXk@�9�=ºjC=�w©;sw�=�hz?AXdhs¼�]P;sX�@ªX�w©KA¸N=�@JXPl4w©Â@PO)@Í;WO)@�»W@P?A@POk;s9¡¿NO�hAVA9i@Pj6X�w�^N;sw�;WO)@

Xk=<j6=i9º;WOfwkh�w©ÂhWX�@C;sX�X�hA]J=º;sw�@J¸ r =�w©^Ãw©Â@�¼�hzO�j�;>9Ï;\?N;s9�Izw�=�]C]Jhzj�¿N;\O�=�X�hz?"O)@J9<;>w�=�hz?AXPD�g%hzO[@J¾N;Wj�¿A9�@Wl]P;>X�@�Xkw©KA¸N=�@JX�j�;xI�;s9�X�hC=<? e hW9 e @fw©Â@�KAX�@�hs¼*=�¸N@P;s9�=! J@J¸ r ;xIAX3hs¼�KAX�=º?A»�w©Â@f]PO�=�w�@PO�=�hz?uD$·�?};s¸N¸N=�w�=�hz?w�Â@PO�@�j�;xI�?AhWw�VN@�;\?WI�¿NO)h e =�X�=�hz?ªw�h�;s]J]JhzKN?\w[¼�hzO4=º?A¸N= e =i¸EKN;>9º=! P@J¸ÝVG@P^N; e =�hzOJD3·Ú¼�w�Â@�]P;sXk@�X�w©KA¸NI=�X$Ð)KAXkw�=º?Ww�@P?A¸N@J¸Áw�h�;sXkX�@JX�X�w©Â@,@�ã*@J]Jw�= e @P?A@JX�Xfhs¼�¸N=Æã*@PO�@P?\w�w�@JX�w�]P;sX�@�X�@J9�@J]Jw�=�hz?ÃX�w©Ok;sw�@J»W=�@JXPlNw�Â@P?]Jh\X�w�j�;xIH?AhWw�^N; e @�VN@J@P?Þ;sX�Xk@JX�X�@J¸H¸EKNO�=º?A»Áw©Â@�]P;>X�@�X�w©KA¸NIH;W?A¸Ç?Ah"]Jh\X�w�Y¥VN@P?A@�ÅEw,X�w©KA¸NIÝjd;PI^N; e @�VG@J@P?"¿G@PO�¼ÚhAO�jC@J¸*D[ÈA=<j6=i9º;WO)9iIWluXk=<?A]J@Cw©Â@f¼�;WKA9�wfX�@ e @PO�=�w�I�=�Xf»W@P?A@PO�;s9�9�I"?AhWw�;\?}=º?Wwk@J»zO�;s9*¿N;WO�wh>¼&w©Â@�wk@JX�w3]P;sXk@¡Xk@J9i@J]Jwk=ihA?ª]PO�=�w�@PO�=º;NlW=�w r hAKA9i¸}VN@fKN?zKAX©KN;>9E=Æ¼�;�]P;sX�@�X�w©KA¸NIÇN@JX�=�»z?A@J¸ªw�h�]Jhzj�¿N;WO)@w�Â@¡@�ã*@J]Jw�= e @P?A@JXkX4hs¼E¸N=ÆãÏ@PO)@P?Ww4X�w�O�;sw�@J»W=�@JX r hzKA9�¸�@ e @P?�]JhA?AX�=�¸N@PO-w©Â=�X4¸N=<j6@P?AX�=�hz?ulN;W?A¸,¼ÚhzOäX�=ºjC=�9º;WOO)@P;sX�hz?AXPlxw©Â@PO�@$=�X3?Ah1O�@P;>X�hz?�wkh�@J¾N¿N@J]Jw4w©^N;>w�;W?,;sX�X�@JXkX©jC@P?\w*hs¼Ew©Â@[h e @PO�;s9�9WXkw©;sw�@4hs¼Ew�Â@¡Xkhs¼Úw r ;WO�@r =i9�94^N; e @�VN@J@P?Ãj�;s¸N@�;sw�w�Â@�@P?A¸"hs¼4w©Â@�]P;sX�@�Xkw©KA¸NIWD�[KAw,]P;sX�@�X�w�KA¸N=i@JX,¸Nh¹^N; e @�XkhzjC@�O�@P;>93¿NhWX�=�w�= e @ª]J^N;WO�;s]Jw�@PO)=iXkw�=�]JX�w�hAhED R Â@JIH]P;\?H¿NO�h e =�¸N@�;Ñ�¿NO�hzh>¼Ehs¼E]Jhz?A]J@P¿Aw�Ó r Â=�]J^Cj�;xI�VN@[X©K'3�]J=�@P?\w4w�h�@P?A]JhAKNO�;s»W@�¿NO�;s]Jwk=iwk=ihA?A@PO�X4w�hfw©O�I�w©Â@[w�@J]J^N?A=�ÔLKA@VG@J=º?A»}=<? e @JX�wk=i»A;sw�@J¸*lN=º?}w�Â@�ÅE@J9�¸*D�·�w�j�;xI�VN@,]Jhz?AX�=�¸N@PO�@J¸Áw�hAh�VA=�»Í;dO�=�X©Mªw�h�w©O)IÍ;�?A@ r w�@JX�wk=<?A»wk@J]_^N?A=�ÔNKA@�hzO$hWw©Â@PO$X�hs¼�w r ;\O�@[¸N@ e @J9�hz¿NjC@P?\w�X�w©O�;>w�@J»WIChz?ª;�9º;WO)»W@1¿NO)hz¸EKA]Jw�=�hz?ªXkhs¼Úw r ;WO�@f¿NO�hWÐ�@J]JwVG@J]P;WKAX�@Chs¼3w�=ºjC@�;W?A¸ÁO�@J9�=º;WVA=�9i=�w�IH]Jhz?AXkw©O�;s=º?\w�XPD�Ö�h r @ e @POJlN=Æ¼3=�w�]P;W?"VG@CX©Âh r ?}=º?H;C]P;>X�@CX�w©KA¸NIw�^N;sw�hWw©Â@PO�X�=ºjC=�9<;\O�¿NO)hWÐ�@J]Jw�X�^N; e @�KAX�@J¸Þw©Â@�w�@J]J^N?A=�ÔLKA@";\?A¸H»WhWw�wk@P?¹VG@Jw�w�@PO,O�@JX©KA9�w�XCw©^N;W?Áw�Â@]PKNOkO�@P?Wwk9iI\Y¥KAX�@J¸�¿NO)hz]J@JX�Xxlsw©^N;sw3jC=�»z^\w�VG@�X©K'3�]J=�@P?\w3w�hf]Jhz? e =º?A]J@�jd;W?N;s»W@PjC@P?\w-hs¼Ew©Â@�KAX�@�¼�KA9<?A@JXkXh>¼�w©Â@�?A@ r ;W¿N¿NO�hz;s]JûD Q ¸N¸N=�w�=�hz?N;>9i9�IWlu]P;sXk@�X�w©KA¸N=�@JX�]P;\?}¿NO�h e =�¸N@�;W?ª@JX�wk=<jd;sw�@�hs¼4w©Â@�¸N=43�]PKA9�w�Ih>¼1KAX�=º?A»Hw©Â@ªw�@JX�wCX�@J9�@J]Jw�=�hz? ]PO�=�w�@PO�=�hz?uD Ê ¼�w�@P?Þ=�w�j�;xIÁX�@J@Pj wkhé¿NO)hWÐ�@J]Jw�¿N@PO)X�hz?N?A@J9�w©^N;>w�w�Â@

7

9�@P;WOk?A=<?A»}]PKNO e @ r =�9�94VN@Cw�hAh�X�w�@J@P¿Îw�h�j�;WM>@�w©Â@�;s¸NhA¿Aw�=�hz?}hs¼3w�Â@�?A@ r w�@J]_^N?A=�ÔNKA@ r hAO�w©^ r Â=�9i@WD�$IHX�Âh r =<?A»ÁÂh r hWw©Â@PO,¿NO�hWÐ�@J]Jw�XC^N; e @�;s¸Nhz¿Aw�@J¸Þw©Â@}KAX�@�hs¼fw©Â@�]PO�=�w�@PO�=�hz?ul$;W?A¸Ý=º?A]J9ºKA¸N=º?A» ;¸N@JXk]PO�=º¿Aw�=�hz?}hs¼4w©Â@�@J¾N¿N@PO�=�@P?A]J@Chs¼4w�@JX�w�@PO)XPlA=iwfjC=�»z^WwfVN@�¿GhWX�X�=ºVA9�@Cw�hC]Jhz? e =º?A]J@�;d¿NO�hWÐ�@J]Jw[w�hCw©O�IKAXk=<?A»ª=�w�w�hAhEDQ ?AhWw©Â@POä=�X�X©KA@[w©^N;sw4j�;xIfX�@PO e @[;sX�;fO�hz;>¸EVA9ihA]JM�w�h�w�Â@7;>¸Nhz¿Aw�=�hz?�h>¼&;�?A@ r w�@JX�w-]P;sX�@$X�@J9�@J]Jw�=�hz?

]PO)=iwk@PO�=�hz?�=�X$w©Â@�¿N@PO)]J@J= e @J¸}hzO4;s]Jw©KN;s9N]Jh\X�w3hs¼*KAX�=º?A»C=iwxD�8:X�w�=ºj�;swk@JX3hs¼uw©Â=�X¡]Jh\X�w4]P;W?�VG@�@JX�Xk@P?Ww�=º;s9=º?Ã]Jhz? e =º?A]J=º?A»Hj�;W?N;s»\@PjC@P?Ww�hs¼¡w©Â@C¿NO�;s]Jw�=�]P;s9�=�w�IÁhzO[¼�@P;sX�=ºVA=�9�=�w¥IÜhs¼¡KAX�=º?A»}w©Â@CX�w©O�;>w�@J»WIWD R ^zKAXPlhA?A@¡wk@JX�w4]P;sX�@�Xk@J9i@J]Jwk=ihA?�X�w�O�;sw�@J»WI�jd;PI�Å&?A¸ `Pb�� j6hzO�@$¼ß;\KA9iwkX4w©^N;W?C;W?AhWw©Â@PO�lzVNKAw4=Æ¼*=iw$]JhWX�w�X4hA?A@ÂKN?A¸EO�@J¸Áw�=ºjC@JX�jChzO�@WlGhzO�=�wf=�X03_×�HWÙ�×.+�w©^N;sw�=�w r =�9�9�]Jh\X�w1jCKA]J^"jChAO�@�w�h}KAX�@WlEw�Â@P?}=�w1j6=i»A^Ww�VN@¸N=�X©j6=iXkX�@J¸�hAKAw3hs¼�^N;W?A¸*D Q ]Jhzj�¿NO�@PÂ@P?AXk= e @�]P;sXk@�X�w©KA¸NICw©^N;sw$=º?A]J9<KA¸N@JXf;W?�;s]J]PKNO�;>w�@�;sX�Xk@JX�X©jC@P?\wh>¼Ï=�w�X[]JhWXkw3w�hCKAX�@�hA?�hz?A@�hzO[jChzO�@�O)@P;s9&¿NO�h\Ð¥@J]JwkX¡j�;xI�VG@�X©K'3�]J=�@P?\w¡wkh r =º?ª;s]J]J@P¿Aw©;W?A]J@f¼�hzO4w�Â@Xkw©O�;sw�@J»\IWDÊ ?A@ChWw�Â@PO�KAX�@�¼ßKA93¿GhWw�@P?\w�=º;s93¿N;xIWhsãÝh>¼3¸NhW=º?A»¹;d9<;\O�»W@�=º?A¸EKAX�w©O)=<;>94]P;sX�@CX�w©KA¸NIÃw�h}¸N@Jw�@PO�jC=º?A@

w�Â@"@�ã*@J]Jw�= e @P?A@JX�Xªhs¼�;ÁX�hs¼�w r ;\O�@�wk@JX�w�X�@J9�@J]Jw�=�hz? ]PO�=�w�@PO�=�hz?²O�@J9º;swk@JX�w�hÞjChz¸N@J9�=º?A»EDU·ßw�=�Xªhs¼Úwk@P?¸N=43�]PKA9�wfw�h�¸N@Jw�@POkjC=º?A@�;W?d@�ã*@J]Jw�= e @�»zOk;W?zKA9º;WO)=iw�IC¼�hzO�j6hz¸N@J9�=º?A»�w�Â@�X�hs¼�w r ;WO)@WD*FUÂ@P?ª=�w�=�X�?A@J]�Y@JXkX©;WO�I�wkh6j6hz¸N@J9�;,X�IAX�w�@PjÎlL¿N;\O�w�=�]PKA9º;WO�9�I r Â@P?ªw©Â@�X�IAX�w�@Pj�=�X�9º;WO�»\@Wlzw�Â@�w©;sX©MC]P;\?ªX�hzjC@Jw�=ºjC@JXXk@J@Pj h e @PO r Â@J9ºjC=º?A»Hw�hH¿NO�;>]Jw�=�w�=�hz?A@PO�XPDÞ·�?Þw©Â@JX�@}Xk=iw�KN;sw�=�hz?AXPl[;Ã]P;sX�@}X�w©KA¸NIÜw©^N;swC=º?A]J9<KA¸N@JX";¸N@JXk]PO�=º¿Aw�=�hz?Ãhs¼�w©Â@,9i@ e @J9*hs¼4»zO�;W?AKA9º;WO�=�w�IÍ;sw r Â=�]_^Îw©Â@�jChA¸N@J9i=º?A» r ;sX[¸Nhz?A@,]P;W?}VN@,@J¾zw©O)@PjC@J9�IÂ@J9º¿\¼�KA9�DÊ KNO,¿N@PO�Xkhz?N;s93@J¾N¿N@PO)=i@P?A]J@"^N;>X�VN@J@P?Üw©^N;sw,9º;WO�»W@�=º?A¸EKAX�w�O�=º;s93]P;sXk@�X�w�KA¸N=i@JXC;WO�@�¸N=43�]PKA9�w�;\?A¸

@J¾N¿N@P?AXk= e @�VNKAw e @PO�I e ;s9ºKN;WVA9�@$¼�hzO*w�Â@¡O�@P;sXkhz?AX�j6@P?Ww�=�hz?A@J¸C;WVNh e @WlW;\?A¸�w©Â@PO�@�¼�hzO�@ r @J9i9 r hzO�w©^fw�Â@wk=<j6@�;W?A¸Ã@�ãÏhAO�wPD[FH@C^N; e @�¿N@PO�¼�hzO�jC@J¸H;�?AKNjCVN@POfhs¼4]P;sX�@,X�w©KA¸N=�@JX�=º?A]J9ºKA¸N=<?A»Áw©Âh\X�@�¸N@JX�]PO)=<VG@J¸=º? � ` l q l p l o l `Pb l `Pp�� ;W?A¸Á¼�hzKN?A¸Áw©Â@Pj w�h"VN@d@J¾zw©O)@PjC@J9�I¹Â@J9º¿\¼ßKA9$¼�hzO�w©Â@�O�@P;sXkhz?AX�¸N=�X�]PKAXkX�@J¸;\VNh e @WD

� � ��24��#u��#

FÜ@�^N; e @CX�w©KA¸N=�@J¸H; e ;WO�=�@Jw�I"hs¼¡¿NO)hz¿NhWXk@J¸ r ;xIAX�hs¼3]JhAj�¿N;WO�=º?A»ªX�hs¼�w r ;WO)@�w�@JX�w�=º?A»}]PO�=�w�@PO�=º;Nl*;\?A¸¼�hzKN?A¸Áw©^N;sw�jd;W?WIÃhs¼¡w�Â@�¼�hzO�jd;s9�]JhAj�¿N;WO�=�X�hz?ÁO�@J9º;swk=ihA?AX�^N;s¸H¿NO�hs¼�hzKN?A¸Ý¿NO)hzVA9�@PjCX�;sXkX�hz]J=º;swk@J¸r =iw�^}w©Â@Pj}lG@ e @P?}w©ÂhAKA»z^ªw©Â@JI}=º?A=�w�=º;s9�9iIH;W¿N¿G@P;WO�@J¸Ãw�h�VN@,=º?Ww©KA=�w�= e @J9�IHO�@P;sXkhz?N;WVA9�@WD3FÜ@�;WO�»AKA@J¸w�^N;sw�w©Â@�9�@P;sX�w�¿NO�hzVA9�@Pj�;>w�=�]�]Jhzj�¿N;\O�=�X�hz?"O)@J9<;>w�=�hz? r ;sX[w©Â@C¿NO�hz¿N@PO)9iI}]Jh e @PO)X�O�@J9º;sw�=�hz?ul%X�=º?A]J@C=iwjd;s¸N@�]Jhz?A]PO�@Jw�@ r ^N;sw[=�w1j6@P;W?Ww7¼ÚhzO$hz?A@,]PO�=�w�@PO�=�hz?Îw�hÇNh�;�jChzO)@�@�ãÏ@J]Jwk= e @�Ð�hzVªhs¼4w�@JX�w�=º?A»�w©^N;\?;\?AhWw©Â@POJD4Ö�h r @ e @PO�lz@ e @P?}w©Â=�X�O�@J9º;swk=ihA? r ;sX�?AhWw r =�w©ÂhAKAw�X�@PO)=ihAKAX0�&; r XPDÊ ¼E]J@P?\w©O�;>9W=ºj�¿NhzO)w©;W?A]J@ r ;sX*w©Â@:¼ß;s]Jw-w©^N;sw-;s9�9Nhs¼Lw�Â@3]PO�=�w�@PO�=º;fw©^N;>w r @PO�@4]Jhzjd¿N;WO�@J¸�VWI�guO�;W?NM\9

;\?A¸}FH@JILKNM>@PO r @PO�@�=�¸N@P;s9�=! J@J¸ e @PO�Xk=ihA?AX�hs¼4w©Â@ r ;PIª¿NO�;s]Jw�=�w�=�hz?A@PO�X�;s]Jw©KN;>9i9�I}w�@JXkw�X�hs¼�w r ;\O�@WD�ÈAhEl@ e @P?�w©ÂhzKA»A^ r @[Mz?Ah r ¿NO)@J]J=iXk@J9iICÂh r w©Â@JX�@$=i¸N@P;>9i=! J@J¸�]PO)=iwk@PO�=º;�]Jhzjd¿N;WO�@¡VN;>X�@J¸�hz?�w�Â@3@J¾N¿N@J]Jw�@J¸?AKNjCVN@PO�hs¼4¼�;WKA9�w�X�¸N@Jwk@J]Jw�@J¸¹;W?A¸Áw©Â@C¿NO�hzVN;WVA=�9�=�w�I"hs¼-Å&?A¸N=º?A»}¼�;WKA9�w�XPl r @�;\O�@�?AhWw�;WVA9�@�wkh�X�w�;sw�@]JhA?A]J9<KAXk= e @J9iIÁÂh r w©Â@�¿NO�;s»Aj�;sw�=�]P;s9�9�I"KAX�@J¸ e @PO�X�=�hz?AX�hs¼4w©Â@JX�@�Xkw©O�;sw�@J»\=i@JX�X�w©;s]JM�KN¿uDQ 9�X�hElW?Ahz?A@�hs¼Ew©Â@�¿NO�hz¿GhWX�@J¸�]Jhzjd¿N;WO�=�X�hz?CO�@J9º;sw�=�hz?AX4wkhzhzM�w©Â@[]JhWX�w-=º?Ww�h�;>]J]JhzKN?WwxD�·Ú¼ r @�Mz?A@ r

w�^N;sw3hz?A@f]PO�=�w�@PO�=�hz? r ;sX[;,9i=�w�wk9i@�VG@Jw�w�@PO[;sw$Å&?A¸N=º?A»C¼�;WKA9�w�X[w©^N;W?ª;W?AhWw©Â@PO$VNKAw¡w�^N;sw[=iw[]JhWXkw¡j�;W?\Iwk=<j6@JX�;sXCj�KA]Jûl r hzKA9�¸Hw©Â@}jChzO�@C@�ã*@J]Jw�= e @ªX�w©O�;swk@J»WI"X�wk=i9�9�VN@ª;sw�w©O�;>]Jw�= e @�hzOf@ e @P?é¼�@P;sX�=ºVA9�@�w�hKAXk@PÛ R ^N;sw r hzKA9�¸C9i=ºMs@J9�I�¸N@P¿G@P?A¸ÍÂ@P; e =�9iIChz?,w©Â@�;W¿N¿A9�=�]P;sw�=�hz?d;W?A¸C=iwkX3O�@J9�=<;\VA=i9�=�w�IÍO)@JÔLKA=ºO�@PjC@P?\w�XPDQ ?A¸H=Æ¼�]PO�=�w�@PO�=�hz? �� r ;sX�¸N@J@PjC@J¸ÇjChzO�@C@�ã*@J]Jw�= e @�w©^N;\?"]PO)=iwk@PO�=�hz?*��V\IÁX�hzjC@�O�@J9º;swk=ihA?ul�VNKAw;>9i9-w©Â@f¼�;WKA9�w�Xfw©^N;sw r @PO�@CVN@J=º?A»}¸N@Jw�@J]Jw�@J¸ÁVWI �� r @PO�@�w�O�= e =º;s9ä¼ß;\KA9iwkXPl&VNKAw��¼�hzKN?A¸¹¿NO)hs¼ÚhAKN?A¸;\?A¸Í¿GhWw�@P?\w�=º;s9�9iI}]P;>w©;sX�w©O)hz¿NÂ=�][¼ß;\KA9iwkXPl r hAKA9i¸ r @fX�w�=�9�9u]Jhz?AX�=�¸N@PO0��;�jChAO�@�@�ã*@J]Jw�= e @�]PO)=iwk@PO�=�hz?NÛ�$I};s9�9�w�Â@�O�@J9º;sw�=�hz?AX r @�=º? e @JX�w�=�»z;>w�@J¸}w©Â@JI r hzKA9�¸¹VG@�]Jhz?AX�=�¸N@PO�@J¸ÁX�w©O�hA?A»W@POJlAX�=º?A]J@Cw©Â@PO�@�=�X1?Ahr ;xI�w�h6¼ß;s]JwkhzO$=<?Îw©Â@�X�@ e @PO)=iw�IªhzO[]Jhz?AXk@JÔLKA@P?A]J@,hs¼�w�Â@f¼ß;WKA9�w�XxD

8

c @POk^N;W¿AX1j6hWX�w�=ºj�¿GhzO�w©;W?\w�=�X�w©^N;sw�w©Â@PO�@�=�X�?Ahª=º?A¸N=i]P;>w�=�hz? r ^N;swkX�hz@ e @PO[hs¼¡Âh r ¸N@P¿N@P?A¸E;\VA9i@w�Â@¡Xkhs¼Úw r ;WO�@ r =�9�9&VG@ r Â@P?�=�w3^N;sX3VG@J@P?Cw©ÂhzO)hzKA»zÂ9�I�w�@JX�w�@J¸�;s]J]JhAO�¸N=º?A»�w�h�XkhzjC@3]PO)=iwk@PO�=�hz?uD38 e @P?MA?Ah r =º?A»�w�^N;sw�]PO)=iwk@PO�=�hz?��;s9 r ;PIAXf¸Nhz@JX�;�j6hzO�@�@�ã*@J]Jw�= e @fÐ�hzV}h>¼3w�@JX�w�=º?A»ªw©^N;W?}]PO)=iwk@PO�=�hz?��Pl¸NhA@JX�?AhWw�=<jd¿A9iIÃw©^N;sw0� � ¸NhA@JX�;CíAçPç +7Ð¥hzVªh>¼�w�@JXkw�=º?A»EDÈAh r ^N;>w¡;WO�@fw©Â@f=ºj�¿A9�=i]P;>w�=�hz?AX�h>¼�;s9�9uw©Â=�X©ÛÃg4=<O)X�wPlAw©Â=�X[=iXf;�]P;>9i9%¼�hzO3?A@ r w©ÂhzKA»z^\w¡;W?A¸}jChzO)@

=ºj�¿GhzO�w©;\?WwPlA?A@ r w¥IN¿N@JX[hs¼-w©ÂhzKA»z^\w3w�hCVN@�¿NKAw[=º?Wwkh6;>w�w©;s]JMW=º?A»,w©Â=�X7¿NO)hzVA9�@Pj}D4FH@fX©; r w©^N;sw3w�Â@=º?A=�w�=º;s9[¿NO�hz¿Nh\X©;s9�X�¼�hzOf]Jhzj�¿N;\O�=�X�hz?HO�@J9º;swk=ihA?AX�X�@J@PjC@J¸ÞO�@P;sX�hz?N;\VA9i@ª;sw�Å&O)X�w�»W9º;W?A]J@Wl4VNKAw�w©KNO�?A@J¸hAKAw�w�hÝVG@ �&; r @J¸àVN@J]P;WKAX�@Ãw©Â@JIàO�@P;s9�9�IÇ¸N=�¸U?AhWw�¿NO�hz¿G@PO�9�IÇ]P;W¿Aw©KNO�@Ãw©Â@}@JX�X�@P?A]J@Áhs¼ r ^N;swd=iwj6@P;W?AX[¼�hzO$hz?A@�w�@JX�w�=º?A»�Xkw©O�;sw�@J»\I�w�h�VG@�jChzO�@�@�ã*@J]Jw�= e @�;sw7Å&?A¸N=<?A»d¼�;WKA9�w�X�w©^N;W?};\?AhWw©Â@POJD R Â@P?w�Â@PO�@ r ;sX[w©Â@,=<?AXk=i»A^Ww�w©^N;>w�KAX�=º?A»Í¿NO)hzVN;WVA=�9�=iXkw�=�]�jC@P;sX©KNO)@JX r hzKA9�¸¹VG@�jChAO�@�;W¿N¿NO�hz¿NO)=<;>w�@Wl&;\?A¸=º?d¼�;s]Jw3w�Â@JI�HWÙ�×�jChzO�@�;W¿N¿NO�hA¿NO�=º;sw�@WD��[KAw¡w�Â@PO�@1;\O�@�Xkw�=�9i9uX�@PO)=ihAKAX0�&; r XPD4·-¸Nh�?AhWw[X�@J@1; r ;xI�w�h;>¸N¸EO�@JX�X�w©Â@�¿NO)hzVA9�@Pj�w©^N;sw r @�;\O�@C]Jhzj�¿N;WO�=º?A»}=�¸N@P;s9�=! J@J¸ e @PO)X�=�hz?AX�hs¼�w©Â@Cw�@JX�w�=º?A»ÃX�w©O�;swk@J»W=�@JXPD·ßw�=�X e @PO)I}¸N= 3ª]PKA9iw,w�hª=<jd;s»W=º?A@�Âh r w�hd¼ÚhAO�j�;s9�=! J@ r ^N;sw�=�X�=º?Á¿NO�;s]Jw�=�]J@�; e @PO�I}=º?A¸N= e =�¸EKN;s9º=! J@P¸¿NO)hz]J@JX�XxD·�;>9iXkh¹Xk@J@"; e @PO�IÁ=<jd¿NhzO�w�;W?Ww�O�h\9i@ª¼�hzO�@Pj�¿A=ºO�=�]P;s9�X�w©KA¸N=�@JXPD R Â@JIH]P;W?Üw�@J9�9�KAXCw©Â=º?A»WX�w�^N;sw

;>9i9-w©Â@,w©Â@JhzO�@PjCX�=<?Ãw©Â@ r hzO�9�¸"]P;W?N?Ah\w�w�@J9�94KAX�Y�Âh r X�hAjC@Jw©Â=º?A»ÍO)@P;s9�9iI r hzO�M\X�=º?¹¿NOk;s]Jw�=�]J@WD�·Xk@J@�]Jhzjd¿N;WO�=º?A»�;W?A¸};sX�Xk@JX�X�=º?A»CX�hs¼�w r ;WO)@¡wk@JX�w�=º?A»�X�w�O�;sw�@J»W=�@JX[;sX�; e @PO�IC=ºj�¿GhzO�w©;W?\w¡;\?A¸�@JX�Xk@P?Ww�=º;s9¿NO)hzVA9�@Pjêw©^N;>w�jCKAX�w�VN@�XkhW9 e @J¸"=º?}hAO�¸N@PO[w�h�@J9�@ e ;sw�@Cw©Â@�¿NO�;s]Jwk=i]J@,hs¼4w�@JX�w�=º?A»ED3·$w©Â=º?NMªw©Â@CVN@JX�wÂhA¿N@}¼�hzO�;ÜX�hW9ºKAw�=�hz? r =�9�91VG@¹w�Â@"]JhzjCVA=º?N;sw�=�hz? hs¼1]P;\O�@�¼ßKA9�9�Iàw�ÂhzKA»z^\w�hzKAw�w©Â@JhAO�IWl[¸Nhz?A@¹V\I¿G@Jhz¿A9�@ r ÂhÍKN?A¸N@PO)X�w©;W?A¸ÁVNhWw©^Îw©Â@JhzO�I};W?A¸Á¿NO�;s]Jw�=�]J@Wlu;s9�hz?A» r =iw�^}]P;WO�@�¼�KA9�9�I"w©ÂhzKA»A^Ww�hAKAw�]P;sXk@Xkw©KA¸N=�@JXPD3·�w r =�9�9u=º? e h\9 e @1;�»zO�@P;sw$¸N@P;s9Ehs¼*w©ÂhAKA»z^Wwxlz;�»AO�@P;sw3¸N@P;>9Ehs¼*=º?A»W@P?AKA=iw�IWlE;\?A¸�;�»zO)@P;sw3¸N@P;s9h>¼�@�ã*hzO�wxlzVNKAw�Âhz¿N@�¼�KA9�9iIÃ=�w r =�9�9�;s9�9�VG@ r hzO�w�^�w©Â@,w©O�hzKNVA9�@WD

�Ä! P!: Ï!7��24!3#

� `�� Q D Q�e O�=�w J@POC;W?A¸Ç8�DäBED*FH@JINKNMs@POJD R Â@ Q KAw�hzjd;sw�=�]�»\@P?A@PO�;sw�=�hz?Áh>¼�9�hz;s¸Hw�@JXkw�X©KA=�w�@JX�;\?A¸w©Â@�;sXkX�@JX�X©jC@P?\w3h>¼�w©Â@�O�@JX©KA9�w�=º?A»CX�hs¼�w r ;WO)@Wl��I� �uÙ HWæ ��%çWæ ,&ç 3Jè 1�HWÙ�×�[æWízì³æE×�×PÙ�ì³æWízlWÈA@P¿Aw`PoWo � lz¿N¿uD nWb'� Y nN` �ND

� q�� Q D Q�e O�=�w J@PO[;W?A¸}8�D\BEDWFH@JINKNMs@POJDäË�@PO�= e =º?A» r hzO�M\9�hz;s¸NX4¼�hzO$¿N@PO�¼�hzO�j�;\?A]J@�w�@JXkw�=º?A» ,&ç 3_è 1�HWÙ�×(¡Ù H ,xè�ì ,�×�HWæ +7 � /N×PÙ�ì�×xæ ,�×Pl��4hW9�D q �Nl%m�hED��NlABzKN?A@ `Po\o �ND� p�� Q D Q�e O�=�w J@POC;W?A¸Ç8�DäBED*FH@JINKNMs@POJDÎÀ¹@Jw�O�=�]JX�wkh¹;sX�Xk@JX�X�w©Â@ª9�=ºMs@J9�=<ÂhAhA¸àhs¼�¿NO�h\Ð¥@J]Jw,X©KA]J]J@JX�XVN;sX�@J¸}hz?};\O�]_Â=�w�@J]Jw�KNO�@�O�@ e =i@ r XPD ¡ë:/&ì³Ù�ì ,�H 6 ,uç 3_è 1�H\Ù¥×![æWí��Nç �AÙ©æ�H 6�l��4hW9�DE½ElNm�hED p lNÈA@P¿AwPD`PoWoWo lz¿N¿uD `Po\n Y qN`Pp D

� ½ � BEDAFÄDzË�KNOk;W?�;\?A¸ÍÈuDA6�DNm�w©;x¼�hWXPD Q ?d@ e ;s9ºKN;sw�=�hz?Îhs¼�O�;\?A¸Nhzj�w�@JX�w�=º?A»ED�I� �uÙ HWæ��H ,xè�ì�çWæ çWæ ,&ç 3Jè 1�HWÙ�×!¡æ\ízì³æE×�×PÙ�ì�æ\ízlzÈN8�Y `Pb á n âJÕy½ pWa� ½W½s½ElsBzKA9�I `PoWa ½ED

� ��c D (�D%g&O�;W?NM\93;W?A¸H8�DuB%DuFH@JILKNM>@POJD Q ¼�hzO�j�;>9�;W?N;>9iIAX�=�X�h>¼¡w©Â@,¼�;WKA9�w�¸N@Jw�@J]Jw�=º?A»Á;WVA=�9i=�w�IÁhs¼w�@JX�w�=º?A»}jC@Jw©ÂhA¸NXPD�� uÙ HWæ H ,xè�ì�ç\æ��çWæ�,&ç 3_è 1�HWÙ�×$[æWíAì�æ%×©×xÙ©ì³æWíAlL¿N;>»W@JX q\bWq LqN`xp lAÀé;\OJD`PoWoWp D

�� c D (�Dug&Ok;W?NMW93;\?A¸Ý8�DäBED*FH@JINKNMs@POJD c O�h e ;WVA9�@ª=ºj�¿NO�h e @PjC@P?\w�X�hz?HVNOk;W?A]_^éw�@JX�w�=º?A»ED��I ��uÙ HWæ��H ,Pè�ì³çWæ �çWæ ,&ç 3Jè 1�HWÙ�×!¡æ\ízì³æE×�×PÙ�ì�æ\ízl `xo á `Pb â�Õ o � q zoWn'� l Ê ]JwxD `PoWoWp D

� n�� BED3ÈuD0(�hzKNO)9<;xIWD Q j�;sw©Â@Pjd;sw�=�]P;s9[¼�O�;WjC@ r hzOkMÃ¼ÚhAOCw©Â@"=º? e @JX�w�=�»z;>w�=�hz?Çhs¼�w�@JX�wk=<?A»%D��I ��uÙ HWæ��H ,Pè�ì³çWæ �çWæ ,&ç 3Jè 1�HWÙ�×!¡æ\ízì³æE×�×PÙ�ì�æ\ízlzÈN8�Y o á �Wâ�Õ � a � NnWbWo lWm�h e D `PoWa\p D

9

� a�� Ë�DWÖ�;\jC9�@Jw7;\?A¸ÍZ�D R ;xIA9�hzOJD c ;WO�wk=iwk=ihA?Cw�@JX�w�=º?A»ÇNhA@JX7?Ah\w3=º?AX©¿A=ºO�@�]Jhz?\ÅE¸N@P?A]J@WD�I� �uÙ H\æ��H ,Pè�ì³çWæ 1çWæ ,uç 3_è 1�H\Ù¥× ¡æWíAì�æ%×©×xÙ©ì³æWíAl ` �Eá `xq âJÕ ` ½ bWq ¹` ½ `\` lAË�@J]WD `PoWoWb D

� o�� ÀÇDPÖ�KAwk]_Â=º?AXPlAÖ�DJg%hWX�w�@PO�l R D (�hAO�;s¸N=º;Nls;W?A¸ R D Ê X�w©Ok;W?A¸*Dz8:¾L¿G@PO�=ºjC@P?WwkX4hz?�w©Â@$@�ã*@J]Jw�= e @P?A@JX�Xhs¼�¸E;sw©;��Eh r Y�;W?A¸Ç]Jhz?\w©O�hW9��Eh r Y¥VN;sX�@J¸Þw�@JX�wC;s¸N@JÔNKN;s]JIH]PO�=�w�@PO�=º;ND c O�hA]J@J@J¸N=<?A»\X�hs¼�w©Â@ ` �sw©^·�?\w�@PO�?N;swk=ihA?N;s9 6[hz?\¼�@PO�@P?A]J@�hz?}ÈAh>¼Úw r ;WO�@�83?A»W=º?A@J@PO�=º?A»El%ÀH;xI `Po\o ½Elz¿N¿uD `PoN` Y qWb\b D

� `Pb�� R DyBED Ê Xkw©O�;W?A¸Á;W?A¸¹8�DyBEDNFH@JINKNMs@POJD 6[hW9�9�@J]Jw�=º?A»";W?A¸}]P;swk@J»WhzO�=! J=º?A»�Xkhs¼Úw r ;WO�@f@PO�O�hAO[¸E;sw©;C=º?;W?ª=º?A¸EKAX�w©O�=º;s9-@P? e =ºO�hz?Nj6@P?WwPD � � ,)- Jè�×Pë �HWæ + ,&ç 3_è 1�HWÙ�×xl �4hW9�Dy½El `xoWa ½ElN¿N¿uD qWa\o Y pWbWb D

� `W`�� ÈuD*Z�;W¿N¿AX�;\?A¸é8�DuBEDuFH@JINKNMs@POJD�Ë�;>w©; �Eh r ;W?N;s9�IAX�=�X�w�@J]J^N?A=�ÔLKA@JX,¼�hzO�¿NO)hW»zO�;Wj w�@JX�w�¸E;>w©;X�@J9�@J]Jw�=�hz?uDU·�? (¡Ù�ç ,�×�×.+Wì³æWí2�,&ì �è³î �©æEè�×xÙ©æ�HWè�ì�ç\æ�H 6��3çWæ�3_×xÙ�×Pæ ,�×}çWæ ,&ç 3_è 1�HWÙ�×�¡æ\ízì³æE×�×PÙ�ì�æ\ízl¿N;s»W@JX q\nWq LqWn\a lWÈA@P¿AwPD `PoWaWq D R hAMWIWh%lzBA;W¿N;W?uD

� `Pq�� ÈuDZ�;\¿N¿AX�;W?A¸�8�DJBEDJFÜ@JILKNMs@PO�DWÈA@J9i@J]Jwk=<?A»�Xkhs¼Úw r ;WO�@-w�@JX�wä¸E;sw©;[KAX�=º?A»�¸E;sw©; �Eh r =º?\¼ÚhAO�j�;sw�=�hz?uD�I � �uÙ HWæ H ,xè�ì�ç\æ��çWæ ,uç 3_è 1�H\Ù¥×![æWízì³æE×�×PÙ�ì³æWízlAÈN8-Y ` ½uá³½zâJÕ p � n LpWn'� l Q ¿NOJD `xoWa � D

� `Pp�� 8�D%BEDuFH@JINKNMs@PO�;\?A¸ Q D Q�e O�=�w J@POJD Q jC@Jw©O)=i]Cw�hª¿NO�@J¸N=�]Jw�X�hs¼�w r ;WO�@fX�]P;s9º;WVA=�9�=iw�IWD (¡Ù�ç , ��Wè³î�I �>,)-ë:/Nç _ì �AëêçWæ��¹×xè�Ù©ì ,�A'�� =,� �3.WlsBzKN?A@ q\bWbWq lN¿N¿uD `��\q Y `��Wa D

� ` ½ � 8�D%BEDEFÜ@JILKNMs@PO�;W?A¸@��DGBW@P?A»ED Q ?N;s9�I7 J=<?A»"¿N;\O�w�=�w�=�hz?}wk@JX�w�=º?A»�Xkw©O�;sw�@J»\=i@JXxD �I� �uÙ HWæ��H ,��è�ì�ç\æ��çWæ ,&ç 3Jè 1�HWÙ�×$¡æ\ízì³æE×�×PÙ�ì�æ\ízl `Pn á n âJÕ n\bWp LnN`\` lsBAKA9iI `PoWoN` D

� `�� 8�DNBEDAFH@JINKNMs@POJl%ÈuDEm�DAFH@J=�X�XxlE;W?A¸}Ë�DEÖf;WjC9�@JwPD�6[hzjd¿N;WO�=�X�hz?ªhs¼4¿NO�hW»zO�;\j+wk@JX�w�=º?A»�X�w©Ok;sw�@�Y»W=�@JXPD�·�? (¡Ù�ç ,�×�×.+Wì³æWí2��*ç �AÙ�è³î�, -së:/Lç Jì �Aë çWæ ,&ç 3Jè 1�HWÙ�×��u×�Jè�ì³æWí/*��æ�H 6!- Jì4�*�HWæ +��%×PÙ�ì �0, H��è�ì�ç\æElN¿N;s»W@JX ` &`Pb D Q 6[À c O�@JXkXPl Ê ]JwPD `xoWoN` D

10

�� !�"�� #��$&%'��(� )*��$+-,.��%/�(��0�� (�13254 687 68259;:=<>:@?BADCE2FA�GIH"J�KML@NPO5Q

J�RS25T!<F4�U.V=WX4Y7YAZ<F9.[H"J�\]J_^`<>a+4�b�c�?/4Y?/<>AZd�R

e/f O!1g<>A h;H(iF?/9kj.?G3lm2FAZR.<FTn1g<>A h@o+p#UqOsr>tFuFQ254Y7YAZ<F9+[=v#A ?/4Y?/<>A�dZRVP<>7Y7BVPdw25T

x�y`z/{'|~}+�F{

��5�� 5�k��5� ��g��D��Z�~��`�m�~�"�5��'��~�#��>��F��Y�F�>�~��M��F��k�� k�M��g��'��M�w�'�¡ 5��s��~�#��#�/��¢�#��¢�'�(�¡�s�5 F��X��5�/�X��F�Z�;�Z�F�k��Z�X��F��5��'�~��'��;��Z�Z�¡�'�'£;¤¥��F�~ F��¦��X�w�§��'��(¨��§��F�¢�5©��¢�F�q�'�¥�¢�5�F�¡��¢�5 5�'�`��#��'�� ~�(�~��~ 5�5��/�¥��Z�¢�/��;��#��'��@��~�5 5�'��¡�q��F�Z�¢� s�5�F��'�s�F�¡�5�(�'�=��5�M�s��~�~��'�ª�¡�s�Z��'��`��X�X�s�~�¡��g��F��F��5�w�~��( 5�Y��#�~��M©��5�B�"��F�'��/�+��F��s��~�~��'��« �¨k��s�w��¡�~� ��5�'�X�¢��Z�5�5��#�¢�¬��k�F�¡��/�S��Z�~��Z£@�q��5��s�� s��¢�F��F��®3�/��Z�~�~��~¯°��~��±²��F�F�(�/�s��¡�5��s�� k�Z�'��¡�~��D�Z�'�5�� 5��F�¡��#��3�'��F��/�>©>�F�B�"��F�'�~�B�'�5�#�X�'©/��¡�( s��~¨F��'��²�m�~��#�'�`�F��¢�F��§�/��5�¬�³ 5�5�Z��¡�~�5�'��¡�´�§�/��µ�s��~�~��'��£²¤-®3�/��Z�~�~��~¯¶°��'��¡��¡�~�µ��k�� k��/��¡�~��Z�~�5��¡��/�� ¢�' 5��5�'��F��¢¨s��Z��'� �B�'�¡ F��"�m��"�¡�s�5 F��s�'��'�#�Z��Z�5��'��B�'��¢�'¨F�¡��~�5�X�� 5�� /�I��F�¥�s��~�~��'��£+·"�F��Z�¡�~ 5��@�³ F��s��k�´�`�D�5 s��k�~��¸+��F�Z�#�Z�'�X¨k�� #�5��¡��]¨��D�� F�¡��'¨5��s��F� ��~�g�¢��¬��¥�'��'� �� 5�/�=��Z�'��m�~�¥��F�#�5��~�~��'��k�~�5��5�Z�²�/�¢��~��'�¥��F��Z��¢�F��¡�~��'��F��5��'��~��« ��³ 5�5� ��5�/�¡�¡�´�'£�·"�F�D�¢�/��"�s 5��k�~��M�¡�g��F�� 5¨>¹º��Z�"�/� ��F�¢��5�~�s��Z£

» ,.�#@��¬¼!½��3� �#�

·"�5�M s�� 5�'�S�>��s�~�¡��g�/�=�m�~��#�'�S�'�5�5��~�~�Y�F��`��X��¢�F�X�¡�g��X�5��~��"�Z�'��`�³��~�_�(�m��X�/�S��s�� 5¯��/��]�/�+��F�M��'�m�´�3�~��~£@·"�F�¢�g�Z�~�¬¨s�D�F��¾¬�Z F�¡�3��#�¡�X�F�¡��#��g�¢��5��'�Z��¢� ��¨k��' 5��#��g��'�m�´�3�~��F�>��5�'�M�5�w�'��m�~��X�/� ��k��Z�¿�À�Z�/��S�S�'�5�q�#�~��/�m�´�g�'��5�'�¢�F�Z��'�5�µ��M�F��F��¡�~�Y©��'�¡�F�¢�F��¡��m��X�'�.�(��F�F�5��£

Áº��F�¡��5�'�k��`��Z�~��F�( 5�� s�/�+�F�¢�� S�s�~�5�� ~�s��¢�F��F��k�~��¢¨F�¡��¡�´��'��'��5��/��¢�F�#�m�~��X�/��k�� k��/��¡�~�s��³��~�Â��¬�Z�~��(�~�5�*�#��'��F��/�g�¢�>�m�~��X�/��¡�~�*�w�B�/�¡�¡�~¨F��§��5��Z£�¤��¡��F�� F�~��'�M�k��~�¡�~�5� �X��F�¡�(�X�w�q��Z��Ã��¢©/�¬�5�'�¢�F�²��F�¢�F��¢�§��F�¬��~�5��5�¡��Z��¡�~�S�@��F��¬�~��¬�X�~�~��'��~�5��!�¡�D�Z�~�q¨k�¬ 5�� ³ F��'��5��/��X��m�~��X�/��k��Z�¿�À�Z�/��q�/�m��M��F�¬��F��Ä�5�~�D�/�¢��'�F�²¨k�Z��¨s F��¡��~�5��S£�·"�F�(��k��Z�¿�k��/��'�²¨k�� 5��²�~�"��F�(¨5�'��¡��m�~�"��F��F�Z�F��'��/��F�(��F��k��F�¡�Y��Z�~ F�¢��5��²¨k��¨5 F�¡�� 5��¡�F��(��5�¡�� ¢�F�¡�¡�F��Y�5�F�¢Å� 5��£�Æ��s� ��F�D�m�~��X�/�+��k�� k��/��¡�~��¢�¥�'�¥�5�~�5�S��~�5�F�¡��¡�~�5�'� ��D�Z�~��Z�~ F�¢�µ¨k�]�F��~��!�³��Ç��£#·"�F�X��s�� k�Z�'��¡�~�µ��'��¨s�X��F�]¨5�'��¡�¥�m�~�M�5��s�'��¡�F� s��F�F�Z s�(��/��S��'�5�;��'�;¨k�� 5��¦��!�Z�F�5�¡�'�¡�;��F��F��È��µ�k�'��¢�/�g 5��'�s�¦�Z 5��#��Z£É �¢�5�/�¡�¡�'�5�(�m�~��X�/�S��k��Z�¿�À�Z�/��'��¨s�D�X¨5�~��¢�3�m�~�g�'�s�/�¡��Ê��¡�5�#�~�5��~��¿�m�>�¢�F�#��F��F��« �"�s��s��ZË��'��q�/�m��D��F�~��~ F��µ��Z�M�/�g��D�5�'�D¨k�Z�� F�� F��µ�"�¡��§� ��Z�� F�¡��.�¡��#�w�q¨s�¬�F�¢�� B�'��5�/�"��F�D��~�F�X��F��_�5�'�"¨k�Z��¨5 F�¡��£

Ék�~�"�X�'��¬��>��X�Z�F�F�~�3��F�¡�]�m�~��X�/�S��k��Z�¿�À�Z�/��5��>¨s F��'��]�´�F�s�M�'�@� ��X�F��M�'�5�� 5�5�~��¨F�¡�~ 5�~ 5��k�� k��/��¡�~�s�=�~��`�¡�~�Y©~�¢�F�k£=±!�~�~�D��F��X�=�~��3�F��¡�~�F��~�5��D��D��F�"¨5�~��¢�=�/�k�F�¡�~�F¯E�¡�Z�~�Z�>��Å� 5�¡��#��Z��5�¡ 5�3��F��¢�F��'�`�¡�]��F�D�F��¡�~�F��«~�F��'�5�`�/�=��5�/�`��F�M�5��~�k��³ 5�5� ��5�/�¡�¡�´�'�F¨s��5�w�>��Z�>�'�s�¬�'�5�k��~��~�5� ��'�+��5��3�~��©��¡�5��5��>�s 5� �"��F�~ F�¢��¨k�'£�·"�5��¢�F��~�g�'�� 5�5�k�~��¨��¬��k��Z�¿�k��¢�5��'�s� ��3��5�/�3��¡�¢ 5��'��F�¥�F��¢��]¨k��5�w�>�¡�~��'�'�5�X��F�¥�Z�'�¡�� ¡�~�#�'�I��F��¢�5��'�s� ��`�X�w�(¨k��'�� ¡�~��'��F��F��Ì��'��'��]�#��k�� k��/��¡�~�.£

Í��B�Î�¢�¥�� 5�Y��¬��F��_��kÏ§·"�F�D�À��"��¥��'��~��D��F�(��k�� k�D�¢�5��~�5� ��"��5�'��3�� 5��5��F�¥��>��Ì�¢�#��F�g�k��F�¡�~� �~£Æ�¨��>�� 5��~�/�¿�I��5�¥��F��Ì�¢��D¨k��Z�~��#� �¡�~��"�� Z�Z�B�¡�� s��s��'��~�D� �5�k��Z��¦�~�;��F��Z�~��Z£!¤��F��(�'�5�¦�5�Z�'��s��¨s�� ~�#��(��X�³�~�#��¡�¡�~��"�¡��F�¥��F��~�5�F�¡��¡�~�5�'�5��~��F��'��s��S�~�k��5�'�s��"�¡��X��5�¥� �>�~�k��/��#�/�S��F��F��« ��'�� 5�/� s��£@¤Ð� ��#�#��]�(��F�F�]�'�+�Z��'��¢�F�D��F��Z��s�� ¢�/�¡��(�m�~�`�¢�~��'�Z��¡�'��>��X�Z��¡�`¨��X�5� �k�F�¢�F�� 5�'��¡�~�`�~�g 5��'��5�¡�Y��'��Z�5�'�X�F�¡��3�/�@��F�D��>��« �g¨k��5�w�>�¡�~��£Æ��F��"��'��3�#�w�¬¨k��Z��'��¨��~¨s��B�/��²�/��F�#� �F�¡��¢�F��Z�~��ZËI��5�#��F��« �M¨k��5�w�>�¡�~�¥�~�µ��k��Z�¿�À�(��'��(�X�w�²�� F�~�'��¥��~�#�

11

��X�/�¡�S�B�'��¡�'��¡�~�5�`�¡��F�M�¡�5�s F��"��3��F��F��_��'��M��5�'�"� �~ 5�¡��I��Z�3��F�D��« �g�� F��Z�~�#�'�5�~�5��F��B�~��¢�/��5�g¨s�� ~�#�D�F��Ð��Z�'��£

¤��m��¬��F�!��F�� ¢�]�F�¢�'�Z��*�¡� �~�k��/��S�`�§�F��-��~ s��Z��'��]�'��¢��X�~ F�X�/��³�/�¡�¢ 5��²��k�~��³��~�&��5��s��¡�S£�¤��m��X�³�'��¢ 5�� ¯´�Z�~ 5��¢�F�#�³�' 5��5�'��¨s��!��5�'�¡��.�5��F�(�¡�s�5 F��'�s�²��F��-��/��5�/��s��F�5 5�Z��]��F��³�/�¡�¡ 5��M�'��¥�'�5�5��¬��F��B�"�¢�F��3¨s�'��'£¤¥�3�� s�Z� ��¡�'�¥�~��¡�~�s��/�.��F�M��F�� ~��s��F�5 5�Z��S�/��Z��¡�~�M��¡�5��¨k��Z�~�#��=�¡�X�k�~��~�~��'�'�s��¥�Z�~�X�#�~�(�s�~��¢� �D�¢�@��w�'�`�'��~�³�' 5��¯E�¢�5�5 5�Z��Z�~��`�¢��F��Z��¡�~�¬�� F�¡��'£

��µ�5��~�k�~��5�'�¬��F�µ��'��]�F��'�Z�¡�~�k��*�m��¬�;��F�� Z�~��¨s�!��F�²�m�� 5�5�5�'��¡�~� �/��m�~��X�/��k�� k��/��¡�~�q�m��D��F��F��£�·"�F�¬�Z�5�s�� §�~ F��5 F��/�"��5� �k�F��©/�Z�q�B�/�¢ F��D�'�"��F��s��~�~��'��« ��¢�5�5 5��w�� F��s F��Z�¢�/��¡�~�.£@·=��Z�~��5�'�� 5�X�� 5�� ³ F�¡��X�Z�~�#�5�Z�¡�¡�F��/��F��¨s�� 5�5�5��'�S��F�¥�s��~�~��'��« ��B�'��¢�]�¢�5�5 F�"��5�'�Z�'ËF�Z�~��s�/�g�F�#�5�'�`�� 5�� 5�� ³ F�¡��]�k�'�¢�~�3�~ 5�3�F�¢�'�Z��`��5�'�3�~��¥�~ F��¢�F��F�M�F�~��X�/��5�~� �'£*·+��X��5�'�X�� 5� �� s�Z� ��³ F�¡��~�¨5 F�¬�~��'�� F��À��¡�;�³��Â��F�²�X�B¹º��¡�´�§�/�M�� 5�� ³ F��¢�5�5 5��s�F� �À�F��F�¢��Z�~��¢�> F��g�~�g�¢��s�� ¡�~��k�'�¢�~��"�/� ��5�M��/�m�´�g�'��'£

¤��~� ��X�/�M��]�Z�~��]��k��Z�¿�s��]�5�'��X�/��F�!¨k��5�w�>�¡�~�#�/�M��5�!��F��3�5�'�#�Z�¡� ��F��k�F�¡��!��Z�]�'��¢�5�5 5�º¯¶�~ F��5 F�M�5�/�¢��/�`��F�#��Z£D·=��¨k�X�#��~��F��'��¡�² 5�� ³ F�E�.�F�B�3�Z�'��Z�À�]�k�5��X��Z��/��M�� s��¨k�D�Z�~�5�'¨F�¡�M�/� ¨s��¡�F�X�~��F��'��¡ÊZ��¬��]��s�� m��¨k��5�w�>�¡�~�`��5�'�"�¡�"�5�'�g� �5�F�¡�¡�Z��'�¡�'��¨��¬�~�5��'�=��F�D��'��£µÆ��F�¬�g�w�µ�/��F�~�¡�5�!��F�¢�(�¡��5��~ F��;�5��'�~��'�Ä�¡�>�m��5� �� Z�� E£²��Z�F 5©'��(�5��s��§ 5��¢�F��s��~�~��'�Ä�¢�>�m��5� ��~��q�(��'�5��/�¥�~��¢�F�²��F��~�F��Å> 5�~� ��/��µ��Z�(�/�"��X�Z�~��Z£!·"�F�¢�#�'�5�5��~�~�Y�� F�~�'��X��5�'�"��Z�3�/�+��3��'��Z�~ F�¢��¨k�M� �~�s��¢�F��'�F��Å� s�/��#��3��F�M¨k��5�w�>�¡�~�`�/�=�(�5��~�~��'��F�]�5��~�~��'�&�¡�F�m��³��Ç��F�#��D��'��`��(��Å> F�¡�w�'��5�X�~� �� 5�/� �5��'�~��'�-¨k�Z�¢�F��S£¤¥��F�~ 5�~�X��5�¡�`�¡�`�'�]�~�5�s��/�¡�¡�5�D��F��~��Z��¢�Z�'�5�³��'�#�Z�3�~��©M�m��Y�5�~��~� ��¡ÊZ�¢�F�M��`�'�F��Å� s�'� �~�'�¡��³�~� ��´�`��s�' 5��¢�F��5��~¨5��#��5�'��'��"�¡�#�'��F��/�5 s�5�F��Z�¡�s�'¨F�¡�'�>�'�5�#�¢�]�5��'� ��¡�Z��/�¡�3�w�F� �F��¾¬�Z F�¡��(�'�Z�Z�~�X�F�¡�¡��S¸�¢�>�m��¡�5�X�X�5��'��~� �³�� '�X�F�¡��g�/�@��¨k��5�w�>�¡�~��>�~�5��F�Z��#�¡�F�¢�F�]�5��'��~� ��Å> F�¡�w�'��5� �~£

Í��B�`��'��B�� 5�Y��Z�'�(¨s�3�~�'�¡�5��M�³��~�Î��5�`��@��¡��¢�F��5��F� ��@��5�~��+�/�s�� X�F��3�Y�5�'��'�Z��¡Ê��/��'�=��F��5��'�~��'��£@��F��#��"�F�Z�k�F��#��Z�~��~�F�F�D�¡�3�³��Å> F��¡��5�¡�5©��¢�F�]�F�'�"�'�=��F�D�~�F�D��Z�"�'��k�� k�#�B�/�¢ F��M�'�`��F�]��+¨5 F��/��F��/�"��~�F�'�#�/�g�B�/�¢ F��s�/�D��5�¬��¢�F�'�¡�X�Z�'��]��5��£(·"�F�¢��¢�g��5�M¨s�'��¡�g�'�=��5��Å> F��B�'��5� �D� �¢�'��g�'�5�s��'�Y�¬��X��g�'��F��/�� >�5��Æ��>�s�� E�5�s��¨5�'¨F�¡��F��#�~��3�³ 5�5�5�~�(��/�=� �~�s� ��5�3�¢��¡�F�k£

·"�F��Z�/��Z�~�~��~¯´�5�~��!��(��k��Z�¿�k��/�� Æ �!�>�"�gÍMÆ�� 3�Z�~�F�� s��D� �5�'�Z��¡�µ��F�¡��´�F�s�¬�'��(��~��F��'�s�F��¢�F��¡�~�X�'�.��Å> F�¡�B�/�¡��5�Z�¥� �¢�'��/�.��`�5�'��s��~�5�]�¢��5�'�� 5��/�s�m�~��X�/�¡�¡��Ì�m��5��¡�F��F��5��'��~��« �3¨s��5�w�>��Z£

# $ �(�&%(��@�Z�� ,.��%/�(��0��(' �*)�½²� ��¥��¥�#@$ �Z�# � ��0�� ,+�"�� #��$

®`��5��¡�F��¥��F�(�m�'�¡��B�"�¢�F��s�/�� s��'�=�¢�'�F�� 5�/�~��F��¢�F��¡�~�!�/�`��~�#��'��5��m��/�� s��¥�'�`�¬�¡��5�5�¡�F��¡�¡¨5��'��F��£

·"�F�3�¡�¡¨5��'��D�5�'�=��s��3�F��I��=�Z�¡�~��=�/�k�#��¨k��Z¸+��Z�� F�¢�'�+�#��¨k��Z� ¹� 5�5��=�#��(¨s��/�'�s��Y�F�¡�¡��#��¨k��Z£®3�F�¡�¡��#��(¨s��"�~��M�/�~��-�B¯.�5��¹� 5�F�¡�~�"�#��¨k��3�~��M�/�~��/�/¯0�/1s�>�'�5��Z�~ 5�¡�~�`�#��(¨s��"�~��'�'��2�3��'�s�; 5�S£�Áº�;�'�5�F�¡��¡�~�.�@��Z�� F�¡�~�D�#��¨k��D��F�q�(��Z��Z��'�¡�§��Å> F�¢��(��D�Z�~�;�'�5�5��µ�m�~��s��¡�>��¡�Z�~��#��¨k��F�¢�S£43�'�Y�¬¨k�>�~©X�¢�¬��5��¡�¢¨5��~��X�¢�g� �¢�'��s��'�g��Z�� F�¡�~�`¨k�>�~©À�F�� m��5� �M¨s�>��©k�>��`�#��¢� ��¬¨k�>�~©À£

5¥� �m��s� �M¨s�>�~©>�"�F�X�F�~�g�Z�¡��Z 5�¡�'��'�F�~�5��¢� ��¨k�>�~©>�g�Z�¡��F��g� �¢�� F�¡�'��m�~�g�#��5�~��3��5�'��F�~��X�/��¡�#��k��¡�>�.�@��Z�~�§¨s��¨s��B�`��!��F��§¨��q�!�s��¡�>��¡�Z�~��§�#��¨k��£²·+�²��5� �� 5��/�'�X�~�~ 5�F�!�k�Z��F�¡�¬��~�S�S��Y�5��¢�µ��`¹� 5�F�¡�~�M�#��¨k��M�X�w�²��~©/�#�~ F�M¨k��©>�¥�m��F�'��¥��5�'�q��F�]�F��X�'�=��¡�#�]�'��¡�~�F��'��F�Z��F�]�F�'�g�B�3�D�'��]�k�F��Z£

Á¶�=¨k�~��B�`��]¨s�>�~©>�3�'��¥��Z�� s��F��5�~��`��F��¡�g�5 5��5�'��'�>��F��¡�¢¨5��~��]�~��D�À�F��¬��F��¨k�~��B�`��'�"£ 6��X�s��¥�5�w�~£7�g�~��B�`��`�B�"�¡�5�¬�(��D��5�'�98��F£ ��X�'�� 5��¡�F��#�/¹º�~��5�Z�¡�¡�5Å> F��k�'�s�²�'��F�'��k��#��µ��¨k�~��B�Ì�~��³ 5��F��M¨k�>�~©>�M 5��¡��F��¡�M�'�� 5��¢�M��¡��.£;:¥��#��(¨s��M�¡�M�/�¡�¡�B�`��²��¨k�~��B� �#�~��5�'�<�/�X¨k�>�~©>�"�/�"�'��¬��F�M��¢�#�'£= �'�m�´�3�~��#�¢�D��²¨k�#��¡��5�'�D�"��¡��X�'�5�'�'�#��F�¬�F��F��q�³ 5�5� ��5�M�/�3��F�]�¡�¢¨5��~��~£ = �~�#�X�/�`��F�

��Å> F�¢��¬��s��'��¡�~�5�`��s�/�"�5�'�s�F��M��F�M�¡��~� ��5�3�/�@ s��3�"�¡��F�D�¡�¡¨s��~��]�'��/�~�¡��'�5�?>+��w�'�¥��F�>=�¡¨s��~��~��g�~��B� �'�5�@5��Z�� 5��A�g�>�~©À��5��~�¥��g�>�~©À�>�'�5� = ��5�&�g�¡��E£Æ��F��s��'��¡�~�5��s��/�¢�]��X�~�5�/�~�¡�F�#��5�D��¢¨5��'��¬� �'�¡�¡�� S�5�� 5�Y��'�B4`��-:¥��C�g�>�~©À�5��¢��D4��F�¢��¡�5�E�g�>�~©À�k®`�¢�'��m�@�g�>�~©À£

12

¤��"�¡��¦�X�'��Å� 5�¡��#��F�F�Z 5�#��~��Z� ��F�¡�(�F��Z��¢�F��¡�~�§�¡��w�~��D�X�'��§Å� 5��¡�~�5�� s�5�'�5��3��S£��s�/�"�'��F�D��Å> F�¡��#��~��`�m�~�g�5��>�¡��'��#��¨k��F�¡�ÀÏ��5�/�g�¢�g��F�D¨5�~��¢�`�m�~�"�Z�¡�~��¿�m�>�¢�F�X�(¨k�>�~©5Ï��s�/��¢��F�� ¢��Z F�¢�/��¡�#�D�m��¥�F��X�'�.¨s�>�~©>��'�5��m�~��¢� ��¨k��©>� ÏµÁ¶��]�5��>�¡��'��#��¨k��¨k�~��B��(��¢� �� ¨s�>��©k�3�F�>��X�¡�]� �¢�� F�¡�'��m�~�#��F�!�F�~��X�/�g��¢�#�'�3�~�(�m�~�#��F�!��5�~��X��¡�Z��¡�#�BÏ��>��F� �/�/¯¶¨k�>�~©��X�B�F�¢�� 5�ª�'�s�F��#��'�Y�#�¢�5��'�s� ��'�I�>�¢��¡��¢�F��F��¡�¡¨s��~��(��¨k�~��B� ¨s�>��©��5��M�#��'�µ��5�'�M��F�#��~��/��> 5�(¨s��'�`¨k��©>�� 5��~��²¨k�Z�¢�F�²¨s��B�3��²¨��!��#��(¨s��M�Z�'�s�F�'��Z�5� �Z��9�3��Ï

Æ�¨��>�� 5��F��~�5�²�X�'��'��5��¥Å> F��5��( 5��¨s�(�'�5��`��¨s�Z�m�~��F�(��'�m�´�3�~��'�²¨k�� s�Y¯�Z��º�³ 5��¡�q��Z�¡��~��SË ��F��F��'��Y�F�¡��Z�Z�@��F��F��F��@�~��k�~��¢¨F�¡�µ��F��F��'��s��D�( 5��(��©!��F��~�5��`��+�³�� 5��Z 5��(��£+ÉÀ 5��F��Z�/��F��F��'�Z�¡�~�k��#��>�� ~¨��>�¡�~ 5��'�S« �¨s�"��(��@�w�'��¢�5�'��"�¡��5�~ F�"��F��'�s��3��Z�5��¢�5� �D��F��D�`�� F�¢��¨k��F�]�g�w�¬�/�©>�F�B�"�¢�F�X��F�Z��F��¥��F��F��_�¢��F�~�¡�5�]��5�/��¡�Z« �� 5�5�k�~��]�F�k£

·"�F��~��¨F�¡�~ 5��`�'�=�¢�>�m�~��X�/�.��Å> F�¢��#��g�'��M¨5�� F�~��3��X��5�M�� 5��³�'�Z��¨��'��X�F��"��#�m�~��#�'��¡ÊZ��F�²��Å> F�¡��#��~��Z£ Áº�5��~� �'��'��©��¡�5�q��/�m�´�g�'��F�'�¢�F�Z��(��; 5��²�!�m��X�'�g��k�� k��/��¡�~�*�¢�'�F�� 5�/�~��¡�¢©/��§�~��M±;�S�3�#�s��s��(��F�] 5��(�'��5�#��k�� k��/��¡�~�µ�¡�~�F�~ s�/�'�(�/��F��®3�/��Z�'��¯¶°��'��¡��¡�~��F��¡�~�§�#�Z��5�>��´®`°`±�£+� �¡�� ®`°`± � Æ �-�F� �gÍMÆ��F�+¤¥Æ��15� �g�¡�� ¶�+��F�¬��~�5�/�¡�>ÊZ��F��w�B�'��¢�'¨F�¡�D�¢�>�m�~��X�/��¡�~�µ�'¨k�~ F��X�³ 5�5�Z��¡�~�S�.�~�5��¡��¥�¢�>�m��X�/��²�F��Z��¢¨F�¡�5�¬��F�(�³ 5�5�Z��¡�~�S« ��¡�5�s F��F�X��>�¡��~�s�(��¢��F�¡�Y�q�¡��s��'��Z�.�~�5�µ��F�¬�� F��5�'�D��F�#�³ 5�5�Z��¡�~�§�5��F�5 5� ��Z£X·"�F�X��¢�>�m��X�/��Z�~�5��¡�� F��"�#��"��s�� k�Z�'��¡�~�S�F��5�¡�Y��Z�~��¨k�D�5��F�Z��¬��]�5��F�5 5�Z��"�Z�'��`�m��`��F��¢�X�F�¡��#��'�m�´�3�~��~£

·"�F�(®`°3±È�¡�~�F�~ 5�'�'��¡�¥Å� 5��¢�X�F��D��]��'��S�5�'�s��"�~��D�/�¢��'�5�X�³�'�#��¡�¢�'�"�"�¡��5��'� ��>�¡�´��'�@�F��¡�~�5�¡�F�#��'��£Æ��'��`��5��5�'��*6�1#�'��~��>��F��~ F��5�~�g�5�'�"¨k�Z��~��F� �¢�/��¬�"�¡��5��D�#�/¹º�~��/�m�´�g�'�� ¯´�5��F�5 5� �¢�F�� ~�X�5�~�F�¡��£X·"�5�]�'�~�'��5�'�D�'��g�w�F��¨k�Z��!�5��F�5 5� �]�Z�~�� Z�+� ¾¬� �¡��/�m�´�g�'��5�/� �� 5�5�k�~��=��F�g� ��#�s�'��I« �=�5��F�5 s� ��£=·=��F�g¨s��@�/�5��F�g�' F��F�~��« �@©>�F�B�"�¡��F�~�'��m�~��#�'��k�� k��/��¡�~��Y�5�5�¡Å> F��5�w�~��F�'�(¨s��¦ 5��¦�¡�¦�~��µ�/��F�Z�¢�#��'�m�´�3�~��¬�F��'��5�#��5��F� ��=¨5 F�#��5��5�w�'��'��g�w�F�¨k�Z��F��F�¡��/��¢�F�#�~��~�~�F��Ê��/��5��¢��F�¢�'�Z�'£ ��F�¡��5��3�'�� s�� 5�'��¡�]Å> F��M�'�>�F�¬�/��F�Z�¢�@¹º�~¨s�Z�F�'�s�� 5�� 5�'��¡�]��X�F�¡�B��>��X�/��¢��'�5�5��~�~�Y�F��3�'�s��Z s��g�' F��~�X�/��¬��>�~�¡��F��F��/�¡�g�w�>��s�w�'�`��F��¢��`�m�~�@��#��3�� 5�Z�� 5��(�'�5�(�#�~��`� ��X�F��"�'�s�5��'�Y�S£.·=�M�(��Z� ��5�¡� �F��S�/��F�g�Z�/��Z�~�~��~¯�s�'��¡��¡�~�§�#�Z��5�>�¦�3�~�D�¡��F�5 5�Z��;�'��~�F��/�"��F�� ~�X�5�~�F�¡��@�~�5�§�3�~�D��X�F�¡�B�'��§�� 5�� ³ F�¡��¡��Z�~��/�F�5��/¹º�� *� Æ��63 ¶�~�5��B�>�¡�5��¡��>�¡�~¨F��¡�¡�´��¡�]�D�Z�~�X�#�� ¢�/�5��/�m�´�g�'��3�5�Z�'��5�#��>�¢��5�#��Z£

� ) �� $ ��@�¥��&+��Ð�D�@� �Z�(�� "��¬¼

¤ ��/��Z�'��¯´�5�'��¡��¡�~�X��k��Z�¿�À�Z�/��¢�g�¢�� À�� X�5��'��~� ��¡��¡�� = �k�� k��/��¡�~�,>@�'�F�� 5�/�~��m��M·+��;��5��/��¡�~�.£(·"�F�#�~ F��5 F��5��F�5 5�Z��µ¨��!�Z�F��Z 5��¢�F��F�X��s�� k�Z�'��¡�~�q�5��~�~��'�-�¢��Z��'��Z�~��]�m�~��5�µ�³ 5�s� ��¡�~�.£ ·"�5�q��s�� k�Z�'��¡�~��Z�~��'�¡�5��´�`� �X�/�¢��5�'��F�� "!��$#&%��~�5� ��F�'��()��*+�,� �-!.�$#&%��sË��F�� ~��!�5��Z��¡¨k�� ¨k�Z�¡�B�&�¢�>�m��X�/�¡�¡�'£ ·"�F��²�¢��5��¡�*�5� � ��#�5��¡��w�B�'��¢�'¨F�¡��m�~�"��F��¥��k��Z�¿�À�Z�/��¡�~�F�~ 5�'�'�~�5�/�¡��F�� F�~��~��¡��~��¡�~�s�3�s�w�'��¨k�Z��¡��²�'�5�� 5�� gÍMÆ��>�SÆ��6/ ¶£�·+�]�¡�¡�¡ 5��/��5��#�Z��5�>�.�k�3��F��'�Z�¡�~��]��¥��s�� k�Z�'��¡�~��m�~��F� �3��B�g¯ �3�>��©�³ s�5� ��²�/��F��¡�¡¨s��~��F��£�¤g�¥�B�'��¡�~ 5��k�'�¢��F��F��~��~��²��Å> F�¢��#��'��F�'��k��Z�¿�À�/��3�D��s�/�¡�.�#�~©/�D�'�� 5�X�F��¡�~�5�"�~¨s�� F�g��F��s��s��"¨s��5�w�>��`�'�@��F��>��£

/10325476�8�93:<;=2?>@:�ACBD6

®3��'��¢�F��F�²�¢�5�5 F�� ¡�~� ��'��X�"�¡�� ¢�F��¿�m�>�¢�F�;��F�!�5�¡��¢�5� �¬�'��¢¨5 F��3��/�¡��E!"FG�H�HIJ%�K)#&��( �g�'��F�X�¡�s�5 F��'�s�q��'��]��s�'� �X��5�/�D��I��Z�D��F�]¨k��5�w�>�¡�~��/�3��~�Y�!�³ 5�s� ��¡�~�.£X¤��m��Z�/��Z�~�~��s�'�M¨s��¢�F��~��¿�k��S�k��F��5�'��¡��¡�~�s�"��¥�¡��¬�5�¡�³¹º�'�¢��'�@�B�'�¡ F��Z�À�Z�'��¡��L!.*MFN("(.�)(YËÀ��F�D�~�~�'�.�¡��5�'��~�Y��Z�¡�~��F�� F�¢�#��s��~��D��Z��/�I�w�'�¡ 5��5�/�`�5�w�'�g��5�¥��~�#�"� �I�� `�~�#��5�"�³ 5�5�Z��¡�~�S« �¨k��5�w�>�¡�~��~��D��~�Y��B�'�¡ F�M�¢��F��Z�¡�~��"��F�~ 5�¡��¨s�D��Å> F��B�'��~�3�m��g��¢�F�¬�5 s��k�~��£

Áº� �'��5��/�E��¡�s�5 F��~�5� ��'��§� �~�s�F��5��Z�'� ��I�� ;�³ s�5� ��S« �²¨k��s�w��¡�~��¡�s�F��>�¢�5 5�'��¡� �~��¡��Z�~�(¨F�¡�s�/��¡�~�#�"�¡��]��'�Y�#�'��F��£ ¤"�m��F�¥��/��'��¡��5�w�~��¨s��¬�s�'��¡��¡�~�F��S�'��F�¥��F��¬��k��Z�¿�k��5�B� ��5��F� �I��Z�¡�~�� ¢��'�Z� ��F��#��5�g�³ 5�5� ��X� �F�� F��Z¸=��F�"��k��Z�¿�k�� B�/�¡�¡�X�~�5�#�¡��B�/�¡�¡��¢�5�5 5�¥�'�5��/�� ¨F�¢�5�/��5��5�'�5��5�� 5��¡�F�X�� F��5 5��~�5��/��Y�s�'�F�~��g��s�/�"�F�Z�� 5�g�"��~�Y��Z�~�(¨F�¡�s�/��¡�~�.£

13

·"�F��¢�>�m�~��X�/��¡�~�;�s��F�5 5�Z��¦�~�(�q�� 5��(�/��5�¡�X�'�s�/�¡�>��¢��Z�~�¦¨k�� 5��¦��q�5� �k�F��#�Z�~��5�/��¢�5�Z�¡ 5�5��/�¡�I� �~�(¨F�¢�5�/��5��'�.��F��¡�5�s F�3�~�5�¬��'��Z�~�5�5��¬� �¢�'��Z£ ·"�F��`��'��`�Z�'��¨s��5��F�5 s� ��X�~�� s�/�¡��³�� F��Z�'��'�~��¯¶�s�'��¡��¡�~��¡�>�m��X�'��¡�~�S�À¨5 F�¥�¡��¢�"�³�~�¥�#�~��5��>�s 5� ��~��'�5�� À�� ~�� s��~��' F��~�X�/��>�~� £3��F��µ�X��>�'�=�¡��w�w�'��¢�'¨5��~�5��F��¡�>�m��X�'��¡�~��¡�¥��¡��¢�!�]�� 5� �� 5��k�� k��/��¡�~��s�/�"�5��B��¢�F��3�X¨F�¢ F��5��¢��3�m�~�"�F�B��F�D�B�/�¢ F��g�¢��F��/��'��¡��3�'��Z�~�(¨F�¡�5��#�m�~��Z�~��m��g��F�M�³ s�5� ��S£= s�5�s��#��5�E�g��B�g¯ �g�>�~©]�³ 5�5� ��µ�5�~��´�`��¡�5�s F��.��"% %�� #��#�'�5�q�� "��K�� #��/£�·"�F�X¨s�>�~©~¯¶�¡�

�s�'��'��'��"�´�`�¬��/��Z�'��¡��¸��5��¨s�>��©k« �"�´�F�k��'�5��¡��/�� 5�"�¢��F��¡�¢¨5��~��~£`·"�F�(�(��¨k��¯E�¢�²�5�~��/��¡��~��D��5��Z�¬�Z�'��'�~��¡��¸D��F��#��¨k��D�´�F�k�'� ��F��(��¨k��« ��F�Z�¡�¡�sÅ� 5��5�Z�q��/�� 5��@�~�5�§��F�� s��¨k��D�'�¨k�>�~©>�M��5�¬�(��¨k��M�¢�D�Z 5��¡�µ¨k�~��B�"�¢�F�s£(�q�¬��~��M�"�¡��5�]�~ F��¢�F�]�/�g��s�� k�Z�'��¡�~�µ�m�~��F��g�´�`��¢�5�5 F��Z�~�'�¡��¢�F��~�F�¡��¡�'�~�¡��/�>�5�'�#��@�m��@��F��/��'��¡��@�'�5�(��5�g�Z�¡�~��@�"�¡��F�¢�(��'�Y�#�Z�'��'�~��'£

�� !��#"%$&�#""��')(*$&�+� ,

-/.0.�102�354-/.0.�1027698�: ;

35<�=�>�?@354A ;�B�CD?E> AGF .0.�1A ;�HI6 A 3@JK6*;�4 F .0.�1A ;KLM; A ;K<NJ�; F .0.�1

O 6P>Q6*CDHF .0.�1%J�RD;�J�1�;�4�.�CD6F .0.�1�>=�>�3@?5> F ?@;F .0.�1%<N.�<�2�J�3 A J�CN?5>Q6*3@<DB

ST;�U F ; A 2�354ST;�U F ; A 276V8D: ;

35<�=�>�?@354A ;�B�CD?E> AWICN<D3@. AJ�RD35?54: A 3@=�35?@;�B�;�4

XY;�?@3@<#Z0CN;�<DJK8<N.�<D;U[35<D. AU\>W9. A

]GCNU F ; A 2�.�C�6Y^_<�CNU F ; A .�L F .0.�1�H`J�C AaA ;�<06*?b8 F . AaA .�cd;�4#e<N.�<D;>Q6f?@;�>�HI6hg�iD?@;�HaHf6*RN>�<�U\>Qj�3@U)CNUU\>Qj�3@U)CNU

Áº�5�s F�(��Z��¡�~�;�Z�'��'�~��¡��D�Z�~�;¨s��/��¡�]��Y�5�~�F�'��'¨F�¡�'£lk�% %�� 9m-� �#�'�s�on �Q��-�.K�� 9m-� �(�'��¬��/��¡��'��¢¨5 F��Ë �m�~��!�'�¡�'��§¨k�>�~©q�~��#��(¨s��Z� ��F�Z�¢��B�/�¢ F��F�µ�5�'��Y�5�~�F�'�~£1�� F��$� ( �qp ��*+# �sr�� .�@!QmB��'�5�t,� �u�"�.K��C%��>�'��3�Y�s�'�F�~��'¨5��~�/��/��Z¯¶¨s�'��'��¢¨5 F��Ë/��F��¡� �B�'�¡ F��'��3�X�'�¡��'�¡�5��¨��F�"��F��Ì�'�5��X�w�X�Y�5�'�5�'�¥�~�� F�¡��/�.�Z�F��Z 5��¢�F��F��³ 5�s� ��¡�~�.£�·"�F��'�� ¯´¨5�~��#�'��¢¨5 F��3�Z�'��'�5�k��~��/��/�¢�]�'��/��Z�'��¡��g�¢��5�A5�� F�¡��Z��¡�~��/��5��k��Z�¿�k��/��S�s�"�¡��!�Z�~�5�5��5�"��s�/��5��Z��¡¨k��F�B� ��F��Y�s�'�F�~��~�"�#�� F�¡�"�/�@� �F�� F��¢�F�X��F�M�³ s�5� ��S£

·"�F��Z��~��@�s��F�5 5�Z��/�I��F�¥�¡�5�s F��Z�'��'�~��¡�� F� �À�F��F�"��¡��s�~��~��¡�'�5�¢�5�5 F��5�~� �3�m�~��Z�~��Z£Ék�~�`��F��g�~��B�g¯ �g�>�~©��s�� k�Z�'��¡�~�S�>��F��~�� 1/� �B��w� �/��%v(��1��(�s��¡¨5��¡�5�s F�"� �~�(¨F�¢�5�/��5�Z£ ·"�F��k�� k��/��¡�~��¡�~�F�~ s�/�'�M�k��(�¡��"�Z�¡�~��3��#¨k��'�5�5�'��'��¬�"�¡��1K ��("�$K)#&!.� #&%G� (��* #_��# � (`��5�/�"��5 5�Z��F��> 5�(¨s��¥�'�� ¨F�¢�5�/��5��5�/��'��5��F�5 5� ��S£¥Ék�~�� 5�'�X�F�¡�'�À��5��X�w��5�� ¢�F�(��5�'��'�!�¡��B�/�¡�¡��g�>�~©~¯¶�´�F�s�²�"�¡��M¨k�q�� >¾¬� �¡��¡�*�� "��¦��¡�5�'�¡�µ�#��¨k��¯¶�¡�S��/��F��5�~��F��1 � �av �w� �B� ��Z�~�(¨F�¡�s�/��¡�~�s�M��5�'��'��¬�F� �À�F��§�¢�§��F��k��Z�¿�k��/��S£�·"�5�¡�(� �~ 5�¡�;¨k��'�� #�5��¢��5��§¨��q�F�¢�'�Z�¡�F�²��F��¢� ��¡�~�

�>±!��¨k��¯¶�´�>�k��v ��Z�� F�¢�'�Yw ��Z�¡�¡�sÅ� 5��5�Z�xv �5�~�F�[w :� 5�(¨s��º¯¶�~ F�hvÌ�F�~�F�D ��F��¡��B�/�¡�¡�µ� �¢�'��"�/� �g�>�~©~¯E�´�F�k�'£"¤¥��¬�� F��s��5��¥�3�~ 5�¡��¨k��'��F��/��S�À� ��s��5�F�¢�F�X��F�g��5��Z�"�Z�¡�~��@�/�À��F� = ��/�� 5��Z�'��'�~��'£=·"�F�"�'�5�F�~��'��¡�~�5� �'��g�F��Z��¡¨k��(�¢�(�#�~��g�F�Z��/�¡�5�¡� � �3ÍDÆ�� ¶£

14

·=�X�'��5��/��'�Z�� 5�'�S��g�¡�s�5 F��3�³��~� ��F�DÁº�5�5 5� = �� S�F��~�Y��Z�¡�~��3�¢�"�'�5�F�~��'��"��#��'�F�~��'��B�'�¡ F��Z£ Ék�~�g� �5�~�#�5��~�F��F� ��Z�¡�¡�sÅ� 5��5�Z��Z�'��'�~��I« �g�Z�¡�~��g� �� F�¢��¨k��k��Z�¿�k��'�3�m�~��¡�B��Z¸��Z�¡�¢�5Å> F��5�Z�

�F��F� � 8��5£ �� #�¢�F�~� � 8��5£ � �#£�£78�1s£ �� X�B¹º�� 8��F£ ��£�£

·"�F�!�5�'��'��¡�~� �¢�#�5��¡��]��5�/�¬�;�� F�¡��~¨F��²�B�'�¡ F��m��X��F� �@%��]� �¢�'��X�¢�?8��s£ ��5��m��x��# ��%�K]�'��>��5�¡�F�¨k�Z�´�3�Z�� 8��s£ ��g�~�5� 8�1k£ ��5�/�~�5�#�m�~�h� F��.%�K78��5£ ��M�'�5�X��/��Z£@·"�F��k��Z�¿�À�Z�/��]�5��>�Z��@�`�� F�¡��~��F��'��]��s�� k�]�¢�5�5 F�(�w�'�¡ 5�� s��¢�F�²��5��~�F�'��Z£ = �¢�(�¡�¢�'��'�5�'�X�¡�F�m�~��#�'��¡�~�;�Z�~ F�¢�§¨s�� 5�s�F��¡��m��F��~��F��¢�5�5 F�#�Z�/��Z�~�~��Z£²·"�F�?�3�>��©'¯¶�´�F�s�¬�~�5�¦±²��¨k��¯E�´�F�k��'�F�~��D�3�~ F�¢�;�F��s��5�;�~�§��F��s�'��¢�Z F�¢�'��m�~��X�/�g�/�@��F�M�¢�S« �g��5�/�"�~��M 5��¨~��F�M�¡�¡¨5��'��'£·"�F�D�g�>�~©~¯¶�¡� = ��'�� 5�g�¢�"�;�g�>�'�¡��~�¬�B�/�¢ F��m��'�Y�� ¢�'��.�'�5�<:� s��¨k��¯E�� F�D�5�'��5�¬��~�F�'�� g�m�~� ��%�� £�£]©�"�m�~� F��*M�"FN()��B�=�~�5� � ©�g�m�~�� F��7#_� � �(£ ¤¥�� F�¢�F�M��D��F��¢�>�m�~��X�/�s��k�� k��/��¡�~�.�'��5�"�w�'�¡ 5��/�S©��¢�!�/�s�~¨5 5��F�"��#��~��3�~�~��X�w�~��©]��]��"��F��5��'��~� �(��M��F�~��~ F��F�¡�'£

/1032�� 2� 9� : ;=2 >@: ACBD6

5¥�� F��D�F��Z��¢¨s�X��5�#�� F��s F��~�5��/��]�Y�5�~�F�'��M�5��F�5 s� ��¨��²��F�X�³ s�5� ��SË=��F�Z�q�'��X��/��Z�'��¡ÊZ��~�5�;�5�~��F��¹� 5��¡�¢©/�¬��F��¢�5�5 F��Z£q·"�F�¬��(�� 5��(�F�� ¢�F�¬��5�'�(�Y�5�~��~� ��Ê��M��5�]�³ 5�5�Z��¡�~�S« �� F�¡��F�'�5��F�� ~�#�D 5��"��Z�/��Z�~�~��5�/��'�F�� 5��5�M�³ 5�5� ��S« �"¨s��5�w�>��Z£ És��3��F��g�~��B�g¯�g�>�~©µ�³ 5�5�Z��¡�~�S��F��©/�� F�¡��¢��F��~� �� 5�/�B�g�~��B�"�¢�F�s¸#�Z�~�;��F��#��(¨s��'©/��F��¨s�>��©q�� F�ZË`�¿��s�.�m�~�D��5�'��s��¡�F��/�g��¢�(�~Ë �¿�"�²¨s�>��©²�¡��¨s��B�`��S�+�F�B� �¡��F�¬�#��(¨s��Z« �D�¢�>�m�~��X�/��q 5�À�5�'��ÀÏ·"�5��M�~��k��Z��g�'�=��5��3��B�� F��"�~��M�Z�~�F�� 5��¢��F��Z�'��'�~��¡�� k�%GK)K % �q� � ��K�� # ("()#&%��s��?�� IG��#�C%��* % FG�s�S�'�5�lt,� �u�"�.K��C%��E£!�g�~��B�g¯´�s��#�¢��¡�~�¬�¢��&�g��~��'��B�/�¢ F��5�/��/��5�Z��5��F� �3��B� �¢��k��#��S£;>=��F�~��>¯¶�/�8¯¶��'��¢�D��> 5�#��¢��B�'�¡ F�#�'�¡�>�¡�5��5�X�> 5�(¨s��/�`�5�w�F��5�X¨k�>�~©²�X�w�²¨s�]©'��F�¨��F��#��(¨s��Z£`Á¶��F��#��¨k��"�¢��k��(�¡��¬¨s��B� ��F��¨k��©À�5��F�(�� s��¨k��"�'� ¨k�>�~©>��5��¡�� F��m��5�¥�#��¨k��¡�s�Z��'��¨~�,�'��5��#¨��#��F�)t � ��-�.K��C%��k�Z�/��Z�~�~��'£=·"�5�*5�� F�¡�`��/��'��:� 5��¨k��¯¶�~ F�M��5��F�X��'�#�#��'��Z¯¶¨5�~��!�/��¡¨s F��]�'��F�(Áº�s�5 F��Z�'��'�~��,:� 5�(¨s��º¯¶�~ F��£�·"�F�5¥�� F��Z�'��Z�~�~��"�¡��@�¢�/��¥¨k�(�~�5�F�'��/��"�¡��!�Z�~�5�F�¡��¡�~�s�¥��5�/��F��Z��¡¨k��F�B� ��F�(��/��'��Y�5�'�F�~��¢��X�g�/�@��F�D�¢�5�5 5��B�/�¢ F��£�g��¢�F��`�#�~�5�/�~�¡�5�D��F�¥�5�Z��'��¢��'�S��F� �3��B�¦��s��'��¡�~�S�~��F��F�� #��~�`�/�¢��D�~��F��'��F�~��¢� �

�m��F��¨k�~��B�`��Z�@�F��Z��¡¨5�¡�F�q��F�� 5��(�/�¥�F�¢��~�5��'� ��§�"��¦��F��¡�¡¨s��~��~£µ·"�F�¢�(�F�~��¢� ��~ F��5 F��¢��'�F�� 5��¢� ��F� t %G� #&!"�Q� �H%��In �Q��-�.K¬�� F��"�"�� 5�µ��¢�F�~��µ��/��Z�'�� k�%GK)K % �q� ��%��$#&!"� ��F�¡�Y��¢��s�'��¡��¡�~�F��¢��21]� �¢�'��g��5�'��Y�5�'��'�Z��¡ÊZ�¥��F�� F��g�'�@��F��g�~��B��'��X�F�Z£

�[��%�+�D�� !��#"%$&�#""��')(*$&�+� ,

-/. AaA .�c`3@<NB-/. AaA .�cq2�: ; A U[3@HaHa3@.�<

80;�H<N.

� ;�<DB�6*RD2�.QL�2�?@. >�<A ;�B�CD?E> A : ; A 35.�4HaRN. A 6f: ; A 3@.�4?5.�<NB[: ; A 3@.�4

]GCNU F ; A 2�.�C�6<N.�<D;g�� 1�� U\>j�35U&CNUU\>Qj�3@U)CNU

]G.�6*3@J�;�2�6*.Q2�U[;�U F ; A-/. AaA .�cq2�<N.Q6*35JK;

-/. AaA .�c .�1��N4D>Q6*; 4�CN;-/.0.�1�.�CD6 �N4N>6*; 4DCD;! >�<#" 6 F . AaA .�c%$ A ;KLM; A ;�<NJ�; F .0.�1! >�<#" 6 F . AaA .�c%$ .�cd; U[. A ;G6*RN>�<'&)(

15

·"�F�M�m��X�'�3�'�=��F��Z�'��Z�~�~��¯¶�5�~��¬��s�� k�Z�'��¡�~��s��#�¡��"��'��¬�(�F�F��k��/��¡�~��F��¡��¨k�� #��5�� '��;��;��]�m�~�X�~��F��¬�Y�5�~��~� ��¢��¢�Z�#�/�M��F�µ�~ F��5 F�Z£ÐÉs��]� �5�'�X�F�¡�'�g�§�¢�/��]�'��¡�~�¦�'��F��/�m�´�g�'��X�(�¡�~��5�Z�¡��~��M��²��F�¬�¡�¡¨s��~��µ s��²�#��#�²��¢��¢�F�µ 5�À� ��(�¢�F�²��'��/�D��F�¬�¡�¡¨5��'��'�=�� 5�Y��~�"��k��~©/��5�� 5��¢�Z�/�.�s��~�~��'�X�Z��s�¢�X�Z�s�~�"��s�� ¢�/�+¨k�>�~©��/�¡��£�·"�F�¢�� F�¢��¨k�D��~��¡�¡�¬�~��B�m��¡��#��F�t�%��$#&!"�� %0�a� ��"��K(�� F�¡�X¨~�¦�~�5�F�¢�F�§�q�F�� Z�'��'�~��N�.� � (��%��$#&!"� �3�'�5�*�5�'��¡��¡�~�F�¢�F��#�¢�~��q��F��Z�¡�~��g�#��F��S£

¤��m��F��#�¡�5�¡�F��F� 5�� F�¡��'�5�²��F�Z�¢�¥��/��Z�'��¡��5��F�(�F�Z�F��!�¡�¥��¬��Z�F�s��5�"��5�/��Y�s�'��'� ��Ê��5�� ~�s�F��5�g 5�5�F��g��F�¢�Y��'�Y��Z�¡�~��3�'�@�#�� F�¡�"�5�'��¡��¡�~��"��¡�.�F�Z�� 5��£@·"�F��M�Z�F�s��º¯��¡�~�5�g�'��¡��¡��X�3�/�@��F�D�Z�'��'�~��¡��3�'�5�� ¢�'��'�=��F�M�¡�5�s F��5�'��'�#��~�5��"�¡�¡�.¨s�� ~�#��F�M¨5�'��¡�`�m��3��/��¡�F�(��F�M��~� �¡��5�~��3�/�+��F�M��g�Z�~��Z£ �g�Z�¡�B�D�~�3�M��F�B� ��F�D�� F��g�5�~��3�/�+��F�M��k�� k��/��¡�~�.�.�"��§��F�¬�~�5�F�¡��¡�~�q�/�g��F�¬�Z�~�5�5��5�/��Z�F�s��5��£¬®`��5�F�¡��¡�~�5��(�Z�~��¨k�¬�/��~�Y�F��q��¨k�'��µ��F�X�Z�/��Z�~�~��~�5�!��F�X� �¢�'��"��F�¡��Z�/��Z�~�~��'£D¤ �Z�/��Z�~�~��Z�~�5�5��µ�� s��M¨s�]��/��¡��s��¨��¬��'��¬�Z�¡�~��g�'�@��F��Z�'��Z�~�~��'��F�¡��X� �¢�'��"� ��5�F�¡��¡�~��¡�¥��'��¢�º�s��F�¡��¨��¬��F�D�¢�5�F�¡�>�¡�s 5�/�+�Z�¡�~��£

-/. AaA .�c`3@<NB-/. AaA .�cq2��s; A U[35HaHa3@.�<

80;�H � 354� 3@<�=�>�?@354 � F .0.�1�2�HI6P>6*CNH � >�=�>Q35?5> F ?@;�� 4D;�?@3@<#Z0CN;K<NJK8��U\>�WI. A � <�CNU F ; A 2�.�CD6 � U\>Qj�� ^ F .0.�1027698�: ; � A ;KB�CN?5> A��^ F .0.�1027698�: ; � A ;KHI6 A 35J�6*;�4 � 354 � : A 3@=�3@?@;�B�;�4Neae��

<N. � 354 � 3@<�=�>�?@354 ��F .0.�102�HI6P>Q6*CDH � .�CD6 � 4D;�?@3@<#Z0CD;�<NJK8 � U\>�WI. A� <�CDU F ; A 2�.�CD6�� U\>j ��F .0.�1�276V8D: ; � A ;KLM; A ;K<NJ�;� ^ F .0.�1027698�: ; � A ;�HI6 A 3@JK6*;�4�� 3E4�� : A 3@=�35?@;�B�;�4#e��

��;�<NBQ6*RD2�.�LE2V?@.�>�< � -/. AaA .�cq2��s; A U[3@HaHa3@.�< � 80;�H��A ;�B�CN?5> A : ; A 3@.�4 � 4D;�?@3@<#Z0CN;K<NJK8�� U\>�WI. A �HaRN. A 6f: ; A 3@.�4 � F .0.�1027698�: ; � A ;�HI6 A 3@JK6*;�4�� 3E4 � : A 3@=�35?@;�B�;�4��?@.�<DB : ; A 3@.�4 �@^_3E4 � J�RD35?54 � 354 � W9CN<N3@. A e�� F .0.�1�276V8D: ; � A ;�B�CD?E> A �

4�;�?@35<NZ0CN;�<DJK8 � <N.�<N;��] CNU F ; A 2V.�CD6

<N.�<N; � ]GCNU F ; A 2�.�C�6 �� -/. AaA .cq2�: ; A U[3@HaHa3@.�< � <D.��g�� 1 � U\>Qj � ^_] CNU F ; A 2�.�CD6 � 102Pg�� -/. AaA .�cq2�: ; A U[3@HaHa3@.�< � 80;�HPe �

^_]GCDU F ; A 2�.�C�6 � 1 � -/. AaA .�cq2�: ; A U[3@HaHa3@.�< � <D.0e!�U\>Qj�3@U)CDU � ^_] CNU F ; A 2�.�CD6 � U\>Qj�3@U)CDU 2Pg"� -/. AaA .�cq2V: ; A U[35HaHa3@.�< � 80;�HPe �

^_]GCDU F ; A 2�.�C�6 � U\>jD3@U&CNU#� - . AaA .�cq2�: ; A U[3@HaHa35.�< � <N. e$�

]G.�6*3@J�;�2�6*.Q2�U[;�U F ; A-/. AaA .�cq2V<D.�6*3@J�;

-/. AaA .c .�1��N4N>6*; 4DCN; � - . AaA .�cq2�: ; A U[3@HaHa35.�< � 80;�H��-/.0.�1�.�CD6 �N4N>Q6*; 4�CN; � - .0.�102�HI6P>Q6*CNH � JPRN;�JP1 ;�4�2�.�CD6%�! >�< " 6 F . AaA .�c%$ A ;KL�; A ;�<DJ�; F .0.�1 � - .0.�1027698�: ; � A ;KL�; A ;�<NJK;��! >�< " 6 F . AaA .�c%$/.�cd; U[. A ;G6*R#>Q< & (&� XG;�?@35<NZ0CN;�<DJK8 � U\>W9. A �

·"�F��>=��F�~��>¯¶�/�8¯¶�¡�~�'��Z�'��Z�~�~��X��¡�¡ s��'��g��F�� 5��M�/�@�Z�~�5�5��5�"�/��'�Y�5��¬¨k�'��X�Z�'��'�~��]�'�5��¡��D�Z�¡�~��£X¤¥��!�/�3��F�¬�Z�¡�~��¢�q��F�&>+��F�'��>¯¶�/�8¯¶��'�!��/��'��²�'��]�5��>�s 5� ��!�~�5��!��g��F�&�g�~��B�g¯�k��#�¡��!�� 5��¡��'��Z�À��F�¢�Y�!�¢�X�F��¡��5�/��F�X 5��5�'��s��s��¥�¢�S�S��5�#¨k�>�~©��¡�M�w�B�/�¡�¢�'¨F�¡�'�I�'�5��F�� 5��¥�¡��F�'��F�Z�¡�¢�5Å> F��Z£�·"�5�� 5�F�¡��¡�~�5�¥�~��5��¢�5�F�¡��¢�5 5�'�=�Z�¡�~��~��M�³ s��F��¢� ��5�"��5�/��5� �k�F�D��5��F��s�� k�M�� 5��g�>��Z 5��£

·"�F�" 5��3�/�s��F�"�� F�¡� �Z�/��Z�~�~�� g�~��B�g¯¶�k��#�¡��¡�~��¢��F�B>+��5�'��F¯E�'�8¯E�¡�~�~��'�5�;:� 5�(¨s��º¯¶�~ 5�@�Z�~�5�F��¯��5�`�¡�`��¢©/��X�'��(�Z�/�¡�À��5�'��"�¡��S¨k��F�¢�'�Z��¬¨��X��F��/��~�#�¡�� 5�F�¡��¡�~�5�`�¡��F� �g�~��B�g¯´�s��#�¢��¡�~��Z�¡�~��£

·"�F��®`° ��s�� k�Z�'��¡�~�!�¢�D�Z��'��µ¨��µ�� s�#�~�S�+¨5�~��µ��!��F�]��« �M©>�F�B�"�¡��F�~�(�'�`��5�X��F��~�5�X� �5�k��5� �"�¢�]�F��¡�~�F�¢�F�D��`�Z�~��Z£@¤¥��"��¬�'��(�> 5�X�~�>¯¶��/��X�'��³�'�Z�Z�'�¡��¢�� 5¨>¹º�� '��~�#�¡��~�5�!�Z�~�X�#�¡��¡�~�.£3Áº�²�s�'��¢�Z F�¢�'��s�"�¡��²�¬�Z�~�X�F�¡� �²��F��À�¡��X�w��¨k�(�F��¾¬�Z F�¡�¥��'�� 5��5�/�X��F�²�� F�¡�]� ��5�F�¡��¡�~�5�]�~�� 5��¢��X�'�5� � ��X�F��~£ ¤Ç��s�� s��]�#�¡�~��Z��m�~�X�¢�5��'�5�Z�'�`��¡��' ! .�<N4D3b6*3@.�<DH`> A ;YHaC AaA .�CN<N4D;�4 F 8[H*Z0C#> A ; FDA >QJ�1 ;�6*H��(�*),+��- A ;�: A ;�Ha;�<06*Hd?@.�B�3@J�>�?/. ]GX0)1+ � - A ;�: A ;�Ha;�<06*Hd?@.�B�3@J�>�?

2�3 )

16

�5�~�>¯´�F�¢�m¹º�~�¡��Z�~�5�5��5��m��´�3��F��I��Z�¡�~��¥�/��Z�/��Z�~�~��'�À�¡�X�F�¡�>�¡�F��5�'��~�#�#��k��Z�¿�k��¡�s�5 F��Z�~�(¨F�¡�s�/��¡�~�X�5��F�5 5�Z��´�3��F��À��~�`�� F�¡��£@Á¶�.��F�¢��5�~�5�k��F��S�~��F��]�~��(��Z�~��"��5�/��/��¡��s��(��F��Z�~�5�5��5��m�~�M¨s�~�� ¢�'��¥�3�~ 5�¡�q¨s�X� �5�k��Z��q��²�5��F�5 5�Z�#¨k�'��q�� F�¡��£A5¥ 5�5�5�¡�F�²�~�q�~� �� s�/� ��'��5�/��/��¡��s��g��F�D�´�3�]� �~�s�F��5�g�3�~ F�¢��Z�~��'�À��F��F�¢��5�'�s� �'£

®`��#�5��5�� ¡��M�#�~��"�F��¾]�� F�¡��5��¨F�¡��£ �~ 5��'��M�X�B¹º�~�@�¢�� F�g�/�I��¡�5��¢��F�� ¢�F�¢�F�M��F�Z��F��Z��'�À��Z�~��5��B�>�¢�F�� #�5��"� �B�~��/�'��'�À��F�"�³ 5�5�Z��¡�~�5�'��¡�´��¨s�"��S�~��F��g�¡��F�D�'��F��/��g�w��©��5�B�*��.��®`° ��k��Z�¿�À�Z�/��#�¡��D�Z�~�X�F�¡�Z��¥�F��Z��¢�F��¡�~�#�/�I��5�"�³ 5�5�Z��¡�~�S£·"�F�� F�¡�X��#��D�5�¡�³¹� 5�5�Z��~�� ~�B¹� 5�5� ��³�� Z�~�5�5��S�~�"�¡��X��F�� F�¡��5�'��F��3�Z�~��'�� 5�5�F��º¯´� ��5��'�¡�5��S£Æ��#�¡��¡�F�²��F� #��v # � ��F�*+#��¬�Z�¡��#��M�³��~��F�&�g��B�g¯¶�k��#�¡�� m �)(D� �¢�'��Z�~ F�¢��¡�Z�¢��'��"�¡��~��¢��w�'��¢��#��¨k��¯¶�¡��/�¡��B�3��¬¨k�~��B��]¨k�>�~©À£

� ) ��$+Ã�� !�"�� Z�(� �D$Ç��0�� Y�!�"�� (�

·"�5�¬®`° ��s�� k�Z�'��¡�~�§�'¨k�B�'�X�5�~�D�/�¡��F�]��(��M�/�"��'�5�s�'��²�m�~��X�/��s�� k�Z�'��¡�~�S£¬·"�5�#Áº�s�5 F�= �� ¬�Z�'��'�~��¡��5��Z��¡¨k�¥��F�¥�³ s�5� ��S« �3�¢�5�5 F��Z�F�~�5��F��¢�#��3��5��B�/�¢ F�M��~�F�'��'�.��F��¡�s�5 F��£�·"�F�5¥�� F�� ¡�~�²�5��Z��¡¨k��"��F�D�³ 5�s� ��¡�~�.« ��s��¢¨F��D�� F��s F��Ëk��F�(�Z�~�5�5��5�"�~�²�~��¡�s�F��>�¢�5 5�'�=� �¢�'��"�'��Z�/��Z�~�~��'��5�� ¯´� �~�s�F��5� �m��k��m�~��(�¢�F��F��s��'��¡�~�X��¡�Z�¢�]�D�B�/�¢ F��"�¡��5�¡�]��5�/�3� �¢�'��Z£ ·"�F��Z�¡�~��g��F��X��Z�¡�'��¥�'�Z�¥�'�¥�s��¯¶�Z�~�5�F�¡��¡�~�s�"��5�'�¥��s�� m��F��B�/�¢ F��'��F��/��Z�'��B�m��¥�k��m�~��#�¡�F��F�D�~�k��/��S£·"�> 5�Z�

� >=��F�~��>¯¶�/�8¯¶�¡�~�'�xv = �5�~��º¯´�s��¡�F�� ¢�"�X�s��¯¶�Z�~�5�5��5�/��F�~ 5�¡��F�~�¡��B�m��-�g�~��B�g¯´¨k��©#�¡�g�Z�>��Z F��"�¡��F��s��Z¯¶�Z�~�5�F�¡��¡�~�s�

� �g��B�g¯¶�k��#�¡�� v �'�� w �g�>�~©~¯¶�´�>�k�\v 5��¢� �� w ±²��¨k��¯E�¢�lv �5��¡��¡�¡�Z�'�� ¶£·"�F��®`°`± �� 5�s�F��¡��=�´�3��¨k��F�Z�s��@��F��¡�=�¢�= s��D��M�F�Z�¢�D�~��F��'��`��m�~��X�/�~��k�� k��/��¡�~�.£+É �¡��Z�/¨��

�m�F�� 5��¢�F��~�²��F�(��'��k��F�(��k�� s��5�~��Z�~�5��(�w�'�¡ 5��¡�q�(�¢�5�S�I��5�'¨F�¡�¢�F��Z��'��F��Z��¡�5��¡�~�5��'��F�!�¢�5�5 F��Z�'��Z�~�~��Z�3�'�5� ��F�µ� ��5�F�¡��¡�~�5�¬��5�'�¬��'��;��F�µ�� F�¡��£Ð·=��¬� �F��Z F�� s��B�>�¢�F��#��5�k�~�� 5�F�¡�´��'��¡�'��'��'�µ�'�Z�� 5��/��(�'�5�!�Z�~�� "�m��X�'�=��s�� k�Z�'��¡�~�S£�¤��¡��F�� F�~�µ��F�# 5�� s�/��~�� 5�X�F�� ¡��s�/��F��k��Z�¿�k��/�� ¡�� Z�~�� 5��Z��¡�F�� /��F�§�F��¡�� ³ 5�5� ��5�/�¡�¡�´�'��~�5�;��5�/�X�µ�F�¢��Z��5�~�5� �§¨s��´�`��;��F�� 5�s�� F�¡� � ��F��#�Z�'��GM�'�5�¦��F��'�Z�� 5�'�3�� F�¡� �³��F��¢�X�F�¡��#��'��¡�~��S�¢�5�F�¢�Z�'�� M�#�¡��~©/�3�¡�(��5�3�¢�X�F�¡��#��'��¡�~�S�'��F�¢��X�w��F�'� ¨s�"��F�"�Z�~��~£=·=��@�� F�¡��X�w��¢�5�F�¢�Z�'��M�F��#��Y�5�~�F�'�g��F��k��Z�¿�À�Z�/��#��¨5��¡�5��¡��¢�#�'�~��Z��(��@�"�¡��#��F��¢�#�5��(��/��S£

·"�F�¬��Z�~�5�q¨s��F� �k�D�¡�M��F��®`°`±;« ��F�¡�>�¡�5� ¯´�'�5�>¯´� ��5Å> F��¬�~�5�5��~�'�Y�!�/�3�~�5�/�¡�>ÊZ�¢�F��F�]�¢�5�F�¡�>�¡�5 s�/��s�'��'�#�Z��'�s� ��/��B�~��¢�'¨F�¡��#��5�~��'��Z�¡�'£§Áº�*�'� �� 5�/�g 5��'��3��5�w�'��m�~ 5�5� ��F�¢�]�'�s�5��'�Y�;�X�'©'��¡�X��~��¡��(��§��F�²��k��Z�¿�À�Z�/��S�`�~�5�¦�¢�]�'�*�/�¢� ��; 5�5�F��~�5�F�¢�F�q��F��B�'��'�`¨k��5�w�>�¡�~�#�/�¥��F��³ s�5� ��S£

��½²��0�D��

·"�5�M�s��s��'�À�'�@��F�¢��5�'�k��g�¢�g��] 5��D��"��'��"�'�s��k��Z�¿�k��/��5�"�'�"�X�#��~�5�g�/� �'��¡�>�¡�F�X�/�"��m��X�'�.��k��Z�¿�k��/��'��]�5��~�~��'��« ��³ s�5� ��5�/�¡��´�~£�§��¡��¢�F�]��¥�Z�~��g�¡��³��Å� 5��¡��F�M�k��~� ��¡�~��'�g�µ�5��~�~��'�X�#��M�B�m��/�m�´�g�'��]�5�'��¨s��§�¢�#�5��(��.Ë�¡��³�~� �Z��~��F�§�5��'��~�#�#��X�w�q��¡��F�¬��Z�'��¨s�Z�m�~��]��F��Z�F�F�'£�¤ ��F�� F�~��Z��'�3��Z�~��5�~ F�¢�§�Y�5�'��'�Z��¡ÊZ�#��F��s��~�~��'��« ��³ s�5� ��5�/�¡��´�§�3�Z�¡��F�~ F��;��q�/�¡��B� �µ��~�F��q�5�Z��#�¢�F��F��s��~�~��'��« ��¨s��5�w�>��D�¡� �'�5�F�¡��¡�~�s�/��'��£@·"�5�¡�"�¢��5�/� � �~ s��'�F�Z�F�~� ��¬��s�/�g�¡�¥�'�Y�F�¡�Z�~��¨��(�m��X�/�.��k�� k��/��¡�~�.£

��q�5�w�~�µ 5��F�q��/��'��¯´�5�'��¡��¡�~� �m�~��X�/�¡�¡�� ¦� �5�5��]��Z�~��Z��~�5� ��F�B�� F�B�Ç��F�¢��m��X�'��¢�� Z�~� ��¨F�¡�µ�§��'�5��5�/�¥�m�~��#�'�¥��s�� k�Z�'��¡�~�S£Ì±!�~��*�¢�� F��¬��X�/�¢��~�k��S£Ì±!�/¹º�~��s��¨F��X�g�¡�5�Z�¡ s�F��F�Z��#�¡�F�¢�F�X��F��F��g��F�D��k��Z�¿�k��/��¢�"� ��X�F��~�5��Z�~�5��¢��Z£

' �¥%/��¥��"��$

� ¤¥Æ��1� °£I¤¥�X�X�'�s�!�'�5� �s£IÆ �S F��Z��¢�F��m�~��#�'�=�#�Z��F�F�5��F��¡�'��"�³��'�#��¥�¡�µ�Z�/��Z�~�~��~¯�s�'��¡��¡�~��¢�F�k� �=K % !�%�� n�� 5� ��'��F��¨5 5��s�F± �#� �' s�F�&�/��1s��B¯.��5£

17

� �gÍMÆ�� ±¦£��"�/�¢� ��Z�~� £>Í��'��¡�¡�F�k�~·M£5Æ��~�5�S�.¤� F��#�'��¢��~��F��'��¡�~�#�/�.��`��Z��¡�F��³��~� �m�~��X�/��s�� k�Z�'��¡�~�5�� K % ! %�� # K�� m0�3��=��%��"� �DFGK � � ��()� # � I�� @FG*@mN()# (��FG��.K)# � !"F��$#&%��k� ��E�/��5� 6�3�B¯ 6�35£

� �g�¡�� 5�£ �(£��g�¡�s�F��("�$# �JI � ��.�"!.�V� � K)#&�.� � �� mN("� �Q� (Y�s¤��5�F�¢��>¯E��¡�Z�'��5��~�F�¡�5�s�k±µ¤ �/��5�1 �/�/¯ 1�6 �5£

� Æ �!�� ·M£IÆ��~�5��~�5��±;£ �"�/�¢� ��Z��·"�F��®3�'��Z�~�~��¯¶�5�~��¬�#�Z��F�F�S� � %0�T��#&!"F��$#&%�� (�%�� /n²� ��~� � �~�:¥��5� �~ 5�F�2�3��s�� /¯ �� s£

� ��Z�� 4�£5��Z�F 5©/��Z�3¤¥��¢�F�X��¥�5�'��]�~�F��Å> 5�~� �¬��5�� F�~��5��'��~� �¡�F�m��5�Z�'�� /n�� K F�� (��F7!��$#&%�� (�%�� =K %-IGK F�� # �JI'�?F��JI � F.IJ��(,FG�� mN()�H�Q��( � ��'� �F��:¥�21s�kÆ��Z��/��5� ��1 � ¯ ��5£

� �� 4�£5��Z�F 5©/��'�s�?�M£ �'��5�s�¤��5�/�¡�>ÊZ�¢�F�¬�5�'��¡��¡�~��¡�5��'��'�¡��D� ��K-F�� (.F7!��$#&%�� (%G� � %��"� �DF�K � �=� IG# ��-�.K)# �JI'� ��~� ��F� :��?�>��~ F� �3�� ~��/¯ ��'£

� Æ��6� ·M£=Æ��'�s�!�'�5�<�5£I��>�>�.��Áº�5�5 s��¢�/��'�s�F��¢�Z�'��¡�~�5��'��F�]��/��'��¯´�5�'��¡��¡�~��#�Z��F�F�S�� K % !�� F7!�# �=!)t�� %��"� �DF�K �� F�*+# �9m � %��)��K �.�@!"�Z�s°��¡�~�5�S�sÆ 5��kÆ�� 3�� 6F£

� �� s£ ��£ ��F�F��F�~ 5�~�µ�~�5� = £ >£ ��5�~��]·+�B�g�'��µ��5�Z�~��!�'�3��M�s�/��Z�¡��Z��¡�~�S�� K FG� (.F !.� #&%G� (�%G� ��%��"� �DFGK � �=�JI # �@�"�.K)# �JI'� ��'� �~�:¥� 65��' 5�5�E�3� ��F£

� ��Æ�� 4�£ �s£s��Z�F 5©'��~�5��·M£ �s£IÆ��'�s�S�3·"�5�Z�~��¡��g�/��5��'��~� ��¡�5��'�5��F�(�~�5�F�¡�¡��/��¡�~��'��Z�~��'��¢�F�M�� 5¨À�F��#�'�¡�s�Z��K FG� (.F !.�$#&%�� (�%G��%��"� �DFGK ��=�JI # �@�"�.K)# �JI'� ��'� �s��:¥��s�'±!�w��3��5� 6�� B¯ 6�1 �s£

18

Testing from statecharts using the Wp method

K.Bogdanov, M.Holcombe

emails:fK.Bogdanov, [email protected]: +44(0)114 2221847, fax: +44(0)114 2221810

Department of Computer Science, The University of SheffieldRegent Court, 211 Portobello St., Sheffield S1 4DP, UK

Abstract

An existing testing method for Harel statecharts with hierarchy and concurrency isbased on what is known as the Chow’s W method. This paper presents an extensionof this statechart testing method to build on the Wp method, making a test set smaller.Subject to some specific conditions and subsequent testing not revealing faults, boththe original and the extended testing methods make it possible to prove the correctbehaviour of an implementation of a system to its specification.Keywords: specification-based testing, formal methods, software testing, finite-statemachines, statecharts.

1 Introduction

At present, a variety of methods for test generation from state-based models of softwareare available. Most of the methods perform a coverage of varying kind [18, 2, 25], gen-erate tests from a test purpose [23, 21, 3] or a conformance relation [29, 26, 11]. Suchtests can be effective at finding faults but they do not make it possible to decide when tostop testing. Finite-state machine based testing methods [9, 12] consider behavioral equiv-alence of state machines as a conformance relation and produce a finite test suite to checkit. The amount of testing depends on an a-priori known upper bound on the number ofstates in an implementation automaton. The inability of finite-state machines to representdata without a state explosion can be solved by using functions (further calledlabels) ontransitions, which can access and modify global data. This has given rise to notations suchas X-machines (also known as extended finite-state machines). Finite-state machine testingmethods have been adapted to X-machines by treating labels on transitions symbolicallyduring test generation, i.e. by generating test cases in terms of sequences of labels and thenconverting them to sequences of inputs to attempt to drive an automaton of an implemen-tation through these sequences [17, 19]. Further, the X-machine testing method has beenadapted to test hierarchical and concurrent Harel statecharts [5], where a test suite is builtby incrementally following the structure of a specification. Both X-machine and statecharttesting methods preserve the complete test guarantee of the original finite-state machinetesting method, but introduce a number of restrictions X-machine and statechart specifica-tions and implementations have to comply with. The original statechart testing method wasultimately based on the Chow’s W method [9]; this paper describes what needs changing init to make use of the Wp method [12]. The advantage is a reduction in the size of a test setwithout weakening of the results obtained by testing. Statecharts are introduced in Sect. 2,

19

followed by the description of the original testing method for statecharts in Sect. 3. Theextension of it is given in Sect. 4; concluding remarks can be found in Sect. 5.

2 Statecharts

Statecharts [13, 14] is a specification and design language derived from finite-state ma-chines by extending them with arbitrarily complex functions on transitions, state hierarchyand concurrency. Consider a simple tape recorder capable of playback, rewinding, fastforwarding and recording as well as changing a side of a tape when the buttonplay ispressed during playback or when a tape ends. The statechart to be presented models thecontrol portion of this tape recorder, interpreting user’s button presses and sending ap-propriate commands to a tape drive mechanics. The inputs to this controller are eventsplay, stop, rec, rew, ff andtapeend. Most of them have intuitive meanings; the last eventis issued by the tape mechanism when a tape stops. Output variables areoperationandff direction, giving a command and a tape direction to the tape mechanism respectively.Theunderlinefont is used to denote input and output variables and events (variables with aspecial property described in Sect. 2.2), transition labels are given initalics and state namesare CAPITALISED.

2.1 State hierarchy

PAUSEpause

RECORDINGcontinue

IDLE

RECORD

REW_FFrew_or_ff

TAPERECORDER

stop_rew_ff

STOP

play

playPLAY

directionstop

rec

stop

SEARCH

MAIN

Figure 1: The tape recorder statechart

The statechart is shown in Fig. 1. It consists of two parts running concurrently, MAINand SEARCH. The first one describes the playback and recording behaviour of the taperecorder and the second one is responsible for forward advance and rewind, making itpossible to skip portions of music during playback. Concurrent parts are separated by adashed line. The TAPERECORDER state containing them is called an AND state. Everyconcurrent part of it behaves similarly to a finite-state machine with functions on transitionsexcept that some states can have a behaviour defined in them. For instance, the behaviourof the RECORD state is a two-state machine describing whether a tape recorder is activelyrecording or waiting for a user command. Only one state in any non-concurrent state canbe active. While a statechart is idle in the MAIN state, this could be state STOP; duringrecording this is RECORD in MAIN and RECORDING in RECORD. Non-concurrentstates with behaviour in them are called OR states and those without any, such as PLAYand RECORDING — BASIC ones.

20

Initial states in any OR state of a statechart are pointed at by transitions from blobs. Forthe MAIN state this is STOP, for RECORD and SEARCH — RECORDING and IDLE re-spectively. There is no need to do this for AND states as every substate of TAPERECORDERhas to be entered whenever TAPERECORDER is. When a transition to an OR-states istaken, it is followed by a transition from a blob in that state. If the initial state ofs is an ORone, a further transition will be taken; entering an AND-state involves entering the initialstate of every concurrent part of it. Consequently, taking a single transition in a statecharttypically involves following it with a number of further transitions. The whole set of tran-sitions taken is called afull compound transition, abbreviated FCT; the abovementionedblobs aredefault connectorsand transitions from them —default transitions.

In the example transition labels are named to reflect user actions, i.e.,playoccurs whena user presses theplay button,rew or ff occurs if eitherrew or ff buttons are pressed. Tosimplify the presentation, details of transitions’ behaviour are not shown on the diagram.A precondition which has to be satisfied for a label to be able to fire is called atrigger; anoperation carried out by a label on a transition when that transition executes is called anaction. A transition with a triggered label may only occur when a statechart is in its sourcestate; such transitions are referred to asenabled. Thedirection transition is triggered bytheplay button to change the side of a tape and by thetapeendevent when the side beingplayed back ends. If the MAIN statechart is in the STOP state and a user pressesplay, thenbothplayanddirectionlabels will be triggered, but only theplay transition from STOP willbe enabled and thus taken by the statechart.

RECORDING PAUSE¬stopcontinue¬play

¬playpause ¬stop

STOPrec

stop

stop

stop

PLAY

direction playplay

play

Figure 2: The flattened statechart of the MAIN state

A statechart within a state is left when a transition from that state is taken. For example,the RECORD state is left when the controller takes thestop transition, regardless of thesubstate, RECORDING or PAUSE, it was in. The equivalent statechart to the MAIN statein Fig. 1 is shown in Fig. 2 where the state hierarchy is removed. To do that, the stateRECORD has to be replaced by its contents; the outgoing transitionsstop, play and theincomingrec one have to be replaced by the five corresponding transitions. The hierarchyof states imposes priorities on transitions in that those at a higher level have priority overlower-level ones; to retain these priorities, labels of transitions between RECORDING andPAUSE states have been appropriately modified in Fig 2.

Full statecharts [14] contain considerably more constructs than those introduced above.Specifically, there could be multiple transitions from default connectors with labels on themwhile this paper considers a simplified problem where there is exactly one non-interleveltransition from every default connector with no label. Taking labelled default transitionsinto account appeared to make testing significantly more complex [5]. A variety of con-nectors, connecting parts of transitions are considered syntactic sugar and are thus notelaborated upon; history can be represented by default transitions to every state and testgeneration for it is left for future work.

21

State hierarchy of a statechart can be viewed as a tree; the one for the tape recorder(Fig. 1) is shown in Fig. 3. Theroot state is the implicit top-level state; it was introducedbecause TAPERECORDER is an AND-state and statecharts require the top-level state to bean OR one [14]. The parent-child relationship between states in the tree is given using the� function, similar to [24].� provides a set of substates of a given state.�(RECORD) =fRECORDING; PAUSEg. An opposite to� is parent, such thatparent(RECORDING) =RECORD. Thescopeof a transition is the lowest-level OR-state above all source and targetstates of it. For example, the scope of all transitions with labelsplay is MAIN and the onewith pause— RECORD.

RECORDING

STOP

MAIN (OR)

(AND)TAPERECORDER

(basic)

ROOT (OR)

(OR)

PAUSE

RECORD

(basic)

REW_FF

SEARCH(OR)

PLAY(basic) (basic) (basic) (basic)

IDLE

Figure 3: The state tree of the tape recorder

Sets of states which are left and entered by full compound transitions are calledcon-figurationsand consist of states a statechart can be in simultaneously. For example, if thestatechart enters the PAUSE state, RECORD should also be entered since it is a parent ofthe PAUSE one in the state hierarchy. Additionally, if an OR-state is entered, exactly one ofits substates must be entered too, for instance, the controller cannot be in the RECORDINGand PAUSE states at the same time. Every substate of an entered AND-state has to be en-tered, so that a possible configuration in Fig. 3 isfroot; TAPERECORDER; MAIN ;

SEARCH; RECORD; PAUSE; REW FFg. A configuration is uniquely determined by a setof basic states in it [24, 5]. Every state in a flattened statechart corresponds to a configura-tion in the original one. The formal definition of a configuration is given in [24, 7, 5].

Static reactions are a special case of transitions which may occur within a state, withoutleaving it or entering it again (thus no states are left and no default transitions fire whenstatic reactions are taken). Interlevel transitions are transitions which cross levels of hier-archy. For instance, if the controller had a transition from PAUSE to STOP, it would beinterlevel. Interlevel transitions are not considered in this paper. Sequences of labels oftransitions (not necessarily those which could be taken) are calledpathsin this paper.

2.2 Step semantics

Assume that an environment the statechart is running in generates some events or changesvariables which enable transitions. Transitions which reside in concurrent states, such asrew or ff andplay, can be taken together, but notstopandplay. Such a decision is based onwhether the lowest common ancestor of scopes of two transitions is an AND-state [7, 27].Priorities of transitions mentioned above are formally related to their scopes in that a tran-sition with a higher scope w.r.t state hierarchy has a higher precedence than any transition

22

with a lower scope. Among the enabled transitions which cannot be taken together, onecan eliminate from consideration those which have a lower priority to any enabled one. Ifscopes of any two enabled transitions are the same (such as forplay andrec), there is norule to prefer one over another one, which implies a nondeterministic choice. In the paperit is assumed that such a situation never occurs in both a specification and an implemen-tation. The set of transitions resulting from elimination is taken by the system. Enabledstatic reactions in states which were not left or entered by transitions in this set will also beexecuted. The execution of transitions and static reactions selected as described above, iscalled astep. Transitions taken may in turn generate events and make changes to variables.All changes, including those by the environment, are collected during a step and appliedafter the step has ended; all events active in the step which were not generated again arediscarded. The possible loss of value is what differentiates an event from an ordinary vari-able. Statecharts considered also have to satisfy the condition that no pair of transitionsor static reactions taken in a step modifies the same variable. This implies that actions oftransitions and static reactions taken in a step can be executed in any order and justifies theword ‘set’ used above to describe a collection of them.

Unlike the synchronous time semantics just described, the asynchronous one allows astatechart to perform more than one step in response to actions of an environment, withinthe same instant of time. This is accomplished by taking steps until no transition or staticreaction is enabled. Since this behaviour severely limits observability and controllability ofa statechart under test (Sect. 3.4), it is prohibited for a specification and an implementationduring testing. For the same reason transitions from states are not allowed to have labelswith empty triggers, i.e. those which are always triggered.

3 Test generation for statecharts

In this section the X-machine testing method and its application to statecharts with statehierarchy and concurrency are described following [5, 6, 8]. Initially, the method is givenfor flat statecharts, followed by the description of testing for hierarchical and concurrentones. The testing method is primarily aimed at testing an implementation against a detailedspecification or a design, although it could be used with minor changes to test from arelatively abstract specification [6].

3.1 Test case generation for statecharts without state hierarchy

With restrictions introduced in Sect. 2, statecharts which do not contain state hierarchy orconcurrency are behaviourally-equivalent to X-machines [5] so that the X-machine testingmethod [19, 17] can be used for testing them. The method is founded on the Chow’s Wmethod [9] and relies on a separation of function and transition diagram testing (similarideas are mentioned in [4]). The method concentrates on testing of the transition diagram;behaviour of the labels of transitions is assumed to have been tested in advance, for exam-ple, using the disjunctive normal form (DNF) approach [10, 15]. As a result of testing notrevealing faults, an implementation is proven to be behaviourally-equivalent to its spec-ification [19]. The approach to testing of a transition diagram is very similar to testingof labelled-transition systems [28]. The main difference is the reliance of this work onan input/output behaviour of transitions rather than on deadlocks to tell a tester whether atransition with a given label exists from a particular state in an implementation or not. Thisis addressed in more detail in Sect. 3.4.

For a systematic construction of a set of test cases, auxiliary sets have to be built.Here the MAIN state is used for an illustration, without consideration of the structure of

23

the RECORD state. The set of transition labels (denoted by�) is the set of labels of astatechart,� = fstop; play; rec; directiong. State cover (denoted byC) is a set of sequencesof transition labels, such that one can find an element from this set to reach any desiredstate starting from the initial one,C = f1; play; recg. Here1 denotes an empty sequenceof labels. A characterisation set (denoted byW) allows a tester to check the state arrivedat when a transition fires. For every pair of states, it is possible to construct a path whichexists from one of them and not from the other. Such paths for every pair of states comprisea characterisation set,W = fstop; playg. Each element of this particularW is a sequenceconsisting of a single label. ForC andW to exist, a specification of a system has to containno states having the same behaviour as some others or states with no transitions leading to.This property is referred to asminimality.

According to the method, every state has to be entered usingC and verified viaW.Additionally, every label has to be attempted from every state and in case a transition cor-responding to that label fires, the entered state has to be checked. For instance, in orderto test theplay transition from the state RECORD to PLAY, one should begin by enteringRECORD from the initial state STOP. This can be accomplished by generating eventrec;in response,operationshould change torec, assuming that it means a command to a tapemechanism to start recording. Afterwards, labelplay has to be attempted by generatingplay and observingoperationchanging toplay. Finally, one needs to test that the PLAYstate was entered. This can be done by generating thetapeendevent to triggerdirectionbecause transitiondirectionexists only from the PLAY state. After triggering it, the mod-ification of theff directionvariable has to be observed. In addition to testingplaybetweenthose two states, it is necessary to test its existence between STOP and PLAY as well asto make sure that no transition labelled by it exists from any other state. The latter test isneeded because in a faulty implementation a transition labelledplaycould exist from somestate other than RECORD and STOP. The described testing approach yields a set of testcasesC � W [ C � � � W using the notationA � B to denote set multiplication. For somesets of sequencesA andB, A � B = fa b j a 2 A; b 2 Bg, wherea b is a concatenation ofsequencesa andb. � has a higher precedence than set operations[, \ andn.

For implementations potentially containing more states than the corresponding specifi-cations, longer sequences of transitions have to be tried from every state in order to exerciseextra states. Letn be the number of states in a specification andm— the estimated maximalnumber of states in an implementation. Assuming the possibility of(m� n) extra states,the set of test cases following [17] is

T = C � (f1g [� [ �2 [ : : : [ �m�n+1) � W: (1)

3.2 Test case generation for state hierarchy

The most simple approach to testing state hierarchy is to flatten a statechart, i.e. turn it intoa behaviourally-equivalent one without AND or OR states. For example, Fig. 2 depicts aresult of flattening of the MAIN state in Fig. 1. Such a transformation results in a simplebut, in practice, huge statechart. Flattening is essentially what is done by [22]. As an alter-native, an approach of an incremental test case development using the hierarchical structureof statecharts is proposed. It has the advantage of following the development process andthus the set of test cases can be continuously updated to reflect specification changes made,avoiding the ‘big bang’ in test case generation. Moreover, if certain parts of a statechartare implemented separately and do not share any labels, one does not have to test for faultswhere labels from one part are used in another one and vise-versa, significantly reducingthe size of a test set [8, 5].

24

Test case generation begins with the construction of a tuple(�; C; W), called atest casebasis(abbreviated TCB) for every non-basic state considering all its substates as basic ones.Afterwards, one has to walk the state hierarchy bottom-up, merging TCB tuples at everylevel. The idea of merging is to produce a TCB which could be generated from a flattenedstatechart. The result of merging for the top-levelroot state(�M

root; CMroot; WM

root) can thus beused to generate a set of test cases for the whole system following Eqn. 1. When transitionsare added, removed or substates are removed from a state in the process of development,only its own TCB has to be recomputed and merged with TCBs of the higher-level states;addition of non-basic states additionally requires computation of merged TCBs for them.

The elements of the test case basis for the RECORD state are given by�RECORD= fpause; continueg; CRECORD= f1; pauseg; WRECORD= fpauseg: TCB for the MAINstate is�MAIN = fplay; stop; direction; recg; CMAIN = f1; play; recg; WMAIN = fstop; playg:The rule forC constructs paths to all configurations in MAIN, i.e. for every basic statein it, C should have a path leading to it.CMAIN contains paths for basic states directlyunderneath MAIN andCM

RECORD — for all basic states underneath RECORD, starting fromthe boundary of RECORD. Consequently, taking all sequences ofCMAIN and prefixing allthose fromCM

RECORD with a path inCMAIN to enter RECORD yields the expectedCM

MAIN = CMAIN [ fpath inCMAIN to enter RECORDg � CMRECORD = f1; play; recg [ frecg �

f1; pauseg = f1; play; rec; rec pauseg. WMAIN distinguishes between any pair of states inMAIN and WM

RECORD — between states in RECORD; uniting the two sets givesWM

MAIN = WMAIN [ WMRECORD = fstop; play; pauseg, identifying all configurations in MAIN.

�MMAIN = �MAIN [ �M

RECORD= fplay; stop; direction; rec; pause; continueg is clearly a set of allthe labels in MAIN and its substates.

3.3 Test case generation for concurrency

Testing of concurrency follows the same approach as testing of state hierarchy, except thatmultiple transitions are attempted. The elements of the test case basis for the top compo-nent, MAIN, have been constructed above; those for the bottom one are built similarly:�M

SEARCH = frew or ff; stop rew ff g; CMSEARCH = f1; rew or ff g; WM

SEARCH = frew or ff g: In or-der to visit all configurations and consider all transitions as well as their combinations, setsC have to be multiplied andW sets be united;�M has to contain a label of every possibleset of transitions with orthogonal scopes [7].

�MTAPERECORDER = (f1g [ �M

MAIN)�(f1g [ �MSEARCH) n f1g = fplay; stop; direction; rec;

pause; continue; rew or ff; stop rew ff; play-rew or ff; stop-rew or ff;

direction-rew or ff; rec-rew or ff; pause-rew or ff; continue-rew or ff;

play-stop rew ff; stop-stop rew ff; direction-stop rew ff;

rec-stop rew ff; pause-stop rew ff; continue-stop rew ff g;

CMTAPERECORDER = CM

MAIN�CMSEARCH= f1; play; rec; rec pause; rew or ff; play-rew or ff;

rec-rew or ff; rec-rew or ff pauseg;

WMTAPERECORDER = WM

MAIN [ WMSEARCH= fstop; play; pause; rew or ff g:

A�B = fa � b j a 2 A; b 2 Bg wherea � b means that sequencesa andb are taken side-by-side withith element ofa andb taken in the same step. Notation-wise, in order to takeseveral transitions in the same step, these sets of sequences have to be considered to be setsof sequences of sets with elements of inner sets shown delimited with a dash (-). For exam-ple, (pause stop) � rew or ff = pause-rew or ff stop, (pause stop) � 1 = pause stop. Heredash means thatpauseandrew or ff are taken in the same step, whilestop(separated by aspace) — in the one after it. Multiplication� is used forC construction in order to produce

25

the shortest possible sequence of transitions by taking as many of transitions as possible inthe same step. A sequential multiplication� could be used instead, leading to longer testsequences. For the tape recorder under the assumption of an implementation containing nomore states than the specification, test case generation produces672 sequences. It is latercontrasted with the size obtained using the Wp method.

Static reactions can be transformed into ordinary transitions through a well-knowntransformation of a statechart. The idea is to consider static reactions as ordinary transitionsexecuting concurrently with the behaviour of states, with which these static reactions areassociated. For example, a static reaction in the TAPERECORDER state can be expressedby adding a third concurrent part to it with a single state and a transition looping in thisstate. In order to represent static reactions in other states, such as RECORDING, thosestates have to be converted to AND-states. With this transformation, static reactions can betested similarly to ordinary transitions.

3.4 Test data generation

Since the aim of the statechart testing method is to test a transition diagram, it is assumedthat all labels are implemented correctly. Thus, an implementation may contain a differentnumber of states, transitions traversing them in any way but labels of implemented transi-tions behave the same as those in a specification. Since sequences of labels generated bythe test method are often not related to those taken by a system during routine operation, itis necessary to force those labels to be triggered through changes to externally accessiblevariables and all other labels — not to be triggered, even if they become such as a con-sequence of actions of some transitions. In addition, for every executed transition someoutput changes have to be observed, giving evidence that a transition with the expectedlabel was actually taken by the implementation under test. The requirement of being ableto trigger, the one of the input-output pair to identify a transition label, a requirement of ab-sence of shared labels between states of a specification, and the one that transitions cannotdirectly enter default connectors, comprise thedesign for testcondition. Under assump-tion that labelsrec, pauseandcontinueare triggered by the samerec event and an outputfrom them makes it possible to uniquely identify them, the controller satisfies these require-ments. More complicated statecharts may have to be designed in the first place to satisfythis condition; it is always possible to add extra inputs, outputs [20], slightly modify labels[6] and re-route transitions to default connectors [5] to satisfy design for test.

Reference [28] considers labelled transition systems; such a system deadlocks if notransition with a label attempted by a tester exists from its current state. The method pre-sented in this paper converts labels to inputs; in response to an input triggering a label withno corresponding transition from its current state, a statechart would either take a differenttransition, a static reaction or simply ignore such an input. An output from an implementa-tion (or absence of any) would then indicate which transition or static reaction (if any) hasbeen executed.

If these requirements, those provided in Sect. 2.2, as well as the assumptions of theminimality (Sect. 3.1) of every OR-state in a specification, availability of a reliable reset(for both a specification and an implementation) and a known upper bound on a number ofstates in an implementation are satisfied, a test set can be generated, applied and provide aprovable compliance of the behaviour of an implementation, to that of a specification [5].It is important to stress the requirement of the synchronous behaviour of statecharts postu-lated in Sect. 2.2. Its purpose is to prevent uncontrollable sequences of transitions taken bya system under test. As a consequence, communication between concurrent states has to beabsent. For some statecharts, it could be possible to test the core transition structure withtransitions which do not trigger others and then test the remaining part of it, following the

26

approach described in [16].

4 Testing of statecharts using the Wp method

This section describes changes to the above testing method for statecharts, so as to use theWp method as a foundation.

4.1 Description of the Wp method

The Wp method [12] is an improvement of the W one, targeted at the reduction of a numberof test sequences. Instead of using a singleW set, multiple smaller sets are introduced, eachidentifying a specific configuration. By ending test sequences with smaller sets, the numberof test sequences is reduced. Unfortunately, in a faulty implementation small identificationsets may fail to identify configurations correctly. To cope with this, a two-phase approachis taken where the first stage tests a part of a statechart and checks whether the small setsidentify configurations; the rest of the statechart is tested at the second stage.

Formally, for a configurationconf, an identification set wrootconf is a set allowing one to

distinguish betweenconf and all other configurations in a statechart. The purpose of theroot in the superscript ofw will be explained later.

The first phase of the Wp method corresponds to the part of the W method where everyconfiguration is entered and verified using the fullW = [confwroot

conf set. Consequently, eachconfigurationconf is also checked whether it could be identified by the smaller setwroot

conf.The set of test cases used in the first phase can be written as

T1 = CM � (f1g [ �M [ (�M)2[ : : : [ (�M)

m�n) � W

This differs from the full test set (Eqn. 1) in that the highest power of�M is m� n ratherthanm� n+ 1.

In addition to configuration verification, this phase also tests many transitions with la-bels used inC. Specifically, transitions labelled by singleton sequences inC get tested(between the respective configurations), since both their initial and final configurations areverified with the fullW set. For non-singleton sequences, such asrec pause, the interme-diate configuration does not necessarily get verified and thus in general none of the twotransitions get tested during this phase. If, however, therec label exists inC as a singletonsequence, the intermediate configuration is verified withW and thus both transitions gettested. This can be generalised, such that for a prefix-closedC (for every sequences2 C,C contains all prefixes ofs) all transitions traversed byC get tested between their respectiveconfigurations. This holds for the tape recorder.

At the second phase all transitions which were left out in the first phase are tested, usingsmall setswroot

conf to identify configurations and therefore create less test cases compared tothe W method while still providing the same level of confidence in the result of testing.Let the initial configuration of a statechart be denoted byconfinit . The set of test cases forthe second phase of the Wp method (without leaving out already tested transitions) is thefollowing:

T2 =[

path2TS

fpathg � wrootCE(path;confinit)

whereTS= CM � �M � (f1g [ �M [ (�M)2[ : : : [ (�M)

m�n) andCE stands for Config-

uration Entered.CE(path; conf) is the configuration entered after taking a pathpath froma configurationconf. For instance, withconfinit = fSTOP; IDLE g, wroot

CE(rec pause;confinit)=

wrootfPAUSE;IDLEg (only basic states in these two configurations are shown).

27

4.2 Merging rules for identification sets

In this subsection setswroots for every statesof a statechart, merging rules for them and the

construction ofwrootconf are described.

Let wi;j denote a set of paths which distinguishes between statesi andj in the same flatstatechart. For example,wSTOP;PLAY = fplayg. For a states 2 �(st), an identification setisdefined asws =

Si2�(st) ws;i , which is a set allowing one to distinguish between a particular

states in a statechartstand all other states inst (but generally not those in a different state).For the controller these sets are:wSTOP= fstopg; wPLAY = fdirectiong; wRECORD= fplay; recg;wREWFF = frew or ff g; wRECORDING= fpauseg; wPAUSE = fcontinueg: The characterisation setW can be expressed in terms ofwi;j as

Wst =[

s;i2�(st)

ws;i =[

s2�(st)

ws (2)

Rules to construct a characterisation setWM for a statechart involve mergingWMAIN

of the main statechart and mergedWMs sets for every non-basic states in it. The same

approach can be applied to merging of identification sets. As defined above, a statest insome statechart can be identified withwst; usingS to denote this statechart, it is possibleto write wS

st = wst. In order to obtain the identification setwSs for a states contained in

st of a higher-level stateS (assuming the last two are OR states), one has to identifys inst andst in S. This giveswS

s = wSst [ wst

s . Consequently,wSs = wS

s1 [ ws1s2 [ : : : [ wsn

swheres1 : : : sn are such thats1 2 �(S); s2 2 �(s1); : : : ; sn 2 �(sn�1); s 2 �(sn). ForFig. 1,wMAIN

PAUSE = wMAINRECORD[wRECORD

PAUSE = fstop; play; continueg. The proposition in the followingsubsection describes how to reduce this set. The general rule for merging ofw sets can bewritten as follows:

wSs =

8>><>>:

? if S= sor S is an AND-state.ws if s2 �(S) andS is an OR-state,

wherews identifiesswithin its enclosing oneS.wS

st [ wsts for somest2 �

+(S) ands2 �(st).

Above,�+(S) means a set of children, grandchildren and so on ofS. Identification of astates in the whole statechart is accomplished usingwroot

s .The identifying set for a configurationconf can be defined as a union of identifying

sets of basic states in the configuration, i.e.

wrootconf =

[s2conf; s is basic

wroots

Applying this to the tape recorder, the size of the set of test cases for the first phase of theWp method is 32 and the second one — 306, resulting in 338 sequences which is a half ofthe set provided in Sect. 3 above; the reduction could be much bigger for complex systems,where the number of transitions to verify is high.

4.3 Optimisation of state identification sets

Above, wRECORDING andwPAUSE were merged withwRECORD even though it was not necessaryas wRECORDING and wPAUSE already identify states in the flattened MAIN state. Note that ifwRECORDING= fcontinueg was used, there would be no way to tell STOP and RECORDINGapart in the merged statechart because transitions with thecontinuelabel exist from neitherof them. These considerations give rise to the following proposition.

28

Proposition Merging rules for state identification sets ws within an OR state parent(s) can

be simplified to wroots = wparent(s)

s if the following holds:

� Labels used in any state of a statechart are not used in any other one.

� For all states s of a statechart, ws only contains labels which exist on transitions froms (described above).

The first condition of this proposition implies, for instance, thatrec cannot be usedinside the RECORD state as it is used in the MAIN one. This condition holds due to therequirements for the statechart testing method described in Sect. 3.4; the second one can bemade true by construction ofws. Using the proposition,wMAIN

RECORDING= fpauseg; wMAINPAUSE= fcontinueg:

4.4 Optimisation of configuration identification

Consider the configuration with basic states PAUSE and IDLE. The identification setfor it is wfPAUSE;IDLEg = fcontinue; rew or ff g, but it could be reduced to a single elementcontinue-rew or ff by taking the two transitions in the same step. The rule for constructionof an identifying set for a configuration can thus be optimised as follows:

wSconf =

8>>>><>>>>:

wSs [ ws

conf if S is an OR-state, wheres2 �(S) \ conf,i.e. the only substate ofS in the configurationconf.

? if S is a basic state.ws1

conf[ws2conf[ : : :[wsn

conf if S is an AND-state,for n substates ofS, si 2 �(S) \ conf.

wherewsaconf[wsb

conf = fseqa � seqb j seqa 2 wsaconf [ f1g; seqb 2 wsb

conf [ f1gg n f1g,such thatseqa andseqb can be taken in the same step. The purpose ofwS

conf is to identifya part of a configurationconf underneathS, thus it is assumed thatwS

conf = wSconf\�+(S).

For example, when applied to the configurationcfgwith basic states PAUSE and IDLE, theabove definition becomes

wrootcfg = wroot

TAPERECORDER[ wTAPERECORDER

fMAIN;RECORD;PAUSEg [ wTAPERECORDER

fSEARCH;IDLEg

q q

wMAINRECORD[ wRECORD

PAUSE wSEARCHIDLE

The aim of the rule is to take as many sequences in the same step as possible. For setsoptimised as described in Sect. 4.3, all pairs of sequences from any two setswsa

conf, wsbconf

(sa; sb 2 �(S)) can be taken in the same step, but applicability of configuration identifi-cation does not depend on whether state identification sets are optimised or not. To avoidredundant sequences inwS

conf for an AND-stateS, every element of the identification setswsi

conf has to be used only once (not shown in the definition). One of theseqa andseqbabove is allowed to be empty (denoted1) to accommodate pairs of sequences which cannotbe taken in the same step as well as to handle varying numbers of sequences in the sets tobe[-ed.

4.5 Merging rules for the characterisation set

The definition ofW (Eqn. 2) for the case of mergedw can be shown to be consistent withmerging rules forW, such that after using the provided merging rules to constructwroot

s ,it is possible to unite these sets afterwards (Eqn. 2) and obtain the rule forW construction(sections 3.2 and 3.3). The proof [5] is omitted from the paper. For example,W for theMAIN state of the tape recorder in Fig. 1 isW = wMAIN

STOP[wMAINPLAY[wMAIN

RECORD[wMAINRECORDING[wMAIN

PAUSE =fstop; direction; rew or ff; pause; continueg. This W set and the reducedws were used inthe computation of the size of the set of test cases in Sect. 4.2.

29

The described optimisation of configuration-identifying sets by taking multiple tran-sitions at the same time may lead to a biggerW set than that constructed using theWmethod. For example, in the controller every configuration can be identified by a pair oftransitions from its basic states. Optimised identification sets could use pairs of such tran-sitionscontinue-rew or ff, pause-rew or ff and so on, a union of which isfstop; direction; pause; continueg�frew or ff; stop rew or ff g, containing 8 elements as op-posed to 4 forW constructed from unoptimised identification sets. Such a growth ofWcauses the number of sequences in the first phase of the Wp method to increase to 64 butin effect actually leads to a reduction in the total size of the set of test cases. This followsfrom thewconf sets being reduced twice and thus halves the size of the second phase. In theoverall, the reduction is by 36% from the Wp method without optimisation ofwconf (butwith optimisation of state identification) and by 68% from theW method.

4.6 Usage of status information

In some statecharts, it is possible to detect a state not by taking transitions but by observingvalues of some variables such as dashboard lights. This could lead to a considerable reduc-tion of the size of a test set. Information obtained by observation is further calledstatusinformation. Its usage is not new - most state-based object-oriented testing methods relyon it, such as [1, 30].

Status variables have to be correctly implemented and their usage restricted in the sameway as labels: if some variable is used to identify a group of states, all those states should bewithin the same higher-level state. For example, information about whether a tape movesor not, cannot be used as a status as it is present in both PLAY and REWFF states (whichbelong to different higher-level states) because one cannot independently identify states inMAIN or SEARCH with it.

Since status makes it possible to identify groups of states without taking any transitions,when constructingws for a states, it is necessary to distinguish it only from members of thegroup it belongs to. More precisely, when identifying states, one could rely onstatusgr toidentify groupsgr of states and then constructws;gr for states within each group. This leadsto usage of a pair(statusgr; ws;gr) instead of a setws. For example, in the tape recordera tester can see whether a head is close to a tape; this is assumed to be unaffected bythe state in the SEARCH statechart, which only controls the speed of tape movement.The head position permits an introduction of thestatusheadcloseboolean status variable,considered to be true in the PLAY and RECORD states of the MAIN statechart and definewSTOP = (f:statusheadcloseg;?). : means that the output should be negative from thestatus. The negation sign is not actually used in the set of test inputs but is shown herefor clarification of the expected output. Note that the proposition in Sect. 4.3 is easilyapplicable to status variables. Here the length of test sequences for identification of theSTOP state as well as the length of those in theW set of the first phase is reduced by one.

There could be more than a single status variable; for example, if one can observethe red ‘recording in progress’ light, the RECORD state can be assumed andwMAIN

PLAY =(fstatusheadclose;: statusrecordinglightg;?). Here both STOP and PLAY states areidentified without taking any transitions.WMAIN = (fstatusheadclose; statusrecordinglightg;fpauseg) can be used for testing of the statechart. The speed of tape movement could alsobe used to tell REWFF from the IDLE state. In the example, status information onlyreduces the size of the first phase of the Wp method, however in complex systems withconfiguration identification sets containing a number of labels, one could expect it to re-duce the complexity of testing significantly.

Having constructedstatusgr and the correspondingws;gr state identification set, it isnecessary to integrate them. Since one can check all status variables in a single step, they

30

all can be united into a singleton sequence, the only element of it performing all statusreporting. Variables and sequences of transitions used to identify states can be mergedto identify configurations using the rules described in Sect. 4.2–4.4. Semantics of Harelstatecharts makes it possible to observe status variables at the same time as applying the firstelement of a sequence from a state identification set. In practice, however, a tester is morelikely to make a separate step devoted to observation of a status report. A configurationconf can be identified by a setfstatusconfg�wroot

statusconf;conf instead of a largerwrootconf. Here

statusconf is the set of status variables, used in the identification of this configuration; ifa particular value ofstatusconf does not single outconf, wroot

statusconf;conf is used to identify itamong configurations satisfying that value ofstatusconf. The� operator is used instead of� in order to observe status and take a transition labelled by the first element of sequencesin wroot

statusconf;conf at the same time.Certain aspects of consistency of statecharts can be verified by testing. For exam-

ple, it is possible to ascertain that if a state is entered, its parent state is entered too. Forthe tape recorder, one could verify RECORDING2 �(RECORD) by usingwRECORDING =(fstatusrecordlightg; fpauseg), sincewRECORD = (fstatusrecordlightg;?) and from theproposition in Sect. 4.3wRECORDING = (?; fpauseg). Status information provides a ‘free’way to do this type of checking.

5 Conclusion

The Wp method can be applied to statecharts in a similar way to the W one [6, 5, 8], byextension of merging rules for identification of a configuration. Due to the complexityof statecharts, the Wp method can be expected to provide a significant reduction in thesize of the set of test cases, compared to the W method. Further, rules were providedfor different optimisations of such sets, allowing additional reduction in the complexity oftesting. Direct observation of state information can lead to further reduction of the sizeof a set of test cases and can be applied together with the other optimisations described.Usage of status variables also permits verification of state properties of a statechart, suchas whether a parent of an entered state is itself in a configuration.

The most important limitations of the presented extension are lack of handling of inter-level transitions, requirement for labels not to be shared between states and a need to forcesequences of transitions during test execution. For the first of these, one might considerinterlevel transitions to belong to their scope states; shared labels can be overcome eitherby partial flattening of the structure of a statechart or by making TCB construction sensitiveto shared labels. The work on these two issues is close to completion. For the last problem,constraint logic programming [23] could potentially be used to derive sequences of testinputs without resorting to artificial test inputs. This is a possible direction for future work.

Theoretical foundations of the usage of W and Wp testing methods for statecharts havebeen shown to be correct in [5].

Acknowledgements

This work was funded by the DaimlerChrysler Research Laboratory (FT3/SM), Berlin,Germany.

31

References

[1] T. Ball, D. Hoffman, F. Ruskey, R. Webber, and L. White. State generation andautomated class testing.Software Testing, Verification and Reliability, 10(3):149–170, September 2000.

[2] M. Benjamin, D. Geist, A. Hartman, G. Mas, R. Smeets, and Y. Wolfsthal. A fea-sibility study in formal coverage driven test generation. In36th Design AutomationConference (DAC’99), June 1999.

[3] M. Blackburn. Using models for test generation and analysis. InDigital AvionicsSystems Conference (DASC’98), 1998.

[4] M. Blackburn, R. Busser, and J. Fontaine. Automatic generation of test vectors forSCR-style specifications. In12th Annual IEEE Conference on COMPuter ASSurance,COMPASS ’97, 18–19 June 1997.

[5] K. Bogdanov.Automated testing of Harel’s statecharts. PhD thesis, The Universityof Sheffield, January 2000.

[6] K. Bogdanov and M. Holcombe. Statechart testing method for aircraft control sys-tems.Software testing, verification and reliability, 11:39–54, 2001.

[7] K. Bogdanov and M. Holcombe. Properties of concurrently taken transitions of stat-echarts. InSemantic Foundations of Engineering Design Languages (SFEDL), 2002.

[8] K. Bogdanov, M. Holcombe, and H. Singh. Automated test set generation for stat-echarts. In D. Hutter, W. Stephan, P. Traverso, and M. Ullmann, editors,AppliedFormal Methods - FM-Trends 98, volume 1641 ofLecture Notes in Computer Sci-ence, pages 107–121. Springer Verlag, 1999.

[9] T. Chow. Testing software design modeled by finite-state machines.IEEE Transac-tions on Software Engineering, SE-4(3):178–187, 1978.

[10] J. Dick and A. Faivre. Automating the generation and sequencing of test cases frommodel-based specifications. In J.C.P. Woodcock and P.G. Larsen, editors,FME ’93:Industrial Strength Formal Methods, volume 670 ofLecture Notes in Computer Sci-ence, pages 268–284. Formal Methods Europe, Springer Verlag, April 1993.

[11] J.-C. Fernandez, C. Jard, T. Jeron, and G. Viho. Using on-the-fly verification tech-niques for the generation of test suites.Lecture Notes in Computer Science, 1102:348–359, 1996.

[12] S. Fujiwara, G. von Bochmann, F. Khendek, M. Amalou, and A. Ghedamsi. Testselection based on finite state models.IEEE Transactions on Software Engineering,17(6):591 – 603, June 1991.

[13] D. Harel, H. Lachover, A. Nammad, A. Pnueli, M. Politi, R. Sherman, A. Shtull-Trauring, and M. Trakhtenbrot. STATEMATE: A working environment for the devel-opment of complex reactive systems.IEEE Transactions on Software Engineering,16(4):403–414, April 1990.

[14] D. Harel and A. Naamad. The STATEMATE Semantics of Statecharts.ACM Trans-actions on Software Engineering and Methodology, 5(4):293–333, 1996.

32

[15] R. M. Hierons. Testing from a Z specification.Journal of software testing, verificationand reliability, 7(1):19–33, 1997.

[16] R. M. Hierons. Testing from semi-independent communicating finite state machineswith a slow environment.IEE Proceedings on Software Engineering, 144(5–6):291–295, 1997.

[17] M. Holcombe and F. Ipate.Correct Systems: building a business process solution.Springer-Verlag Berlin and Heidelberg GmbH & Co. KG, September 1998.

[18] H. Hong, Y. Kim, S. Cha, D. Bae, and H. Ural. A test sequence selection method forstatecharts.Software testing, verification and reliability, 10:203–227, 2000.

[19] F. Ipate and M. Holcombe. An integration testing method that is proved to find allfaults. International Journal on Computer Mathematics, 63:159–178, 1997.

[20] F. E. Ipate.Theory of X-machines and Applications in Specification and Testing. PhDthesis, University of Sheffield, July 1995.

[21] A. Kerbrat. Automated test generation from SDL/UML specifications. Obtainedprivately, March 1999.

[22] Y. Kim, H. Hong, S. Cho, D. Bae, and S. Cha. Test cases generation from UML statediagrams.IEE Proceedings - Software, 146(4):187–192, August 1999.

[23] H. Lotzbeyer and A. Pretschner. Testing concurrent reactive systems with constraintlogic programming. In2nd Workshop on Rule-based constraint reasoning and pro-gramming, Singapore, September 2000.

[24] E. Mikk, Y. Lakhnech, C. Petersohn, and M. Siegel. On formal semantics of state-charts as supported by Statemate. InBCS-FACS Nothern Formal Methods Workshop,pages 0–13, Craiglands Hotel, Ilkley, West Yorkshire, U.K., July 1997.

[25] J. Offutt and A. Abdurazik. Generating tests from UML specifications. InSecondInternational Conference on the Unified Modeling Language (UML99), Fort Collins,CO, October 1999.

[26] J. Peleska and M. Siegel. Test automation of safety-critical reactive systems.http://www.informatik.uni-bremen.de:80/ �jp/papers/sacj97.ps.gz , August 1996.

[27] A. Pnueli and M. Shalev. What is in a step: On the semantics of statecharts. InT. Ito and A. Meyer, editors,Int. Conf. TACS’91: Theoretical aspects of ComputerSoftware, volume 526, pages 244–264. Springer-Verlag, September 1991.

[28] Q. M. Tan, A. Petrenko, and G. von Bochmann. Checking experiments with labeledtransition systems for trace equivalence. InIFIP 10th International Workshop onTesting of Commnication Systems (IWTCS’97), Korea, 1997.

[29] J. Tretmans and A. Belinfante. Automatic testing with formal methods. InEu-roSTAR’99:7th European Int. Conference on Software Testing, Analysis & Review,Barcelona, Spain, November 8–12, 1999. EuroStar Conferences, Galway, Ireland.

[30] B. Tsai, S. Stobart, N. Parrington, and I. Mitchell. Automated class testing: Usingthreaded multi-way trees to represent the behavior of state machines.Annals of Soft-ware Engineering, 8:203–221, 1999.

33

�� !��"��#$�&%('*)+�,#-�/.��

021436587:9<;�=49?>A@�BC;D7E6FCG�HJILKNMPO8Q"R+GTSVUAWXGAU�Y�Z6[/S\K]UAY�K4S2^_W`S\a8UcbcYdSLKNMR<K4b�e+F8bgf6HihjSNWlk6FJIVUnmJZXo8p:ojo-[�SLKqUAY�K4S\ZsrtO8uvFJW`SVF

wxBC58=4B`9zy|{"7:3s58}+{_7~�Ud��F8bDK4uiUcW<K/O�Q2��O�u$��HsKqUcb�R<GgS�UcWXG�UDZ+R:�<Uc�iUcI\h�^�W`SLa�UAbTYgS\KNMrtUTfÙcW<K��O:HJbDK�Zs[/O8b�K]OC�CUcINIVO�R<K4b�UU8K�Z+RC�+Uc�iUcI\h`Z+R�m-�J~t["Z�^"�

w�=��+7P��361\�j3+��7~�Ud��F8bDK4uiUcW<K/O�Q2��O�u$��HsKqUcb�R<GgS�UcWXG�UDZ+R:�<Uc�iUcI\h�^�W`SLa�UAbTYgS\KNMrtUTfÙcW<K��O:HJbDK�Zs[/O8b�K]OC�CUcINIVO�R<K4b�UU8K�Z+RC�+Uc�iUcI\h`Z+R�m-�J~t["Z�^"�

��_� 365i��Bs1d�B`9"7:�� E6FCG�HJILKNMPO8Q"R+GTSVUAWXGAU�Y�Z6[/S\K]UAY�K4S2^_W`S\a8UcbcYdSLKNMR<K4b�e+F8bgf6HihjSNWlk6FJIVUnmJZXo8p:ojo-[�SLKqUAY�K4S\ZsrtO8uvFJW`SVF

� �"��;58B`�j;j��]� �g¡T¢C£C¤s¥¦�£¨§:©«ª�¬NN¦�:§6¦�¡g®6¯�°-±]²v³jćµ:¶V·<¸A¹vº�¢!¡n»�¶V¼½¸·+¾ç¿\À«²Á³!´TµC¶V·+¸�¹�Â-Ã�¦�¡g¦vÄ`¡T¢jÄ+¢!Åg¦�£§:©ÁÆ�¢jÇ¥�¢!ÈÉ§+¦�¬N�PÊ�Ë!ÌjÌ-Í!Å/Í$§6ÍjÅg¬NÅ�Î�¢j¡�ÍÉÄ6¢ ÅgÅg¬N§`½¦ÏÅdÄ+¦�¥¬ÑÐ+¥Í8�T¬½¢!�vNÍj�`®j¤6ÍJ®j¦�Íj�s£ÒÅg¬½�6¥�¦��TÓ`¦��Í$�:¤`ÈnÔ§+¦¡�¢JÎ�Î�¤s¡d�TÓ`¦¡�¬½�:Õ!¦�Åd�g¬N®!Í8�T¬½¢!�sÅ�Ó6Í�Õj¦t£`¦ÈÁ¢j�sÅd�g¡cÍ8�T¦�£Á�TÓ`¦ÏÕ�Íj½¤s¦�¢JÎ��gÓ`¬ÇÅ�¬N£C¦DÍ`Ö:×z�:¤`È�§6¦�¡�¢jÎ_¥�ÇÍjÅTÅg¦�Å¢jÎ�Ø�ÔqÈÁÍ!¥cÓ`¬N�`¦�ÅtÓsÍ�Õj¦�§6¦�¦�«¬N£C¦�� g¬½Ðs¦�£«ÍJ�s£«Å��T¤s£C¬N¦�£X¯<ÈÁ¢!Åd�Ï¬NÈÁÄ6¢!¡d�cÍJ� �gN©|�gÓ`¦Á¥�ÇÍjÅTÅt¢JÎ�¹AÙL¿g¸c³8²Ú°-±²v³jćµ:¶V·<¸A¹AÖ6×Û�gÓ`¦�¢j¡T©i¢JÎ"�g¦DÅ��T¬½�s®v§sÍjÅg¦�£|¢j��Åd�g¡T¦�ÍjÈÚØ�ÔqÈvÍj¥cÓ`¬N�`¦DÅ�ÓsÍjÅ�ÍjNÅg¢Á§6¦�¦�P£C¦�Õj¦�½¢!Ä6¦D£XÖsÜ�Ó`¬ÇÅÍj½N¢8Ã�ÅÏ�gÓ`¦i®j¦�s¦¡cÍ8�g¬N¢j�¨¢JÎ��T¦�Åd��Åd¦�TÅ$�gÓsÍJ��ÍJ¡T¦ÁÄ`¡g¢8Õ!¦�£��g¢P®!¤sÍJ¡cÍJ� �T¦¦n�gÓ`¦�¥�¢j¡T¡T¦�¥A�T�`¦�ÅTÅ�¢JÎ2¬NÈÁÄ`½¦ÔÈÁ¦� �cÍ8�g¬N¢j�nÍJ® ÍJ¬N�sÅ��"�gÓs¦�ÅgÄ+¦�¥�¬½Ð6¥�Í8�g¬N¢j�n¤`�s£`¦¡�¥�¦�¡d�cÍJ¬N��¥¬½¡c¥�¤`ÈvÅd�TÍj�s¥�¦DÅÖ8×Ý¡g¦D¥�¦��!��ÄsÍjÄ6¦�¡�®j¦�s¦¡cÍJN¬NÅg¦�Å�TÓ`¬NÅ��TÓ`¦¢!¡g©n�g¢��gÓs¦Ï®!¦�`¦�¡TÍj6Ø�ÔLÈvÍ!¥cÓ`¬½�s¦�ÈÁ¢C£C¦XÍJ�6£X¯:Î�¤`¡g�gÓ`¦�¡gÈÁ¢j¡T¦j¯!�gÓs¦t¡T¦�Åg¤`½�TÅ�Ä`¡T¢8Õj¦�Ò¥�ÍJ�iÎ�¢j¡TÈ�TÓ`¦v§sÍjÅg¬ÇÅt¢jÎ��Ã�¢�£C¬ÇÅ��T¬½�s¥��-�g¦DÅ��T¬½�`®PÅd�g¡cÍ8�T¦®!¬½¦DÅÖXÜ�Ó`¬ÇÅ�ÄsÍJÄ+¦¡É®j¦�s¦¡cÍJN¬NÅg¦�Å��gÓ`¦DÅd¦v¡T¦�¥¦� �-¡g¦DÅd¤sÑ�cÅÏ�g¢�TÓ`¦t�s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅd�g¬Ç¥Ï¥�ÍjÅg¦jÖ:Ü�Ó`¦�®j¦��`¦¡cÍJN¬NÅTÍ8�T¬½¢!�v¬NÅ��s¢j�CÔL�g¡T¬½Õ:¬ÇÍJ<ÍJ�s£i¬Ñ��¥�ÍJ��¥¢jÄ+¦�Ã2¬Ñ�TÓ|Íj½+��©:Ä6¦DÅ¢jÎ_�`¢!�CÔq£`¦��g¦�¡gÈÁ¬N�`¬ÇÅdÈ(�TÓsÍ8��¥�ÍJ�|§6¦�Î�¢!¤`�s£|¬N��Íj��Ø�ÔqÈÁÍ!¥cÓ`¬N�`¦�Èn¢C£C¦�\ÖÞ�7 ßXàÉ3s5 � �já6Ü�¦DÅ��T¬½�`®6¯:Ðs�`¬½�g¦$Åd�TÍJ�g¦-ÈvÍj¥cÓ`¬N�`¦!¯�º4Åd�g¡T¦�ÍJÈÒÂ�Ø�ÔqÈvÍj¥cÓ`¬N�`¦!¯CÎ�¢j¡TÈvÍJXÅdÄ+¦�¥¬ÑÐ+¥Í8�T¬½¢!�â�ãäâ BC;D7 }+365�=\7:�já`å�Ö æ`Ö æ`¯`åÉÖçæCÖ è

é ê!ë�ìCí`î2ï�ð�ñ+ì`òdî/ëó �`¦-¢JÎ"�gÓs¦$Å��T¡g¦��`®J�TÓsÅ�¢JÎ�£C¦Õ!¦N¢jÄ`¬N�`®vÍ�Î�¢j¡TÈvÍJ�ÅgÄ6¦D¥�¬½Ð6¥ÍJ�g¬N¢j��¢JÎ�ÍvÅd©CÅd�g¦ÈÚ¬NÅ��TÓ`¦�Î4Íj¥��2�gÓsÍJ��¬Ñ�Ï¥ÍJ��Íj¥��ÍjÅÍ$¡T¦�Î�¦�¡g¦��s¥�¦tÄ6¢!¬½� �/Î�¢!¡/�TÓ`¦�Äs¡g¢jô�¦�¥A��£C¦Õ!¦N¢jÄ`ÈÁ¦��!�D¯!¬½��¥�ÍJ�i£`¦�Ðs�`¦!¯:¬½�v�TÓ`¦tÎ�¢j¡TÈõ¢jÎ�ÍÉö ¤sÍ!Åd¬½ÔLN¦® ÍJsÅd�TÍJ�g¦�Èn¦�� ¯�gÓ`¦�¡T¦�ö ¤`¬N¡g¦D£v¢j¤`�T¥�¢!ÈÁ¦�¢JÎ��gÓ`¦ÏÄ`¡T¢Jô�¦�¥��Íj�s£v¬½��¥ÍJ��ÍJÇÅd¢�§6¦-ÍÉÅg¢j¤s¡T¥¦�¢JÎ_¬½�CÎ�¢!¡gÈvÍJ�g¬N¢j�v�TÓsÍ8�2¥Íj�i§+¦t¤sÅg¦�£Ò�g¢¦�Åd�TÍj§`½¬ÇÅgÓv�gÓsÍJ�/�TÓ`¦�¬NÈÁÄ`½¦�ÈÁ¦� �TÍJ�g¬N¢j�Ò¬ÇÅ�¥¢j¡T¡g¦D¥A�DÖj�]�Ò¡T¦�¥¦� �/©j¦DÍJ¡cÅ��gÓs¦¡T¦�ÓsÍ!Å�§+¦¦�|Åd¢!ÈÁ¦�¬½� �T¦¡T¦�Åd�/¬½�Ò�g¡T© ¬N�`®�g¢Ï¤sÅg¦/�TÓ`¦�¬N�CÎ�¢!¡gÈvÍ8�T¬½¢!�É¬N��Í�Î�¢j¡TÈvÍJ:ÅdÄ+¦�¥¬ÑÐ6¥�Í8�T¬½¢!�ÉÍjÅ�Í�§6ÍjÅg¬NÅ�Î�¢j¡"�g¦DÅ��Åg¦��®j¦�s¦¡cÍ8�g¬N¢j��ÖDÜ_¦�Åd�g¬N�`®�¬ÇÅ�ÍJNCÍJ§+¢j¤C�Ðs�s£C¬N�`®ÉÎ4ÍJ¤`½�TÅ�ÍJ�s£ÁÕ!¦¡T©�Åg¦Ç£C¢jÈ÷�gÓs¦�¬ÇÅgÅg¤`¦�¢jÎX�gÓ`¦��:¤`È�§6¦�¡�¢jÎ<Î4ÍJ¤`½�TÅ/�gÓsÍJ�/¡T¦ÈvÍJ¬N�v¬½�Ò�gÓ`¦t¬½ÈÁÄ`N¦ÈÁ¦� �cÍ8�g¬N¢j�Í8ÎV�T¦¡��g¦DÅ��T¬½�s®|¬ÇÅ�£C¬ÇÅg¥¤sÅgÅg¦�£�Ö�ø�¦�¡g�s¢J��¦��$ÍJLÖ�ù úJû/ÍJ�s£«åtÍj¤s¥cÓ:©�¦��$ÍJLÖ�ùÑÊ!Ê�û�¥�¢!�sÅg¬N£C¦�¡��TÓ`¦v®j¦��`¦¡cÍ8�T¬½¢!�P¢JÎ��g¦DÅ��Åd¦�TÅ_Î�¡T¢jÈÛÍJN®j¦�§`¡TÍj¬N¥/ÅdÄ+¦�¥¬ÑÐ6¥�Í8�T¬½¢!�sÅ¯DÓ`¦�¡g¦/�gÓ`¦�¡g¦�¬NÅ�Í�Èn¢!¡g¦�¥�¢!ÈnÄs¡g¦�Ó`¦�sÅg¬NÕj¦�Î�¡cÍJÈÁ¦Ã�¢j¡TüÁºV�gÓs¦�ýjÓ ©:Ä+¢J�TÓ`¦�Åg¬NÅTý!ÂÃ2Ó`¬Ç¥cÓ|Íj½N¢8Ã�Å�Î�¢!¡��TÓ`¦Ï¬NÅTÅd¤s¦t¢jÎ��g¦DÅ��¦�þ<¦�¥��g¬NÕj¦�s¦�ÅTÅ/�T¢�§+¦�£C¬NÅT¥�¤6ÅgÅg¦�£i§`¤C��gÓ`¦t�g¦DÅ��2®!¦�`¦�¡TÍJ�g¬N¢j�vÄ`¡T¢C¥�¦�ÅTÅ�£C¢:¦�Å�`¢J��¦ÿCÄ`½¢!¬Ñ�2�TÓ`¬ÇÅ�ÄsÍJ¡g�g¬Ç¥�¤`ÇÍJ¡TN©jÖÜ�Ó`¦-Ä`¡T¢j§`N¦ÈÚ¢JÎ��T¦�Åd��¦�þ<¦�¥��g¬NÕj¦�s¦�ÅTÅ�¬NÅ2§+¦�Åd��Íj£s£C¡g¦DÅgÅg¦�£i¬ÑÎ"�gÓs¦��g¦�Åd��Åg¦��¥Íj��§+¦-®j¤sÍj¡TÍj� �g¦¦D£v�T¢ÁÐs�s£�³8¼V¼

� ³��C¼ Ù\¹�¢JÎ��gÓ`¦É¬½ÈÁÄ`N¦ÈÁ¦� �cÍ8�g¬N¢j��Ö ó �`¦$ÍjÄ`Ä`¡T¢!Íj¥cÓ|¬ÇÅ��g¢i¥¢j�sÅg¬Ç£C¦¡��Ã�¢ÒÍJN®j¦�§`¡TÍj¬N¥Ï¢!§Cô�¦�¥��TÅ$º��gÓ`¦ÉÅgÄ+¦�¥�¬½Ð6¥�Í8�g¬N¢j�ÍJ�s£��TÓ`¦�¬½ÈÁÄ`N¦ÈÁ¦� �cÍ8�g¬N¢j�+ÂA¯`¦DÍj¥cÓi¢jÎ��TÓ`¦È ¥cÓsÍJ¡cÍj¥��g¦¡T¬ÇÅd¦D£v§:©iÍJ�|¬½�sÄ`¤C��8¢j¤C�TÄ`¤C��§+¦ÓsÍ�Õ:¬N¢j¤`¡D¯CÍJ�s£i�g¢��<¿��8¸�gÓsÍJ��¯_¬ÑÎ��gÓs¦Ò§6¦�ÓsÍ�Õ:¬½¢!¤`¡cÅ�¢JÎ��gÓ`¦DÅd¦v¢!§Cô�¦�¥��TÅ$¥¢j¬N�s¥�¬Ç£C¦ÁÎ�¢!¡ÉÍJ�:©�¬N�`Ä`¤`�É¬½� �TÓ`¦v�T¦�Åd�ÉÅd¦��¯��TÓ`¦©¨Ã2¬N½/¥¢j¬N�s¥�¬Ç£C¦Î�¢j¡�ÍJ�:©n¬½�`Äs¤C��¬N�Ò�TÓ`¦t£`¢jÈvÍJ¬N��Ö:Ü�Ó ¤6Å¯!�gÓ`¦ÏÅdÄ+¦�¥¬ÑÐ+¥Í8�T¬½¢!�iÍJ�6£Á�gÓ`¦Ï¬NÈnÄs½¦�Èn¦�� TÍ8�T¬½¢!�ÒÃ2¬N½+§6¦Ï®j¤6ÍJ¡cÍJ� �g¦�¦�£��g¢ÓsÍ�Õj¦�¬N£`¦� �g¬Ç¥Íj!§+¦ÓsÍ�Õ:¬N¢j¤`¡"Ä`¡T¢8Õ:¬N£C¦D£Ï�gÓsÍJ�_�TÓ`¦©-§+¦Ó6Í�Õj¦/¬Ç£C¦��!�T¬N¥�ÍJN½©�Ã2Ó`¦��Åg¤`Ä`Ä`N¬N¦�£$Ã2¬½�gÓÉ�gÓ`¦�¬N�`Ä`¤C�cÅ�¬½�-�TÓ`¦�g¦DÅ��Åg¦��DÖ ó §:Õ:¬½¢!¤sÅdN©j¯JÅg¤s¥cÓvÍJ�vÍjÄ`Ä`¡T¢!Íj¥cÓnÃ�¢j¤`Ç£É¢!�`N©É§+¦�ÍJÄ`Äs½¬Ç¥Íj§`½¦��T¢$¥�¦�¡d�cÍJ¬N�nÅg©CÅ��T¦ÈvÅ�ÍJ�6£nÅgÄ+¦�¥�¬½Ð6¥�Í8�g¬N¢j�

35

NÍj�`®j¤6ÍJ®j¦DÅ��A¬½�_Ã2¬NNj�`¢j��§6¦�ÍJÄ`Ä`N¬Ç¥ÍJ§s½¦��T¢�ÍJ�-ÍJ¡T§`¬½�g¡cÍJ¡T©�¥�¢!ÈÁÄ`¤C�g¦�¡_Åg©CÅ��T¦È÷º\ÍJ�$Íj¡g§`¬½�g¡cÍJ¡T©�Ü_¤`¡T¬½�`®2ÈvÍ!¥cÓ`¬½�s¦�ÅcÂA¯¢J�TÓ`¦¡TÃ2¬NÅg¦Ï�gÓ`¦-Ó6ÍJ½�g¬N�`®vÄ`¡T¢j§`N¦È(Î�¢!¡�Ü�¤s¡g¬N�`®ÁÈvÍj¥cÓ`¬N�`¦�Å�¯:Î�¢j¡2¦ÿ`ÍJÈÁÄ`N¦j¯CÃ2¬N½�§+¦$¥�¢!� �g¡cÍj£C¬Ç¥A�T¦�£XÖÜ�Ó`¬ÇÅtÍjÄ`Ä`¡T¢!Íj¥cÓ�Ó6ÍjÅt§6¦�¦��¦�ÈÁÄ`½¢8©!¦�£�¬N�P�TÓ`¦�Íj¡g¦DÍv¢JÎ��T¦�Åd�t®!¦�`¦�¡TÍJ�g¬N¢j��Î�¢j¡t�gÓs¦nÅg¢JÎV��Ã�ÍJ¡T¦$ÈÁ¢C£C¦N½¦D£�§:©

� ·6¶VÙq¸�¹AÙ]³8Ù]¸É²v³jćµ:¶V·<¸A¹��vù½Ê� JûL¯"ù �� 8ûq¯_ù½ÊèjûL¯"ù æ`Ê�ûqÖ+Ü�Ó`¦É§6¦DÅ��ü:�`¢8Ã2��g¦DÅ��T¬½�`®�ÈÁ¦��gÓs¢:£sÅ�§sÍ!Åd¦D£�¢j��ÅdÄ+¦�¥¬ÑÐ+¥Í8�T¬½¢!�sÅ�Íj¡g¦Ï�g¡cÍJ�6Åd¬½�g¬N¢j�CÔL�g¢!¤`¡-º4Ü�Ô�Â�ÈÁ¦��gÓs¢:£�ù �`ÊûL¯�ù �JèjûL¯C¤s�`¬Nö ¤`¦ÔL¬N�`Ä`¤`�dÔq¢j¤C�TÄ`¤C��º�� ó Ô�Â�Èn¦�gÓ`¢C£�ù ��JûL¯ù �jèJûq¯!£C¬ÇÅd�g¬N�`®j¤`¬ÇÅgÓ`¬½�s®ÉÅd¦Dö ¤`¦�s¥¦Éº4å�� Ô�Â�ÈÁ¦��TÓ`¢C£�ùÑÊ��ûq¯6ù �Jèjû6ÍJ�s£v¥cÓ6ÍJ¡cÍj¥A�T¦¡T¬��¬½�s®�Åg¦��Ïº��?Ô�Â�ÈÁ¦��TÓ`¢C£PùÑÊ 8ûq¯6ù �JèjûLÖÜ�Ó`¦�Ä`¤`¡TÄ6¢ Åd¦|¢JÎÏÍJ�:©¨�g¦�Åd�g¬N�`® ÈÁ¦��TÓ`¢C£ ¬ÇÅÉ�T¢�¥�¢jÈÁ¦�¤`ÄlÃ2¬½�gÓ?Í8�ÁN¦�ÍjÅd�n��Ã�¢«¡g¦Dö!¤s¬½¡T¦ÈÁ¦� �cÅá�º4Í Â$�TÓ`¦|�g¦DÅ��Åd¤s¬Ñ�T¦ÁÅgÓ`¢!¤`N£P§6¦Á¡T¦ÇÍ8�g¬NÕj¦�½©�ÅgÓ`¢j¡g��Íj�s£�º4§6Â��gÓ`¦n�g¦DÅ��-Åg¤`¬Ñ�T¦nÅgÓ`¢!¤`N£«¥�¢8Õ!¦¡tÍ!Å�È�¤s¥cÓ«Í!Å�Ä+¢!ÅTÅg¬½§`N¦ÁÍJN_Î4Íj¤`½�TÅùÑÊ�èJûqÖ"!�¢!�s¥�¦�¡g�`¬N�`®ÁÎ4Íj¤`Ñ��¥�¢8Õ!¦¡cÍJ®j¦!¯ �gÓ`¦�NÍ!Å��Ã�¢vÈÁ¦��TÓ`¢C£`Åt¥¢8Õj¦�¡�ÍJN�Î4ÍJ¤sÑ�cÅÖ"�:Ó`¢j¡g�g¦�¡��T¦�Åd�tÅd¤s¬Ñ�T¦ÉÓsÍ!Å2§6¦�¦�¢j§C�cÍJ¬N�`¦�£�Î�¢j¡#�� ó ÔLÈÁ¦�gÓ`¢C£�¬N��gÓs¦�¥Í!Åd¦É¢JÎ$�� ó Åg¦�ö ¤`¦��s¥�¦DÅ�Ã2¬½�gÓP¢8Õ!¦¡TNÍjÄ`Ä`¬N�`®Pù ��ûq¯s¢!¡�¦�¬Ñ�TÓ`¦¡tÃ2Ó`¦��TÓ`¦��ÓsÍ!Å�¡T¦�Åg¦��¥ÍjÄsÍj¥¬Ñ��©¨ºV�TÓ`¦¡T¦$¬ÇÅ�ÍJ��¬N�`Ä`¤`��gÓ6Í8��cÍJü!¦�Å2¦�Õj¦¡T©�Åd�TÍJ�g¦-�T¢v�gÓs¦$¬½�s¬Ñ�T¬NÍj_Åd�TÍ8�T¦DÂ�¢j¡�ÓsÍ!Å�N¢:¢jÄsÅºV�T¡TÍj�sÅd¬½�g¬N¢j�6Å�Ã2¬Ñ�TÓ��gÓ`¦$ÅTÍJÈÁ¦�¬½�s¬Ñ�T¬NÍj�ÍJ�s£iÐs�sÍj�Åd�TÍ8�T¦�ÅcÂÏùÑÊûL¯`¢!¡�Ã2Ó`¦�|�gÓs¦%�&�'� ¥¢j� �TÍj¬½�6Å�¦¬½�gÓ`¦�¡�¬½�:Õ!¦¡g�g¬N§`½¦�g¡cÍJ�sÅg¬½�g¬N¢j�sÅvù½Ê�úJû�¢j¡�¬½�:Õ!¦¡g�g¬N§`½¦vÅg¦�ö ¤`¦��s¥�¦DÅ�¢JÎ/�T¡TÍj�sÅg¬Ñ�T¬½¢!�sÅvùÑÊ)(DûqÖ�× Õ8ÍJ¡T¬NÍj�!��¢JÎ*�?ÔqÈn¦�gÓ`¢C£ ¥Íj½N¦�£,+ ÄsÍJ¡g�g¬ÇÍJ�?ÔLÈÁ¦�gÓ`¢C£-+�º4¢j¡*� ÄCÔqÈn¦�gÓ`¢C£sÂ�©:¬N¦Ç£`Å�ÅdÓ`¢!¡d�T¦¡��g¦DÅ��2Åd¤s¬Ñ�T¦�Å��gÓsÍj�Ò�TÓ`¦��?ÔLÈÁ¦��TÓ`¢C£�ù½ÊèjûLÖC×�N+�gÓ`¦DÅd¦�ÈÁ¦��TÓ`¢C£`ÅÍjÅTÅd¤sÈn¦Á�TÓsÍ8�-�TÓ`¦Ò¥�¢!� �g¡T¢j�ÍjÅgÄ+¦�¥A�cÅ-¢JÎ��gÓs¦ÒÅd¢jÎV��Ã�Íj¡g¦ÁÍJ¡T¦vÅd¦�ÄsÍJ¡cÍ8�T¦�£�Î�¡g¢!È*�gÓ`¦�Åd©CÅd�g¦È £`Í8�cÍ�ÍJ�s£ ¥Íj�«§+¦ÈÁ¢:£`¦N½¦D£i§:©iÍ.��Ö`Æ�¢8Ã�¦Õ!¦¡D¯!¬N��Åd¢!Èn¦�Åg¬Ñ�T¤sÍ8�T¬½¢!�sÅ�¬Ñ�2¬ÇÅ�Õ!¦¡T©Ò£C¬�/v¥¤`½��T¢vÅd¦�ÄsÍJ¡cÍ8�T¦��gÓs¦�Åg©CÅ��T¦È ¥¢j� �g¡T¢jÎ�¡g¢!È ¬½�TÅi£`Í8�cÍ ùÑÊ 8ûq¯/Åd¢ Í ÈÁ¢!¡g¦�¥�¢!ÈÁÄ`½¦ÿÝÅgÄ6¦D¥�¬½Ð6¥ÍJ�g¬N¢j�?ÈÁ¢C£C¦��gÓsÍJ�i¬½� �T¦®j¡cÍ8�T¦�Ån�TÓ`¦�Åg¦��Ã�¢ Í!ÅdÄ+¦�¥��TÅv¬ÇÅ�`¦¦D£C¦�£�Ö

�:¤s¥cÓPÍÁÈÁ¢C£C¦_¬NÅ��gÓ`¦n°-±]²v³jćµ:¶V·+¸Éº�¢!¡Ï»�¶V¼½¸·+¾ç¿\À|²Á³!´TµC¶V·+¸TÂA¯XÍÁ§`N¦�s£�¢jÎ0�&�'�PÅ¯+£`Í8�cÍvÅ��T¡g¤6¥A�g¤s¡g¦DÅ�ÍJ�s£Ä`¡T¢:¥¦�ÅTÅd¬N�`®2¡T¦ÇÍ8�T¬½¢!�sÅ�º�¢!¡XÎ�¤`�s¥��g¬N¢j�sÅcÂAÖ��]�-¬Ñ�cÅX¦�ÅTÅd¦��s¥�¦�Íj��Ø�ÔqÈÁÍ!¥cÓ`¬N�`¦�¬NÅ�½¬Nüj¦�Í1�� §s¤C��Ã2¬½�gÓ-¢j�s¦�¬½ÈÁÄ+¢j¡g�TÍJ� �£C¬½þ+¦�¡g¦��s¥�¦!Ö�×õ§sÍjÅg¬N¥Á£`ÍJ�TÍ�Åg¦��¯-2�¯X¬NÅ�¬Ç£C¦� �T¬ÑÐs¦D£«�g¢j®!¦��TÓ`¦¡-Ã2¬½�gÓ Í�Åd¦�$¢JÎ�§6ÍjÅg¬N¥nÄ`¡T¢C¥�¦�ÅTÅg¬½�`®�¡g¦�NÍJ�g¬N¢j�sÅÁº4¢j¡Î�¤`�s¥��g¬N¢j�sÅcÂA¯'3�¯ Ã2Ó`¬Ç¥cÓi¢jÄ+¦¡cÍ8�T¦�¢j��ØÉÖ:ª/Í!¥cÓiÍJ¡T¡g¢8ÃÝ¬N�Ò�gÓs¦�Ðs�`¬½�g¦�Åd�TÍ8�T¦tÈvÍ!¥cÓ`¬½�s¦t£C¬ÇÍJ®!¡TÍjÈx¬ÇÅ/�TÓ`¦��NÍj§6¦�½N¦�£§:©ÁÍÉ¡g¦�NÍJ�g¬N¢j��º4¢j¡/Î�¤`�s¥A�T¬½¢!�6Â/Î�¡g¢!È43�¯ �TÓ`¦ÏÅg¦�ö ¤`¦��s¥�¦DÅ�¢jÎ_Å��cÍ8�T¦��g¡cÍJ�6Åd¬½�g¬N¢j�sÅ/¬½�i�gÓ`¦tÈvÍj¥cÓ`¬N�`¦t£`¦��g¦�¡gÈÁ¬N�`¦��TÓ`¦Ä`¡T¢:¥¦�ÅTÅd¬N�`®$¢jÎX�gÓ`¦Ï£`Í8�cÍ$Åg¦��Íj�s£Á�TÓ ¤6Å��gÓs¦t¡T¦ÇÍ8�T¬½¢!�v¢j¡�Î�¤`�6¥A�g¬N¢j�|¥�¢!ÈnÄs¤C�g¦D£XÖ Ü�Ós¦t£`ÍJ�TÍ$Åg¦��52 ¥ÍJ��¥�¢j� �cÍJ¬N�¬½�`Î�¢j¡TÈÁÍJ�g¬N¢j�PÍj§6¢!¤C��gÓs¦$¬½� �T¦¡T�sÍJ_Èn¦�ÈÁ¢j¡T©i¢JÎ�ÍÒÅg©CÅ��T¦È ÍjÅ2Ã�¦N_Í!Å�£C¬½þ+¦�¡g¦�� tÅd¢!¡d�cÅ2¢JÎ�¢!¤C�gÄ`¤`�t§+¦ÓsÍ�Õ:¬N¢j¤`¡Åd¢v¬½��¬ÇÅ2Ä6¢ ÅgÅg¬N§`½¦Ï�T¢vÈn¢C£C¦��Õj¦�¡g©i®j¦�s¦¡cÍJXÅd©CÅd�g¦�ÈÁÅ�¬N�PÍ��g¡cÍJ�sÅgÄsÍj¡g¦��!��Ã�Í�©jÖC�]� �g¡T¢C£C¤s¥�¦D£i§:©|ª�¬N½¦�� §+¦¡T®�ùÑÊ�æ�û¬½�«Ê�Ë6(�ès¯8Ø�ÔLÈvÍ!¥cÓ`¬½�s¦�Å/Íj¡g¦�Ä`¡g¢!Ä6¢ Åd¦D£Á§:©nÆ�¢jÇ¥�¢jÈ�§6¦nùÑÊDË8û<ÍjÅ/Í$§sÍjÅg¬NÅ�Î�¢j¡�Í$Ä+¢!ÅTÅd¬N§`N¦�ÅdÄ+¦�¥¬ÑÐ+¥Í8�T¬½¢!�ÒÇÍJ�`®!¤sÍJ®!¦ÍJ�s£¨Åg¬½�s¥¦É�TÓ`¦� Í�� ¤sÈÉ§+¦¡-¢JÎ/Î�¤`¡d�TÓ`¦¡-¬N�:Õj¦DÅ��T¬½® Í8�g¬N¢j�6Å�ÓsÍ�Õ!¦�£C¦�ÈÁ¢j�sÅd�g¡cÍ8�T¦�£��TÓsÍ8��TÓ`¦ÁÈn¢C£C¦��¬NÅ�¬N� �g¤`¬½�g¬NÕj¦ÍJ�s£|¦DÍjÅg©v�g¢Á¤sÅg¦vù æ`Ê�ûq¯�ù æJèJûq¯�ù æ��ûq¯�ùÑÊ �8ûqÖ× �:¤`ÈÉ§+¦¡2¢jÎ"¥�ÇÍjÅTÅg¦�Å�¢JÎ"Ø�ÔqÈÁÍ!¥cÓ`¬N�`¦�Å�ÓsÍ�Õ!¦t§+¦¦��¬N£C¦�� g¬½Ðs¦�£|ÍJ�s£|Åd�g¤s£C¬N¦�£ ù æCÊûL¯�ù æ7�JûLÖCÜ�© Äs¬N¥�ÍJN½©!¯:�gÓ`¦DÅd¦

¥�ÇÍjÅTÅd¦DÅ$ÍJ¡T¦i£C¦Ðs�`¦D£ § ©¨¡T¦�Åd�g¡T¬N¥��g¬N¢j�sÅ-¢!� �gÓ`¦�¤`�s£C¦�¡gN©:¬½�s®�£`Í8�cÍ�Åd¦�82 ÍJ�6£¨�gÓ`¦|Åd¦�É¢JÎ�§sÍ!Åd¬Ç¥ÁÄ`¡T¢C¥�¦�ÅTÅg¬½�`®¡g¦�NÍJ�g¬N¢j�sÅ«º�¢!¡ÒÎ�¤`�s¥��g¬N¢j�sÅcÂA¯13�¯�¢JÎ-�TÓ`¦�ÈvÍj¥cÓs¬½�`¦DÅÖ�×�ÈÁ¢j�s®lÍJN��TÓ`¦�Åg¦j¯��gÓs¦«¥�ÇÍjÅTÅÒ¢jÎv¹AÙ\¿g¸c³J²ä°$±]²Á³!´TµC¶V·+¸�¹º��:Ø9��Â/ÓsÍjÅ/¡g¦D¥�¦¬NÕj¦D£��gÓ`¦tÈn¢ Å��Í8�d�T¦� �g¬N¢j��Ö;:�Íj¡d�T¬N¥¤`NÍj¡��©:Ä6¦DÅ�¢JÎ<�CØ#�PÅ�¯!Ó6Í�Õ ¬N�`®$Åd�TÍ!¥cü:Å�ù æ!æ�ûq¯j¢j¡�Åd¦Dö ¤`¦�s¥¦�Å¢JÎ_Åg©:ÈÉ§+¢jÇÅ�ù �8ûXÍjÅ/Èn¦�ÈÁ¢j¡T©j¯ ¢j¡/¢!¤C�gÄs¤C��Åg¦�ö ¤`¦��s¥�¦DÅ�¬N�sÅd�g¦�Í!£v¢JÎ"Åd¬N�`®jN¦�¢!¤C�gÄ`¤`��Åg©:ÈÉ§+¢jÇÅ�ù æ�ûq¯!ÓsÍ�Õ!¦�ÍJÇÅg¢$§6¦�¦�¥�¢!�sÅd¬Ç£C¦�¡g¦D£XÖÜ�Ó:¤sÅ=�CØ#�PÅ"ÍJ¡T¦�®j¦��`¦¡cÍJN¬ÇÅgÍJ�g¬N¢j�sÅX¢jÎCÐs�`¬½�g¦�Å��cÍ8�g¦�ÈvÍj¥cÓ`¬N�`¦�Å�¯�Åd¬NÈÁ¬½ÇÍJ¡��g¢�¦ÿ:�g¦�6£C¦�£�Ð6�`¬Ñ�T¦�Åd�TÍJ�g¦�ÈÁÍ!¥cÓ`¬N�`¦�Å

º4ª>�&�'��Â�ù æjË8ûq¯2ù ËJûLá�Ó`¦�¡g¦!¯��gÓ`¦�Õ8ÍJ¡T¬ÇÍJ§`N¦�ÅÁÍJ¡T¦|¡g¦�Ä`NÍ!¥�¦D£ §:© Í¨Èn¦�ÈÁ¢j¡T© ÍJ�s£��gÓ`¦�Åg¦��cÅÁ¢JÎtÄs¡g¦D£C¬N¥�Í8�T¦�ÅÁÍJ�s£ÍjÅTÅd¬N®j�sÈn¦�� TÅ2ÍJ¡T¦Ï¡g¦�Ä`NÍ!¥�¦D£i§:©iÍvÅg¦��2¢JÎ�Ä`¡T¢C¥�¦�ÅTÅg¬½�`®n¡T¦ÇÍ8�g¬N¢j�6ÅÏº4¢j¡�Î�¤`�6¥A�g¬N¢j�6ÅTÂ�Ö× �T¦�Åd�g¬N�`®tÅd�g¡cÍ8�T¦®!©tÎ�¢!¡"Åg©CÅ��T¦ÈvÅ"ÅdÄ+¦�¥¬ÑÐs¦D£-§:©$Å��T¡g¦DÍJÈ Ø�ÔqÈvÍj¥cÓ`¬N�`¦�Å_ÓsÍ!Å_ÍjNÅg¢�§+¦¦��£C¦�Õj¦N¢jÄ+¦�£iù æ��8ûq¯ ù æ7 JûL¯

ù æ`Ê�ûqÖ�Æ�¦�¡g¦!¯�Íi�:¤`È�§6¦�¡-¢JÎ/�T¡TÍj�sÅg¬Ñ�T¬½¢!�¨Íj¡g¦n®j¡T¢j¤`Ä+¦�£�¬½� �T¢|Äs¡g¢C¥�¦DÅgÅg¬N�`®�¡T¦ÇÍ8�T¬½¢!�sÅÁº�¢!¡tÎ�¤s�s¥A�T¬½¢!�sÅTÂ�Íj�s£��gÓ`¦DÅd¦ÍJ¡T¦$ÍjÅTÅd¤sÈn¦D£Ò�T¢v§6¦É¬½ÈÁÄ`N¦ÈÁ¦� �T¦�£�¥�¢!¡g¡T¦�¥��gN©jÖCÜ�Ó:¤sÅ�¯C�g¦DÅ��T¬½�`®Á�TÓ`¦8�:Ø9�ä¡g¦D£C¤s¥¦�Å��g¢Á�T¦�Åd�g¬N�`®v¬½�TÅ2�T¡TÍj�sÅg¬Ñ�T¬½¢!�£C¬ÇÍJ®j¡cÍJÈ º��gÓ`¦vÍ!ÅgÅg¢C¥�¬ÇÍ8�g¦D£l³ �CÙ �J²Á³JÙ �J·|¢jÎ/�TÓ`¦vÅ��T¡g¦DÍJÈ*Ø�ÔqÈvÍj¥cÓ`¬N�`¦�ÂAÖ�Ü�Ó`¦Á¥�¢!¡g¡T¦�¥��g�`¦DÅgÅt¢JÎ��gÓ`¦ÁÄ`¡T¢C¥�¦�ÅTÅg¬½�`®¡g¦�NÍJ�g¬N¢j�sÅ�º�¢!¡�Î�¤`�s¥��g¬N¢j�sÅcÂ�¬NÅÏ¥cÓ`¦�¥cü!¦�£|§:©�ÍÒÅd¦�ÄsÍJ¡cÍ8�T¦$Ä`¡T¢C¥�¦�ÅTÅ�ás£C¦Ä+¦�6£C¬½�s®�¢!��gÓ`¦��sÍ8�T¤`¡g¦�¢JÎ��TÓ`¦É¡T¦ÇÍ8�T¬½¢!�º�¢!¡�Î�¤`�6¥A�g¬N¢j�+ÂA¯<�gÓs¦�Åg¦n¥�ÍJ�P§+¦É�T¦�Åd�g¦D£P¤sÅg¬½�s®Ò�gÓs¦nÅTÍJÈÁ¦ÉÈÁ¦�gÓ`¢C£P¢!¡ÏÍjÑ�T¦¡T�sÍ8�T¬½Õ!¦-Î�¤`�s¥��g¬N¢j�sÍj�Èn¦�gÓ`¢C£`ÅÁù æCÊûL¯ù æJèJûqÖ�s¤`¡d�TÓ`¦¡TÈÁ¢j¡T¦j¯C�TÓ`¦$ÈÁ¦��TÓ`¢C£P¥Íj��¢j�`N©�§+¦ÉÍjÄ`Ä`N¬½¦D£�¬ÑÎ��TÓ`¦$Ä`¡T¢C¥�¦�ÅTÅg¬½�`®v¡T¦ÇÍ8�T¬½¢!�sÅ$º4¢j¡2Î�¤`�6¥A�g¬N¢j�6ÅTÂ�Èn¦�¦��Åd¢!ÈÁ¦|ý!£C¦�Åg¬½®!��Î�¢j¡n�T¦�Åd�Á¥¢j�s£C¬½�g¬N¢j�6Ågýs¯"¥¢jÈÁÄ`N¦��g¦��`¦�ÅTÅnÍJ�s£�¢j¤C�TÄ`¤C�dÔ]£C¬ÇÅ��T¬½�s®j¤`¬ÇÅdÓ6ÍJ§`¬N½¬½��©jÖ�Ü�Ó`¦|ÈÁ¦��TÓ`¢C£�Ã�ÍjÅÐs¡cÅ��$£C¦�Õj¦N¢jÄ+¦�£«¬N��TÓ`¦v¥�¢j� �T¦�ÿ:�-¢JÎ�£`¦��g¦�¡gÈÁ¬N�`¬ÇÅ��T¬N¥ÁÅd�g¡T¦�ÍJÈ*Ø�ÔLÈvÍ!¥cÓ`¬½�s¦�ÅÁù æ��8û�ÍJ�6£P�TÓ`¦�¨¦�ÿ:�g¦��s£C¦D£��T¢i�TÓ`¦�`¢j�`Ôq£C¦�g¦�¡gÈÁ¬N�`¬NÅd�g¬Ç¥-¥Í!Åd¦�¥�¢!�sÅg¬N£C¦�¡g¬N�`®n�g¦DÅ��2Î�¢!¡2¦�ö ¤`¬NÕ8ÍJN¦�s¥¦Áù æJúJû�¢j¡2¥�¢!�CÎ�¢j¡TÈvÍJ�s¥¦vùÑÊDÌ8ûqÖ× ¡g¦D¥�¦� ��ÄsÍJÄ+¦¡-ù æ�(�û<®!¦�`¦�¡TÍj½¬ÇÅg¦�Å/�gÓ`¦Ï¦�ÿC¬ÇÅ��T¬½�`®vÅd�g¡T¦�ÍjÈõØ�ÔLÈvÍ!¥cÓ`¬½�s¦t�T¦�Åd�g¬N�`®��gÓ`¦�¢j¡T©v¬½�|ÈÁ¢j¡T¦��TÓsÍJ��¢j�`¦

Ã�Í�©!Ö-�_¬N¡cÅ��T½©!¯X¬Ñ�$¥�¢!�sÅg¬N£C¦�¡TÅ��gÓs¦v®j¦�s¦¡cÍJ"Ø�ÔqÈÁÍ!¥cÓ`¬N�`¦�ÈÁ¢C£C¦��ÍJ�s£¨Åd¦D¥�¢!�s£CN©j¯+�gÓ`¦Á¡T¦�Åg¤`½�TÅÏÄ`¡T¢8Õj¦�£�¥ÍJ�¨®j¬NÕj¦¡g¬ÇÅg¦��g¢v��Ã�¢Ò£C¬ÇÅ��T¬½�s¥��g¦DÅ��T¬½�s®iÅ��T¡TÍJ�g¦�®j¬N¦�Å�Ö`Ü�Ó`¦�Åg¦$¡T¦�Åg¤`Ñ�cÅ�ÍJ�6£i�TÓ`¦¬N¡t¥¢j¡T¡g¦DÅdÄ+¢j�6£C¬½�s®��T¦�Åd�g¬N�`®iÅd�g¡cÍ8�T¦®j¬N¦�Å2Íj¡g¦�gÓ`¦�� ÄsÍj¡d�T¬N¥¤`NÍj¡g¬ÇÅg¦�£«�g¢��TÓ`¦�Åd�g¡T¦�ÍjÈ Ø�ÔqÈvÍj¥cÓ`¬N�`¦Ò¥NÍ!ÅgÅ�Ö ó �`¦v¢jÎ��gÓ`¦DÅd¦iÅd�g¡cÍ8�T¦®!¬½¦DÅ-¬NÅ�Í�ÅdN¬N®jÓ �gN©¨Åd�g¡T¢j�s®j¦¡Î�¢j¡TÈÚ¢jÎ��gÓs¦-¡g¦DÅd¤`½��®j¬NÕj¦��i¬N��ù æ��8ûqÖÆ�¢8Ã�¦Õ!¦¡D¯X�gÓ`¬ÇÅ�®j¦�s¦¡cÍJN¬��DÍ8�g¬N¢j�¨¬ÇÅÉ¢!�`½© ÍJ¬NÈÁ¦�£ ÍJ��?j¸Ù]¸�¿A²n¶V·s¶Ç¹AÙL¶4´ÉØ�ÔLÈvÍ!¥cÓ`¬½�s¦�Å�Ö ó ��TÓ`¦i¢j�gÓ`¦�¡ÉÓsÍj�s£X¯

�gÓ`¦�¡g¦�¬NÅÏÍvÄ`¡cÍj¥��g¬Ç¥Íj��`¦�¦�£�Î�¢!¡��g¦DÅ��T¬½�s®�· �J·s±@?!¸�Ù]¸�¿A²n¶V·s¶Ç¹AÙL¶4´�ÈÁ¢C£C¦�NÅ�ÖBA�¢j�CÔ]£C¦�g¦¡TÈÁ¬½�s¬NÅgÈ*ÍJ�s£�¥¢j�s¥¤`¡g¡T¦�6¥�©

36

ÍJ¡T¦$��Ã�¢i¬NÈÁÄ6¢!¡d�cÍJ� ��Î�¦DÍ8�g¤s¡g¦DÅ�¢jÎ�Î�¢j¡TÈvÍJ�ÅdÄ+¦�¥¬ÑÐ6¥�Í8�T¬½¢!�PNÍj�`®j¤6ÍJ®j¦DÅ2Î�¢!¡Ï¥¢jÈÁÈÉ¤`�s¬N¥�Í8�g¬N�`®|Åd¢jÎV��Ã�Íj¡g¦!¯s¬N��ÄsÍj¡dÔ�g¬Ç¥�¤`ÇÍJ¡-¥¢jÈÁÈÉ¤`�s¬N¥�Í8�g¬N¢j��Ä`¡g¢j�g¢C¥�¢!NÅ�Ö6×�½�ÈvÍ8ô�¢!¡tÅgÄ6¦D¥�¬½Ð6¥ÍJ�g¬N¢j�«NÍj�`®j¤sÍj®j¦DÅ�Î�¢j¡�¥�¢!ÈnÈ�¤`�`¬Ç¥ÍJ�g¬N¢j��Åg¢JÎV��Ã�ÍJ¡T¦-Ô¦jÖ ®sÖ�� ó Ü ó �Pù Ì8ûq¯ �Cå�� ù ��û<Ô/Åg¤`Ä`Ä+¢j¡g�2�`¢j�CÔ]£C¦�g¦¡TÈÁ¬½�s¬NÅgÈ�Ö'��¢j¡T¦¢8Õ!¦¡D¯!ÍnÅd©CÅd�g¦ÈÚ¢JÎ"¥¢jÈÁÈÉ¤s�`¬N¥�Í8�T¬½�`®Á£C¦�g¦¡gÔÈÁ¬½�`¬ÇÅd�g¬Ç¥-Ø�ÔqÈvÍj¥cÓ`¬N�`¦�Å�ÈvÍ�©ÒÓsÍ�Õ!¦��`¢j�CÔ]£C¦�g¦¡TÈÁ¬½�s¬NÅd�g¬Ç¥Ï§6¦�ÓsÍ�Õ:¬½¢!¤`¡-ù èjûLÖÜ�Ó`¬ÇÅ2ÄsÍJÄ+¦¡2®!¦�`¦�¡TÍj½¬ÇÅg¦�Å��gÓ`¦DÅd¦-¡T¦�¥¦� ��¡T¦�Åg¤`Ñ�cÅ��g¢Á�TÓ`¦-�`¢j�`Ôq£C¦�g¦�¡gÈÁ¬N�`¬NÅd�g¬Ç¥-¥Í!Åd¦!Ö`Ü�Ó`¦-®j¦��`¦¡cÍJN¬ÇÅgÍJ�g¬N¢j�i¬ÇÅ

�`¢j�`Ô\�T¡g¬NÕ:¬NÍj�ÍJ�s£|¬½�t¥Íj��¥�¢jÄ+¦-Ã2¬½�gÓPÍJNX��©:Ä+¦�Å�¢jÎ"�s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅgÈ �gÓ6Í8�t¥�ÍJ��§6¦$Î�¢j¤`�s£�¬N��ÍJ��Ø�ÔqÈvÍj¥cÓ`¬N�`¦ÈÁ¢:£`¦LÖ�Ü�Ós¦«ÄsÍjÄ6¦�¡�¬ÇÅ�Å��T¡g¤6¥A�g¤s¡g¦D£ ÍjÅiÎ�¢jN½¢8Ã�Å�á�Åd¦D¥A�g¬N¢j� æ ¥�¢!� �TÍJ¬N�sÅ|¥�¢!�s¥�¦�ÄC�TÅiÎ�¡g¢!È �&�'�&�gÓs¦¢j¡T© ÍJ�s£�� g¦�Åd�g¬N�`®�`Åd¦D¥A�g¬N¢j� �n¬½� �T¡g¢C£C¤s¥¦�Å��gÓs¦Òº��`¢!�CÔq£`¦��g¦�¡gÈÁ¬N�`¬ÇÅ��T¬N¥DÂ/Ø�ÔLÈvÍ!¥cÓ`¬½�s¦ÏÈÁ¢C£C¦��ÍJ�s£�¡g¦�NÍJ�g¦D£i¥�¢!�s¥�¦�ÄC�TÅ��Åd¦D¥A�T¬½¢!�sÅ�ènÍj�s£ �ÉÄ`¡T¦�Åg¦� ��TÓ`¦Ï��Ã�¢É�g¦DÅ��T¬½�`®vÅd�g¡cÍ8�T¦®j¬N¦�Å�ÍJ�s£i�gÓs¦Ï¥¢j¡T¡g¦DÅdÄ+¢j�s£`¬½�`®É�gÓ`¦�¢j¡T¦��T¬N¥�ÍJ<¥�¢j�6¥�¦Ä`�TÅ�ÍJ�s£¡g¦DÅd¤sÑ�cÅ��8�TÓ`¦�Åg¦�Íj¡g¦��gÓs¦�vÄsÍj¡d�T¬N¥¤`NÍj¡g¬ÇÅg¦�£É�g¢-�TÓ`¦�Åd�g¡T¦�ÍJÈxØ�ÔqÈÁÍ!¥cÓ`¬N�`¦�¥�ÇÍjÅTÅ�¬N�ÒÅd¦D¥A�g¬N¢j�vús¯8Ðs�sÍj½N©�¥¢j�s¥½¤sÅg¬N¢j�sÅÍJ¡T¦-£C¡TÍ�Ã2�|¬N��Åg¦�¥��g¬N¢j��(:Ö

� �vòdë�ò�ì��!ì�_ì��ñ� �ògë�� ñ<î/ë�ñ��ì��

Ü�Ó`¬ÇÅnÅg¦�¥��g¬N¢j��£`¦�Ðs�`¦DÅ$�TÓ`¦�³��CÙ �8²v³8Ù �8·�¢!¡i¿g¸c´ �TÀJ·6¶��¸¿ÉÍj�s£ �gÓs¦ � ·s¶VÙ]¸Ò¹AÙ]³8Ù]¸|²Á³!´TµC¶V·+¸|ù æJÌ8û2ÍJ�6£�Ä`¡T¦�Åg¦� �TÅ¡g¦�NÍJ�g¦D£�¥¢j�s¥¦ÄC�cÅ�ÍJ�s£�¡T¦�Åg¤`Ñ�cÅ��gÓsÍJ��Ã2¬½N�§+¦-¤sÅg¦�£�NÍJ�g¦¡2¬N�|�gÓ`¦-Ä6ÍJÄ+¦¡DÖø�¦�Î�¢j¡T¦�Ã�¦�®!¢�ÍJ�:©�Î�¤`¡g�gÓ`¦�¡�¯�Ã�¦�¬N� �g¡T¢:£`¤s¥�¦��TÓ`¦��`¢J�cÍ8�T¬½¢!�Ý¤6Åd¦D£l¬N�Ý�gÓ`¬ÇÅÒÄ6ÍJÄ+¦¡DÖ0� Ó`¦� ¥¢j�sÅg¬N£`¦¡T¬½�`®

Åd¦Dö ¤`¦�s¥¦�Å�¢JÎ�¬½�sÄ`¤C�TÅ�¢j¡�¢!¤C�gÄs¤C�TÅ�Ã�¦$Ã2¬NN�¤sÅg¦��g¢i£`¦�`¢j�g¦-�TÓ`¦ÉÅg¦��¢jÎ"Ð6�`¬Ñ�T¦�Åg¦�ö ¤`¦��s¥�¦DÅ2Ã2¬Ñ�TÓ�ÈÁ¦ÈÉ§+¦¡cÅ¬½��$Ö�� Ã2¬N½�£C¦�s¢J�g¦Ò�gÓ`¦�¦ÈÁÄC��© Åd¦Dö!¤s¦�s¥¦iÍJ�s£�� !#"$��%'&<�s¢j¡)(�*,+.-/��J¯0(�+nÃ2¬N½�£C¦�`¢j�g¦v�TÓ`¦¥�¢!�s¥ÍJ�g¦�6Í8�g¬N¢j��¢JÎ/Åg¦�ö ¤`¦�6¥�¦�Å�(�ÍJ�s£1+�ÖB�s¢j¡324*,5768��j¯�295:��"$(;+)<;(=->24*,+3-�5?% ÖB�s¢j¡ÏÍÒ�`¢!�CÔL¦�ÈÁÄC��©Åd¦Dö ¤`¦�s¥¦9()�#(�@A&B&B&C(ED�Ã2¬½�gÓF(�@G*B&H&B&B*I(;DJ-F��K*MLONzÊ'*�PGQR(EPCºS(CÂT�#(;Di£C¦��`¢J�T¦�Å��TÓ`¦-¡g¬N®jÓ �TÈn¢ Å��¦N¦ÈÁ¦��!�2¢jÎ�gÓ`¦$Åg¦�ö ¤`¦��s¥�¦��PGQ$('PCºU�6Â�¬ÇÅ2¤`�6£C¦�Ðs�s¦�£XÖ

�`¢!¡|Í�¡T¦ÇÍ8�T¬½¢!��º�¢!¡|Í�ÄsÍJ¡g�g¬ÇÍJ�Î�¤`�s¥A�T¬½¢!�6ÂWV áX�ZY?[]\i¯�£C¢!È�ºVÎTÂ|£C¦��`¢J�T¦�Åi�gÓ`¦¨£C¢jÈvÍJ¬N� ¢jÎ-Î�Ö5�s¢j¡2�6_Ê`$a¨ºUVXÂA¯�V�ºb2-Âc�8"G+X<ed�(f-=2�Ã2¬Ñ�TÓF(�Vg+R%E&��`¢j¡��Ã�¢�º�ÄsÍj¡d�T¬NÍjÇÂ�Î�¤`�s¥��g¬N¢j�sÅhV�áK��!i[j\f*;kiáK\l!�[jm�*k9noV�áK�p!�[jmx¬NÅ�ÍÉÎ�¤s�s¥A�T¬½¢!��£`¦�Ðs�`¦D£|§ ©fkXn4V�ºS(CÂT�qk<ºUV�ºS(CÂdÂTrg(s-t�3&

�`¢!¡�ÍÉÐ6�`¬Ñ�T¦$Åd¦�h�3*vuB('PG^+ºS�ÏÂ2£C¦�s¢J�g¦DÅ��gÓs¦-� ¤sÈÉ§+¦¡2¢JÎ"¦N¦ÈÁ¦� �cÅ2¢JÎA�3&w�7Ex�9_=4;�=\3698y+�9zt·iÍj¤C�g¢!ÈvÍ8�g¢!��¶Ç¹É³Á¹|{�¹AÙq¸²��#�xºU}.*,~?*C�4*I��'*M�tÂX�_µs¸�¿T¸H�}.*I~?*C� ³J¿g¸vÙ�µ`¸ � ·s¶VÙ]¸n¹¸Ù � � ¬N�`Ä`¤C�cÅ¯�Åd�TÍJ�g¦DÅÒ³8·B?ÁÐs�sÍJ�Åd�TÍJ�g¦DÅ¯��l6�~�� ¶Ç¹ÁÙVµs¸��`¦ÿ �$Åd�TÍJ�g¦ � �C·+´ÙL¶ �8·��xá;~��t}�!i[�æe��*�³J·B?3� � -=~ ¶Ç¹�Ù�µ`¸�¬N�`¬Ñ�T¬NÍj�Åd�TÍ8�T¦E�

�`¢!¡Á�gÓ`¦��T¦�Åd�g¬N�`® Ä`¤`¡TÄ6¢ Åd¦DÅvÍJN��gÓ`¦�Åd�TÍ8�T¦�ÅvÍj¡g¦|Ðs�sÍj�Å��cÍ8�T¦�Å�¯��~Á¯�ÍJ�s£��gÓ:¤sÅn�TÓ`¦PÅd¦�s� Ã2¬N½2§+¦¬½®!�`¢j¡T¦�£�Ö� �JÙq¸)�K��]�i®!¦�`¦�¡TÍj\¯ ÍJ��Íj¤C�g¢!ÈvÍ8�g¢!�ÒÈvÍ�©v§6¦n· �J·s±@?!¸�Ù]¸�¿A²n¶V·s¶Ç¹AÙL¶4´�¬½�i�gÓ`¦�Åg¦�sÅg¦��TÓsÍ8��Î�¢j¡�¦DÍj¥cÓiÅd�TÍJ�g¦X�$ÍJ�s£¬½�sÄ`¤C�)��gÓs¦¡T¦ÒÈvÍ�©P§6¦iÈn¢!¡g¦Á�TÓsÍJ� ¢!�`¦v�`¦�ÿ:��Åd�TÍJ�g¦!Ö�×�� Íj¤C�g¢!ÈÁÍJ�g¢!�«¬ÇÅ$¥Íj½N¦�£ ?!¸�Ù]¸�¿A²n¶V·s¶Ç¹AÙL¶4´$¬½Î��Ú¬ÇÅ$Íº�ÄsÍj¡d�T¬NÍjÇÂ�Î�¤s�s¥A�T¬½¢!�F�÷á'~��=}�!i[�~?&w�7Ex�9_=4;�=\369/��X� � �;*C�G��-t~?*��-�} ³8·"?3�G��-W�vº��;*C��Â��/¸-¹³G{vÙ�µ`³JÙ0�?¶Ç¹�³J·iÍJ¡c¥ � ¿��J²��Ù �3�G��³8·"?s��¿A¶VÙ]¸�Ýá��s[��G��&�� ;*C�G�T-�~ ³8¿T¸n¹��s´Tµ«Ù�µ`³JÙ2ÙVµs¸�¿g¸i¸C�!¶Ç¹AÙT�R@G*B&H&B&B*I�BD � @�-�~?�0L_N ��o��¶VÙ�µW�R@��;*��HD � @9��G�³8·"?s�v�tái�H�o[��B� � @ � �J¿v³J¼V¼�Êf�� 8L�*¡�/¸n¹³G{�Ù�µ`³8Ù��/¸Éµ`³ �¸|³ÁÄsÍJ�gÓ>¢s��i@0&H&B&C��D � ¿��8²£��Ù �s� � ³J·B?��¿A¶VÙq¸�¢�á��J[��G��&&� �8¿9�F-¤~?*�¥o¦��:"$¢.-�}s�.<�d;Pt-_~ ¹ �sćµ�Ù�µ`³JÙA¢�á��J[�PE%�¶Ç¹Òć³8¼V¼½¸ ?PÙVµs¸-ÇÍJ�`®!¤sÍJ®!¦Íj¥�¥�¦Ä`�g¦�£�§:©W�Û¬½�=�� B��Ù�µ`¸·W¥o¦v¶Ç¹-¹A¶V² �+¼§{�´T³J¼V¼½¸ ?�ÙVµs¸É¼N³8· À �s³À ¸�Íj¥�¥�¦�ÄC�g¦D£�§:©F� ³J·B?i¶Ç¹8?j¸· �JÙq¸ ?¾�{�¥T¨4�Ü�Ã�¢�ÍJ¤`�g¢jÈvÍJ�TÍW�õÍj�s£O�h��ÍJ¡T¦Á¥ÍJNN¦�£�2)!2¦�ö ¤`¬NÕ8ÍJN¦� ��¯�2£6�}s��¬½Îo¥ ¨=© 2:��¥ ¨gªi© 2«&+�qÎ�2:��}s�

�gÓ`¦��=�ÛÍJ�s£W�h��ÍJ¡T¦�¥�ÍJN½¦D£i¦Dö ¤`¬½Õ8Íj½¦��!�DÖw�7Ex�9_=4;�=\369¬��9z Ðs�`¬½�g¦$Åd�TÍ8�T¦�ÈÁÍ!¥cÓ`¬N�`¦vº��ÂÉ¶Ç¹É³Á¹|{�¹AÙq¸²l®¯��ºb}.*I°)*,~?*C�4*,�6Â��_µ`¸¿g¸R�}.*I°)*,~ ³J¿g¸ � ·6¶VÙq¸��· �8·6±d¸�² �+ÙU{Ò¹¸Ù4¹�� ¬N�`Ä`¤C�cÅ¯<¢!¤C�gÄ`¤`�TÅÒ³8·"?ÁÅ��cÍ8�T¦�Å�¯"¿T¸A¹ �s¸T´ÙL¶ �¸¼§{$±c� ¶Ç¹ÉÙ�µ`¸-�`¦�ÿ:�ÏÅd�TÍJ�g¦� �C·+´Ù\¶ �J·¨³8¹�¶V·F²�¸ � ·6¶VÙ\¶ �J·O��³8·B?��á'~��=}l!i[�°)*"¶Ç¹-Ù�µ`¸�¢j¤C�TÄ`¤C�2Î�¤`�6¥A�g¬N¢j�0�w�7Ex�9_=4;�=\369q³_�.´�¶ 8¸�·�³�¹¸Ù � � ¶V·�� CÙ�¹¸,µ �s¸�·<´T¸�¹�276�}s�G*�Ù�� i¹AÙ]³8Ù]¸A¹T¶�*C�¨³8¿g¸vć³8¼V¼N¸ ?.2)!É¸,µ �C¶ 8³8¼½¸·sÙ2¶ �¶Ý³J·B?3��¿T¸A¹ � �8·B?f��¶VÙVµP¶�?j¸·sÙL¶4ć³8¼ ��CÙ � �CÙ�¹¸,µ �s¸�·<´T¸�¹�Ù ��¸T³!´Tµ�¶V·�� CÙ/¹¸,µ �s¸·+ć¸$¶V·F24&

37

Ü�Ã�¢ ��PÅ¡®�Íj�s£)®��sÍJ¡T¦�¥�ÍJN½¦D£?2?!2¦�ö ¤`¬NÕ�Íj½¦�� ¯'2�6}s��¬½Î<�gÓ`¦�¬½¡�¬N�`¬½�g¬ÇÍJ+Å��cÍ8�g¦DÅ�ÍJ¡T¦h2)!2¦�ö ¤`¬NÕ8ÍJN¦� ��ÖÜ�Ã�¢ ��PÅ�ÍJ¡T¦Ï¦Dö ¤`¬½Õ8Íj½¦��!�2¬½Î_�TÓ`¦©|ÍJ¡T¦�2)!2¦�ö ¤`¬NÕ8ÍJN¦� ��Î�¢!¡�ÍJ�:©iÅg¦��2�¢JÎ�¬½�sÄ`¤C��Åg¦�ö ¤`¦�6¥�¦�Å�Ö

�«¦��`¢8Ã��T¤`¡T�v¢j¤`¡/ÍJ�d�T¦� �g¬N¢j�n�g¢8�&�'� �g¦�Åd�g¬N�`®ÉÍj�s£n¬½�vÄ6ÍJ¡g�g¬Ç¥�¤`ÇÍJ¡��T¢-�gÓ`¦�®j¦�s¦¡cÍ8�g¬N¢j�n¢JÎ<�T¦�Åd��Åd¦Dö ¤`¦�s¥¦�ÅÎ�¡g¢!È Í8�� ÅgÄ6¦D¥�¬½Ð6¥ÍJ�g¬N¢j��Ö��¦�2¤sÅ�¥�¢j�6Åd¬Ç£C¦¡��gÓs¦�Íj¤C�g¢!ÈvÍ8�g¢!�iÍjÅTÅg¢:¥¬NÍJ�g¦D£vÃ2¬Ñ�TÓ|Íj�iØ�ÔLÈvÍj¥cÓs¬½�`¦Áº4Åg¦¦�A�¢j�g¦�!Â�Ö�Ü�Ó`¬ÇÅ$ÍJ¤C�T¢jÈvÍ8�T¢j�¨¬NÅÉ£C¦��T¦¡TÈn¬N�`¬ÇÅ��T¬N¥j¯�§`¤C��¬½� ®j¦��`¦¡cÍJ��s¢J�É¥�¢!ÈÁÄ`½¦�g¦�½©�ÅgÄ+¦�¥�¬½Ðs¦D£XÖ_Ü�Ó`¦Á�T¦�Åd�g¬N�`®��gÓs¦¢j¡T©§sÍjÅg¦�£�¢!��PÅ�¯s�TÓsÍ8��¬N� �g¦�¡g¦DÅ��cÅ�¤sÅ�¯6£C¦DÍJÇÅ�¬N�P®j¦��`¦¡cÍJ�Ã2¬Ñ�TÓ��&�'�PÅt£`¦��g¦�¡gÈÁ¬N�`¬ÇÅ��T¬N¥j¯sÈÁ¬½�s¬½ÈvÍJL¯<¥�¢jÈÁÄ`N¦��T¦N©ÅdÄ+¦�¥¬ÑÐ6¦�£�Íj�s£�¡T¦�Î�¦�¡TÅ��g¢�Íj�P¦�ö ¤`¬NÕ8ÍJN¦�s¥¦É¡T¦ÇÍ8�T¬½¢!�sÅdÓs¬½Ä�§+¦��Ã�¦¦��ÅdÄ+¦�¥¬ÑÐ+¥Í8�T¬½¢!��ÍJ�6£�¬½ÈÁÄ`N¦ÈÁ¦��!�cÍ8�T¬½¢!��º4Åg¦¦ùÑÊ 8ûq¯_ù½Êèjû_ÍJ�s£�ù �!æ8û�Î�¢j¡ÏÍÁ¡g¦�Õ:¬½¦�Ã ¢!��&�'�ä�g¦DÅ��T¬½�`®:ÂAÖ+×�¥¥¢j¡c£C¬N�`®Á�g¢v�TÓ`¬ÇÅ2�gÓs¦¢j¡T©j¯s¢j�s¥¦$Ã�¦ÉÓsÍ�Õj¦-ÍÒÅgÄ6¦D¥�¬½Ð`Ô¥ÍJ�g¬N¢j�� Èn¢C£C¦�½N¦�£«ÍjÅtÍ �� Ã2¬Ñ�TÓP�gÓs¦nÍj§6¢8Õ!¦$Ä`¡T¢jÄ+¦¡g�g¬N¦�Å�Ã�¦nÈÁÍ�©�¥�¢!�sÅd�g¡T¤s¥A��ÍÒ�T¦�Åd�ÏÅg¦��2 ÍJ�s£�Ã2Ó`¦�ÍJÄ`Äs½¬N¦�£i�g¢��gÓ`¦�¬NÈÁÄ`½¦�ÈÁ¦� �TÍJ�g¬N¢j��Á¬NÅ�ÍJ§s½¦t�g¢nÐs�s£|ÍJN<¦¡T¡g¢!¡TÅ/¬ÑÎ_�gÓ`¦�¬NÈÁÄ`½¦�ÈÁ¦� �TÍJ�g¬N¢j��Á¬NÅ�ÍjÅTÅg¤`ÈÁ¦�£v�T¢�§+¦ÈÁ¢:£`¦N½¦D£¨Í!Å-Í �&�'��ù½Ê� JûL¯�ù½ÊèjûLÖ-�s¢j¡TÈÁÍj½N©P¬½Î�§+¢J�TÓ��zÍj�s£��ÍJ¡T¦�ÈÁ¢C£C¦NN¦�£ ÍjÅ��PÅ$Íj�s£¨ÅgÍJ�g¬ÇÅ�Î�©�Åg¢jÈÁ¦¥�¢!�s£C¬½�g¬N¢j�sÅ�¯jÅg¤s¥cÓvÍjÅ"�gÓs¢!Åg¦�Äs¡g¦�Õ ¬N¢j¤6ÅdN©$ÈÁ¦� �g¬N¢j�s¦�£X¯8�TÓ`¦�n�TÓ`¦©ÁÍJ¡T¦�¦�ö ¤`¬NÕ�Íj½¦�� ¬½þi�TÓ`¦©nÍJ¡T¦h2)!2¦�ö ¤`¬NÕ8ÍJN¦� ��¯Î�¢j¡�2 Í-�T¦�Åd��Åg¦��ÍjÅ�ÍJ§+¢8Õj¦jÖ�� Ó`¦��£C¦�Íj½¬N�`®ÉÃ2¬½�gÓ|ÍJ�ÒØ�ÔLÈvÍ!¥cÓ`¬½�s¦j¯!Íj�iÍJ¤`�g¢jÈvÍJ�g¢j�f��º��$Âtº4Åg¦¦9A�¢J�T¦9� Â�ÈvÍ�©§6¦tÍJNÃ�Í�©CÅ�£C¦Ðs�`¦�£�Ö��`¢!¡��Ã�¢-Ø�ÔLÈvÍ!¥cÓ`¬½�s¦�Å�� ÍJ�s£��9��*jÃ�¦�ÍJ¡T¦�¬½� �g¦�¡g¦DÅ��T¦�£n¬N�ÁÐs�s£C¬N�`®$Í-Åg¦��o2 ¢8Õj¦�¡�3T�e*!Åd¤s¥cÓ�gÓsÍJ��Ã2Ó`¦��`¦Õ!¦¡-�TÓ`¦¬N¡É¤s�s£C¦¡TN© ¬N�`®PÍj¤C�g¢!ÈÁÍJ�TÍt��º��$Â$Íj�s£ �Éº�9�ÇÂ$ÍJ¡T¦.2)!2¦�ö ¤`¬NÕ8ÍJN¦� ��¯�Åg¦¦ A�¢J�T¦�Å8�`¯X�TÓ`¦��gÓ`¦�©�¦�ö ¤`¬NÕ8ÍJN¦� ��Ö<Ü�Ó`¦¡T¦$ÓsÍ�Õ!¦$§+¦¦�«Åd¤`®!®j¦DÅ��T¦�£�Åg¢jÈÁ¦ÉÃ�Í�©CÅ2¢JÎ�®!¦��d�T¬½�s®�Í ��Î�¡g¢!È Íj��ÍJ¤`�g¢jÈvÍJ�g¢j� ù (DûqÖ×�¥�¥�¢j¡c£C¬N�`®��g¢�ù (Dû�Íj� ¬½�s¥¢jÈÁÄ`N¦��T¦N©«ÅgÄ6¦D¥�¬½Ðs¦�£ ÍJ¤`�g¢jÈvÍJ�g¢j�¨¬ÇÅ��g¡cÍJ�sÅdÎ�¢j¡TÈÁ¦�£«¬½� �T¢PÍ�¥�¢jÈÁÄ`N¦��T¦N©«ÅgÄ6¦D¥�¬½Ðs¦�£��§:© ¥¢j�sÅg¬N£`¦¡T¬½�`®�Î�¢j¡Á¦Õ!¦¡T©¨�g¡cÍJ�sÅg¬Ñ�T¬½¢!��¢jÎ��gÓ`¦�Íj¤C�g¢!ÈÁÍJ�g¢!��ÍJ�l¢j¤C�TÄ`¤C��Ê��"Î�¢j¡ÁÍJN��`¦ÃÚ�g¡cÍJ�sÅg¬½�g¬N¢j�sÅ¬½� �T¡g¢C£C¤s¥¦�£PÎ�¢j¡�ÈÁ¬NÅTÅd¬N�`®|¬½�sÄ`¤C�TÅ�Íj�s£P®!¢j¬N�`®Ò�T¢|Í|£C¦�Í!£�Åd�TÍJ�g¦j¯XÍj��¢j¤`�gÄ`¤C�% i¬NÅ�ÍjÅTÅg¢:¥¬NÍJ�g¦D£�Ã2¬Ñ�TÓ�Ö �`¢!¡��TÓ`¦¢j§C�cÍJ¬N�`¦�£,��¯�Ã2Ó`¬Ç¥cÓ�ÈÉ¤6Å��n§6¦�£C¦�g¦¡TÈÁ¬½�s¬NÅd�g¬Ç¥iÍj�s£ ÈÁ¬N�`¬½ÈvÍj\¯�Í��T¦�Åd�ÁÅg¦��J2 ÈvÍ�© §6¦|§`¤`¬N½�vÍ!¥¥¢j¡c£C¬½�s®�g¢�Í�®j¬NÕj¦��g¦DÅ��T¬½�`®�Åd�g¡cÍ8�g¦�®j©�ù½Ê� 8ûq¯�ùÑÊ�èJûqÖ-�`¤`¡g�gÓ`¦�¡�¢j��¯�2 ÈÁÍ�©�§+¦n¤sÅd¦D£P�T¢�Äs¡g¢8Õ!¦$�gÓs¦n¦Dö ¤`¬½Õ8Íj½¦��s¥�¦n¢JÎ��TÓ`¦��Ã�¢ÁÍJ¤`�g¢jÈvÍJ�TÍ�¡g¦�Ä`¡g¦DÅd¦�� g¬N�`®$�TÓ`¦�¤`�s£C¦�¡gN©:¬½�`®ÁÅd�TÍ8�T¦�ÈÁÍ!¥cÓ`¬N�`¦�Å�¢JÎ_�gÓ`¦-ÅgÄ6¦D¥�¬½Ð6¥ÍJ�g¬N¢j��Íj�s£�¬½ÈÁÄ`N¦ÈÁ¦� �cÍ8�g¬N¢j�Ø�ÔqÈvÍj¥cÓ`¬N�`¦�Å�Ö

� �$��ñv �ògë�� ñ<î/ë�ñ��ì��

Ü�Ó`¬ÇÅ�Åd¦D¥A�T¬½¢!��Ä`¡T¦�Åg¦� �cÅ��gÓ`¦-Ø�ÔLÈvÍj¥cÓs¬½�`¦�ÈÁ¢C£C¦_ÍJ�s£�¬½NN¤sÅ��T¡TÍJ�g¦DÅ�¬Ñ��Ã2¬½�gÓ�ÍJ��¦ÿCÍjÈÁÄ`½¦!Öw�7Ex�9_=4;�=\369��9zt·ÒØ�ÔLÈvÍ!¥cÓ`¬½�s¦Ò¶Ç¹É³Á¹|{�¹AÙq¸²��p�xº�2=*,~?* 34*I�4*C��'*CuG*I^v*,°)*C`JÂ��_µ`¸¿g¸R�� 2 ¶Ç¹É³ � � ��¹c¹A¶4¾�¼ {Ò¶V· � ·s¶VÙ]¸ �Á¹¸�Ù�ć³8¼V¼½¸ ?iÙVµs¸�£`ÍJ�TÍÁÅg¦�� ~ ¶Ç¹-Ù�µ`¸ � ·s¶VÙ]¸�Åg¦��¢jÎ"Åd�TÍJ�g¦�Å�� 3 ¶Ç¹-Ù�µ`¸$¹�¸Ù � � §sÍ!Åd¬Ç¥ÏÄ`¡g¢C¥¦�ÅTÅd¬N�`®n¡g¦�NÍJ�g¬N¢j�sÅB�/³ � ·6¶VÙq¸-¹¸�Ù � � �s³8¿AÙL¶4³8¼ � �C·+´Ù\¶ �J·`¹hVPá�2 Y?[ 2

� � ¶Ç¹-ÙVµs¸��s¦�ÿ:��Å��cÍ8�T¦ � �C·+´Ù\¶ �J·��³�� `³J¿AÙ\¶4³J¼ � � �C·+´Ù\¶ �J·J�÷áE~��3�!i[�æK�1�

� � � -F~ ¶Ç¹-Ù�µ`¸�¬½�s¬Ñ�T¬NÍj�Å��cÍ8�T¦e±� uÁ¶Ç¹-Ù�µ`¸tÅ��T¢jÄ`Ä`¬N�`®v¥�¢!�s£C¬½�g¬N¢j� � � �)��³ �<¿g¸ ?8¶4ć³8Ù]¸ �8· 2 �

� ^«¶Ç¹-ÙVµs¸2�T¦�Åd�g¬N�`®v£C¢jÈvÍJ¬N� � � �)��³ � �C·+´ÙL¶ �8·.^Òá�3_!�[�æ��Ú¹��s´Tµ�ÙVµs³8Ùgr�Vt- 3^+º�VXÂo6q^'`$a º�VXÂ �� ° ¶Ç¹-Ù�µ`¸�¢j¤C�TÄ`¤C��Åg¦�� `�¶Ç¹$Ù�µ`¸�¢j¤C�TÄ`¤C��Î�¤s�s¥A�T¬½¢!� � � �)��³ � �s³8¿AÙL¶4³8¼ � � �C·<´�ÙL¶ �8·W`ná�2j!i[ ° ��¶VÙVµJÊ`$a¨º�`JÂ��q^'`$a º�3�Â�*��_µ`¸¿g¸Ê`$a¨º�3�ÂT��^'`$a º�VXÂ

!�¢jÈÁÄsÍj¡g¦D£lÃ2¬½�gÓ �gÓ`¦«Ä`¡g¦�Õ:¬½¢!¤sÅi£C¦Ðs�`¬½�g¬N¢j� ¢jÎ$ÍJ� Ø�ÔqÈvÍj¥cÓ`¬N�`¦�ù æCÊûL¯/�gÓ`¦¨ÍJ§+¢8Õj¦P£C¦Ðs�`¬½�g¬N¢j� ¬N�s¥½¤s£`¦�ÅÅd¢!ÈÁ¦tÅgÄ6¦D¥�¬½Ð6¥�¦�½¦�ÈÁ¦� �TÅ�¬½� �T¡g¢C£C¤s¥¦�£ÁÎ�¢!¡/�T¦�Åd�g¬N�`®ÉÄs¤`¡gÄ+¢!Åg¦�Å�á:Å��T¢jÄ`Ä`¬N�`®n¥�¢j�6£C¬Ñ�T¬½¢!��ºSu�ÂA¯ �g¦DÅ��T¬½�`®n£C¢jÈvÍj¬½��º�^ Â�¯¢j¤C�TÄ`¤C��Î�¤`�s¥��g¬N¢j��º�`JÂ ��^�£`¦��g¦�¡gÈÁ¬N�`¦�Å/�gÓs¦t£C¢ ÍJÈvÍJ¬N�vÕ8ÍJN¤`¦�Å/¢JÎ�¦�Í!¥cÓvÄ`¡T¢:¥¦�ÅTÅd¬N�`®-Î�¤s�s¥A�T¬½¢!�v�gÓsÍJ��¥�ÍJ�Ò§+¦�¤sÅg¦�£¬½�Ò�g¦�Åd�g¬N�`®6¯'`Ï�gÓs¦�¢j¤`�gÄ`¤C��gÓsÍJ��¥Íj�v§6¦t¢j§sÅg¦¡TÕj¦D£X¯JÃ2Ó`¦�¡g¦DÍjÅcu�¡T¦ÄsNÍ!¥�¦�Å��gÓ`¦ÏÅd¦�/¢JÎXÐs�6ÍJ6Åd�TÍJ�g¦DÅ��gÓ6Í8�/¤sÅg¤sÍj½N©ÍJÄ`Ä+¦�Íj¡TÅ�¬N��Ä`¡T¦Õ:¬½¢!¤sÅ�£C¦�Ð6�`¬Ñ�T¬½¢!�sÅ2¢jÎ�Íj��Ø�ÔLÈvÍj¥cÓs¬½�`¦!Ö� �JÙq¸��E�#�`¢!¡/ÍJ�vØ�ÔLÈvÍj¥cÓs¬½�`¦�� Í!Å�ÍJ§+¢8Õj¦!¯K`Ï¬NÅ/¦�ÿ:�g¦��s£C¦�£n�T¢ÉÍ�Î�¡T¦¦ÔqÅg¦ÈÁ¬N®j¡T¢j¤`ÄnÈÁ¢j¡TÄ`Ó`¬ÇÅdÈ�`Éá�2O��!i[j°3�K&Ü�Ó:¤sÅf`Cº��+Ât� ��*�ÍJ�s£q`Cº� @ &H&B&! #"!Â.� `Cº� @ Â�&B&H&C`Cº� #"!Â|*�¶�N�Ê'&��]�?Ã2ÓsÍ8�vÎ�¢!½N¢8Ã�ÅÁÃ�¦�Ã2¬NN�¡g¦Î�¦¡v�T¢ �gÓ`¬ÇÅ¦�ÿ:�g¦��sÅg¬½¢!��Ö�q�$¬NÅÉÅd¢!Èn¦�g¬NÈÁ¦�Å-Ó`¦�½Ä`Î�¤`��T¢��gÓ`¬N�`ü¨¢JÎ2ÍJ� Ø�ÔqÈvÍj¥cÓ`¬N�`¦vÍjÅ$Íj��ÍJ¤C�T¢jÈvÍ8�T¢j�¨Ã2¬Ñ�TÓ �gÓ`¦ÒÍj¡T¥�Å�NÍj§6¦�½N¦�£¨§:©

Åd©:È�§6¢!NÅ�Î�¡T¢jÈ 3�Ö� �JÙq¸�$'�#�`¢!¡�Íj��Ø�ÔqÈÁÍ!¥cÓ`¬N�`¦%�xÍjÅ2Íj§6¢8Õ!¦j¯:�TÓ`¦i³�¹c¹ ��´¶4³8Ù]¸ ?�³ �CÙ �J²Á³JÙ �J·v¬NÅ«��º��$ÂT��º�34*,~?*C�4*I��8Â|&

38

»��:³8² �+¼½¸?�'�h��¦��¤sÅ�¬½ÈvÍj®j¬N�`¦ÏÍn¥�¢!ÈÁÄ`¤C�g¦�¡�Ä`¡g¢!®j¡cÍJÈõ�gÓ6Í8��¯CÃ2Ós¦��Åd¤`ÄsÄ`½¬N¦�£�Ã2¬½�gÓ�Í�Åd�g¡T¬½�s®n¥¢j� �TÍj¬½�`¬N�`®ÁÍJ�:©½¦�d�T¦¡D¯:£`¬½®!¬Ñ��ÍJ�s£Á�TÓ`¦�§sNÍj�`üv¥cÓsÍJ¡cÍj¥��g¦¡D¯j¥¢j¤`� �TÅ/�gÓs¦��:¤`ÈÉ§+¦¡�¢JÎ�Ã�¢j¡c£`Å�Î�¢j¡�Ã2Ó`¬N¥cÓÒ�gÓ`¦�Ðs¡TÅd��¥cÓ6ÍJ¡cÍj¥A�T¦¡�¬ÇÅtÊK*ÍJN_Äs¡g¦Ð`ÿC¦�Å2ÓsÍ�Õ!¦$Ív�:¤`ÈÉ§+¦¡t¢JÎ�ÊDÅ��gÓsÍJ�t¬ÇÅ�®!¡g¦DÍ8�g¦�¡2�gÓ6ÍJ��¢j¡t¦�ö ¤sÍj��g¢Ò�gÓ`¦�� ¤sÈÉ§+¦¡�¢jÎ0 jÅ�Íj�s£�¥cÓsÍj¡TÍ!¥A�g¦�¡TÅ¢J�TÓ`¦¡cÅ2�TÓsÍJ� Ò¢j¡$Ê!¯sÈvÍ�©|¥¢j¤`� �tÍ!Å�¦�¬Ñ�TÓ`¦¡ÏÍ v¢j¡ÏÍJ��Ê'& �¨¢j¡c£`Å�Íj¡g¦$Åg¦ÄsÍj¡TÍJ�g¦D£�§:©|¢j�`¦É¢j¡�ÈÁ¢!¡g¦-§`ÇÍJ�sü:Å�Ö�`¢!¡�¦�ÿ`ÍJÈÁÄ`N¦j¯j�gÓ`¦2¬N�`Ä`¤`��Åg¦�ö ¤`¦�6¥�¦��\Ê� K(+Ê ��7 `Ê$+ `Ê��:ÊjÊjÊH�8Ã2Ó`¦�¡g¦��Ï£`¦�`¢j�g¦�Å/Í�§`NÍj�`ü<¯j¥Íj�Á§6¦�ÅgÄ`N¬Ñ��¬½� �g¢��TÓ`¦Î�¢jN½¢8Ã2¬N�`®�Ã�¢!¡T£`ÅT�\Ê K(+Ê� '� *;�� sÊR+ sÊH�sÍj�s£f�\ÊjÊ!ÊH� & �qÎ��TÓ`¦t¥cÓsÍj¡TÍ!¥A�T¦¡T(n¬N�Ò�gÓs¦�Ðs¡cÅ��Ã�¢!¡T£v¥¢j¤`� �cÅ�Í!Å/ÍJ�.�4ÊR�`�TÓ`¦��gÓ`¦�Ä`¡T¢j®!¡TÍjÈzÃ2¬N½C¥�¢!¤`� ��Ã�¢�Åg¤s¥cÓ$Ã�¢j¡c£`Å¯�¢J�TÓ`¦¡TÃ2¬NÅg¦j¯D¬½�"Ã2¬N½:¥�¢!¤`� �_¢!�`½©�¢!�`¦/Ã�¢j¡c£XÖ�×��ÉØ�ÔLÈvÍj¥cÓs¬½�`¦�ÈÁ¢:£`¦¢JÎ��gÓs¬NÅ�Ä`¡g¢!®j¡cÍJÈ(¬ÇÅ2®j¬NÕj¦��`¦�ÿ:��Öi~õ¬NÅX"$��'*C�R@G*C��e*C��G%ÉÍj�s£t�x¬ÇÅ�£C¦Ðs�`¦D£�§ ©W�vºS�B�'*C ]Â¡�#��e*i�vºS��K*CQ8ÂT��'*�vºS��K*,VK@�Â=��R@$*o�vºS��K*,VgÂ=��K*¡�vºS�$@G*,V$�DÂ=��K*¡�vºS�$@G*,VTÂ=�j��K*¡�vº��R@e* k`ÂF��R@e*¡�vº��'*IVTÂt�j��'*�vºS��K*��6Â4�8��'& 2��}s�X�� =�� ¯6Ã2Ó`¦�¡g¦�}7��" �*�ÊK*,+R%'*� =�� 1"E!-ÊK*H!�æ�*B! �v*B!2èv%'&:Ü�Ó`¦É£`ÍJ�TÍÒÅg¦��¢JÎ��gÓ`¦ÁÈvÍj¥cÓs¬½�`¦v¥¢jÈÁÄ`¡T¬NÅg¦�Åt�g¤sÄ`½¦DÅvº�¢'*ML�*��`Â|*,¢.-_} � ¯gL#-� � *�� -� �¯XÃ2Ó`¦�¡g¦f¢Á¬ÇÅÏ�gÓs¦ÁÅd�g¡T¬N�`®�Åd¤`ÄsÄ`½¬N¦�£�g¢i�gÓ`¦nÅd©CÅd�g¦È�¯iL�¡g¦�Ä`¡T¦�Åg¦� �TÅ��TÓ`¦�£`¬Ñþ<¦¡T¦�s¥¦É§+¦��Ã�¦¦��gÓ`¦��:¤`ÈÉ§+¦¡t¢JÎ�Ê�ÅtÍJ�s£��gÓ`¦�� ¤sÈÉ§+¦¡Ï¢JÎ0 jÅ�¬½��TÓ`¦¥�¤`¡T¡T¦� ��Ã�¢j¡c£ ÍJ�6£�� TÓ`¦��:¤`È�§6¦�¡Á¢JÎ�Ã�¢j¡c£`ÅÖ&�`¢!¡�¡T¦�Í!Åd¢!�sÅ-�TÓsÍ8�ÁÃ2¬N½�§+¦�¦ÿ:ÄsNÍj¬½�`¦D£�ÇÍ8�g¦�¡�¯0L ÈvÍ�©�ÍJÇÅd¢ÓsÍ�Õj¦��gÓ`¦�ýj£`¤`ÈÁÈÉ©Cý-Õ8ÍJN¤`¦�Å�!-ÊK*i!�æ�*i! �-¢!¡�!2è�&�3>�8"R I*IQE*IV � *,V @ *,V * k�*��%!¯jÃ2Ós¦¡T¦��gÓs¦Ï£C¦Ðs�`¬½�g¬N¢j�sÅ�¢JÎX�TÓ`¦Ä`¡T¢:¥¦�ÅTÅd¬N�`®Á¡T¦ÇÍ8�g¬N¢j�6Å�Íj¡g¦-Í!Å�Î�¢jN½¢8Ã�Å�áºU¢K*H!2èv* !Â AºU¢K* �* !ÂA¯ Ã2Ó`¦�¡g¦3¢9-�}s�8¯º��¢'* �*��sÂ Q:º�¢'*B!-Ê'*��`Â�¯:Ã2Ó`¦¡T¦3¢9-=} � ¯��.-� �¯��i¬ÇÅ2ÍJ�:©i¥cÓ6ÍJ¡cÍj¥A�T¦¡�¢J�TÓ`¦¡��TÓsÍJ� Êj¯º� '¢'* v*��`ÂCV$�jº�¢'*H!�æ�*��!ÝÊDÂA¯sÃ2Ó`¦¡T¦3¢9-=}s�8¯��.-� t*�� `¯ºdÊR¢'* v*��`ÂCV @ º�¢'*�ÊK*�� ÊDÂA¯sÃ2Ó`¦¡T¦3¢9-=}s�8¯!�g*MLO-" t*º#�e¢'*ML�*��`ÂMVº�¢'* v*��`Â�¯CÃ2Ó`¦¡T¦�¢9-=}s�J¯��J-� t*CL1-� =�%$h"E!2è�%E*º� i¢'*ML�*��`ÂbkXº�¢'*ML&��*��`Â�¯6Ã2Ós¦¡T¦�¢)- }s�J¯'��*CL>-( t*�º L�� * O->"� �*Iu$%$ÍJ�s£��J��!-Ê�Â�¢j¡�º -�"!Ê'*Cu$%Íj�s£&�s� Ê�ÂA¯`Ã2Ó`¦�¡g¦9u�£C¦��`¢J�T¦�Å2ÍJ�:©i¥cÓ6ÍJ¡cÍj¥A�T¦¡�¢J�TÓ`¦¡��TÓsÍJ� n¢j¡-Ê'*º� i¢'*ML�*��`Â)�_º�¢'*B! �v*��`Â�¯CÃ2Ó`¦¡T¦3¢9-=}s�8¯'�J-� t*CL1-� =��$h"E!2è�%E* t-�}.&�«¦i�TÍjüj¦W°��* ��c�+ t*0`CºU¢'*ML�*��sÂ�� º L�*��`ÂA¯�¢O-�}s�J¯�L�*H-, =�U*-�q-, �0uJºU��*CL�*��`Â?�/. P10iQ�Î�¢!¡�ÍJN

L1-� � *��.-� t*`¢j�gÓ`¦�¡gÃ2¬ÇÅd¦ÏÎ4ÍjNÅg¦jÖ�q��ÈvÍ�©¨§6¦�¢j§sÅg¦¡TÕj¦D£¨�gÓsÍJ��k«¬ÇÅnÍ�¡g¦�NÍJ�g¬N¢j� Í!ÅgÅg¢C¥�¬ÇÍ8�g¬N�`®��T¢«ÍJ�:©¨¦N¦ÈÁ¦� ��ºSuB¢'*ML�*��`Â|*"Ã2Ó`¦�¡g¦JuÒ¬NÅnÍJ�:©

¥cÓsÍJ¡cÍj¥��g¦�¡2¢J�gÓs¦¡2�TÓsÍJ�� v¢!¡$Êj¯s¦¬½�gÓ`¦�¡�º�¢'*CLW!?Ê'*��`Â�¢!¡Éº�¢'*ML&�zÊK*��`Â2Íj�s£ º2�e¢'*CL�*��`Â�- Ê`$a º3�+Â © Ê`$a¨ºUV Â�&ø�¢J�gÓ�¢jÎ��gÓs¦$ÍJ§+¢8Õj¦-¥�¢!�s£C¬½�g¬N¢j�sÅ2Íj¡g¦�£C¬½þ+¦�¡g¦��!�2Î�¢!¡gÈvÅ�¢jÎ"�`¢!�CÔ]£C¦��T¦¡TÈn¬N�`¬ÇÅdÈ ÍjÅ�Ã�¦ÏÃ2¬NN�ÅdÓs¢8Ã Î�¤`¡g�gÓ`¦�¡2¢j��Öw�7Ex�9_=4;�=\36954��X� � �;*I�G�X-8~?*¡Vp- 34*t³J·B?F�G�X-��vºS�;*IVXÂ.�/¸|¹³e{«Ù�µ`³JÙhVÛ¶Ç¹�³J· ÍJ¡c¥ � ¿ �8² ��Ù �F�G�$³J·B?��¿A¶VÙq¸.VÛác��[ �G��&¡� � �;*C�G�9-p~ ³8¿g¸|¹��sćµlÙVµs³8Ù$Ù�µ`¸¿g¸P¸I�!¶Ç¹AÙ�� @ *B&B&H&�*C� D � @ -p~)�4L�N ��¶VÙ�µ � @ � �;*� D � @ �:�G�t³J·B?JV � á�� [¯� � � @ � �J¿i³8¼V¼/ÊW�� 9��L�*T�/¸Ò¹�³e{�ÙVµs³8Ù��/¸nµs³�8¸|³ÒÄsÍ8�TÓt¶�.��7V @ &B&H&IV D � ¿��J²��Ù �)� � ³8·"?W��¿A¶VÙq¸«¶�.Ïáv�?[�� &"»�³jćµ �`³JÙVµ�¶!.4��V @ &H&B&CV D Àj¶ �¸�¹�¿A¶Ç¹¸ÁÙ ��³�¿g¸�¼N³8ÙL¶ �8· �qÙ�µ`¸ÏÄsÍJ�gÓ�¡T¦ÇÍ8�T¬½¢!��V "76�á�2 Y?[ 2��_µs¸�¿g¸ iV "86 i�/¶ � ³8·B? �8·6¼§{v¶ � d @ *B&H&B&�*! D � @ - 2 ¹��sćµ�Ù�µ`³JÙ � V � � � @ � �J¿�³8¼V¼�Ê9�� c�_L�*�_µ`¸¿g¸ @ � �*! D � @ � i��&× ÈvÍj¥cÓ`¬N�`¦�¥�¢jÈÁÄ`¤`�TÍ8�T¬½¢!��cÍJü!¦�Ån�gÓs¦�Î�¢!¡gÈ ¢JÎ-ÍP�T¡TÍ�Õ!¦¡cÅgÍj�¢jÎÏÍ¨ÄsÍ8�TÓ?¬½�l�gÓ`¦PÅd�TÍJ�g¦�ÅgÄsÍj¥¦|Íj�s£ �TÓ`¦

ÍJÄ`Äs½¬Ç¥ÍJ�g¬N¢j��¯:¬N�Ò�g¤s¡g��¯:¢jÎX�gÓ`¦�ÄsÍJ�gÓiÇÍJ§+¦ÇÅÏº�Ã2Ó`¬Ç¥cÓi¡T¦Ä`¡T¦�Åg¦� ��§sÍjÅg¬N¥�Ä`¡T¢:¥¦�ÅTÅd¬N�`®$¡T¦ÇÍ8�T¬½¢!�sÅcÂAÖ:Ü�Ó`¬NÅ�®!¬½Õ!¦�Å�¡g¬ÇÅd¦�g¢Á�TÓ`¦-¡g¦�NÍJ�g¬N¢j��¥�¢!ÈnÄs¤C�g¦D£i§:©Ò�TÓ`¦-ÈvÍj¥cÓ`¬N�`¦!¯`ÍjÅ2£C¦Ðs�`¦�£|�`¦ÿ:��Öw�7Ex�9_=4;�=\369,9��:<µ`¸P¿g¸¼½³8ÙL¶ �8·z´ �8² � �CÙ]¸ ?�¾�{��)��V<; á�2 Y?[ 2 ¶Ç¹ ?!¸ � ·+¸ ?�¾B{ �V<; � ¶ � ³8·"? �8·6¼§{«¶ �d��)-F~*³J·B?|³ �s³8Ù�µX¶!.�áK�B��[j��¹��s´Tµ�ÙVµs³8Ù iV "76 ��2³J·B?3ujº ��VÂ$¶Ç¹�ÙL¿��s¸R��]�-®j¦��`¦¡cÍJL¯ÍJ�-Ø�ÔLÈvÍ!¥cÓ`¬½�s¦�ÈÁÍ�©Ï§+¦��`¢j�`Ôq£C¦�g¦�¡gÈÁ¬N�`¬NÅd�g¬Ç¥J¯�¬½��TÓ`¦�Åg¦�6Åd¦��TÓsÍ8��gÓ`¦/ÍjÄ`Ä`N¬N¥�Í8�T¬½¢!�-¢JÎ`ÍJ�-¬N�`¬½�g¬ÇÍJ

£`Í8�cÍ�Õ8ÍJN¤`¦� vÈvÍ�©ÉÄ`¡T¢C£C¤s¥¦2Èn¢!¡g¦��TÓsÍJ�v¢!�`¦2Õ8ÍJN¤`¦2¢JÎ+�gÓ`¦t£`Í8�cÍ-Åd¦��Öj×��vØ�ÔqÈÁÍ!¥cÓ`¬N�`¦2¬NÅ/£C¦��T¦¡TÈn¬N�`¬ÇÅ��T¬N¥�¬ÑÎX¬½�TÅÍjÅTÅd¢C¥¬NÍJ�g¦�£ÁÍj¤C�g¢!ÈÁÍJ�g¢!�v¬NÅ�£C¦��T¦¡TÈn¬N�`¬ÇÅ��T¬N¥j¯�3¨¬ÇÅ/Í$Åg¦��/¢jÎXÄsÍJ¡g�g¬ÇÍJsÎ�¤`�s¥A�T¬½¢!�sÅ�¡cÍ8�TÓ`¦¡��gÓsÍj�v¡g¦�NÍJ�g¬N¢j�sÅ�¯jÍJ�:©��Ã�¢Ä`¡T¢:¥¦�ÅTÅd¬N�`®vÎ�¤s�s¥A�T¬½¢!�sÅ��TÓsÍ8�t¦ÈÁ¦¡T®j¦-Î�¡T¢jÈ �gÓs¦�ÅTÍJÈÁ¦ÉÅd�TÍ8�T¦ÉÓsÍ�Õ!¦$£C¬ÇÅ�ô�¢!¬½� �g¦D£P£C¢!ÈÁÍj¬½�6Å�ÍJ�6£��`¢ÒÄ`¡T¢C¥�¦�ÅTÅg¬½�`®Î�¤`�s¥��g¬N¢j�P¥Íj��Äs¡g¢C¥�¦DÅgÅ�Õ8ÍJN¤`¦DÅ�Î�¢j¡2Ã2Ó`¬Ç¥cÓ��gÓ`¦$Åd�g¢!Ä`Ä`¬N�`®v¥�¢j�6£C¬Ñ�T¬½¢!��¬NÅ��T¡g¤`¦!Öw�7Ex�9_=4;�=\3695=��9zt·Á°-±]²v³jćµ:¶V·+¸ � ¶Ç¹Ïć³8¼V¼½¸ ?Ï£C¦��T¦¡TÈÁ¬½�`¬ÇÅd�g¬Ç¥��_µs¸�·s�÷á'~� 3¤!�[�~��63 ¶Ç¹t³É¹¸Ù � � �s³8¿AÙL¶4³8¼� �C·+´Ù\¶ �J·`¹É¿T³8Ù�µ`¸¿$ÙVµs³8· ¿g¸¼½³8ÙL¶ �8·s¹,± � �8¿Á³8·�{iÙU� � ?J¶Ç¹cÙL¶V·+´Ù �+¿ ��ć¸�¹T¹A¶V·:À � �C·+´Ù\¶ �J·`¹�Vi* kt- 34*�¶ � d��s-1~*¹��s´TµÙVµs³8Ù2ºS�;*,VXÂo-t^'`$a ºS�$Ân³8·"?iº��;* k`Â4-t^'`$a ºS�$Â$ÙVµs¸�·W^'`$a º�VXÂ © Ê`$a º k`ÂT�?>'� � �J¿�³8·�{ �+¿��Dć¸A¹c¹A¶V· À � �C·<´�ÙL¶ �8·Vi*_¶ � t-FÊ`$a º�VXÂ-Ù�µ`¸·.ujº +Â¡�/V�(A@�¢RQE&×�¥�¥�¢j¡c£C¬N�`®n�g¢n�gÓs¦-Ä`¡g¦�Õ:¬½¢!¤sÅ2£C¦�Ð6�`¬Ñ�T¬½¢!��ÍJ�|Ø�ÔqÈÁÍ!¥cÓ`¬N�`¦-¥ÍJ�|ÓsÍ�Õ!¦Ïèn��©:Ä+¦�Å�¢JÎ��`¢!�CÔq£`¦��g¦�¡gÈÁ¬N�`¬ÇÅdÈ�á

� ¹AÙ]³8Ù]¸-· �J·s±@?!¸�Ù]¸�¿A²n¶V·s¶Ç¹A²�¬½Î"�gÓ`¦�¡g¦�¦�ÿC¬ÇÅ��h��-t~?*IV�-�3lÃ2¬½�gÓtu�(EPG^6º��vºS�;*IVXÂgÂB� ÊK&

39

� � �`¸¿g³8Ù �8¿-· �8·6±@?j¸Ùq¸¿A²�¶V·6¶Ç¹A²�¬ÑÎ�Åg¢jÈÁ¦�¦N¦ÈÁ¦� �TÅ�¢JÎ=3ÝÍJ¡T¦�¡g¦�NÍJ�g¬N¢j�sÅ�¬N�sÅd�g¦�Í!£|¢JÎ_Ä6ÍJ¡g�g¬ÇÍJ<Î�¤`�s¥��g¬N¢j�sÅ�Ö� ? �8²v³8¶V·¨· �8·6±@?j¸Ùq¸¿A²n¶V·s¶Ç¹A²�¬½Î_�TÓ`¦¡T¦�¦�ÿC¬NÅd�h��-t~s*IV @ *,V � - 3�Ã2¬½�gÓ�º��;*IV @ Â|*�º��;*IV � Â4-F^'`$a ºS�$Â�*IV @��V �Íj�s£.Ê`$a º�V @ Â © ^'`$a º�V � Â �� >�&

� Ù]¸�¿A²n¶V·+³JÙ\¶ �J·�· �8·s±@?!¸�Ù]¸¿A²�¶V·6¶Ç¹c²x¬ÑÎ"�gÓ`¦�¡g¦�¦ÿ:¬ÇÅd�� t-�2�*IVt- 3lÃ2¬Ñ�TÓ �-WÊ`$a¨ºUVXÂ�ÍJ�s£FuJº� +ÂT�5. P10iQE&Ü�Ó`¦nØ�ÔqÈÁÍ!¥cÓ`¬N�`¦É¬N�«ª�ÿCÍjÈÁÄ`½¦�Ê�Ó6ÍjÅÏ£C¢jÈvÍJ¬N��Íj�s£P¢!Ä6¦�¡TÍJ�g¢j¡t�`¢j�`Ôq£C¦�g¦�¡gÈÁ¬N�`¬NÅgÈ §`¤C��`¢J�-Åd�TÍ8�T¦É¢!¡��T¦¡TÈn¬½Ô�sÍ8�T¬½¢!��`¢!�CÔ]£C¦��T¦¡TÈn¬N�`¬ÇÅdÈ,º4¬\Ö ¦jÖ��TÓ`¦|Î4Íj¥��TÓsÍ8�fuÒ¬ÇÅ . P10iQ�¢!�`½© Î�¢!¡�º��*ML�*��sÂÉÕ8Íj½¤`¦DÅÁÍ�Õj¢j¬Ç£`Å$�g¦¡TÈÁ¬½�6Í8�g¬N¢j��`¢j�`Ôq£C¦�g¦�¡gÈÁ¬N�`¬NÅgÈÒÂAÖ�]��®!¦�`¦�¡TÍj�Åd�TÍ8�T¦��s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅgÈ ÍJ�s£ �T¦¡TÈÁ¬½�sÍJ�g¬N¢j�l�`¢j�CÔ]£C¦�g¦¡TÈÁ¬½�s¬NÅgÈ�ÍJ¡T¦i�`¢j�n¡T¦�Íj½N© �`¦�¥¦�ÅTÅgÍj¡g©

Åd¬N�s¥¦��gÓ`¦�©l¥Íj�?§6¦�¡T¦ÈÁ¢8Õj¦D£�§:© ¡T¦Ã2¡T¬½�g¬N�`®¨�gÓ`¦PØ�ÔLÈvÍ!¥cÓ`¬½�s¦jÖ��]�s£C¦�¦�£X¯�Å��cÍ8�T¦|�s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅgÈ ¥Íj�l§+¦¡g¦�ÈÁ¢8Õj¦�£�§:©�¤sÅd¬N�`®�Å��cÍJ�s£sÍJ¡c£�ÍJN®j¢!¡g¬½�gÓsÈÁÅ��gÓ6Í8��TÍjüj¦ÁÍi�`¢!�CÔ]£C¦��T¦¡TÈn¬N�`¬ÇÅ��T¬N¥ÁÍj¤C�g¢!ÈÁÍJ�g¢!��ÍJ�s£«Ä`¡T¢C£C¤s¥�¦ÁÍJ�¦�ö ¤`¬NÕ8ÍJN¦� �Ï£C¦�g¦�¡gÈÁ¬N�`¬NÅd�g¬Ç¥ÉÍj¤C�g¢!ÈvÍ8�g¢!��Ö6Ü�Ós¦$�g¡cÍJ�6Å�Î�¢!¡gÈvÍ8�T¬½¢!�P£C¢:¦�Å��`¢J�ÏÄ`¡g¦DÅd¦�¡gÕ!¦��gÓ`¦Á£C¢!ÈÁÍj¬½�P£`¦��g¦�¡gÈÁ¬N�CÔ¬NÅgÈ�¯sÍjÅ2¥�ÍJ�|§6¦$Åg¦¦��¬½��ª�ÿ`ÍjÈnÄs½¦-æCÖ»��:³8² �+¼½¸��;�h��¦��i¤sÅ�¥�¢!�sÅd¬Ç£C¦�¡ÒÍJ� Ø�ÔqÈvÍj¥cÓ`¬N�`¦�ÓsÍ�Õ:¬N�`® �gÓs¦PÎ�¢jNN¢8Ã2¬½�`® �`¦ÿ:�|Åd�TÍ8�T¦�Î�¤`�s¥��g¬N¢j��á4�vº� v*IVXÂF�"!Ê'*Tæ;%E*C�vºdÊK*IV @ Â�� *C�vºLæ�*,V � Â1� ��Ã2Ós¦¡T¦1Ê`$a¨ºUV @ Â © ^'`$a º�V � Â �� >�&��q��¬NÅ|Å��cÍ8�T¦��`¢!�CÔq£`¦��g¦�¡gÈÁ¬N�`¬ÇÅ��T¬N¥§`¤C�v£C¢jÈvÍj¬½� £C¦�g¦�¡gÈÁ¬N�`¬NÅd�g¬Ç¥JÖ�×��¦�ö ¤`¬NÕ�Íj½¦�� n£C¦�g¦¡TÈÁ¬½�s¬NÅd�g¬Ç¥ÒÍJ¤`�g¢jÈvÍJ�g¢j��¬ÇÅ)�9�\º� �*IVXÂ�� ÊDæ�*I�9�4ºdÊDæ�*,V @ Â)��9�qº�ÊDæ�*IV � Âc� �v&JÜ�Ó`¦2�`¦Ãl¦�ö ¤`¬NÕ8ÍJN¦� ��Ø�ÔqÈvÍj¥cÓ`¬N�`¦�¬NÅ�Åd�TÍJ�g¦�£C¦�g¦�¡gÈÁ¬N�`¬NÅd�g¬Ç¥�§`¤C�/£`¢jÈvÍJ¬N��s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅd�g¬Ç¥JÖ�/7:� � B>y6�%� �J¿É³8·�{�°-±]²v³jćµ:¶V·<¸ � ³J·¨¸,µ �C¶ 8³8¼N¸�·6Ù�Ù]¸¿A²�¶V·<³8ÙL¶ �8· ?!¸�Ù]¸¿A²�¶V·6¶Ç¹cÙL¶4´�°-±]²v³jćµ:¶V·<¸ �9��²v³G{�¾ç´ �8·`¹AÙL¿��s´�Ù]¸ ?K�

��¿�� ¶Ç¹�Ù]¸¿A²�¶V·<³8ÙL¶ �8· · �8·s±@?!¸�Ù]¸¿A²�¶V·6¶Ç¹cÙL¶4´ÁÙ�µ`¸· �9��¶V¼V¼_µs³�8¸ÒÙ�µ`¸ ?!³8Ù]³|¹¸�Ù$2��0� 2��"� �*�Êe%'*�_µ`¸¿g¸ 2 ¶Ç¹ ?!³8Ù]³Á¹¸�Ù � � �4*�³8·"?vÙ�µ`¸�¹³J²Á¸$¹¸�Ù � � ¹AÙq³JÙq¸�¹��¶VÙ�µ �4&�zt¼V¼XÙ�µ`¸ �+¿��Dć¸A¹c¹A¶V· ÀÒ¿g¸�¼N³8ÙL¶ �8·`¹ � � �9�c��¶V¼V¼¾ç ?!¸ � ·+¸ ? �8· ¹ �s¾�¹¸�Ù\¹ � � 2 ��"� �%�� 3 � � "GV � <�d�V_- 34* r �*)� - 2&¶ � iV'�lÙVµs¸�·lº �* !ÂCV � º��i* !Â|%��u � º� +Â��¶V¼V¼ �J·s¼§{�¾ç . P 0�Q«¶ � q- 2 ��"!ÊK%'&=� �8¿i¸c³jćµ¨¹AÙ]³8Ù]¸��=-_~)��·<¸��Û¼ � � �<±d¾c³j´��PÙL¿g³J·`¹A¶VÙ\¶ �J·>��¶V¼V¼�¾ç|³�?�?j¸ ?K�zt¼V¼�ÙVµs¸A¹¸|ÙL¿g³8·s¹c¶VÙL¶ �8·s¹J��¶V¼V¼�¾ç|¼½³j¾ç¼V¼½¸ ? ¾B{¨³¨¿g¸¼½³8ÙL¶ �8· .|*2Ù�µ`³JÙ-Ù\¿T³8·`¹A¼½³JÙq¸�¹|¸ �¸¿|{ º �* !Â.- 2 ��" �%¨¶V·6Ù �º �*ÊDÂ9- 2�� " Êe%'&�� 8·s¹¸Iµ �s¸·sÙL¼§{$�0�9��ái~l��3��!i[ ~ ¶Ç¹�?!¸ � ·+¸ ?�¾�{)PJ- �9�qºS�;*IV��ÇÂ�¶ �8PJ- �vºS�;*IVXÂÁ³J·B?�9�qºS�;*).dÂ��l"R�E% � �8¿Ò³8¼V¼g�.- ~s& :<µs¸vÙ]¸A¹AÙL¶V· À ? �J²Á³J¶V·=^'��¶Ç¹�?j¸ � ·<¸ ?|¾B{?^'�Lº�V��VÂ«�l":º �* !ÂX< �- ^+º�VXÂ,%�³J·B?^6º�.dÂT�p" º !6,* !Â|% � �8¿n³ �s³8¿AÙL¶4´ �C¼½³J¿� �6o-�2=&"�/¶V·+³J¼V¼§{�`G�Lº �* ÂT�/`Cº� +Â�* � �J¿É³8¼V¼ =-WÊ`$a ºS`JÂ|&×�¥�¥�¢j¡c£C¬N�`®��g¢|�gÓ`¬ÇÅ�N¦ÈÁÈvÍi�T¦¡TÈÁ¬½�sÍJ�g¬N¢j�¨�`¢j�`Ôq£C¦�g¦�¡gÈÁ¬N�`¬NÅgÈ ¥�ÍJ��§+¦Á�g¡cÍJ�6Å�Î�¢!¡gÈÁ¦�£�¬½� �T¢�£`¢jÈvÍJ¬N��`¢!�CÔ

£C¦��T¦¡TÈÁ¬½�`¬ÇÅgÈ|Ö�`¡T¢jÈ �gÓ`¬ÇÅt�`¢J�T¦É¬½��Î�¢jNN¢8Ã�Å2�gÓ6Í8�tÃ�¦$ÈvÍ�©|¦�ÍjÅg¬N½©��g¡cÍJ�sÅdÎ�¢j¡TÈ ÍJ�:©�Ø�ÔLÈvÍ!¥cÓ`¬½�s¦$¬½� �T¢iÍÒ�`¦�ÃÛ¢j�`¦ÉÓsÍ�Õ:¬½�`®

ÍjÅTÅd¢C¥¬NÍJ�g¦�£iÅ��T¢jÄ`Ä`¬N�`®Á¥�¢!�s£C¬½�g¬N¢j�sÅ��g¢n¦Õ!¦¡T©vÅ��cÍ8�g¦!ÖCÜ�Ó`¬NÅ�¢!§sÅd¦�¡gÕ8ÍJ�g¬N¢j�sÅ�ÅdÓs¢8Ã�Å��TÓsÍ8��gÓ`¦-Íj§6¢8Õ!¦��g¡cÍJ�6Å�Î�¢!¡gÈvÍ8Ô�g¬N¢j�Á¬ÇÅ�¢j�n�gÓs¦2¢j�`¦�ÓsÍj�s£Á¥�¢j�6Åd¬ÇÅ��T¦� ��Ã2¬½�gÓn�gÓ`¦��T¦�Åd�g¬N�`®-Ó:©:Ä6¢j�gÓ`¦DÅd¬ÇÅ�ÍjÅgü:¬½�s®�Î�¢!¡/ÍJN`Å��cÍ8�T¦�Å�§+¦¬N�`®�Ðs�sÍj`Å��cÍ8�T¦�ÅÍJ�s£�¢j�i�gÓ`¦Ï¢J�TÓ`¦¡�ÓsÍj�s£ÒÄs¡g¢8Õ!¦�Å��TÓsÍ8��Åd�g¢!Ä`Ä`¬N�`®n¥¢j�s£`¬Ñ�T¬½¢!�sÅ�ÈÁÍ�©Á§+¦�¬½®!�`¢j¡T¦�£XÖ��:¤`§6Åd¦Dö!¤s¦� �gN©vÃ�¦ÏÃ2¬N½�¥¢j�CÔÅd¬Ç£C¦�¡tØ�ÔLÈvÍj¥cÓs¬½�`¦DÅ�Ã2Ó`¬Ç¥cÓ�Íj¡g¦ÉÅd�TÍJ�g¦nÍJ�s£��T¦¡TÈÁ¬½�sÍJ�g¬N¢j��£`¦��g¦�¡gÈÁ¬N�`¬ÇÅ��T¬N¥�ÍJ�s£�Ã2¬½�gÓs¢j¤C�-Å��T¢jÄ`Äs¬½�`®�¥�¢j�6£C¬Ñ�T¬½¢!�sÅÅdÄ+¦�¥¬ÑÐ6¦�£XÖX×�¥�¥�¢!¡T£C¬N�`®v�T¢Ò�TÓ`¬NÅt¢j§6Åd¦�¡gÕ8Í8�T¬½¢!�PÅd¬N�s¥¦$�`¢8ÃÛ¢j�«ÍJ�:©�Ø�ÔLÈvÍ!¥cÓ`¬½�s¦ÉÍjÅt¬½� �T¡g¢C£C¤s¥¦�£�§:©�å�¦Ðs�`¬½�g¬N¢j��nÃ2¬½NXÓsÍ�Õ!¦t�TÓ`¦-�`¦ÿ ��Åd�TÍJ�g¦ÏÎ�¤`�s¥��g¬N¢j��¢JÎ"�gÓs¦�Î�¢j¡TÈ7�xáE~�� 3_!�[j~÷�`¢vÅ��T¢jÄ`Äs¬½�`®v¥¢j�s£C¬½�g¬N¢j��ÍJ�2Íj½LÖå�¢!ÈvÍJ¬N��`¢!�CÔq£`¦��g¦�¡gÈÁ¬N�`¬ÇÅdÈ Íj�s£�¢jÄ+¦¡cÍ8�T¢j¡Ï�`¢j�`Ôq£C¦�g¦�¡gÈÁ¬N�`¬NÅgÈ*¥Íj�`�`¢J��§+¦�¡T¦ÈÁ¢8Õj¦D£�§:©�¡g¦�Ã2¡g¬½�g¬N�`®Ò�TÓ`¦

Ø�ÔqÈvÍj¥cÓ`¬N�`¦j¯2Åg¢ �TÓ`¦¡T¦«Åg¦¦�ÈÁÅ|�`¢l®j¢:¢C£ ¡T¦�ÍjÅg¢j�?�T¢l¢!¤C�gÇÍ�Ã �gÓs¦�Åg¦P��©:Ä6¦DÅ|¢JÎÉ�`¢!�CÔ]£C¦��T¦¡TÈn¬N�`¬ÇÅdÈ Íj�s£X¯2ÍjÅ¬½NN¤sÅ��T¡TÍJ�g¦D£�¬N��ª�ÿ`ÍJÈÁÄ`N¦nÊj¯C�TÓ`¦©|¥ÍJ�|§+¦-¤sÅd¦Î�¤`LÖ

1 h��tí�� 4�-î/òdë�ì�ì��!ì��E�Xìlî�� G��ñ� �òdëh��«¦/�g¤`¡T�$�`¢8Ã¨¢j¤s¡_Í8�g�g¦��!�T¬½¢!��g¢2�T¦�Åd�g¬N�`®sÖD×�Å"Å��cÍ8�T¦�£�¬N�-�gÓ`¦/¬½� �g¡T¢C£C¤s¥��g¬N¢j��¯�gÓ`¦�ÍJÄ`Ä`¡T¢!Í!¥cÓt¤6Åd¦D£-¬NÅ��g¢�¥¢j�sÅg¬Ç£C¦¡��Ã�¢iØ�ÔqÈÁÍ!¥cÓ`¬N�`¦�Å�Íj�s£��g¢Ò®!¦�`¦�¡TÍJ�g¦-Í � ·s¶VÙ]¸2Åd¦��¢JÎ�Åg¦�ö ¤`¦��s¥�¦DÅ��gÓsÍJ��¯6Ã2Ó`¦�PÍjÄ`Ä`N¬½¦D£|�g¢Á�gÓs¦$��Ã�¢vÈÁÍ!¥cÓ`¬N�`¦�ÅÃ2¬Ñ�TÓ�¬Ç£C¦��!�T¬N¥�ÍJ<¢j§6Åd¦�¡gÕ8ÍJ§s½¦t¡g¦DÅd¤`½�TÅ�¯ ®j¤sÍj¡TÍj�!�T¦¦DÅ��gÓ6Í8��gÓ`¦Ï��Ã�¢ÉÈvÍj¥cÓ`¬N�`¦DÅ/ÓsÍ�Õ!¦�¬Ç£C¦� �T¬N¥�ÍJ<§6¦�ÓsÍ�Õ:¬½¢!¤`¡DÖ Ü�Ó`¬ÇÅ¬NÅ�Î�¢j¡TÈvÍJN¬NÅg¦�£��`¦�ÿ:�DÖ!Ü�Ó`¦�Åg¦�¥��g¬N¢j�vÍJÇÅd¢�¬N� �g¡T¢:£`¤s¥�¦DÅ��gÓ`¦�¥¢j�s¥¦ÄC�cÅ��gÓ6Í8��Íj¡g¦�¡T¦�ö ¤`¬N¡g¦D£�¬N�n�gÓ`¦��g¦�Åd�g¬N�`®-Ä`¡T¢C¥�¦DÅgÅÍJ�s£�ÅgÓ`¢8Ã�Å�Ó`¢8Ã Ín�T¦�Åd��Åd¦��¥ÍJ�|§+¦-®j¦�s¦¡cÍ8�g¦D£XÖw�7Ex�9_=4;�=\369�� 8¿�³8·�°$±]²Á³!´TµC¶V·+¸��¡�$³ �s³8¿AÙL¶4³8¼ � �C·+´ÙL¶ �8·�� ; á�2O�1!i[ 2 � ´T³J¼V¼½¸ ? ³�Í«§`¡g¦DÍJü:Ä+¢j¬N�!�¥�¢!ÈnÄs¤C�TÍJ�g¬N¢j� ¢jÎ ��¶Ç¹�?j¸ � ·<¸ ?«³8¹ � ; º� �@�&B&B&! �D`Â)�/�E@0&B&H&)�KDi*2¶ � ÙVµs¸�¿g¸�¸I�!¶Ç¹cÙ\¹�³ �`³JÙVµOVK@A&B&B&,VGD � ¿��J² ��¹��s´Tµ�ÙVµs³8Ù ��bVG� �K�C* ��-F^6ºUVG�qÂ|*"Ê9�¤ T��L�*�LON �&

� �JÙq¸��tÜ�Ó`¦n¦N¦ÈÁ¦� �TÅ � Î�¢!¡-ÍJN�æt�8 ��L ¬½�«�gÓs¦ÁÍj§6¢8Õ!¦�£C¦Ðs�`¬½�g¬N¢j��Î�¢j¡�Ã2Ó`¬Ç¥cÓ �� @ ÍJ¡T¦�¥Íj½N¦�£¾�¿T¸T³�� 8¶V·6Ù �³J¼ �s¸A¹�¢JÎ � ; &

40

Ü�ÓsÍ8�|¬NÅ�¯�Í�§`¡T¦�ÍJü:Ä+¢j¬N� ��¥�¢!ÈnÄs¤C�TÍJ�g¬N¢j� ÍjÅTÅg¢:¥¬NÍJ�g¦DÅiÍ Åg¦�ö ¤`¦��s¥�¦P¢jÎÉ£`Í8�cÍ�Õ8ÍJN¤`¦�Å�Ã2¬½�gÓ �TÓ`¦«Åg¦�ö ¤`¦��s¥�¦¢JÎÉ£`ÍJ�TÍ�Õ8Íj½¤`¦DÅÒÄ`¡T¢C£C¤s¥¦�£?Ã2Ó`¦�� Í�ÄsÍ8�TÓ ¬½� �gÓ`¦«ÈÁÍ!¥cÓ`¬N�`¦�¬NÅi�g¡cÍ�Õj¦�¡TÅg¦�£�Ö0A�¢J�i�gÓsÍJ��¯�¬½� ®!¦�`¦�¡TÍj\¯�Î�¢!¡�Í�`¢j�`Ôq£C¦�g¦�¡gÈÁ¬N�`¬NÅd�g¬Ç¥ÁØ�ÔqÈvÍj¥cÓ`¬N�`¦!¯XÈÁÍj�:©PÄsÍ8�TÓsÅ�ÈvÍ�©P§+¦Á�g¡cÍ�Õj¦¡cÅg¦�£P§:©P¢!�`¦vÅd¦Dö ¤`¦�s¥¦Á¢JÎ2£`Í8�cÍ�Õ8Íj½¤`¦DÅ-ÍJ�s£Î�¤`¡g�gÓ`¦�¡gÈÁ¢j¡T¦�Í�ÄsÍJ�gÓvÈvÍ�©ÉÄ`¡T¢C£C¤s¥¦2ÈÁÍj�:©�Åg¦�ö ¤`¦�6¥�¦�Å�¢jÎ�£`Í8�cÍ�Õ�Íj½¤s¦�Å�¯jÅd¢$Í�§s¡g¦DÍJü:Ä6¢!¬½� ��¥�¢!ÈÁÄ`¤C�TÍJ�g¬N¢j�vÈvÍ�©�`¢J��§+¦-¤`�`¬Çö ¤`¦N©�£`¦�Ðs�`¦D£X¯sÍ!Å�¬½N½¤6Å��T¡TÍJ�g¦�£�§:©v�gÓs¦�Î�¢jN½¢8Ã2¬N�`®Á¦�ÿ`ÍJÈÁÄ`N¦jÖ»��:³8² �+¼½¸ $E� �s¢j¡��xÍ!Å�¬½��ª�ÿCÍjÈÁÄ`½¦ÁÊ-ÍJ�6£

g@h�õº�Ê!ÊH(6 ��CÊK*H!2èv* ÂA¯ !�X�õº�ÊjÊR(6 ��:Ê'* v* !Â�¯ '�X�÷ºdÊH(6 ��CÊK*Ê'*Ê�ÂA¯ ��3�÷ºS(6 ��CÊK*Tæ�*Ê�ÂA¯# ��X�õº� A�:ÊK* �*�ÊDÂA¯ ��h��º#�:ÊK*H!�æ�* !ÂA¯ ��h��ºdÊK* v* ÂAÖ

Ã�¦ÏÈvÍ�©Á®j¦��¦¬½�gÓs¦¡ �?�5� @ � � � � � � � � ��7��K*:¢j¡ �;�i�5� @ � � � � �� e*:¬½Î�ÄsÍJ�gÓJ V @ k'k�V � V V @ ¬ÇÅ�¤6Åd¦D£XÖ !�¢j�sÅg¦�Ôö ¤`¦� �gN©iÃ�¦-ÈvÍ�©i£C¦Ðs�`¦ � ; º +Âo�5��¢j¡ ��; º <Â¡�,�;��*`Ã2Ó`¦�¡g¦ t� @ &B&H& ��'&sÜ�Ó`¦-Õ8Íj½¤`¦DÅ � � *�Ê9�� ¡� (nÍj¡g¦¢j§C�cÍJ¬N�`¦�£�Í!Å�Î�¢jN½¢8Ã�Å�á

�E@«��º�Ê!ÊH(6 ��CÊK* v* Â�º g@| #�E@tÍj�s£.�vº��E*M �Âc��DÂ�¯� � ��º�ÊR(; A�:Ê'*ÊK*�ÊDÂ�º � V @ � � ÍJ�s£W�vºS� � *,V @ ÂT�/� @ ÂA¯��h��ºS(6 ��CÊK*cæ�*Ê�Â�º� !�Bk��%�ÏÍj�s£W�vºS�R@e* k`Âc��$@Â�¯� � ��º� A�:ÊK* ��*�ÊDÂA¯A�� xº� E+�ÊK*�ÊK*�ÊDÂ|*<º � kA� � * � k�� Íj�s£F�vºS� @ * k`Âc�/� @ Â�¯� � ��º2�CÊK*B!�æ�* ÂA¯Xº � V � � � ÍJ�s£F�vº�� @ *,V � Â¡�� ÂA¯� � ��º�Ê'* �* !Â�¯�º � V)� � ÍJ�6£.�vº��e*,VTÂT��DÂ�¯��h��º��*Ê'*ÊDÂ�¯�º ��RV @ ��ÍJ�6£W�vº�� *IV @ Âc�/� @ ÂAÖ�q��ÈvÍ�©Ò§6¦-¢!§sÅg¦¡TÕj¦�£Ò�gÓsÍJ�� ¬ÇÅ�Ín§`¡T¦�ÍJü:Ä+¢j¬N� ��Õ8ÍJN¤`¦-¢jÎ_§+¢J�gÓ � ; Íj�s£��v�; º �� j¯ �� ÂAÖ�]��¢!¡T£C¦�¡É�T¢��T¦�Åd�n�s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅd�g¬Ç¥Ò¬NÈnÄs½¦�Èn¦�� TÍ8�T¬½¢!�sÅ�¯"¢!�`¦|¤sÅd¤6ÍJN½© ÈvÍJü!¦�ÅnÍ«Åg¢JÔ]¥Íj½N¦�£ ´ �8² �+¼N¸�Ù]¸�±

Ùq¸�¹AÙ\¶V·:Ài³8¹T¹��C² �+ÙL¶ �8·6¯<ù �� JûXÃ2Ó`¬N¥cÓ|ÅgÍ�©CÅ/�gÓsÍJ��¬½�2¬NÅ�Ä+¢!ÅTÅd¬N§`N¦j¯:§:©ÒÍJÄ`Äs½©:¬N�`®�Í�®j¬NÕj¦��Åg¦�ö ¤`¦�6¥�¦�¢jÎ"£`ÍJ�TÍÉÕ�Íj½¤s¦�Å¢n�g¢�Í�®j¬NÕj¦�«¬½ÈÁÄ`N¦ÈÁ¦��!�cÍ8�T¬½¢!�«ÍiÐs�`¬½�g¦Á�:¤`ÈÉ§+¦¡�¢JÎ/�g¬NÈn¦DÅ¯<�T¢�¦ÿC¦¡c¥�¬ÇÅd¦nÍJN��gÓ`¦nÄsÍ8�TÓsÅ�¢JÎ/�gÓ`¦Á¬NÈnÄs½¦�Èn¦��CÔ�TÍJ�g¬N¢j��TÓsÍ8��¥ÍJ��§+¦$�T¡TÍ�Õ!¦¡cÅd¦D£i§:©=¢!Ö � ¬½�gÓ`¢!¤C�-Åd¤s¥cÓPÍj�PÍjÅTÅd¤sÈnÄ`�g¬N¢j��¯6�`¢Ò�T¦�Åd�ÏÅg¤`¬Ñ�T¦�Åt¥ÍJ��®!¤sÍJ¡cÍJ� �T¦¦�Î�¤`NÎ4ÍJ¤`½�2¥�¢8Õj¦�¡TÍj®j¦�Î�¢j¡��`¢j�CÔ]£C¦�g¦¡TÈÁ¬½�s¬NÅd�g¬Ç¥�¬NÈÁÄ`½¦�ÈÁ¦� �TÍJ�g¬N¢j�sÅ�Öj�]�v�T¦¡TÈvÅ/¢jÎ<Ø�ÔLÈvÍ!¥cÓ`¬½�s¦�Å�¯J�gÓs¬NÅ�ÈÁ¦�ÍJ�6Å��TÓsÍ8��TÓ`¦ÍJÄ`Äs½¬Ç¥ÍJ�g¬N¢j��¢JÎ�ÍvÅg¦��¢JÎ�Åg¦�ö ¤`¦��s¥�¦DÅ��v�g¢Á�TÓ`¦$¬NÈÁÄ`½¦�ÈÁ¦� �TÍJ�g¬N¢j��ÍnÐs�`¬½�g¦$�:¤`È�§6¦�¡�¢jÎ_�T¬½ÈÁ¦�Å�Ã2¬½N�¡T¦�Åg¤`½��¬½��Íº�§`¡T¦�Íjü:Ä6¢!¬½� �cÂ�¥¢jÈÁÄ`¤C�cÍ8�T¬½¢!��¢jÎ_�TÓ`¦-¬½ÈÁÄ`N¦ÈÁ¦��!�cÍ8�T¬½¢!��Ö× Åg¦��¢JÎ�Åg¦�ö ¤`¦��s¥�¦DÅ�¢JÎX£`Í8�cÍ-Åd¦�/Õ8ÍJN¤`¦�Å �-Ã2¬½N6£`¦��g¦D¥A��Íj½`�gÓ`¦2Î4Íj¤`½�TÅ�¢jÎ<Íj�v¬½ÈÁÄ`N¦ÈÁ¦��!�cÍ8�T¬½¢!�� ÍJ® ÍJ¬N�sÅ��

ÍÒÅgÄ6¦D¥�¬½Ð6¥ÍJ�g¬N¢j� �õ¬ÑÎ��TÓ`¦�ÍjÄ`Ä`N¬N¥�Í8�g¬N¢j��¢jÎ��ÍÒÅg¤�/Ò¥�¬N¦� ��:¤`ÈÉ§+¦¡t¢JÎ��g¬NÈÁ¦�Å�º�¬LÖ ¦!Ös�T¢Ò¦�ÿC¦¡c¥�¬ÇÅg¦$ÍJN��gÓs¦$ÄsÍ8�TÓsÅ¢JÎ �ÛÍj�s£ �9�s�gÓ6Í8�2¥ÍJ�i§6¦t�g¡cÍ�Õj¦�¡TÅg¦�£Á§:© � Â��g¢ ��ÍJ�6£ �9�+Ã2¬Ñ�TÓi¬Ç£C¦� �g¬Ç¥Íj6¢!¤C�gÄs¤C��¡T¦�Åg¤`½�TÅ�®j¤sÍj¡TÍj� �g¦¦DÅ��TÓsÍ8��ÚÍj�s£��9��Ã2¬NN�§6¦�ÓsÍ�Õj¦n¬N£`¦� �g¬Ç¥Íj½N©�Î�¢j¡-Íj� ©PÅg¦�ö ¤`¦��s¥�¦Á¢jÎ�£`Í8�cÍ�Åd¦��Õ8Íj½¤`¦DÅÖ �:¤6¥cÓ¨Í�Åg¦��Ã2¬½N�§+¦Á¥�ÍJN½¦D£�Í��¾�¿g¸c³�� 8¶V·6Ù �ÒÙ]¸A¹AÙ/¹�¸Ù � � � ³8·"? �9�\Öw�7Ex�9_=4;�=\3698y�� :�� -°-±]²v³jćµ:¶V·+¸�¹ � ³8·B? �9��³J¿g¸-ć³8¼V¼½¸ ?Ï�T¦�Åd�g¬N�`®JÔ]¥�¢!ÈÁÄsÍ8�T¬½§`N¦n¶ � Ù�µ`¸¶V¿9?!³8Ù]³�¹�¸Ù\¹I�_¹¸�Ù\¹ � �¾c³�¹A¶4´ �+¿��Dć¸A¹c¹A¶V· À�¿g¸¼½³8ÙL¶ �8·s¹,��³8·B? ��CÙ � �CÙ � �C·+´Ù\¶ �J·`¹$´ �8¶V·+´¶�?j¸R�w�7Ex�9_=4;�=\3698yiy6��¸Ù�� º�2=*,~?* 34*I�4*C� � *I^v*,°)*C`JÂÝ³8·B? �9�� º�2=*,~9��* 34*C�9��*C�G�� *I^v*,°)*C`JÂÝ¾ç ÙU� ��°$±²Á³!´TµC¶V·+¸�¹PÙVµs³8ÙÁ³8¿g¸�Ùq¸�¹AÙ\¶V·:ÀJ±d´ �J² �s³8ÙL¶4¾�¼N¸H� :<µ`¸· ³ � ·6¶VÙq¸|¹¸Ù �86 2 � ¶Ç¹�ć³8¼V¼N¸ ?l³�§`¡T¦�Íjü:Ä6¢!¬½� �Á�g¦DÅ��iÅg¦�� *³8·"? �9�/¶ � �_µ`¸·+¸ �¸¿-ÙVµs¸�¿T¸É¸I�j¶Ç¹AÙ-� ; ³8·"? � ; ª ÙU� �Ò¾�¿T¸T³�� 8¶V·6Ù�´ �J² � �CÙq³JÙ\¶ �J·`¹ � � �*³8·"? �9��*�¿g¸�¹ �`¸c´±Ù\¶ 8¸¼§{$�¡��¶VÙ�µs`�n � ; º +Â¡�`�n � ; ª º <Â|* t- �=�/¸�µ`³ �¸XV ; �#V ;

ª &� �JÙq¸ �K�#�`¢!¡_��Ã�¢�Ø�ÔqÈvÍj¥cÓ`¬N�`¦�Å � ÍJ�s£ �9��*8¬ÑÎg�Éº�$Â�ÍJ�s£?�Éº�9�NÂ�Íj¡g¦�¦�ö ¤`¬NÕ8ÍJN¦� ��ÍJ¤C�T¢jÈvÍ8�cÍt�gÓ`¦��sV ; �/V ; ª ÖÆ�¢8Ã�¦Õ!¦¡D¯j�TÓ`¦$¥�¢!� Õ!¦¡cÅd¦�¬½ÈÁÄ`N¬N¥�Í8�T¬½¢!��¬ÇÅ��`¢J��T¡g¤`¦!¯CÍjÅ�¬½��¬ÇÅ�¦�Í!Åd©n�T¢Á¥¢j�sÅd�g¡T¤s¥��Ã�¢É�T¦�Åd�g¬N�`®v¥�¢!ÈnÄ6Í8�g¬N§`N¦�Ø�ÔÈvÍj¥cÓ`¬N�`¦�Å��TÓsÍ8��¥¢jÈÁÄ`¤C�T¦-¬N£`¦� �g¬Ç¥ÍjX¡g¦�NÍJ�g¬N¢j�sÅ2Íj�s£iÓ6Í�Õj¦��`¢j�`ÔL¦Dö!¤s¬½Õ8ÍJN¦� �2ÍjÅTÅd¢C¥¬NÍJ�g¦�£|ÍJ¤`�g¢jÈvÍJ�TÍ`Ö

�:¬NÈn¬NÇÍJ¡|�g¢l�gÓ`¦ £C¦�g¦¡TÈÁ¬½�s¬NÅd�g¬Ç¥ ¥ÍjÅg¦lù æ7�JûL¯�ù æ�(Dûq¯��gÓ`¦¨¬Ç£C¦�Íl¢JÎÉ¢!¤`¡�ÈÁ¦��gÓs¢:£z¬NÅ��T¢lÄ`¡T¢8Õj¦¨ÍlÅd�g¡T¢j�s®j¦¡¡g¦Dö ¤`¬½¡T¦ÈÁ¦��!�D¯:�gÓsÍJ�2¬NÅ��TÓsÍ8��gÓs¦��Ã�¢ÁÍjÅTÅd¢C¥¬NÍJ�g¦�£iÍJ¤C�T¢jÈvÍ8�cÍ�Íj¡g¦�¦�ö ¤`¬NÕ8ÍJN¦� ��Ö:�]�|�gÓs¬NÅ�Ã�Í�©j¯:¬N��¢!¡T£C¦�¡��g¢n�g¦DÅ��gÓ`¦n��Ã�¢�Ø�ÔLÈvÍ!¥cÓ`¬½�s¦�ÅÏÃ�¦Á¥Íj��¤sÅg¦��gÓ`¦n�g¦DÅ��$Åg¦��cÅt¢jÎ��gÓs¦ÁÍ!ÅgÅg¢C¥�¬ÇÍ8�T¦�£PÍj¤C�g¢!ÈÁÍJ�TÍsÖ<Æ�¢8Ã�¦�Õj¦�¡�¯s�gÓ`¬ÇÅ�¬N£`¦�Í|¥ÍJ�¢j�`N©�Ã�¢j¡Tü�¬½Î�¬½�$¬NÅ$Ä6¢ ÅgÅg¬½§s½¦n�g¢P£`¬NÅd�g¬N�`®j¤s¬NÅgÓ §6¦��Ã�¦�¦��ÍJ�:©��Ã�¢�Äs¡g¢C¥�¦DÅgÅg¬N�`®�¡g¦�NÍJ�g¬N¢j�sÅÏ¤sÅg¬½�s®PÍJÄ`Ä`¡T¢jÄs¡g¬ÇÍ8�T¦Õ8ÍJN¤`¦�Å�Öw�7Ex�9_=4;�=\3698y��X�3zt·P°-±]²v³jćµ:¶V·+¸v¶Ç¹Áć³8¼V¼½¸ ?ÁÃ�¦�Íjü�¢j¤C�TÄ`¤C�dÔ]£C¬ÇÅ��T¬½�s®j¤`¬ÇÅdÓ6ÍJ§`N¦�¶ � � �J¿Á³J·v{sVi* k�- 34*�¶ � Ù�µ`¸¿g¸¸C�!¶Ç¹AÙ �* i�@ *! �� -�2��¶VÙ�µ� iV i�@ *! �k �� ³8·B?�`Cº i�@ Âc�#`Cº i�� Â$ÙVµs¸�·FV.�ki&zt·�°$±]²Á³!´TµC¶V·+¸�¶Ç¹�ć³8¼V¼N¸ ?�Åd�g¡T¢j�s®�¢!¤C�gÄs¤C�dÔ]£C¬ÇÅ��T¬½�`®!¤`¬ÇÅdÓsÍj§`N¦t¶ � � �8¿�³J·v{4Vi* kf- 34*:¶ � Ù�µ`¸¿g¸2¸C�!¶Ç¹AÙ �*! ��@ * �� -

2��¶VÙVµ iV i�@ *! �k �� ³8·B?�`Cº i�@ ÂT�/`Cº i�� Â$ÙVµs¸�·WVW�qk�³J·B?% i�@ � i�� &

41

Ü�Ó`¦ÉØ�ÔLÈvÍ!¥cÓ`¬½�s¦$¬½�«ª�ÿ`ÍJÈÁÄ`N¦ÒÊÉ¬ÇÅ�Åd�g¡T¢j�s®Ò¢j¤C�TÄ`¤C�gÔq£C¬ÇÅd�g¬N�`®j¤`¬ÇÅgÓsÍJ§`N¦��+¬N�P¢j¡c£C¦¡��g¢iÈÁ¦�¦��TÓ`¬ÇÅ�Ä`¡T¢jÄ+¦¡g��©�gÓ`¦$£`¤`ÈÁÈÉ©iÕ8Íj½¤`¦DÅX!-ÊK*g!�æ�*g! �nÍj�s£1!2ènÃ�¦¡T¦�¤sÅg¦�£�¬½�|�gÓs¦$£C¦�Ðs�s¬Ñ�T¬½¢!�sÅ2¢JÎAQE*�V � *��PÍJ�s£. ,*`¡g¦DÅdÄ+¦�¥��g¬NÕj¦�½©!Öó §:Õ ¬N¢j¤6ÅdN©j¯�¬½ÎB3P¬ÇÅ�ÍÏÅd¦��¢jÎ"º4ÄsÍJ¡g�g¬ÇÍJVÂ�Î�¤`�s¥A�T¬½¢!�sÅ�¡cÍ8�gÓs¦¡"�gÓsÍj��¡T¦ÇÍ8�T¬½¢!�sÅ�¯�Ã�¦�Íjü-¢j¤C�TÄ`¤C�dÔ]£C¬ÇÅ��T¬½�s®j¤`¬ÇÅgÍj§`¬N½¬½��©

ÍJ�s£-Åd�g¡T¢j�s®2¢j¤C�TÄ`¤C�dÔ]£C¬ÇÅ��T¬½�s®j¤`¬ÇÅdÓ6ÍJ§`¬N½¬½��©t¥¢j¬N�s¥�¬Ç£C¦!Ö�]��gÓs¬NÅ_Åd¦D¥A�g¬N¢j��¢!�`½©��gÓ`¦�ýJÃ�¦�ÍJüCý�¥�¢!�s£C¬½�g¬N¢j�-Ã2¬N½!§6¦/¤sÅd¦D£X¯�gÓ`¦$ý!Å��T¡g¢!�`®!ýn¥�¢!�s£C¬½�g¬N¢j�|Ã2¬½N�§+¦-¡g¦Dö ¤`¬½¡T¦�£�¬N��TÓ`¦-�`¦ÿ ��Åg¦�¥��g¬N¢j��Ö

�«¦n�`¢8Ã��s¦¦�£«ÍiÈÁ¦D¥cÓsÍJ�`¬ÇÅgÈ Î�¢!¡Ï�g¡cÍJ�sÅgNÍJ�g¬N�`®iÅg¦�ö ¤`¦��s¥�¦DÅt¢jÎ/Ä`¡T¢C¥�¦�ÅTÅg¬½�`®i¡g¦�NÍJ�g¬N¢j�sÅt¬½� �T¢|Åg¦�ö ¤`¦��s¥�¦DÅ�¢jÎ£`Í8�cÍ`ÖsÜ�Ós¬NÅ�¬ÇÅ�Í��g¦DÅ��2Î�¤`�6¥A�g¬N¢j��¯sÍjÅ2£C¦Ðs�`¦D£��s¦�ÿ:��Öw�7Ex�9_=4;�=\3698y�¬��¸Ù �:� º�2�*I~?* 34*C�4*C�B�K*I^v*I`JÂÒ¾çi³8·�°$±]²Á³!´TµC¶V·+¸R� :<µ`¸·l³ � �C·+´Ù\¶ �J· . ; á"3T�s!i[ 2O�¿g¸c´ �C¿c¹A¶ 8¸�¼ { ?j¸ � ·<¸ ?�³�¹ � �8¼V¼ �G��¹B�� . ; ºU�6ÂT��±� � �J¿¡¶�N �*�´ �J·`¹A¶�?j¸¿�. ; ?j¸ � ·<¸ ? � �8¿Ò³8·�{i¹AÙL¿A¶V· ÀsV @ &H&B&,V ".- 3T�$±2Ù�µ`¸· � �8¿Ò³8·�{i¹AÙL¿A¶V· ÀsV @ &H&B&,V "eV " � @ *. ; ºUVK@0&B&H&IV " V " � @Â-¶Ç¹É¸�¶VÙ�µ`¸¿ � � �

� ¶ � VK@0&B&H&IV " ¶Ç¹�³ �`³JÙVµ ¶V· �äÙ�µ`³JÙ$¸�²v¸�¿LÀ!¸�¹ � ¿��8²äÙ�µ`¸�¶V·s¶VÙL¶4³8¼�¹AÙq³JÙq¸��¨Ù�µ`¸·(. ; º�V'@0&B&H&IV " V " � @�Â��. ; ºUVK@0&H&B&IV " Â " � @G�c�_µ`¸¿g¸ " � @�-F^6ºUV " � @�Â� �JÙVµs¸�¿|��¶Ç¹¸�. ; º�V'@0&B&H&IV " V " � @�Âc�,. ; º�V'@0&B&H&IV " ÂB�

¶Ç¹�ć³8¼V¼½¸ ?|³��g¦DÅ��2Î�¤s�s¥A�T¬½¢!� � � �f��]��¢j�gÓ`¦�¡�Ã�¢j¡c£`Å¯6Î�¢j¡ÏÍJ�:©�Åd¦Dö ¤`¦�s¥¦É¢jÎ�Ä`¡g¢C¥¦�ÅTÅd¬N�`®Ò¡T¦ÇÍ8�T¬½¢!�sÅT¶!.4��V @ &B&H&IV "C¯<. ; º§¶!.dÂ�¬ÇÅtÍ�Åd¦Dö ¤`¦�s¥¦É¢jÎ

£`Í8�cÍn�gÓsÍJ�2¦�ÿC¦¡c¥�¬ÇÅd¦DÅ��gÓ`¦-N¢j�`®!¦�Åd�2Ä`¡g¦Ð`ÿi¢jÎi¶!.��gÓ6Í8��¬ÇÅ2Í�Ä6Í8�gÓ�¢jÎ_�TÓ`¦-ÈvÍj¥cÓ`¬N�`¦-ÍJ�s£|ÍJÇÅg¢��T¡g¬N¦�Å��T¢Á¦�ÿC¦¡c¥�¬ÇÅd¦�gÓ`¦-Äs¡g¢C¥�¦DÅgÅg¬N�`®�¡T¦ÇÍ8�T¬½¢!�i�TÓsÍ8�2Î�¢!½N¢8Ã�Å�Í8ÎV�T¦¡��gÓs¬NÅ2Äs¡g¦Ð`ÿX¯C¬ÑÎ"�gÓ`¬ÇÅ2¦ÿ:¬ÇÅd�TÅ�Ö'A�¢J�T¦��gÓsÍJ��Í��g¦�Åd��Î�¤`�s¥��g¬N¢j��¬NÅ��`¢J�¤`�`¬Çö ¤`¦N©�£C¦Ðs�`¦D£X¯C�gÓs¦¡T¦-ÈÁÍ�©v§+¦-ÈvÍJ�:©Ò�T¦�Åd��Î�¤`�s¥A�T¬½¢!�sÅ2¢jÎ_�TÓ`¦$ÅgÍjÈÁ¦ÏØ�ÔLÈvÍ!¥cÓ`¬½�s¦jÖ»��:³8² �+¼½¸ �i� �s¢j¡��gÓ`¦�Ø�ÔqÈvÍj¥cÓ`¬N�`¦Ï¬½�|ª�ÿ`ÍJÈÁÄ`N¦nÊj¯CÍ-�T¦�Åd��Î�¤s�s¥A�T¬½¢!�iÎ�¢!¡��TÓ`¦�Åd¦Dö!¤s¦�s¥¦� VK@,k'k�V$�HV��'��¥�ÍJ�Ò§+¦¥�¢!�sÅ��T¡g¤6¥A�g¦D£�ÍjÅ�Î�¢jNN¢8Ã�Åá

.�ºS ]Â=� @ .�º V @ Â=� @ � .�º V @ kCÂ=� @ � � .�º V @ kEk`Â=� @ � � � .�º V @ k'k�V � Â�� @ � � � �.�ºS V'@Ck'k�V$�HV�gÂT� �@ !� !� �� .�º VK@,k'k�V$�HV� �+Âc� g@ '� '� ��

� .�ºS V'@Ck'k�V$�HV� �'�6Âc�� @ !� !� �� Ã2Ó`¦¡T¦ @ * � *! � * � * � *! ��K* ��ÉÍJ¡T¦��gÓ`¢ Åd¦-¬N�Pª�ÿ`ÍJÈÁÄ`N¦%�`Ö6Ü�Ó`¦É¥�¢!�sÅd�g¡T¤s¥A�T¬½¢!�|¬ÇÅ�¥¢j¡T¡g¦D¥A��Åd¬N�s¥¦ @ -=^6ºS ]Â�* � -�^+º�V @ Â|*! � -�^+º k`Â|* � -1^6º kCÂ�* � -�^+º�V � Â|*! ��-�^+º�V Â|*! ��-�^+º3�+ÂA¯i V @ kEk�V � V ¬ÇÅ�ÍvÄ6Í8�gÓ�Î�¡T¢jÈ � � §`¤C� V @ kEk�V � V ��¬NÅ��s¢J��ÍnÄsÍ8�TÓ|Î�¡g¢!È7� � Öw�7Ex�9_=4;�=\3698y;³��3z Ùq¸�¹AÙ � �C·+´ÙL¶ �8· . ; ¶Ç¹2ć³J¼V¼½¸ ?«Lv�sÍJ�g¤`¡cÍJ��ELON æ�*`¶ � � �8¿�³J·v{�VK@G*B&B&H&�*IV " - 34*� �@e*B&H&B&B*! " -2 � �8¿�³J¼V¼�ÊX�O¶t��L�*_¶ � . ; º�VK@A&B&B&,V " Âc� g@0&B&H& " Ù�µ`¸· ��bVG� �� @ � �J¿�³8¼V¼_ÊX�� ¡��¶f!ÝÊe&Ü�ÓsÍ8�"¬NÅ�¯�Í��g¦DÅ��_Î�¤`�s¥A�T¬½¢!�É¬ÇÅ�Lv�sÍJ�g¤`¡cÍJ!Ã2Ó`¦��¯Î�¢!¡"Íj� ©�Åg¦�ö ¤`¦�6¥�¦�¢jÎ`§sÍjÅg¬N¥�Ä`¡g¢C¥¦�ÅTÅd¬N�`®2¡T¦ÇÍ8�g¬N¢j�6Å�¢JÎ`N¦�s®J�gÓ

Í8�/ÈÁ¢ Å��cL�¯j�gÓ`¦�Õ8Íj½¤`¦DÅ�Ä`¡T¢C£C¤s¥�¦D£n§ ©É�gÓ`¦��g¦�Åd��Î�¤`�6¥A�g¬N¢j�ÒÍj¡g¦�¥cÓs¢!Åg¦�vÅd¤6¥cÓ��TÓsÍ8�/�gÓ`¦��s¦�ÿ:��Õ8ÍJN¤`¦�¬ÇÅ�¢j§C�cÍJ¬N�`¦�£Î�¡g¢!È �TÓ`¦$¥�¤`¡T¡T¦� ��Õ8Íj½¤`¦��TÓ`¡T¢j¤`®!ÓÒ�gÓs¦$ÍJÄ`Ä`N¬Ç¥Í8�T¬½¢!��¢jÎ_�TÓ`¦-¥�¢!¡g¡T¦�ÅgÄ6¢!�s£C¬N�`®nÄ`¡g¢C¥¦�ÅTÅd¬N�`®n¡g¦�NÍJ�g¬N¢j��Ö`ª�ÿCÍjÈÁÄ`½¦èÒÅdÓs¢8Ã�Å/�TÓ`¦$¥�¢!�sÅd�g¡T¤s¥A�T¬½¢!��¢jÎ"ÍÁèÁ�sÍ8�T¤`¡cÍJ<�g¦DÅ��Î�¤`�6¥A�g¬N¢j��Ã2Ós¬N¥cÓ|¬NÅ��`¢J� ��sÍ8�T¤`¡cÍJ�º4Åg¬N�s¥�¦% ��-JkXº ��ÂgÂ|&� {"7 36587:� y+� _¸�Ù �p�Ûº�2=*I~s* 34*C�4*I� � *C^�*I°)*I`JÂ�³8·"? �9��º�2=*I~3� * 34*I�9�U*C�G�� *C^�*I°)*I`JÂ�¾ç�Ù�� 2°$±]²Á³!´TµC¶V·+¸�¹ÙVµs³8Ù�³8¿T¸$Ù]¸A¹AÙL¶V· Àj±d´ �8² �`³JÙ\¶4¾¼½¸Á³8·"?f�/¸c³ � � �CÙ � �CÙ\±@?J¶Ç¹cÙL¶V· À �C¶Ç¹gµ`³!¾�¼½¸��/¼½¸Ù�. ; ¾ç�³iÙq¸�¹AÙ � �C·<´�ÙL¶ �8· � � �72�6 3T�³8·"?��J��. ; ºb2-Â|&�� Ù�µ`¸¿g¸v¸I�j¶Ç¹AÙ � ; ³J·B? � ; ªtÙU� ��¾�¿T¸T³�� 8¶V·6Ùt´ �8² � �CÙ]³8ÙL¶ �8·s¹ � � � ³J·B?��9��*�¿g¸A¹ �s¸c´�ÙL¶ �¸¼§{$��¶VÙVµJ`�n � ; º� +ÂT�/`�n � ; ª º <Â|* =- �«Ù�µ`¸·.�Éº�$ÂÉ³J·B?3��º��9�VÂÉ³J¿g¸X2n±d¸,µ �C¶ 8³8¼½¸·sÙ ��¿�� _¸ÙAV @ &H&B&,V D -=24&��¸ �+¿ ��8¸ÉÙ�µ`³JÙAV @ &B&H&CV D ¶Ç¹É³ �s³8Ù�µ�¶V· � ¶ �#V @ &H&B&CV D ¶Ç¹É³ �`³JÙVµ�¶V· �9�b�� ¶ � V @ &B&H&IV D ¶Ç¹Ï³ �`³JÙVµ�¶V· �(Ù�µ`¸· � ¿��8²�²n¸ � ·s¶VÙL¶ �8·=��$Á¶VÙ�¿g¸A¹��C¼ Ù\¹�Ù�µ`³8Ù�Ù�µ`¸¿g¸-¸I�!¶Ç¹cÙ � -t^'`$a º�V � Â � �8¿-³8¼V¼ÊX�_ c��L�¹��s´Tµ�Ù�µ`³JÙ . ; º�V @ &H&B&,V D Âc� @ &B&H& D ³J·B?nÙ�µ`¸¿g¸-¸C�!¶Ç¹AÙ � @ *B&B&H&�*)� D - 2 ¹��sćµ�ÙVµs³8Ù � V � � � � �8¿³J¼V¼_Ê��/ 4�L�&�z�ć´ �8¿ ?J¶V· À�Ù ��²n¸ � ·s¶VÙL¶ �8·��W�/¸n²Á³e{�?j¸ � ·<¸Á³|¾¿g¸c³ � � �8¶V·sÙ�´ �J² � �CÙq³JÙ\¶ �J· � �C·<´�ÙL¶ �8· � ;¹��sćµ$Ù�µ`³JÙ!� ; º @ &B&H& D Âc� � @ &H&B& � D &'� � Ù�µ`¸¿g¸�¸I�j¶Ç¹AÙ\¹�� ; ª ³�¹/¹AÙ]³8Ù]¸ ?Ï¶V·vÙVµs¸/µ;{ � �8Ù�µ`¸�¹A¶Ç¹ � � Ù�µ:¶Ç¹�ÙVµs¸ �8¿g¸²��¹��sćµ«ÙVµs³8ÙT`�n�� ; º @ &B&H& D Â��`�n � ; ª º� @ &B&B& D ÂnÙ�µ`¸·�¶VÙ � �J¼V¼ �G��¹vÙ�µ`³8Ù�ÙVµs¸�¿g¸i¸C�!¶Ç¹AÙ ��@ *B&B&H&B* �;�D - 2¹��sćµlÙVµs³8Ù�`�n � ; ªgº @ &B&H& D ÂJ� � �@ &B&H&)� �D &�� J·`¹¸,µ �s¸·sÙL¼§{¨ÙVµs¸�¿T¸�¸I�j¶Ç¹AÙ�V �@ *B&H&B&H*IV �D - 37��¶VÙ�µ � V �� J¿i³8¼V¼/ÊF�� 9��L�*2³8·B?J`Cº � @ &B&B& � D Â9��`Cº��;�@ &B&H&)��D Â�&$�+¶V·+ć¸83 ¶Ç¹?�/¸c³�� CÙ � �CÙ\±@?J¶Ç¹cÙL¶V· À �C¶Ç¹gµ`³!¾�¼½¸�³J·B?`Cº�� Â��`Cº �� Â,��¾�{�¶V·B? �s´�ÙL¶ �8· �J·¨Ê?�� #LA��¶VÙ � �8¼V¼ �e��¹nÙ�µ`³JÙTV � ��V�� ³J·B?vµ`¸·+ć¸3V @ &B&B&IV D ¶Ç¹v³ �s³8Ù�µ¶V· �9� �

42

� ¶ � V @ &B&B&IV D ¶Ç¹�· �8ÙÁ³ �s³8Ù�µ?¶V· � Ù�µ`¸·z¼½¸Ù ��-�" v*B&H&B&|*ML¤!ÛÊe%l¾çPÙ�µ`¸P¼½³8¿LÀ!¸�¹AÙ�· �C²Á¾ç¿ � �J¿t�_µ:¶4ćµV @ &H&B&,V��¶Ç¹�³ �`³JÙVµ�¶V· �4&�:<µs¸�·�³jć´ �8¿ ?J¶V· À|Ù ��²n¸ � ·s¶VÙL¶ �8· ��$W�/¸-µ`³ �¸ . ; ºUV @ &B&H&IV D Â4� @ &H&B& �� @� �J¿Á¹ �J²Á¸� � - 2=*�Ê.�� 3� � � Ê'& _¸�Ù �:¹v³8¹c¹ �C²v¸vÙ�µ`³JÙ4V @ &B&H&IV�� @ ¶Ç¹i³ �s³8Ù�µ ¶V· � � & :<µ`¸·lÙ�µ`¸¿g¸¸I�!¶Ç¹cÙ � @ *B&H&B&�* �� @ - 2 ¹��s´TµzÙ�µ`³8Ù � V � � � * � -�^+º�V � Â,� � �8¿ ³8¼V¼�Ê/�� 1� ��õÊ?³J·B?+� ; ª ��¶VÙ�µ� ; ª º� @ &H&B&! �� @ Â�� @ &H&B& �� @ & :<µ`¸·ÝÙVµs¸�¿g¸|¸I�j¶Ç¹AÙ�V��@ *H&B&H&B*IV�� @ - 34*)��@ *B&H&B&H*)�� @ -,2 ¹ �sćµ ÙVµs³8ÙV��@ &H&B&,V�� @ ¶Ç¹n³ �s³8Ù�µ«¶V· � ³J·B? ��bV�� ;�� 8¿Ò³8¼V¼�Ê?�# �� Ê�³8·"??`Cº �E@�&B&H& � � � @�Â��p`Cº��@ &H&B&)�� @ Â�&��¸�·<´T¸h`Cº �K�qÂc�#`Cº �� Â � �J¿É³8¼V¼�Ê9�_ c�5� � Ê'& �+¶V·+ć¸ 3 ¶Ç¹9�/¸c³ � ��CÙ � �CÙL±@?8¶Ç¹AÙL¶V· À �C¶Ç¹gµ`³j¾¼½¸��¾B{v¶V·B?��s´ÙL¶ �8·�J·PÊX�� ¡� � �?Êe��¶VÙ � �8¼V¼ �e��¹$ÙVµs³8Ù0Ve��#V�� ³8·B?�µ`¸·+ć¸�V'@0&B&H&CV � � @v¶Ç¹-³ �`³JÙVµ�¶V· �£�_µ:¶4ćµP´ �8·6Ù\¿T³�?8¶4´Ù\¹� �C¿-³8¹c¹ �C² �+ÙL¶ �8·�� :<µ �:¹hVK@0&H&B&CV � � @Ò¶Ç¹�· �8Ù�³ �s³8Ù�µ�¶V· �9�U&

â 3s583+1414B`5Dß�y6��_¸�Ù#�p�Ûº�2�*I~?* 34*C�4*C�B�'*I^v*,°)*C`JÂ�³8·"? �9��º�2=*I~3�S* 34*C�9��*C�G�� *C^�*I°)*I`JÂ�¾ç�ÙU� ��°$±]²Á³!´TµC¶V·+¸�¹ÙVµs³8Ù�³8¿g¸�Ù]¸�¹cÙL¶V· Àj±d´ �8² �`³JÙ\¶4¾¼½¸�³8·B?s�/¸T³�� CÙ � �CÙ\±@?J¶Ç¹cÙL¶V· À �C¶Ç¹gµ`³!¾�¼½¸�³8·"?Á¼½¸Ù . ; ¾ç$³vÙq¸�¹AÙ � �C·+´Ù\¶ �J· � � �4&�� 2¶Ç¹É³ÁÙq¸�¹AÙ�¹¸Ù � � ��º��$ÂÉ³J·B?��Éº��9�ÇÂ�¹��sćµ|Ù�µ`³8Ù�¸C�!¶Ç¹AÙ�� ; *'� ; ª ÙU� �Ò¾¿g¸c³ � � �J¶V·sÙ2´ �8² � �CÙ]³8ÙL¶ �8·`¹ � � �*³J·B? �9��*¿g¸�¹ �s¸c´�ÙL¶ 8¸�¼§{$�4��¶VÙ�µJ`hn � ; º� +Â«�8`hnB� ; ªdº� +Â�* O-(. ; ºU2-Â�*�ÙVµs¸�·". ; ºU2$Â$¶Ç¹n³�¾¿g¸c³ � � �J¶V·sÙ2Ù]¸A¹AÙ�¹¸�Ù � � � ³J·B?�9�U&

��¿�� 0�A·"?j¸ç ? � ¿��J² :<µ`¸ �8¿g¸² ��¶VÙ � �8¼V¼ �e��¹�Ù�µ`³8Ùc��º��$Ân³8·"?��º��9�VÂn³8¿g¸32n±d¸,µ �C¶ �³J¼½¸·sÙ�³8·"?|³!ć´ �J¿ ?8¶V·:ÀÙ �� E��$¶VÙ � �J¼V¼ �G��¹�ÙVµs³8Ù�ÙVµs¸�{i³J¿g¸�¸,µ �C¶ �³J¼½¸·sÙ2³8·B?|´ �8·s¹�¸,µ �s¸�·6Ù\¼ {9V ; ��V ; ª &Ü�Ó:¤sÅ¯'!�¢j¡T¢jNÇÍJ¡T©iÊt¥�ÍJ�v§+¦t¤6Åd¦D£Á�g¢�®j¦�s¦¡cÍ8�g¦tÍ$§`¡T¦�Íjü Ä+¢j¬N� ��g¦DÅ��2Åg¦��¢jÎ �ÛÍJ�s£ �9�� gÓs¬NÅ�¬NÅ ��,. ; ºU2-Â�*

Ã2¬Ñ�TÓ12�Í��T¦�Åd��Åd¦��¢JÎ0��º��$Â-ù½Ê� JûL¯Xù �JèjûL¯�ù½ÊèjûLÖA�¢j�g¦|�gÓsÍJ�Á�gÓ`¦|�g¦DÅ��vÅg¦��Ò£C¦�Ð6�`¦�£l¬½�l�gÓs¬NÅvÅg¦�¥��g¬N¢j�l¥¢j�sÅg¬ÇÅ��cÅ�¢jÎtÍ«� ¤sÈÉ§+¦¡v¢JÎÏÅd¦Dö!¤s¦�s¥¦�Ån¢JÎ�£`Í8�cÍ«Åg¦��

¦N¦ÈÁ¦� �cÅÖ�ª�Íj¥cÓ¨Åd¤s¥cÓ¨Åd¦Dö ¤`¦�s¥¦Á¦�ÿC¦¡c¥�¬ÇÅd¦DÅ�ÍiÄsÍJ�gÓ ¢JÎ��gÓ`¦ÁÈvÍj¥cÓs¬½�`¦vÍj�s£�¦DÍj¥cÓ«¦N¦ÈÁ¦� �$¢JÎ��gÓ`¦vÅg¦�ö ¤`¦��s¥�¦¬NÅiÍJÄ`Ä`N¬N¦�£l�g¢ �TÓ`¦�Ä`¡T¢:¥¦�ÅTÅd¬N�`®¨¡g¦�NÍJ�g¬N¢j�l�gÓsÍJ�ÒNÍj§6¦�NÅv�gÓ`¦P¥¢j¡T¡g¦DÅdÄ+¢j�s£`¬½�`® ÍJ¡c¥J¯�¡T¦® ÍJ¡c£CN¦�ÅTÅÉ¢jÎt�TÓ`¦�¡g¦DÅd¤sÑ�¥�¢!ÈnÄs¤C�g¦D£ §:©��TÓ`¦|Ä`¡g¦�Õ:¬½¢!¤sÅ$ÍJ¡c¥JÖ"Ü�ÓsÍ8�n¬NÅ�¯_�gÓ`¦�ÍJÄ`Äs½¬Ç¥ÍJ�g¬N¢j��¢JÎ2�TÓ`¦Ò�T¦�Åd�nÅg¦��nÓsÍJÄ`Ä+¦�6Å�Í!Å$�TÓ`¢j¤`®!Ó Í8ÎV�T¦¡Ä`¡T¢:¥¦�ÅTÅd¬N�`®vÍJ�PÍj¡T¥t�TÓ`¦$ÈvÍj¥cÓ`¬N�`¦$Åd�g¢!ÄsÅ�ÍJ�6£�¡T¦�¥¦¬NÕj¦DÅ2ÍÁ�`¦Ã £`Í8�cÍÁÕ8ÍJN¤`¦-Î�¡T¢jÈ �TÓ`¦-�T¦�Åd��Åd¦��Ö �¨¦É¥�ÍJNX�gÓ`¬ÇÅ�gÓ`¦i¾¿g¸c³ � � �8¶V·sÙ��g¦DÅ��T¬½�`®ÒÅd�g¡cÍ8�T¦®!©ÁÎ�¢j¡2Ø�ÔqÈvÍj¥cÓ`¬N�`¦DÅÖ×�½�gÓ`¢!¤`®jÓÁ�`¢j��¤`�:¤sÅg¤sÍJC¬N�ÁÄ`¡TÍ!¥A�T¬N¥¦j¯��gÓs¦2�`¦¦D£É�T¢-Ä`ÇÍj¥�¦�§`¡T¦�Íjü:Ä6¢!¬½� �TÅ�ÍJÎV�g¦�¡�¦�Íj¥cÓÁÍJ¡c¥�¢JÎ+�gÓ`¦2ÈvÍ!¥cÓ`¬½�s¦�¬ÇÅ

Ä`¡T¢:¥¦�ÅTÅd¦D£$Ã2¬N½:¢!§ Õ:¬N¢j¤sÅgN©�¥¢jÈÁÄ`N¬N¥�Í8�T¦/�TÓ`¦��g¦�Åd�g¬N�`®�Ä`¡T¢C¥�¦�ÅTÅ�Ö��£C¦DÍJN½©!¯�¢j�`N©��gÓ`¦�¬N�`¬½�g¬ÇÍJ:Õ8ÍJN¤`¦�¢JÎ`�TÓ`¦2£`Í8�cÍtÅg¦��Ã2¬½N<ÓsÍ�Õj¦��g¢É§+¦tÅg¤`Ä`Äs½¬N¦�£Ò�g¢$�TÓ`¦ÏÈÁÍ!¥cÓ`¬N�`¦j¯j�gÓ`¦�Åd¤s§sÅd¦Dö ¤`¦� ��Õ8Íj½¤`¦DÅ/Ã2¬NN6§+¦Ï¥¢jÈÁÄ`¤C�T¦�£v§:©n�gÓs¦�Ä`¡T¢C¥�¦�ÅTÅg¬½�`®¡g¦�NÍJ�g¬N¢j�sÅ��TÓsÍ8��ÈvÍJü!¦t¤sÄ��TÓ`¦�ÄsÍ8�TÓiÎ�¢!½N¢8Ã�¦�£Ò§:©v�TÓ`¦-ÈvÍj¥cÓ`¬N�`¦ÁºV�TÓ`¬NÅ�¬NÅ2ÍjNÅg¢É�TÓ`¦-¬Ç£C¦�Ín§+¦Ó`¬N�s£��gÓ`¦-¥¢j�s¥¦ÄC�¢JÎ_Íj�JLÝ·+³JÙ �C¿g³J¼8�g¦DÅ��Î�¤`�s¥��g¬N¢j��£C¦�Ð6�`¦�£�ÍJ§+¢8Õj¦DÂ�Ö Ü�Ós¬NÅ�ÈvÍ�©n�s¢J�2ÍJNÃ�Í�©CÅ�§+¦ÏÄ6¢ ÅgÅg¬½§s½¦!¯:Åg¬N�s¥�¦t¬½��®j¦�s¦¡cÍJ+�`¢J�ÍJNX�gÓs¦-ÄsÍ8�TÓsÅ�¢JÎ"�gÓ`¦-ÈvÍ!¥cÓ`¬½�s¦�¥�ÍJ�|§6¦-¦ÿC¦¡c¥�¬ÇÅd¦D£i§:©iÍjÄ`Ä`¡T¢jÄ`¡T¬NÍJ�g¦Ï¬½�s¬Ñ�T¬NÍj�Õ8ÍJN¤`¦�Å�¢jÎ��gÓs¦$£`Í8�cÍvÅd¦��ÖÆ�¢8Ã�¦Õ!¦¡D¯_¬½ÎÏÍ«Õ8ÍJN¤`¦�¥ÍJ�l§6¦�¢!§C�TÍj¬½�s¦�£ §:©�ÍjÄ`Ä`N©:¬½�`®«�gÓs¦�ÍjÄ`Ä`¡T¢jÄ`¡T¬ÇÍ8�g¦�Ä`¡T¢:¥¦�ÅTÅd¬N�`®«¡g¦�NÍJ�g¬N¢j� �T¢��TÓ`¦

Ä`¡T¦Õ:¬½¢!¤sÅ�Õ8ÍJN¤`¦v¬N�«�TÓ`¦iÅg¦�ö ¤`¦��s¥�¦n�gÓs¦�¨�gÓ`¦�¡g¦v¬ÇÅ-�`¢��s¦¦�£«�T¢�Åg¤`Ä`Äs½©��gÓsÍJ�ÉÕ8ÍJN¤`¦n�g¢��gÓs¦ÒÈvÍj¥cÓ`¬N�`¦j¯�Åg¬N�s¥�¦¬Ñ��Ã2¬½N�§+¦ÒÅd¬NÈÁÄ`½©¨¥�¢!ÈnÄs¤C�g¦D£ § ©�¬Ñ�DÖ_Ü�Ó:¤sÅÏ�gÓs¦iÅd¦Dö ¤`¦�s¥¦Á�`¦¦D£`Å-�`¢j�É¥�¢j� �cÍJ¬N��TÓsÍ8�$Õ8ÍJN¤`¦!¯�ÍJ�s£«�TÓ`¬NÅÉ¥ÍJ�§6¦É¡g¦�Ä`NÍ!¥�¦D£i§:©�ÍvÅg©:ÈÉ§+¢jX�TÓsÍ8��¬N�s£C¬Ç¥ÍJ�g¦DÅ��gÓ`¬ÇÅ�Ö6Ü�Ó`¬ÇÅ2¬Ç£C¦�ÍÁN¦�Í!£`Å��g¢Á�TÓ`¦É¥�¢!�s¥�¦�ÄC��¢JÎ�¸I�jÙ]¸·B?j¸ ?ÒÙq¸�¹AÙ/¹¸Ù�ÍjÅÄ`¡T¦�Åg¦� �g¦D£i�`¦ÿ:��Ö

1 h��ì��ëtï��ï ì��!ì��E�Xìlî�� $��ñv tòdëh��¦�$¤sÅtÐs¡TÅd�$¥�¢!�sÅd¬Ç£C¦�¡�Åg¢jÈÁ¦n�`¢J�cÍ8�T¬½¢!�sÅ-ÍJ�s£«£C¦�Ð6�`¬Ñ�T¬½¢!�sÅ�Ö��qÎoQ �- 2 ÍJ�s£ 2� $£C¦��`¢J�T¦�Å�2/��"RQ'%'*+�gÓs¦�«Î�¢j¡ =-�2� 8¯��f- 2 Ã�¦-£C¦�s¢J�g¦�§:©JL��A@� �º �*)�`Â�¦�¬Ñ�TÓ`¦¡� �*`¬ÑÎ ��/Q$¢j¡ ��*`¬½Î .�#QE&×�� ¦�ÿ:�T¦�s£C¦D£�§s¡g¦DÍJü:Ä6¢!¬½� �$¥�¢!ÈÁÄ`¤C�TÍJ�g¬N¢j�¨Ã2¬½N�§+¦ÁÎ�¤`¡d�TÓ`¦¡-¢!�¨¥¢j�sÅg¬Ç£C¦¡T¦�£«ÍjÅ-Í|�sÍ8�T¤`¡cÍJ�¦�ÿ:�g¦��sÅg¬½¢!�«¢jÎ

§`¡T¦�ÍJü:Ä+¢j¬N� �2¥¢jÈÁÄ`¤C�cÍ8�T¬½¢!�� ; *C¬N�!�T¡g¢C£C¤6¥�¦�£|§:©iåt¦�Ðs�s¬Ñ�T¬½¢!��ËsÖw�7Ex�9_=4;�=\3698y �X�%� �J¿�³8·�°-±]²v³jćµ:¶V·<¸ �¡��³ �s³8¿AÙL¶4³8¼ � �C·+´Ù\¶ �J· � ; á=2�2 � !�[ 2 � ć³8¼V¼½¸ ?|ÍJ��¦�ÿ:�g¦��s£C¦�£§`¡T¦�ÍJü:Ä+¢j¬N� �2¥¢jÈÁÄ`¤C�cÍ8�T¬½¢!��¢jÎ � ¶Ç¹ ?j¸ � ·<¸ ?i³�¹ � ; º @ &B&H& D Âc�5� @ &B&B& � D *_¶ � ÙVµs¸�¿g¸n¸I�j¶Ç¹AÙ\¹-³ �`³JÙVµ.V @ &H&B&IV D� ¿��8²�� ¹ �sćµ ÙVµs³8Ù� @ V @ � @ * @ -/^6ºUV @ Â|*�³8·"?fL��A@� 8º� � *)� � �g@ ÂMV � � � *�L��A@� �º � *)� � �g@ Âs-/^+º�V � Â|*/æ �� )��L�*L1N �&

��¬Nüj¦ � ; £C¦�Ðs�s¦�£$¬N�$�TÓ`¦�Ä`¡T¦Õ:¬½¢!¤sÅ"Åd¦D¥A�g¬N¢j��¯�Î�¢!¡"Ít�`¢!�CÔq£`¦��g¦�¡gÈÁ¬N�`¬ÇÅ��T¬N¥/Ø�ÔqÈÁÍ!¥cÓ`¬N�`¦j¯D�gÓs¦�ÄsÍj¡d�T¬NÍj Î�¤`�s¥A�T¬½¢!�sÅ� ; ÍJ¡T¦�¬½��®!¦�`¦�¡TÍj+�s¢J��¤`�`¬Çö ¤`¦N©i£C¦Ðs�`¦D£XÖ»��:³8² �+¼½¸ �'� �s¢j¡ � ÍjÅÁ¬N�?ª�ÿ`ÍJÈÁÄ`N¦�Êj¯� � * � � *�Ê�� W� (�* �� *�ÍJ�s£?Í ÄsÍJ�gÓ 0p� V @ k'k�V � V V @ Í!Åv¬½�ª�ÿ`ÍJÈÁÄ`N¦ �`¯�¬½Î � ?�� @ Q$QRQ � Q$QE*XÃ�¦ÁÈvÍ�©�¥�¢!� �g¡T¤s¥A� � ; * � � ; á"2� 2O�J!i[ 2O�G*_Åd¤s¥cÓ«�gÓ6Í8� � ; º � �Â9� �ÍJ�s£ � � ; º� Âc�5��*CÃ2Ó`¦¡T¦ �)�,�E@��7�� *��5�;@��7�� 7� � � � &

43

Ü�Ó`¦�§`¡T¦�Íjü Ä+¢j¬N� �Á�g¦�Åd�i¬N� �g¡T¢:£`¤s¥�¦D£l¬N� å�¦Ðs�`¬½�g¬N¢j�ÛÊ!Ê|ÈvÍ�© §+¦P¬N� Í �sÍ8�T¤`¡TÍj2Ã�Í�©�¦�ÿ:�g¦��s£C¦�£Ý¬N�?�gÓ`¬ÇÅ¥�¢!�!�T¦�ÿ:�É§:©«Íj� ¸C�!Ù]¸�·"?j¸ ?«¾¿g¸c³ � � �8¶V·sÙ�Ù]¸A¹AÙ�¹�¸Ù � J642�2O� §:©¨¡g¦�Ä`ÇÍj¥�¬N�`®|�gÓs¦ÒÄsÍJ¡g�g¬ÇÍJ�Î�¤`�s¥A�T¬½¢!�sÅ � ; *�� ; ªÃ2¬Ñ�TÓ � ; Íj�s£ � ; ª�¡T¦�ÅgÄ6¦D¥A�g¬NÕj¦�½©!Ös× �T¦�Åd�tÅd¦� � Ï�TÓsÍ8�t¬NÅtÍvÅd¤`§6Åd¦��¢JÎ�2�"$QK% � Ã2¬½N�§+¦�¥�ÍJN½¦D£�Í�·+³JÙ �C¿g³J¼�Ù]¸A¹AÙ¹¸�ÙLÖÜ�ÓsÍ8��¬NÅ�¯�Í��sÍJ�g¤`¡cÍJ�¦ÿ:�g¦�6£C¦�£ §`¡T¦�Íjü:Ä6¢!¬½� �-�g¦DÅ��nÅd¦�É¬NÅ$ÈÁÍ!£C¦Ò¤`Ä�¢jÎ�Åd¦Dö!¤s¦�s¥¦�Å-Ã2Ó`¢ Åd¦ÒÍj½/¦N¦ÈÁ¦� �TÅ�¯

¦�ÿ`¥�¦�ÄC��TÓ`¦-Ðs¡cÅ��D¯6Íj¡g¦3QE&sÜ�Ó`¬ÇÅ�¥¢j¡T¡g¦DÅdÄ+¢j�6£`Å��g¢Á�TÓ`¦ÉÅg¬Ñ�T¤sÍ8�T¬½¢!��Ã2Ó`¦¡T¦-¢j�`N©Ò�TÓ`¦$¬N�`¬½�g¬ÇÍJ_£sÍ8�TÍÁÕ8Íj½¤`¦É¢JÎ�¦�Í!¥cÓÅd¦Dö ¤`¦�s¥¦-¬NÅ2Åg¤`Ä`Äs½¬N¦�£��g¢n�TÓ`¦��Ã�¢ÁÈvÍj¥cÓs¬½�`¦DÅÖ�/7:� � BO�X�9� � �s-�2O�Á¶Ç¹$³Ò¾¿g¸c³ � � �J¶V·sÙ�Ùq¸�¹AÙ�¹¸�Ù � � � ³8·B? �9��Ù�µ`¸· �P¶Ç¹$³8¼ç¹ �Ò³J·«¸I�jÙ]¸·B?j¸ ?ÁÙ]¸�¹cÙ�¹�¸Ù � � �³8·"?��9�b�

��¿�� 8¼V¼ �G��¹.?J¶V¿g¸c´�ÙL¼§{ � ¿��J² Ù�µ`¸ � ³j´Ù�ÙVµs³8Ù � �� ³8·B? � ; � � ; &w�7Ex�9_=4;�=\3698y�4��3z �`³J¿AÙ\¶4³J¼ � �C·<´�ÙL¶ �8·�� ; á�2 �¡�.3T��!i[ 2�2O� ¶Ç¹Ïć³8¼V¼½¸ ?Ò³J·Á¬½�`Äs¤C��¦ÿ �T¦� �g¬N¢j� � � � ¶ � � �8¿³8·�{� g@G*H&B&B&H* iD�- 2=*�VK@G*B&H&B&B*,V � - 34* � � Ê?N�L_N v*�� ; º g@A&H&B& iD�*IVK@A&B&B&,V � Â�� @�� &B&B&! �D�� - 2�2O� ³�¹ � �J¼V¼ �G��¹B�� g@�� g@� � �J¿-Ê��s�_L

� ¶ � VK@0&B&H&IV � ��@-¶Ç¹t³ �s³8Ù�µ � � � Ù�µ`³JÙ_¹AÙ]³8¿AÙ\¹�³8Ùg��v³8·"? �� g@�-t^+º�V � ��@Â�Ù�µ`¸·� �� QÁ¶ � �� g@RV � ��@ ��³J·B? �� JÙVµs¸�¿|��¶Ç¹¸�±� ¸¼ç¹¸ �� C*�s�_ c��L�&Ü�ÓsÍ8��¬ÇÅ¯:¬½Î � ¥ÍJ��§6¦�¥�¢!ÈÁÄ`¤C�g¦D£i§:©vÍJÄsÄ`½©:¬N�`®��gÓ`¦�¥�¢!¡g¡T¦�ÅgÄ6¢!�s£C¬N�`®$Ä`¡T¢C¥�¦DÅgÅg¬½�s®É¡T¦ÇÍ8�g¬N¢j�Ò�g¢ � �g@ �TÓ`¦�

�� Q ¯�¢j�gÓ`¦�¡gÃ2¬ÇÅg¦� �� '&DÜ�Ó:¤sÅ�� ; Ä`¡g¢8Õ:¬Ç£C¦�Å�Õ�Íj½¤s¦�Å�£`¬Ñþ<¦¡T¦� ��Î�¡T¢jÈ�Q�¢j�`N©ÏÃ2Ó`¦�-�TÓ`¦�¥¢j¡T¡g¦DÅdÄ+¢j�6£C¬½�s®Ä`¡T¢:¥¦�ÅTÅd¬N�`®Á¡T¦ÇÍ8�g¬N¢j�6Å�¥�ÍJ�`�s¢J�2§6¦-¦ÿC¦¡c¥�¬ÇÅd¦D£i§:©Ò¤sÅg¬N�`®n�gÓ`¦-Ä`¡T¦Õ:¬N¢j¤sÅ2¥¢jÈÁÄ`¤C�T¦�£�Õ8ÍJN¤`¦�Å�Ö

A�¢j�g¦P�TÓsÍ8�D¯�¬½� ®j¦�s¦¡cÍJL¯�Î�¢j¡�Í �s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅd�g¬Ç¥�Åd�g¡T¦�ÍJÈ Ø�ÔqÈvÍj¥cÓ`¬N�`¦�� ; ÈvÍ�©?�`¢J�|§6¦¨¤`�`¬Çö ¤`¦N©£C¦�Ð6�`¦�£XÖ�×�ÇÅd¢6¯�Î�¢j¡F2 6 3T�e* � � �� ; º . ; º�0<Â�*)0XÂn¬NÅiÍ�Åd¦�i¬½�6¥�N¤s£C¦�£Ý¬N� 2�2O� */Åd¢ Íj�?¦�ÿ:�g¦��s£C¦�£¥�¢!ÈnÄs¤C�TÍJ�g¬N¢j� � ;�� ÈvÍ�©Ò§+¦$£C¦�Ðs�s¦�£XÖ»��:³8² �+¼½¸��K� �s¢j¡ �4*! �*)�ÁÍjÅ�¬½�Òª�ÿCÍjÈÁÄ`½¦ �-Íj�s£ 00* � �Í!Å�¬½�Òª�ÿ`ÍJÈÁÄ`N¦ �C¯jÃ�¦2ÈvÍ�©É¢!§sÅd¦�¡gÕ!¦��gÓsÍJ� . ; º 0XÂT� �*� ; º� �*)0XÂ?� � vÍj�s£�¦�ÿC¬ÇÅ�� ; * � ; Åd¤s¥cÓ �gÓsÍJ� � ; º +Âs� � ; º � �Â$¬LÖ ¦jÖ � ; º�. ; º 0XÂdÂ?� � ; º�� ; º�. ; º 0XÂ|* 0<ÂgÂ|&Ü�Ó`¬ÇÅ2¬NÅ�Í�ÈÁ¢!¡g¦�®j¦��`¦¡cÍJ<¡T¦�Åg¤`½�2Í!Å2ÅdÓs¢8Ã2��`¦ÿ:��Ö�/7:� � B1¬��W´�¶ �¸·P³8·Ò°-±]²v³jćµ:¶V·<¸ ��xº�2=*,~?* 34*I�4*C� � *C^�*I°)*I`JÂ|*�. ; ³�Ùq¸�¹AÙ � �C·<´�ÙL¶ �8· � � � ³J·B?92�6,3T�K*� �8¿�³J·v{ � ; ÙVµs¸�¿T¸�¸I�!¶Ç¹cÙ\¹ � ; ��¶VÙ�µ � ; º�� ;2º . ;�º�0<Â�*)0XÂdÂc� � ; º�. ;�º 0XÂdÂ � �8¿É³8¼V¼!0=-=24&��¿�� ¸Ù<0W�/V @ &B&H&IV D -=2«* @ &H&B& ��9�5. ; º�0<Â�*# @�� 0&B&B& �� ; º . ; º 0XÂ|*)0XÂÏ³8·B? � ; ³8·P³J¿¾�¶VÙL¿g³8¿|{¸C�!Ù]¸�·"?j¸ ?|¾�¿g¸c³�� 8¶V·6Ù2´ �J² � �CÙq³JÙ\¶ �J·�¹��sćµ�Ù�µ`³JÙ � ; º @�� 0&H&B& �� Âo�?� @ &B&H&)��;&�zt´T´ �J¿ ?8¶V·:ÀiÙ � � ; ?!¸ � ·s¶VÙL¶ �8·�/¸nµs³�8¸% @�� f->^6ºUV @ Â�* @�� |V @ � @ ³J·B??L��A@� 8º �� G*)� � �g@ Â9-¤^+º�V � Â|*�L��@� Jº �� G* � � �g@ ÂCV � � � � �8¿i³J¼V¼_æF�p X� ��&��¸ �<¿��8¸Á· �G�zÙ�µ`³JÙ� ��4-O^6ºUVG�LÂ�* i�UVG��K� � �8¿v³8¼V¼�Ê)�# «� �g&��¸ �+¿ ��8¸ÁÙVµC¶Ç¹n¾B{i¶V·B? �s´�ÙL¶ �8· �J·«Ê?�/ h� ��&:<µ:¶Ç¹t¶Ç¹ �!¾ D¶ ��:¹A¼§{�Ù\¿��s¸ � �8¿¡ A�ÛÊÉ¹A¶V·+ć¸ �@�� g@G& ��¸Ï³8¹c¹ �C²v¸tÙVµs³8Ù"ÙVµs¸ �+¿�� `¸¿AÙ�{-µ �J¼�?�¹ � �J¿�Ê9��s�_ I&�� @�� /Q�ÙVµs¸�· �� @�� @Ò³J·B?ÒÙVµs¸ �<¿�� s¸�¿AÙU{�µ �J¼�?�¹ � �J¿ �� Ê�³�¹4L��@ º �� @e*)�K�LÂT� "! � @G&$#�Ù�µ`¸¿|��¶Ç¹¸�/¸nµs³�8¸ i� � @)� �'�M*/¹ � �K�h-�^6ºUVG� � @Â�*)�K�bVG� � @��K� � @�³8·B?�³À ³8¶V·�Ù�µ`¸ �+¿�� `¸¿AÙU{�µ �8¼ ?�¹ � �8¿% � ÊK& ��¸�·<ć¸?�/¸²Á³e{�?j¸ � ·+¸v³�¾¿g¸c³ � � �8¶V·sÙÏ´ �J² � �CÙq³JÙ\¶ �J·(� ; ¹��s´Tµ�Ù�µ`³JÙ � ; º� �@�&B&B&! � Â�� E@0&H&B& � � */³8·"?�³jć´ �8¿ ?J¶V· À�Ù �|Ù�µ`¸´ �8·`¹AÙL¿��s´�ÙL¶ �8· ³j¾ ��8¸-µ`³8¹�Ù�µ`¸ �+¿ � �s¸�¿AÙU{ � ; º�� ; º�. ; º 0XÂ|* 0<ÂgÂc�?� ; º . ; º�0<ÂgÂ � �J¿É³8¼V¼�0�-t2«&� {"7 36587:�¯�� _¸�Ù �p�Ûº�2=*I~s* 34*C�4*I� � *C^�*I°)*I`JÂ�³8·"? �9��º�2=*I~3� * 34*I�9�U*C�G�� *C^�*I°)*I`JÂ�¾ç�Ù�� 2°$±]²Á³!´TµC¶V·+¸�¹ÙVµs³8Ù�³J¿g¸�Ù]¸A¹AÙL¶V· Àj±d´ �8² �`³JÙ\¶4¾¼½¸P³J·B?«¹AÙ\¿ �8· À � �CÙ � �CÙ\±@?J¶Ç¹AÙ\¶V·:À �C¶Ç¹gµ`³!¾�¼N¸P³8·"?¨¼½¸�Ù . ; ¾çP³¨Ù]¸A¹AÙ � �C·+´Ù\¶ �J· � � �4*276 3 � *�� ; ³J· ¶V·�� CÙ�¸I�!Ùq¸·`¹A¶ �J· � � � ³8·B?�� X� � � �� ; º . ; º�0<Â�*)0XÂ|&�� Ù�µ`¸¿g¸v¸I�j¶Ç¹AÙ � ; ³J·B? � ; ªÏÙ�� ¸C�!Ù]¸�·"?j¸ ?|¾�¿g¸c³�� 8¶V·6Ù2´ �J² � �CÙq³JÙ\¶ �J·`¹�� ³8·"?��9��*_¿T¸A¹ �s¸T´ÙL¶ �¸¼§{J��¶VÙ�µJ`«n � ; º� � �Âo�#`�n � ; ª º� � �Â|* � X- � ÙVµs¸�·W�Éº�$ÂÉ³8·"?��º��9�ÇÂÉ³J¿g¸�2Á±d¸Iµ �C¶ 8³8¼½¸·sÙ �

��¿�� ¸ �<¿��8¸�ÙVµs³8Ù�¶ � ìn � ; º � Âc�/`�n � ; ªgº � �Â�Ù�µ`¸·ÒÙVµs¸�¿T¸t¸I�!¶Ç¹cÙ<� ; ³J·B? � ; ªA��¶VÙ�µ9`�n!� ; �#`�n!� ; ª *�8· ��*��_µ`¸¿g¸ �J��. ; ºb2-Â|& :+µs¸n¿g¸�¹ �C¼ÑÙ«�/¸v³8¿g¸v³ � Ùq¸¿��¶V¼V¼�Ù�µ`¸· � �8¼V¼ �e� � ¿ �8²*Ù�µ:¶Ç¹Á³8¹c¹�¸¿AÙL¶ �8· ³8·"?�:+µs¸ �8¿g¸²�K�

�¸Ù � . � ¾ç�Ù�µ`¸�¹¸�Ù � � ³J¼V¼��s³8Ù�µ ¹ � � � ÙVµs³8Ù_¹cÙ]³8¿AÙ�³8Ù�� ³8·B? � . �� Ù�µ`¸�¹¸�Ù � � ³J¼V¼��s³8Ù�µ ¹ � � � � Ù�µ`³JÙ�¹AÙ]³8¿AÙ�³8Ù�G�� _¸�Ù-0=��V @ &B&H&CV D - 24* t� @ &B&H& ��)� . ; º 0XÂ|* � h� @�� 0&B&H& �� &� ; º�. ; º 0XÂ|* 0<Â�* �t�L�& :<µs¸�· ¶VÙ� �8¼V¼ �e��¹�Ù�µ`³JÙ2³J· ¸I�!Ùq¸·B?!¸ ?i¾¿g¸c³ � � �J¶V·sÙ�´ �8² � �CÙ]³8ÙL¶ �8· � ; ¸I�!¶Ç¹AÙ4¹-¹��sćµ�Ù�µ`³8Ù � ; º � Â¡�?�f�?� @ &B&H&)��E& :<µ`¸·� ¿��8² _¸�²n²v³ $ÒÙ�µ`¸¿g¸n¸C�!¶Ç¹AÙ\¹B� ; ��¶VÙVµ&� ; º� +Âo� � ; º Âc�5��&

44

�X¿ �8² `�n � ; ��`�n � ; ª * ��8¸¿ � �¶VÙ � �8¼V¼ �G��¹ÒÙ�µ`³8Ù �=� � @ &B&H& ��F-�� ; º <Â|* �;�� @ &H&B& �� - � ; ª º � Â��¶VÙVµJ`Cº �`Âc�#`Cº ��VÂ|&:<µ �:¹¡V @ &H&B&,V��3- � . � ³8·"?� � -t^6ºUV � Â�* � V � � � � �8¿t³J¼V¼6Ê9�_ c�5��¶ � ³8·B? �8·6¼§{É¶ � ÙVµs¸�¿T¸Ï¸I�!¶Ç¹AÙ4¹TV��@ &H&B&,V�� -

� . �� ¶VÙ�µ� �@�� -¤^+º�V��@ Â|*! �@�� V��@ �;�@ ³8·"??L��A@ º i�� * �� g@ Â9-¤^+º�V�� Â|*CL��@ º� �� * �;��@ ÂCV�� 8¿i³8¼V¼"æt�p X� ��&�X¿ �8²:`Cº �'�\Â4��`Cº �� Â � �8¿n³J¼V¼_Ê)� 4�?��*�³8·"? �:¹A¶V·:ÀiÙ�µ`¸É¹AÙL¿��8·:À � �CÙ � �CÙ\±@?J¶Ç¹AÙ\¶V·:À �C¶Ç¹gµ`³!¾�¶V¼Ñ¶VÙ�{ �+¿�� `¸¿AÙU{ � � �4*¾�{i¶V·B?��s´ÙL¶ �8· �8·�Ê�� o�,� ¶VÙ � �J¼V¼ �G��¹�ÙVµs³8Ù�VG�0��V �� J¿n³J¼V¼�Ê9�q ¡�5� ³J·B?� ��0�#L��A@ º i�� *)� �� g@ Â � �J¿�³8¼V¼æ)�� T� ��&

:<µ �:¹?V @ &B&H&CV��¤-�� . � ³J·B? � -�^+º�V � Â|*! � V � � � � �8¿�³8¼V¼2Ê �7 f� � ¶ � ³J·B? �8·6¼§{¨¶ � V��@ &B&B&,V�� -�� . ��³8·"?� � -�^6ºUV�� Â�* � V�� 8¿P³J¼V¼2ÊO� f�*�g*�³8·B?F`Cº��`Âf� `Cº ��VÂ|& �É¸·+ć¸W�/¸�²v³G{�¾ �C¶V¼�?(� ; ª�¹��sćµlÙVµs³8Ù`�n � ; º� +ÂX��`Xn � ; ª º� +Â|* >-��&0z � �+¼§{8¶V·:ÀP· �G��:+µs¸ �8¿g¸²��¶VÙ � �8¼V¼ �e��¹ÁÙ�µ`³JÙT�Éº�$ÂÒ³8·"?s�Éº�9�VÂv³8¿g¸�2?!¸,µ �C¶ 8³8¼½¸·sÙ �â 3s583+1414B`5Dß�X��_¸�Ù#�p�Ûº�2�*I~?* 34*C�4*C� � *I^v*,°)*C`JÂ�³8·"? �9��º�2=*I~3�S* 34*C�9��*C�G�� *C^�*I°)*I`JÂ�¾ç�ÙU� ��°$±]²Á³!´TµC¶V·+¸�¹ÙVµs³8ÙÁ³8¿g¸PÙq¸�¹AÙ\¶V·:ÀJ±d´ �8² �s³8ÙL¶4¾�¼½¸«³8·"?¨¹AÙ\¿��J· À � �CÙ � �CÙ\±@?J¶Ç¹AÙ\¶V·:À �C¶Ç¹gµ`³!¾�¼N¸�³8·"? ¼½¸Ù . ; ¾ç�³ Ù]¸A¹AÙ � �C·<´�ÙL¶ �8· � � �¹��s´Tµ Ù�µ`³JÙ�¸C�!¶Ç¹AÙ � ; * � ; ª Ù�� ¸I�!Ùq¸·B?!¸ ? ¾¿g¸c³ � � �8¶V·sÙ|´ �J² � �CÙq³JÙ\¶ �J·`¹ � � ��³J·B? �9��*$¿g¸�¹ �`¸c´Ù\¶ 8¸�¼ {$�?��¶VÙ�µ`�n � ; º <ÂJ��`�n � ; ª º <Â|* �- . ; ºb2-Â|*Ï³8·B? � ; ³8· ¶V·�� CÙ�¸I�jÙ]¸·`¹A¶ �8· � � �f�o� � 2 6 3T�¨¶Ç¹�³�Ùq¸�¹AÙ�¹�¸Ù� � �Éº�$Âv³8·"?��º��9�VÂnÙ�µ`¸·�³J·B?�� 9� � � �� ; º . ; º�0<Â�*)0XÂ�¶Ç¹Á³8· ¸I�!Ùq¸·B?!¸ ?�¾¿g¸c³ � � �J¶V·sÙ�Ù]¸�¹cÙ�¹¸Ù � � � ³J·B?�9�U&

��¿�� =�X¸ç � �8¿ �8¼V¼½³J¿|{W�K�� {"7 36587:� ¬�� _¸�Ù ��º�2=*,~?* 34*I�4*C� � *C^�*C`JÂÉ³8·B? �9�i�Ûº�2=*I~3�S* 34*C�9��*C�G�� *C^�*C`JÂÉ¾T¸$Ù�� -°$±]²Á³!´TµC¶V·+¸�¹-ÙVµs³8Ù³8¿g¸2Ùq¸�¹AÙ\¶V·:ÀJ±d´ �8² �s³8ÙL¶4¾�¼½¸�³8·B?t¹AÙL¿��8·:À ��CÙ � �CÙL±@?8¶Ç¹AÙL¶V· À �C¶Ç¹dµs³j¾¼½¸R�E� � Ù�µ`¸¿g¸�¸I�!¶Ç¹AÙ4¹ . ;Ý³8·9L«·+³8Ù �C¿g³J¼!Ù]¸A¹AÙ � �C·<´�ÙL¶ �8·� � � � �8¿9L ¹�� ´¶4¸·sÙL¼§{�¼½³8¿LÀ!¸��ÙVµs¸�·�Ù�µ`¸¿g¸�¸C�!¶Ç¹AÙ4¹Ò³�·<³8Ù �C¿g³8¼/¸I�!Ùq¸·B?!¸ ?�¾¿g¸c³ � � �8¶V·sÙÏÙ]¸A¹AÙ2¹¸Ù � � � � ³J·B?�9�U&

��¿�� _¸�Ù«2 ¾T¸�³�Ù]¸A¹AÙ2¹¸Ù � � ��º��$Â�³8·B?f�Éº�� Â�*�L ÙVµs¸v¼½¸· ÀjÙVµ � � Ù�µ`¸v¼ �8· À ¸�¹cÙ�¹¸Iµ �s¸·+ć¸v¶V·O2 ³J·B?.Ò³8·tL ·+³8Ù �C¿g³J¼"Ù]¸�¹cÙ � �C·<´�ÙL¶ �8· � � �4&=��¿��8² � �J¿��8¼V¼N³8¿|{ �P¶VÙ � �J¼V¼ �G��¹vÙ�µ`³JÙ � 3� � � �� ; º�. ; º 0XÂ|* 0<Ân¶Ç¹Ò³8·¸C�!Ù]¸�·"?j¸ ?|¾�¿g¸c³�� 8¶V·6Ù�Ù]¸�¹cÙ�¹¸�Ù � � � ³8·"?��9�U&<�6¶V·+ć¸�. ; ¶Ç¹�L ·<³8Ù �C¿g³8¼ � � ¿��8²:²n¸ � ·s¶VÙL¶ �8·O��i¶VÙ � �J¼V¼ �G��¹nÙVµs³8Ù� �6 2>"RQ'%G�R&

Ü�ÓsÍ8�2¬ÇÅ¯`�gÓ`¦�¦�ÿC¬ÇÅ��T¦�s¥¦�¢JÎ"Íj�FL��sÍJ�g¤`¡cÍJ+�g¦DÅ��2Î�¤s�s¥A�T¬½¢!��Î�¢!¡4L¨Åg¤�/Ò¥�¬N¦� �gN©ÒÇÍJ¡T®j¦ÏÃ2¬½NX¦�6Åd¤`¡T¦Ï�gÓsÍJ��ÍJ�:©ÄsÍ8�TÓ�¬N��2(¥ÍJ�«§6¦n¦�ÿC¦�¡T¥¬NÅg¦�£�¤6Åd¬N�`®�Í!Å�¬N�`¬½�g¬ÇÍJ�£`ÍJ�TÍ�Õ�Íj½¤s¦�Å��gÓ`¦nÓ`¦�Í!£P¦�½¦�Èn¦�� TÅt¢JÎ��TÓ`¦nÅg¦�ö ¤`¦��s¥�¦DÅÏ¬½� � $&Ü�Ó:¤sÅ¯ � t¬NÅ2Ín�sÍJ�g¤`¡cÍJX¦ÿ �T¦�s£`¦�£|§`¡T¦�ÍJü:Ä+¢j¬N� ��T¦�Åd��Åd¦�2¢JÎ��xÍJ�6£ �9��&

� ��ìCí�� G��ñ� �òdëh��ë�ï �!ìCí�� G��ñ� �ògë�� ì;��jì`ògë��

Ü�Ó`¬ÇÅ�Åg¦�¥A�T¬½¢!��¬N� �g¡T¢C£C¤s¥�¦DÅ��gÓs¦$Å��T¡g¦DÍJÈÚØ�ÔLÈvÍ!¥cÓ`¬½�s¦�Íj�s£|ÄsÍJ¡g�g¬Ç¥�¤sNÍj¡g¬ÇÅd¦DÅ��gÓ`¦-¡T¦�Åg¤`½�TÅ2®!¬½Õ!¦�|¬½�|�TÓ`¦$Ä`¡T¦Õ:¬N¢j¤sÅÅd¦D¥A�T¬½¢!�sÅ��g¢Á�TÓ`¬NÅ�¥�ÇÍjÅTÅ�¢jÎ"Ø�ÔLÈvÍ!¥cÓ`¬½�s¦�Å�Öw�7Ex�9_=4;�=\3698y�9X�3zt·�°-±]²v³jćµ:¶V·<¸ ��xº�2=*,~?* 34*I�4*C�B�K*C^�*��¡*C`JÂ�¶Ç¹tć³8¼V¼½¸ ?Á³�Åd�g¡T¦�ÍjÈ�Ø�ÔqÈvÍj¥cÓ`¬N�`¦ ��C°� � �8¿¹gµ �8¿AÙ��Ò¶ � Ù�µ`¸ � �8¼V¼ �e��¶V· À�³8¿T¸$ÙL¿��s¸H�� 2��9��F® �=}s�G*��_µ`¸¿g¸X® ¶Ç¹�Ù�µ`¸ � � �8¹c¹c¶4¾¼§{Ò¶V· � ·6¶VÙq¸ �ÏÈÁ¦�Èn¢!¡g©i��} ¶Ç¹-ÙVµs¸ � ·s¶VÙ]¸�¬N�`Ä`¤C��Íj½ÄsÓsÍJ§+¦��³J·B?�Ú¶Ç¹-ÙVµs¸ � ·s¶VÙ]¸2¢j¤`�gÄ`¤C�ÏÍJNÄ`ÓsÍJ§+¦��H±

� ¶ � Vt- 3 Ù�µ`¸·s^'`$a º�VXÂ © º�9�4�s® �."$��%�Âc�?>|³J·B?nÙ�µ`¸¿g¸-¸I�j¶Ç¹AÙ\¹Ï³�¿g¸¼½³8ÙL¶ �8·�� áE®��f}�Y?[ ��s®¹��sćµÝÙVµs³8Ùhr�k�-��9�$*Ca1*CaW�?-�®8*,¢_-l}s�G*��-��¡*C�7-�} º k�*MaO*I¢R��ÂMV�º k��A*MaF�S*,¢�Â�¶ � ³8·"? �J·s¼§{�¶ �ºSa1*I��Â�� º��A*MaF�NÂ �

� rik?-��9�G*Ca -=®8*iuJº ki*Ca1*,¢�ÂA�,. P10iQ|¶ � ³J·B? �J·s¼§{i¶ � ¢�� `�¶Ç¹-³ � �C·+´Ù\¶ �J·J`Éá�� .®¯�.}s�X!i[ � ?!¸ � ·+¸ ?Ò¾B{X`Cº ki*Ca1*,¢�Âc�PGQ$(EP:º kCÂ�* kJ-��9�G*Ca -=®8*I¢9-=}s�

� `�¿g¸Ù �C¿A·s¹tÙ�µ`¸É¿A¶ÑÀDµCÙ\² ��¹AÙ2¸�¼N¸�²v¸�·6Ù � � ³8·�{v· �8·6±d¸�² �+ÙU{ ��CÙ � �CÙ/¹¸Iµ �s¸·+ć¸ �K�Ü�Ó`¦|¢j¤C�TÄ`¤C�ÒÅd¦�s°*¤sÅd¦D£ ¬N��TÓ`¦�£C¦�Ðs�s¬Ñ�T¬½¢!�l¢jÎtÍJ� Ø�ÔLÈvÍ!¥cÓ`¬½�s¦�¬ÇÅn�`¢8Ã�� ¬½��gÓ`¦�ÍJ§+¢8Õj¦�£C¦�Ðs�s¬Ñ�T¬½¢!��Ö

:�N¦�Í!Åd¦��`¢j�g¦Ï�gÓsÍJ�� ¬NÅ�ÍÉÐ6�`¬Ñ�T¦$Åd¦��Ö×�� :Ø9� ÈvÍ�©�ÓsÍ�Õj¦�Åd�TÍJ�g¦��`¢!�CÔ]£C¦��T¦¡TÈn¬N�`¬ÇÅdÈ�¯�¢!Ä6¦�¡TÍJ�g¢!¡+�s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅgÈ ÍJ�6£-£C¢jÈvÍJ¬N��`¢j�`Ôq£C¦�g¦�¡gÈÁ¬N�`¬NÅgÈ

§`¤C�2�`¢j�/�g¦�¡gÈÁ¬N�sÍ8�T¬½¢!�Ò�`¢!�CÔq£`¦��g¦�¡gÈÁ¬N�`¬ÇÅdÈ�ÖC×�Å/Î�¢j¡��gÓ`¦Ï®j¦��`¦¡cÍJ6Ø�ÔqÈvÍj¥cÓ`¬N�`¦�ÈÁ¢C£C¦�\¯:¢j�s½©Á¢jÄ+¦¡cÍ8�T¢j¡�ÍJ�s£Ò£`¢JÔÈvÍJ¬N�|�s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅgÈ Ã2¬½N�§+¦$¥�¢!�sÅd¬Ç£C¦�¡g¦D£i¬N��Ã2Ó6Í8�2Î�¢jNN¢8Ã�ÅÖ

45

� �JÙq¸ �e�#�`¢!¡tÅg¬½ÈÁÄ`N¬N¥¬Ñ��©!¯<¬½�«Ã2ÓsÍ8�tÎ�¢jN½¢8Ã�Å�Ã�¦nÃ2¬½N�¥�¢j�6Åd¬Ç£C¦¡ÏÄ`¡T¢C¥�¦�ÅTÅg¬½�`®i¡g¦�NÍJ�g¬N¢j�sÅ�¢JÎ��gÓs¦ÉÎ�¢!¡gÈ�V�ái® �}�Y?[ �#�?® º4¬\Ö ¦jÖ:Ã�¦�Ã2¬N½<¤sÅg¦ � � ¬N�sÅ��T¦�Í!£v¢JÎ�V�Î�¡T¢jÈ(åt¦�Ðs�`¬½�g¬N¢j�«Ê�(jÂAÖ��:¬½ÈÁ¬NNÍj¡gN©j¯ Ã�¦�Ã2¬N½<¥�¢!�sÅd¬Ç£C¦�¡/�TÓsÍ8��gÓ`¦n�T¦�Åd�g¬N�`®|£`¢jÈvÍJ¬N��¢jÎ/�gÓs¦�ÈvÍj¥cÓs¬½�`¦n¬ÇÅÏÍiÎ�¤`�s¥��g¬N¢j� ^Pá"38!i[,æ �� &<×�� CØ#� Ã2¬½N�§6¦v£C¦��`¢J�T¦�£P§:©PÍ�g¤`Äs½¦��p�Ûºb}.*��¡*I®8* 34*C�4*C� � *I^ Â�&� �JÙq¸��R�t×��,�CØ#�,¬ÇÅnÃ�¦DÍJü¨¢j¤C�TÄ`¤C�gÔq£C¬ÇÅd�g¬N�`®j¤`¬ÇÅgÓsÍJ§`N¦i¬½Î�Î�¢!¡nÍj� ©�Vi* k- 34*�¬½Î��gÓs¦¡T¦i¦�ÿC¬ÇÅ��)a1*CaW�@ *MaF� � -®8*C�O-=}.*��=-�� Ã2¬Ñ�TÓ�º aO*C��ÂMV�º �0*CaW�@ Â|*�ºSa1*I��ÂbkXº��A*MaF� � Â��TÓ`¦�=VW�qk�&� �JÙq¸�'�tÜ�Ã�¢-Åd�g¡T¦�ÍjÈ�Ø�ÔqÈvÍj¥cÓ`¬N�`¦�Å/ÍJ¡T¦��T¦�Åd�g¬N�`®$¥�¢!ÈÁÄsÍ8�T¬½§`N¦2¬½Î+�TÓ`¦¬N¡�¬N�`Ä`¤C��ÍJNÄ`ÓsÍJ§+¦��cÅ¯j¢j¤C�TÄ`¤C��Íj½Ä`Ó6ÍJ§+¦��TÅ�¯ÈÁ¦ÈÁ¢j¡T©iÅg¦��TÅ�¯sÅg¦��cÅ�¢JÎ�Ä`¡g¢C¥¦�ÅTÅd¬N�`®n¡g¦�NÍJ�g¬N¢j�sÅ�ÍJ�6£i�T¦�Åd�g¬N�`®v£C¢jÈvÍj¬½�sÅ2¥¢j¬N�s¥�¬Ç£C¦!Ö»��:³8² �+¼½¸�$��ª/Õj¦��gÓ`¢!¤`®jÓ��gÓ`¦ÁØ�ÔLÈvÍj¥cÓs¬½�`¦Á¬N�¨ª�ÿ`ÍJÈÁÄ`N¦�ÊnÄ`¡T¢:¥¦�ÅTÅd¦DÅtÍ�Åg¦�ö ¤`¦��s¥�¦n¢JÎ�¬½�`Äs¤C�$Åd©:ÈÉ§+¢jÇÅ�¯+¬½�¬NÅ��`¢j��ÍJ� �:Ø9� º�¬LÖ ¦jÖ� �£C¢:¦�ÅÉ�`¢J��Ä`¡g¢C¥¦�ÅTÅ��gÓ`¦�¬½�sÄ`¤C�nÅg¦�ö ¤`¦��s¥�¦i¬½� Íj� �:Ø#� Î4Í!ÅdÓs¬½¢!� Íj�s£ �TÓ`¦i£`ÍJ�TÍPÅg¦��£C¢:¦�Å/�`¢J�/¬N�s¥½¤s£`¦�¦�ÿCÄ`N¬N¥¬Ñ�T½©ÁÍJ�Á¢!¤C�gÄ`¤`��ÍJNÄ`ÓsÍj§6¦�cÂ�Ö!Æ�¢8Ã�¦Õ!¦¡D¯8¬Ñ��¥ÍJ�Á§+¦�¦DÍjÅg¬½N©É¡T¦Ã2¡T¬Ñ�g�g¦��n¬N�Á�gÓs¬NÅ�Î4ÍjÅgÓ`¬½¢!��¯ÍjÅvÅgÓ`¢8Ã2�Ý�`¦�ÿ:��Ö5�:¢ 2 � �X�f�¤® �¤}s�|Ã2¬Ñ�TÓ#} � "$u><Tu|¬ÇÅÁ½¦�d�T¦¡Ò¢!¡Ò£C¬½®!¬Ñ�F% �_"��*8�E%¨º#�«¬NÅn�TÓ`¦§`ÇÍJ�`ü�¥cÓ6ÍJ¡cÍj¥A�T¦¡ÏÍJ�s£ �õ¬ÇÅ-Í�Åg©:ÈÉ§+¢j�¤sÅg¦�£��g¢|ÈÁÍj¡gü��TÓ`¦vÅ��cÍJ¡g�Ï¢jÎ/�TÓ`¦Á¬½�`Äs¤C�ÉÅd¦Dö ¤`¦�s¥¦DÂ�¯g® � �( t*��p"R� � <G��-�}.*,Vt- 3o%'*�3>��"H ,*CQE*IV � *IV @ *IV * k�*��%!¯JÃ2Ós¦¡T¦2�gÓ`¦t£C¦�Ðs�s¬Ñ�T¬½¢!�sÅ�¢jÎ+�TÓ`¦�Äs¡g¢C¥�¦DÅgÅg¬N�`®�¡g¦�NÍJ�g¬N¢j�sÅº�Ã2¡T¬Ñ�g�g¦��¬½��gÓ`¦�Î4Í!ÅdÓs¬½¢!�|¢jÎ=A�¢J�g¦$ú Â�ÍJ¡T¦�Í!Å�Î�¢jN½¢8Ã�Å�áºgº� �* !Â�*��Â Aº�� *�º� �* ÂdÂ�¯ºgº� �*��`Â|*IuÂ Q:º�u R*�º� �*��sÂdÂA¯sÃ2Ó`¦¡T¦ �J-� t*vu�-�} $h"!ÊK*��*��;%'*ºgº� �*��`Â|* !ÂCV � º� �� *�º� v*��!ÝÊDÂdÂ�¯`Ã2Ó`¦�¡g¦ �.-" =*�� s¯ºgº� �*��`Â|*�ÊDÂCVK@�º�Ê �� *�º�Ê'*�� ÊDÂdÂ�¯`Ã2Ó`¦�¡g¦ �.-" =*ºgº L�*��sÂ|*I+ÂMV º�+ �� *�º� �*��sÂdÂA¯CÃ2Ós¦¡T¦ ��*ML1-� =*ºgº L�*��sÂ|* <ÂbkXº ��*�º L&� ��*��sÂdÂA¯+Ã2Ó`¦�¡g¦ �g*ML>-( =*"ºSL�� v* ->"� �*CuG%ÉÍJ�s£��.��!-Ê�Â�¢j¡nº ->" ÊK*Iu$%ÉÍJ�s£�)��ÊDÂ�¯`Ã2Ó`¦�¡g¦9u�-t} $h" v*Ê'*��*��;%'*ºgº L�*��sÂ|* <Â)�_º ��v*Dº L�*��`ÂdÂ�¯`Ã2Ó`¦¡T¦ ��*MLO-� t* =-=} $h"��%'&

Ü�Ó`¦$£C¦Ðs�`¬½�g¬N¢j��¢JÎ�� ¡T¦ÈvÍJ¬N�sÅ�¤`�s¥cÓ6ÍJ�`®!¦�£XÖ:�N¦�Í!Åd¦n�`¢J�T¦É�TÓsÍ8��TÓ`¦ÁÕ�Íj½¤s¦�ÅX� � ºS�q-�}.*,V�- 34* ÂÏÍJ¡T¦�¥¢j�sÅg¬Ç£C¦¡T¦�£�¬½� �õ¬½�¨¢j¡c£C¦¡t�g¢|üj¦�¦Ä��gÓ`¦ÁÈvÍj¥cÓ`¬N�`¦¢j¤C�TÄ`¤C�gÔq£C¬ÇÅd�g¬N�`®j¤`¬ÇÅgÓsÍJ§`N¦jÖ6×�ÇÅd¢Á�`¢j�g¦��gÓ6Í8�2�gÓs¦$ýj£C¤`ÈÁÈ�©:ýnÕ8ÍJN¤`¦DÅX!-ÊK*B!�æ�*B! �v*B!2è$¤sÅg¦�£�¬N�|¦ÿ`ÍJÈÁÄ`N¦vÊ�Íj¡g¦�`¢vN¢j�`®!¦¡��`¦¦D£C¦�£�Íj�s£iÓ6Í�Õj¦�§6¦�¦��¡T¦ÈÁ¢8Õj¦D£XÖw�7Ex�9_=4;�=\3698y�=��%� �J¿�³J·��:°� �4*_³ �s³8¿AÙL¶4³8¼ � �C·+´ÙL¶ �8·&��; ásºU® �s}ÁÂI��!i[ �9�vć³8¼V¼½¸ ?Ò³J·Á¬½�`Äs¤C�dÔqÈÁ¦ÈÁ¢j¡T©¥�¢!ÈnÄs¤C�TÍJ�g¬N¢j� � � �(¶Ç¹�?j¸ � ·+¸ ?n³�¹ ��; º @ &H&B& D Âc� � @ &H&B&�� D *<¶ � Ù�µ`¸¿g¸-¸I�j¶Ç¹AÙ\¹�³ �s³8Ù�µ)V @ &B&H&IV D � ¿��8²�� ³J·B?a � -F®8*"Ê9�¤ ¡��L�*�¹ �sćµ�Ù�µ`³JÙ � -F^6ºUV � Â�* � V � º � � *Ma � Â�*_Ê9�� T�_L�*vLON v&� �JÙq¸ �'�tÜ�Ó`¦Ï�g¦DÅ��2Î�¤`�6¥A�g¬N¢j��¬N� �g¡T¢:£`¤s¥�¦D£�§:©iåt¦�Ð6�`¬Ñ�T¬½¢!� Ê��nÃ2¬½N�§+¦� . ; ºU�6ÂT�� Î�¢!¡o¶�N �*X¥�¢!�sÅg¬N£C¦�¡ . ; £C¦Ðs�`¦�£«Î�¢!¡�Íj�:©PÅ��T¡g¬N�`®tVK@0&B&H&IV " - 3T�7�<�gÓ`¦��¨Î�¢j¡-ÍJ�:©PÅd�g¡T¬½�`®tVK@0&H&B&,V " V " � @$*. ; ºUVK@0&B&H&IV " V " � @Â�¬NÅ�¦�¬Ñ�TÓ`¦¡�¢jÎ�á

� ¬½Î�V @ &B&H&IV "|¬NÅ$Í|ÄsÍJ�gÓ ¬N�� TÓsÍ8�$¦�Èn¦�¡g®!¦�ÅÏÎ�¡T¢jÈ*�TÓ`¦Ò¬N�`¬½�g¬ÇÍJ/Åd�TÍJ�g¦f� � �TÓ`¦� . ; ºUV @ &H&B&IV "eV " � @ Â9�. ; ºUV @ &H&B&IV "JÂ #" � @ ¯`Ã2Ó`¦¡T¦ #" � @ -F^+º�V " � @ Â|*`Ã2¬½�gÓ� " � @ �ÛºSa1*I��Â|*va -F®8*sÍj�s£W�1-=}.&� ¢j�gÓ`¦�¡gÃ2¬ÇÅg¦�. ;�ºUV @ &H&B&CV "'V " � @ Âc�5. ;2ºUV @ &H&B&IV "JÂ�Ö

�]�|�gÓ`¬ÇÅ�¥Í!Åd¦ . ; ºb2-Â|*i2�6 3T��¥�¢!� �TÍJ¬N�sÅ2Åg¦�ö ¤`¦��s¥�¦DÅ�¢jÎ"Ä6ÍJ¬N¡TÅ-ºSa1*I��Âo-t® �=}.&»��:³8² �+¼½¸��E� �s¢j¡��xÍ!Å�¬½��ª�ÿCÍjÈÁÄ`½¦ (C¯CÃ2¬Ñ�TÓ"0F�q V @ kEk�V � V V @ ÍJ�s£�� @ � � � � � � � � � �� e*CÃ2Ó`¦�¡g¦

� @ � ºdº� �* Â|*8�JÂA¯�� (ºdº� v* Â|*Ê�ÂA¯�� ºgº�Ê'*ÊDÂ�*Ê�ÂA¯�� ºgº\æ�*�ÊDÂ�*I+�Â�¯�� ºdº� �*Ê�Â|* !ÂA¯�� X�(ºdº� v* Â|*I+ÂA¯� �h�Ûºgº� v* !Â�*Ê�ÂAÖ

Ã�¦$¥�ÍJ��¥�¢!�sÅ��T¡g¤6¥A� �v�; Åg¤s¥cÓi�TÓsÍ8��; º �:Âc� �0*CÃ2Ó`¦�¡g¦ �F�!��dÊ �� Ê � + � � � � � � Ê �"� &w�7Ex�9_=4;�=\3698y ��¸Ù ��ºb}.*��¡*I®8*,~?* 34*I�4*C��E*C^:Â$³J·B? �9�i��ºb}.*��¡*I®8*I~3�S* 34*C�9��*C�G�� *C^:ÂÉ¾ç-ÙU� �n¹AÙL¿g¸c³8²°-±]²v³jćµ:¶V·<¸A¹ÏÙVµs³8Ù�³8¿g¸ÏÙ]¸�¹cÙL¶V· Àj±d´ �8² �`³JÙ\¶4¾¼½¸R� :<µs¸�·P³ � ·6¶VÙq¸�¹¸�Ù �s6 º�®��)}ÁÂ � ¶Ç¹Ïć³J¼V¼½¸ ?v³8·n¬½�`Äs¤C�dÔqÈÁ¦ÈÁ¢j¡T©�g¦DÅ��2Åd¦�� ³J·B? �9��¶ � �_µ`¸·+¸ 8¸�¿�Ù�µ`¸¿g¸$¸I�j¶Ç¹AÙ ��; ³J·B? ��; ª ÙU� �É¶V· � �CÙL±]²Á¸² �8¿|{v´ �J² � �CÙq³JÙ\¶ �J·`¹ � � � ³J·B?� � *�¿g¸�¹ �`¸c´Ù\¶ 8¸�¼ {$�¡��¶VÙ�µ � �; º +Â¡�?� �; ª º� +Â�* =-��*��/¸�µ`³ �¸XV ; �#V ;

ª &

46

� {"7 36587:��³_� _¸�Ù ��ºU}.* �T*,®8*I~?* 34*C�4*C� � *I^ Ât³8·"?��9��xºU}.* �T*,®8*I~9�S* 34*C�9�U*I�G�� *I^ Ât¾ç�ÙU� �Ï¹AÙ\¿T¸T³J² °$±²Á³!´TµC¶V·+¸�¹$ÙVµs³8Ù2³8¿g¸ÉÙ]¸A¹AÙL¶V· Àj±d´ �J² �s³8ÙL¶4¾¼½¸�³J·B?J�/¸c³ � ��CÙ � �CÙL±@?8¶Ç¹AÙ\¶V·:À �C¶Ç¹gµs³j¾¼½¸�³J·B?i¼½¸Ù . ; ¾ç�³ÒÙq¸�¹AÙ � �C·<´�ÙL¶ �8·� � �f�A� � 2 6 3 � ¶Ç¹Ò³�Ùq¸�¹AÙ�¹¸�Ù � � ��º��$Âi³J·B?J�Éº�� ÂÁ¹��sćµ¨Ù�µ`³8Ù�¸C�!¶Ç¹AÙ � �; ³8·"? � �; ª ÙU� ��¶V·�� CÙ\±]²v¸² �J¿|{´ �8² � �CÙ]³8ÙL¶ �8·`¹�� ³J·B?��9�S*"¿g¸�¹ �s¸c´�ÙL¶ 8¸�¼§{$�o��¶VÙVµ��; º <Â¡� �v�; ª º <Â|* �-�. ; ºb2-Â|*�Ù�µ`¸·&. ; ºb2-Â$¶Ç¹�³J·�¶V· � �CÙL±²Á¸² �8¿|{ÒÙ]¸A¹AÙ/¹�¸Ù � � �*³8·"?��9��&

��¿�� 8¼V¼ �G��¹.?J¶V¿g¸c´�ÙL¼§{ � ¿��J² :<µ`¸ �J¿g¸�²��³8·B?)²n¸ � ·s¶VÙL¶ �8·1� �'�w�7Ex�9_=4;�=\369/��%� �J¿$³8· �C°� �4*"³ �s³8¿AÙL¶4³8¼ � �C·+´Ù\¶ �J·&�v�; � � áE}s�X!i[ �9�vć³8¼V¼½¸ ?|³8·Ò¬N�`Ä`¤C��¥¢jÈÁÄ`¤C�cÍ8�g¬N¢j�� ¶V·�a -�® ¶Ç¹ ?j¸ � ·<¸ ?l³8¹��v�; � � ºS� @ &B&B&I� D Â=� � @ &B&B&�� D *�¶ � Ù�µ`¸¿g¸ ¸I�j¶Ç¹AÙ\¹�³ �s³8Ù�µ¤V @ &B&H&IV D � ¿��J²� � ³J·B?Oa � *MaF�� - ®8*-Ê#� O� L¤!xÊ'*«a � *MaF�D - ®8*«a � � a1*�¹��sćµ Ù�µ`³JÙiº a � �g@ *I� � Â>-£^6ºUV � Â�*º a ��@ *I� � ÂMV � º�� *MaF�� Â|*"Ê9�¤ ¡��L�*�L1N �&

� �JÙq¸)��'��Ü�Ó`¦t�g¦DÅ��Î�¤`�s¥��g¬N¢j�". ; Ã2¬N½<§+¦�£`¦�Ðs�`¦D£iÅg¬½ÈÁ¬NNÍj¡/�T¢.A�¢J�T¦ÏË�Ã2Ó`¦¡T¦��TÓ`¦�£C¦�Ðs�s¬Ñ�T¬½¢!��¢jÎ . ; º�V @ &B&B&,V "V " � @�Â"Ã2Ó`¦�fVK@0&H&B&,V " ¬ÇÅ�ÍÏÄsÍ8�TÓn¬N� � Ã2¬NNs§+¦2¡g¦�Ä`NÍ!¥�¦D£É§:© . ; ºUVK@0&H&B&IV " V " � @Âc�5. ; ºUVK@0&H&B&IV " ÂM� " � @e*'� " � @�-}.*�¬½Î�¦�ÿC¬ÇÅ��cÅ3a " � @W-/® Åg¤s¥cÓ �TÓsÍ8��ºSa " � @e*C� " � @Âs-q^+º�V " � @Â�&��]� �gÓs¬NÅn¥Í!Åd¦ . ; ºb2-Â|*c2 643T�i¥�¢!� �TÍJ¬N�sÅÅd¦Dö ¤`¦�s¥¦�Å�¢jÎ"¬N�`Ä`¤C��Åg©:ÈÉ§+¢jÇÅ«�O-t}.&w�7Ex�9_=4;�=\369/��y6��¸Ù ��ºb}.*��¡*I®8*,~?* 34*I�4*C��E*C^:Â$³J·B? � � ��ºb}.*��¡*I®8*I~ � * 34*C� � *C� �� *C^:ÂÉ¾ç-ÙU� �n¹AÙL¿g¸c³8²°-±]²v³jćµ:¶V·<¸A¹|ÙVµs³8ÙÉ³8¿T¸|Ùq¸�¹AÙ\¶V·:ÀJ±d´ �8² �s³8ÙL¶4¾�¼½¸R� :+µs¸�·z³ � ·s¶VÙ]¸�¹�¸Ù��_6£}s�«¶Ç¹|ć³8¼V¼½¸ ?�³J·¨¬N�`Ä`¤`��T¦�Åd�ÁÅg¦�� ³8·B?��9��¶ � �_µ`¸·+¸ �¸¿ÁÙVµs¸�¿g¸i¸C�!¶Ç¹AÙca -�®8*-�v�; � � ³J·B? ��; ª�� Ù�� |¶V· � �CÙt´ �J² � �CÙq³JÙ\¶ �J·`¹ � � � ³J·B? �9��*¿g¸�¹ �s¸c´�ÙL¶ 8¸�¼§{$��¶V·JaZ��¶VÙVµ�� ; � � º +Â¡�?� �; ª � � º <Â|* =-=} � *��/¸Ïµs³�8¸XV ; ��V ;

ª &

� {"7 36587:� �� _¸�Ù � � ºU}.* �T*,®8*I~?* 34*C�4*C�B�'*I^ Â|³8·"? �9�4� ºU}.* �T*,®8*I~9��* 34*I�9�S*I�G�� *C^:Â|¾ç�ÙU� ��¹AÙL¿g¸c³8²°-±]²v³jćµ:¶V·<¸A¹ÁÙVµs³8Ù�³8¿g¸ÁÙ]¸�¹cÙL¶V· Àj±d´ �8² �`³JÙ\¶4¾¼½¸��/¸c³ � � �CÙ � �CÙ\±@?J¶Ç¹AÙ\¶V·:À �C¶Ç¹gµ`³!¾�¼N¸i³8·"?�¼½¸Ù . ; ¾çÒ³�Ù]¸A¹AÙ � �C·<´�ÙL¶ �8·� � �4&i� � 2�6 3T�Á¶Ç¹-³ÁÙq¸�¹AÙ�¹¸�Ù � � �Éº��$ÂÉ³8·B?3�Éº��9�ÇÂÏ¹��sćµ�ÙVµs³8Ù�¸I�!¶Ç¹cÙ�a�-F® ³8·"? ��; � � *!��; ª�� Ù�� n¶V· � �CÙ´ �8² � �CÙ]³8ÙL¶ �8·`¹ � � � ³J·B? �9��*"¿T¸A¹ �s¸T´ÙL¶ �¸¼§{$��¶V·Fa ��¶VÙVµ"��; � � º� +Â4��v�; ª � � º� +Â�* 1-�. ; ºb2-Â|*�Ù�µ`¸·�. ; ºb2-ÂÉ¶Ç¹³8·«¶V·�� CÙ�Ù]¸A¹AÙ�¹¸Ù � � �*³8·B?��9��&

��¿�� Ù � �J¼V¼ �G��¹8?J¶V¿g¸c´�ÙL¼§{ � ¿ �8² :+µs¸ �8¿g¸²��i³8·"?�²n¸ � ·s¶VÙL¶ �8·��K�� JÙq¸)�K�'�#�:¬NÈÁ¬½ÇÍJ¡i�g¢�LÛ�sÍ8�T¤`¡TÍj��T¦�Åd�iÎ�¤`�s¥��g¬N¢j� Ã�¦�ÈvÍ�©?ÍJN½¢8Ã Í�ÅgN¬½®!Ó!�T½©ÝÈÁ¢C£C¬ÑÐ6¦�£ ¥¢j�s£C¬½�g¬N¢j�zÃ2Ó`¬N¥cÓÅgÍ�©CÅÒ�gÓsÍJ��¬½Î)V @ *H&B&H&�*IV D - 3 Íj�s£ ¦�ÿC¬ÇÅ��W� � - }.* � � - �T*oa � -:®8*tÊ� �� L�*oa � -7® Ã2¬½�gÓº a ��@ *I� � ÂMV � º�� *Ma � Â|*�Ê9�¤ T�_L�*:�gÓs¦��. ; º�V @ &B&H&CV D ÂT�/� @ &H&B&M� D &�]��gÓs¬NÅ�¥ÍjÅg¦ÒÃ�¦Ò¡T¦�¥ÍjÄC�g¤s¡g¦Á�TÓ`¦Ò�T¦�Åd�ÉÎ�¤`�s¥��g¬N¢j��£`¦�Ðs�`¬½�g¬N¢j��¤sÅd¦D£ ¬½� ù æ`Ê�û�Í!ÅÉÍJ��Ã�¦�Íjü1L?�sÍJ�g¤`¡cÍJ/�g¦DÅ��

Î�¤`�s¥��g¬N¢j��Ã2¬½�gÓFL�®!¡g¦DÍ8�g¦�¡��gÓsÍj�|¢!¡2¦�ö ¤sÍj<�g¢n�gÓ`¦-N¦�s®J�gÓ�¢jÎ��gÓs¦-½¢!�`®j¦DÅ��Åg¦�ö ¤`¦�6¥�¦�¢JÎT24&

� � î/ë�ñ��gðh�:ò�î�ëh�

Ü�Ó`¦$ÄsÍjÄ6¦�¡�Ä`¡T¢8Õ:¬N£C¦DÅ��gÓ`¦$�gÓ`¦�¢j¡T¦��g¬Ç¥Íj�§sÍ!Åd¬ÇÅ�Î�¢j¡2�TÓ`¦$®!¦�`¦�¡TÍJ�g¬N¢j�|¢JÎ��g¦DÅ��Åg¦��cÅ2Î�¡T¢jÈÚ�s¢j�CÔ]£C¦��T¦¡TÈÁ¬½�`¬ÇÅd�g¬Ç¥�Ø�ÔÈvÍj¥cÓ`¬N�`¦$ÅgÄ6¦D¥�¬½Ð6¥ÍJ�g¬N¢j�sÅ�Ös×(Ù]¸A¹AÙ�¹¸�Ù�¬ÇÅ�ÍnÐs�s¬Ñ�T¦ÉÅd¦��¢JÎ�Åg¦�ö ¤`¦�6¥�¦�Å�¢jÎ�¦N¦ÈÁ¦� �TÅ2�gÓsÍJ��®j¤sÍj¡TÍj� �g¦¦DÅ��gÓsÍJ��Ã�¢ÈvÍj¥cÓ`¬N�`¦�Å�ÓsÍ�Õj¦-¬Ç£C¦��!�T¬N¥�ÍJ�§+¦Ó6Í�Õ ¬N¢j¤s¡�Ã2Ó`¦��TÓ`¦ÉÍjÄ`Ä`N¬N¥�Í8�g¬N¢j��¢jÎ��gÓ`¬ÇÅ�Åg¦��T¢v�gÓs¦-��Ã�¢vÈvÍ!¥cÓ`¬½�s¦�Å�Äs¡g¢C£C¤s¥¦�Å¬N£`¦� �g¬Ç¥Íj�¡g¦DÅd¤sÑ�cÅÖ`�]��Î4Í!¥A�D¯C�gÓ`¦É¬½ÈÁÄ`N¬N¥�Í8�T¬½¢!�|¬ÇÅ�Åd�g¡T¢j�`®!¦¡Dá:�`¢J��¢!�`½©i�gÓ`¦É§6¦�ÓsÍ�Õ:¬½¢!¤`¡TÅ�¢jÎ"�TÓ`¦��Ã�¢vÈÁÍ!¥cÓ`¬N�`¦�Å¥�¢!¬½�s¥¬N£`¦j¯8§`¤C��ÍjNÅg¢��TÓ`¦¬N¡�ÍjÅTÅd¢C¥¬NÍJ�g¦�£-Ðs�`¬½�g¦2Å��cÍ8�T¦�ÈvÍ!¥cÓ`¬½�s¦�Å�Ö�Ü�Ó:¤sÅ_�TÓ`¦2ÍJÄ`Ä`¡T¢!Í!¥cÓ-¬NÅ"�T¢t®!¦�`¦�¡TÍJ�g¦�Åd¦Dö ¤`¦�s¥¦�Å¢JÎ�Íj¡T¥�Å2�TÓsÍ8�-¥Íj��g¦DÅ��Ï�gÓ`¬ÇÅÏ¦�ö ¤`¬NÕ8ÍJN¦�s¥¦�º�¤6Åd¬N�`®��gÓ`¦n¦�ÿC¬ÇÅ��T¬½�`®i�g¦DÅ��T¬½�`®��gÓs¦¢j¡T©|Î�¢j¡tÐs�`¬½�g¦ÁÅ��cÍ8�T¦ÉÈvÍj¥cÓ`¬N�`¦DÅTÂÍJ�s£Ò�g¢n¦�ÿC¦¡c¥�¬ÇÅg¦��gÓs¦�Åg¦t¤sÅg¬N�`®nÍjÄ`Ä`¡T¢jÄ`¡T¬ÇÍ8�g¦ÏÅd¦Dö ¤`¦�s¥¦�Å�¢JÎ�¦�½¦�ÈÁ¦� �TÅ�¬N�Ò�gÓs¦�£sÍ8�TÍnÅg¦��ÖCÜ�Ã�¢�ÍjÄ`Ä`¡T¢!Íj¥cÓs¦�Å/Íj¡g¦¬½�:Õ!¦�Åd�g¬N®!Í8�T¦�£XÖ:Ü�Ó`¦�Ðs¡TÅd��¬ÇÅ/�g¢�Åg¤`Ä`Äs½©v¦DÍj¥cÓÒÍJ¡c¥2¬N��ÍÉÄsÍ8�TÓÒÃ2¬Ñ�TÓ�Í�Åd¤`¬½�TÍj§`N¦�Õ8ÍJN¤`¦�¢jÎX�gÓ`¦�£`ÍJ�g¦tÅg¦��ÍJ�s£Ò�gÓ`¬ÇÅ¥�¢!¡g¡T¦�ÅgÄ6¢!�s£`Åt¬½�«Ä`¡cÍj¥A�T¬N¥¦É�T¢�ÄsNÍ!¥�¬N�`®i§`¡T¦�Íjü:Ä6¢!¬½� �TÅÏÍ8ÎV�T¦¡�¦�Í!¥cÓP¡T¦ÇÍ8�g¬N¢j�«ÓsÍjÅt§+¦¦�¨Ä`¡T¢C¥�¦�ÅTÅg¦�£XÖ<Ü�Ó`¬ÇÅt®!¬½Õ!¦�Å¡g¬ÇÅg¦��g¢Á�gÓs¦�¾�¿T¸T³�� 8¶V·6Ù�Ùq¸�¹AÙ�¹¸�ÙLÖsÜ�Ó`¦|¸C�!Ù]¸�·"?j¸ ?vÙ]¸A¹AÙ/¹�¸Ù�Åd�g¡cÍ8�T¦®j©i¦N¬½ÈÁ¬N�sÍ8�T¦�Å��TÓ`¦$§`¡T¦�Íjü Ä+¢j¬N� �TÅ�Ã2Ó`¦��`¦Õ!¦¡�gÓ`¬ÇÅ�¬NÅ/Ä6¢ ÅgÅg¬½§s½¦�§:©n¡g¦�¤sÅg¬½�`®ÉÕ�Íj½¤s¦�Å�Î�¡T¢jÈ÷�gÓs¦�Ä`¡T¦Õ:¬N¢j¤sÅ�¥¢jÈÁÄ`¤C�cÍ8�T¬½¢!��Öj��£C¦DÍJN½©!¯j¢!�`½©��gÓs¦�Ðs¡cÅ��Õ�Íj½¤s¦�¬½�Á�TÓ`¦Åd¦Dö ¤`¦�s¥¦ÉÃ�¢j¤`Ç£�§+¦�Åg¤`Ä`Ä`N¬N¦�£X¯+�gÓs¬NÅÏ¥�¢!¡g¡T¦�ÅgÄ6¢!�s£`Å��T¢Ò�TÓ`¦n¥�ÍjÅg¦$Ã2Ó`¦��ÍJ�=L ·+³JÙ �C¿g³J¼�Ù]¸A¹AÙ � �C·<´�ÙL¶ �8·|¥ÍJ��§+¦¥�¢!�sÅ��T¡g¤6¥A�g¦D£�Î�¢j¡�ÍÁÅd¤'/v¥¬½¦�� gN©ÒNÍj¡g®!¦XL�&Ü�Ó`¦�Åg¦��Ã�¢�ÍjÄ`Ä`¡T¢!Í!¥cÓ`¦�Å�ÍJ¡T¦��gÓs¦�ÁÄsÍJ¡g�g¬Ç¥�¤sNÍj¡g¬ÇÅd¦D£$�T¢��gÓ`¦tÅ��T¡g¦DÍJÈxØ�ÔLÈvÍ!¥cÓ`¬½�s¦�¥NÍ!ÅgÅ/ÍJ�s£��gÓs¦�¥�¢j�6£C¬Ñ�T¬½¢!�sÅ

¬½�?Ã2Ó`¬Ç¥cÓ?Í«Åd�g¡T¦�ÍjÈ�Ø�ÔqÈÁÍ!¥cÓ`¬N�`¦�Íj£CÈÁ¬½�TÅvÍJ��Lz�sÍJ�g¤`¡cÍJ��T¦�Åd�vÎ�¤`�s¥A�T¬½¢!�ÝÍj¡g¦|¬Ç£C¦� �g¬½Ðs¦D£XÖ/Ü�Ó`¦|�gÓs¦¢j¡T¦��T¬N¥�ÍJ¡g¦DÅd¤sÑ�cÅ2¬½��gÓs¬NÅ2Ä6ÍJÄ+¦¡�ÍJ¡T¦�®j¦��`¦¡cÍJN¬NÅTÍ8�T¬½¢!�sÅ�¢JÎ"�gÓ`¦-¡T¦�Åg¤`½�TÅ�¬N� ù æJúJûLÖ

47

� � ñ 2ë�î�� _ï��c��ë�ì��«¦�Ã�¢!¤`Ç£�½¬Nüj¦-�T¢Ò�TÓsÍJ�`ü��gÓs¦�ÍJ�s¢j�:©:Èn¢!¤sÅ2¡T¦Õ:¬N¦Ã�¦¡cÅ�Î�¢j¡��TÓ`¦¬N¡ÏÕj¦¡T©iÓs¦NÄCÎ�¤`�¥�¢jÈÁÈÁ¦� �cÅ¯<ÍJN½¢8Ã2¬N�`®v¤sÅ��g¢¬½ÈÁÄ`¡T¢8Õj¦��gÓs¦Òö!¤6ÍJN¬Ñ��©P¢jÎ/�TÓ`¬NÅ�Ä6ÍJÄ+¦¡DÖ-�«¦ÒÍj¡g¦ÁÍJÇÅd¢|®!Íj¡d�T¦�Î�¤`��T¢|�gÓ`¦Òª>:>�� ! Ä`¡T¢Jô�¦D¥A�cÅ9� ó Ü��tª º�®!¡TÍj�!�� )� �Jú;(�(�(jÂ/Íj�s£ � ó ��Ü2ª>�CÜ÷º � � ��2è��sÊ �7 Â�Î�¢!¡2ÄsÍJ¡g�g¬ÇÍJNN©vÎ�¤`�s£C¬N�`®v¢!¤`¡2Ã�¢!¡gü<Ö

� �,��í��ëtñ�� "!#�"��$� %&�'�)(+*,*-�� .�/1032�4!5�768� 0��:9;�5<-= =?>@��.A�-B"CED'FGD�H5�4CED��-.ACE*,I#��.�D'JK �*MLN� !@B�!E� CE�KIO�-PI,� .�LN� !EFQ� .�I,*&CE*,R;C:S-*,.�*O!#�TCED��-.U�V� R�*,/W� .U0&X;YZR�*5JK �*,.�I,*OR[� .V/Q\� �!#� P+]^��D�.�*,R�*�_�� R;CEFQ� .`%a�- "!ER,��_7!E�KI,*O*5/�D�.�S R�TL)_7!E�TCE�KI,�-P�b"B�*,I,Ddc�I5�TCED��-.+��%a*OR;CED'.�S�� .�/U��*e!ED�c�I5�TCED�� .U�&X�X�X#��f-g4hi= j"��:CEP'� .KCED�I�]^DdCk2K��l&�T!�CE��hnm&� P'P'�T.V/+�

oK��%&�p3q� Prq� .�*,R�I, s��t&*O.�*O!#�TP'D�R�*5/GR;C�!E*5�TFvu�hnFQ� I#��D�.�*,R�w[DdCE�G�- "CEB� "C:/"*,P�D'FGDdCE*5/�Ck2"B�*-�xsy ze{M|-}"~&�r��E�O��y;��)yT{&�V��r��K� �s�5o��Kf �4hn�?= �"�+o � �-��

��%&��p3q� Prq� .�*,R�I, s�s68��t&��*,�T!ES-��* �+68��m&� P�I,�-F��*-�V��*eCE*O!EFGD�.�D�R;CED�I�R;C�!E*,� F�u3hnFQ� I#��D�.�*OR��V� R�*,/�� .�S !#�TFGFQ�T!�R;2"R;hCE*,FGR,�D�.��yTz�� E�7��O��e��#�e�E�3�^z�| {�{G| z#�E��s| �� |5�K�e�O�a�� ezE�&¡[�ry-}�yE� ¢T�:�)y {3�V��i�ez��O�n�e�V�e�e�s�� E��r�O��| ��£ |T�N ��e{G| ��O��{Q�E�e��¤?�-P� �FG*@�-�V]3��6��4!�CED�.�hn�&D'/�*$�T.V/W��V6UD�C�!#�T.V�@*,/�R,��V¥�P� Kw:*O!5�Vo � �-��

�"��¦��p:�T!E.��T!#/+��¦"�:§¨��DdCiw:� !�CE�+�[68�:§©�K�/"w:�T!#/+�3]^� FGF@ �.�D�I5�TCED�.�S1u3hnFQ� I#��D�.�*,R,��ª#�,�,y z#{G| ��ryT�«|T��¬�Vy;�e��| z�� # �Vy-}�yE� ¢T�a� ="��?�"�ehn�?�?fK�a�,<-<-j�

gK��®^�7p�*,P�D'.��"��m&� S !E*OLN*-�)%:��*`]�]^Xk%�%^hiR�B�*OI,DdcVI5�4CED'� .¯�T.V/A/�*OR�IO!ED�B�CED��-.AP'� .�S- �� S-* ��)y {&�V��i�ezG°��e��y z�±T�`| ��ª#�²&°³��¢ �E�i�e{@�E�7�5j�a�,� �Kf5hE�5�?gTj"��,<-= <"�

j�$t��p�*O!E.��TC5�+68�+t�� /�*,P�� .V/�p��+6��T!�!E*-�sb� LĆkw��4!E*�CE*OR;CED'.�SQ�V� R�*,/��-.�L��T!EFQ� P�R�B�*,IOD�c�I5�TCED�� .�R,µ+�@CE��*O� !�2��T.V/��CE�K� Pr�s��y;�#��^|TzE��¶:�� E�eze��K�W·y �z#��|-} �Vj"��-=-f4hn�?�-g��,<-<"� �

fK��¥M��p^�-S-/��T.��4¤��V�� CE�-FQ�4CE*5/WCE*OR;CED'.�SM� L�m��T!E*OPr¸ R�R;C#�TCE*,I#�V�4!�CER,��_7��«CE��*,R�D�R,��b��*O¹M*,P'/U0&.�D'¤-*O!ER�DdCk2K�0&¥M��oT�-�-��=��%&�7p��-P��-S .�*,R�D��º[��p�!ED�.�»R�FQ�"�aXk.KC�!E�/� �IOCED��-.©CE��CE��*GX�b�Y¼R�B�*,IOD�c�I5�TCED�� .½(aY�%[Y�b��)y {&�V��i�ezG°��e��y z�±T�`| ��ª#�²&°³��¢ �E�i�e{@�E�7�,��9;�4>e��o-g4hkgT<"�a�,<-=-f�

<��¥M� hi%&��]^��*,.�SQ�T.V/��$� b��V¥�!ED�R��.�� » �FQ�4!5�V�� CE� FQ�TCED�I&L� �.�IOCED�� .V� PsCE*,R;C&S *,.�*e!#�TCED��-.� �R�D'.�SMCE��*$*O¾CE*,.�/�*5/QcV.�DdCE*R;C#�4CE*�FQ� I#��D�.�*�FG�/"*-��¿�z;y5�4Àa²[~��+�Ohij"�s�5< <-�"�

�,�"�$%&�Kb��-]^��5w��K%s*,R;CED�.�S�R�� LĆkw:�T!E*�/�*,R�D�S .GFG�/�*,P�P�*5/��K2$cV.�DdCE*:R;C#�TCE*[FQ� I#��D�.�*,R,�?ª;¶�¶)¶ z�|T��e|?�O��ry ��3y �`�Vy;�e��| z��¶:�� E�eze��K� ��s�4f =4hE�5=?fK��5<-f =�

� �-�$_��T �I#�2K�K6Át��T V/�*OP�� .V/Qp3��6��4!�!E*-�"0&R�D�.�S�� P�S *,��!#�TD'I&R�B�*,I,DdcVI5�4CED��-.�R�D�.QR�� LĆkw:�T!E*&CE*,R;CED�.�S�µ"�$I5� R�*3R;CE V/"2M�-.CE��*�R�� LĆkw��4!E*��TL7� .�� CE� FQ�TCED�I�R� ��Kw:�52K�+·y �z#��|-}ay;��¢T�E�i�e{@��yk�e��| zE�e��o�-��o-oT<ThkoT� ��,<-<-��

�5o��b��Vº7D�P'*O."��*e!ES��+~��ny {M| �n| ��a| �K� ��|,�K�e�@|T�� £ |?�# ��e�E�� Pr��$�V��I5�-/"*,FGD�I�_7!E*OR�R,�a�5<-fT�"��,�"��68�+®V�TDd!�CEP'� �S �s�a68��m&� P'IO�-F@��* �+®^��XkBV�4CE*-�s]3�+¦-�T!#/�� .+�at��+(a�,2"I,�KIe»��T.V/ÃÂ�� V�T.s��03R�D'.�SU�T.8u�hnFQ� I#��D�.�*�CE�

FG�/"*,P+�@¤D´/"*,�MI5�TR�R�*OC�CE*�!E*,I,�T!#/�*O!5�)��zez��e��^ª#�E�E�V�e�&��`¶[}'��O��z;y ��r� £ y5�K�O}�} ��K� ��"�+�,�"�OhE�5j�-��,<-<-g��O��b��a®� Ä;Ddw:�T!#�"��t��s¤?�-.8p^�KI#��FQ� .�.s�s®^�+¥��*,.�/�*,»��s68�s�3FQ�TP��- 8� .V/8��st&��*5/��TFGR�Dr�s%a*OR;C�R�*OP'*OIOCED��-.1�� R�*5/Ã�-.

c�.�DdCE*�R;C#�TCE*$FG�/"*,P�R,��ª;¶)¶)¶ z�| ��e|?�O��ry ��y ��y;�e��| z��¶:�� #�ez#��K� ��4f��g <�Ohij-� �"��,<-<"� ��5g��t��t&� .�*,.�I-��¨FG*OCE��/@LN� !:CE��*&/"*,R�D�S-.Q� L+L��T �PdC[/"*OCE*,IOCED��-.Q*O¾"B�*O!ED�FG*,.KCER,�ª;¶�¶)¶ z�| ��O|-�O��ry ��y �©�)y {3�V��i�eze�

�,<"��g g�eh;g g =��5<-f �"��,j"��\$� 68�sm3D�*O!E�-.�R,�aº�¾CE*,.V/"D�.�SQCE*,R;C$R�*5JK �*,.�I,*@�4¤?*e!EP´�TB8�K2�D�.¤?*O!�CED��D�P�DdCk2K� ��U�)y {3�V��i�ezG·y �z#��|-} �7� <"�s�?o g4hi�-� �"�

�,<-<-jU��5f��\$� 68�m&D�*O!E�-.�R,�%a*,R;CED�.�S�L´!E�-F¼��c�.�DdCE*[R;C#�TCE*&FQ�TIe��D�.�*-µ-*O¾CE*,.V/"D'.�S�D�."¤-*O!�CED��D�P�D�Ci2MCE�$R�*5JK �*,.�I,*,R,� ��)y {&�V��i�ez

·y �z#��|-} ��-�"��o-o �4hko �-��5< <?fK��,="��\$� 68� m3D�*O!E�-.�R,� 68� m&�T!EFQ�T.s�4%a*OR;CED'.�S&I,� .�LN� !EFQ� .�*�CE�3�3JK �� R�Ddhn.��-."hi/�*OCE*O!EFGD�.�D'R;CED�I)R;C�!E*5� F«u3hnFQ� I#��D�.�* �Txay z#{G|-}

~&�r��E�O��y;�M�)y {3�V�� 5o��KoT�Thn�-�?o�+oT�-�-��,<"��68��m&� P'IO�-F@��* �u3hnFQ� I#��D�.�*OR�� R[�@�� R�D�R:L��T!3/"2".V�TFGD'I3R;2"R;CE*,FÅR�B�*,IOD�c�I5�TCED�� .s�a�Vy;�e��| z��&¶:�� #�ez#��K�Q·y �z#��|-} �

��Vj <Thkf j��5< =-="�oT�"��68�5m3�-P�I,� F@��*-�,®^�5XkB��TCE*)� .�/��4t3!E� .V/"�- V/"D�R,�T]^�-FGB�P'*eCE*7LN �.�IOCED��-.V�TP-CE*,R;CED�.�S[�TL�RE�4L�*OCi2hiIe!ED�CED�I5�TPKR;2"R;CE*,FGR,�-�V|;�5�e��¢

| �V��Æ[�O} �r|?ÇO��} ��¢��8¶:{Q�ez�� A�)y ��z;y-} ��# �Vy-}�yE� �n�e�O�^~¼¿[y �E�d�Vz#��&ÈTy-} �{Q�3�#z�y {É�N ��@ª;x�~��Ê��yTzE±T�; �ye�½y ��V|;�5�e��¢U| ��QÆ[�O} �r|?ÇO��} ��¢Q��¶:{Q�ez�� 8�)yT��z�y } ��# ��y-}�yE� �r�e�#�+��,2CE�-.��Qp^*5� I#�s��®�P'�T!ED'/��"��0�b��$�a�5< <Thko �T��7�Ohi�l3�T¤-*,F@��*O!&�5<-<-g�

oK�-��68�+m&� P�I,�-F��*@�T.V/Ã®^��XkBV�4CE*-��)y z#zE��O�&��¢ �E�i�e{��,�7¡��"��}�� |W¡��"�E��e�E�$¿:z�y5�#�e�E�@��y } �"��y ��b"B�!ED�.�S-*O!��)*O!EP'� S"�p^*e!EP'D�.+�a�5< <-=�

o o�$®^��XkB��TCE*$� .�/�68��m&� P'IO�-F@��* �V��.�� CE��*O![P��K�-»`�TC�I,� FGB� �C#�T��D�P�DdCk2K�Vª#�5�,yTze{M| ��r�E| �+oT�"��-g <4hk�-f-oK��5< <-j"�oT�"�$®^�TXkB��TCE*^� .V/�68�Tm&� P'IO�-F@��* �T�3.$D�.CE*OS !#�TCED�� .�CE*,R;CED�.�S3FG*OCE��/�CE��TC�D�R�B�!E�4¤?*,/�CE��cV.�/��TP�PL�� P�CER,�Kª#��i�ez#��|T��ry ��| }

·y �z#��|-}ay;�G�)y {&�V��i�ez £ |T�N ��e{G| ��O�#�sj �"�a�5g <4h#�5f =��5< <?f�o4��$®^�XiBV�TCE*&� .�/`68�m3�-P�I,� F@��*-��bB�*,I,DdcVI5�4CED��-.`� .V/MCE*,R;CED�.�S@ �R�D�.�S�S *,.�*O!#�TP�D'HO*5/`FQ�TIe��D'.�*,R,µ�$B�!E*,R�*O.C#�4CED��-.`� .V/Q�

I5�TR�*$R;CE V/"2K��Vy;�e��| z�� e�E�� Ë��eze� Ì^�E| ��ry �©| �V�MÆ[�O} �r|?ÇO��} �N��¢ �V="��j"�Ohi=�-��,<-<-=�o g�$®^�^XkBV�4CE*Ã� .V/�68�^m&� P'IO�-F@��* ��ÍFG*OCE��/ÎL��T!`!E*Oc�.�D�.�SÏ�T.V/½CE*,R;CED�.�SAS-*,.�*O!#� P�D�R�*5/�FQ� I#��D�.�*�R�B�*,IOD�c�I5�TCED�� .�R,�

ª#��i�eze�V| ��ry �V|-}�·y �z#��|-}ay;�M�)y {&�V��i�ez £ | �N ��e{G| ��r�O�E�sj-=�a�,<?f4hkoK�5<"�s�5< <-="�

48

oTj"�$®^�+XkB��TCE*@� .V/©68�+m&�-P�I,� F@��*-�st&*O.�*O!#�4CED'.�SUCE*,R;C$R�*5JK �*,.�I,*OR&LN!E� FÉ.��-."hi/�*OCE*O!EFGD�.�D'R;CED�I�S-*,.�*O!#� P�D�R�*5/©R;C�!E*,� FÉu3hFQ�TIe��D'.�*,R,�Vxay z#{G|-}V~��r��O��y;�M�)y {&��"��N�� 4oK�V� �?�Thn�?g ="��o � �-�"�

o f�$®^��XkB��TCE*-�V68��t&��*,� !ES ��*�� .�/�68��m&� P'IO�-F@��* �V%a*OR;CED'.�S�9�R;C�!E*5�TFW>^u3hnFQ� I#��D�.�*OR,��R� ��FGDdC�CE*5/��oT="��Â��¥�� V�5¤D��s��)�N�n�# ��W| ��x��i�&~��ny {M| �n| ��EyTze¢T�a6UI4t3!#�,w�him3D�P'Pap^�K�-»U]^�-FGB�� .K2K��5<-f ="�oT<"��@�+(+*,*M�T.V/868��:�T.�.V�T»-�T»D'R,��_7!ED�.�IOD'B�P�*,R$� .�/ÃFG*OCE��/�R3� L^CE*OR;CED'.�S`c�.�DdCE*�R;C#�4CE*MFQ� I#��D�.�*,R&h[�³R� �!E¤?*e2K�+¿�z;y-�

�#�E�� yk��N ��ª;¶�¶)¶:��=T��s�5�-< �ThE�-�5o ��5<-< j"�� "��t��(+ ��"�+t��¤��p^�KI#��FQ�T.�.��T.V/��V_�*OC�!E*,.�»?��V%a*,R;C�R�*OP'*OIOCED��-.Ã�V� R�*,/��-.�I,� FGF@ �.�D�I5�TCED�.�SG.��-."hk/"*OCE*O!EFGD�.�D�R;CED�I

c�.�DdCE*OhnR;C#�TCE*WFQ� I#��D�.�*OR� �R�D'.�SÃ��S *,.�*e!#� P�D�R�*5/¬§¨B"hnFG*OCE��/��7ª;¶)¶�¶ z�| ��O|-�O��ry ��y �¬��y;�e��| z��G¶��K� ��E�ez#�� oT�"�a�O�?<4h#�,j"� ��5< < ��

��-��b��Kl��TD�CE��T.V/Q68�"%:R� �.��52� FQ��K®V�T �PdC�/"*OCE*,IOCED��-.GLN� !:R�*,J �*,.KCED'� PVFQ�TIe��D'.�*,R,�"¿:z�y5�3ª;¶)¶�¶Ïxa| �"} � y }'�ez�| ��3�)y {@��V��iÀ:�)y �5�,À'�a�,<-="� �

�-o�$�$�a_�*eC�!E*,.�»?�"�+®V� �PdC$FG�/�*,Pdhi/"!ED�¤?*,.�CE*,R;C�/"*O!ED�¤-�4CED��-.8L´!E�-FÁc�.�DdCE*@R;C#�4CE*MFG�/�*OP'R,µs�T.�.��TC#�TCE*5/Ã��D��P�D��-ST!#� B��2K�+D�.£ y5�?�O}�} ��M|T��8Ë��ez#� Ì^�E| ��ryT�Ãy;�:¿[| z�| }�}'�O}"¿�z;y5�#�e�#�O�e�E��®^��]:�TR�R�*,H-��]3�"¦?�T!#/��p3�\��-H,�52K�"68� �@�?\�2�T.G*5/�R,��"(+l�]�boT�-j?fK��5< jThko �-g�+oT�-��-�

� �"��¥M� ¥M�4b"� ��.V� .�D?�T.V/�� %&�5�� "!#�"�5�8B�!E� CE�KIO�-P?CE*,R;CED�.�S�B"!E�KI,*5/" �!E*-�V�)yT{&�V��i�ez)°$�e��y z�±T�:| �V�[ª#�"²3°¯��¢ �E�i�e{��#�gK��oT=?g4hkoT<?f�a�5<-= ="�

�T��@� _��-b"D'/�� .�/�%&� hn¥M� (s*, �.�S�� ®��T!EFQ� PFG*OCE��/�RaLN� !)B�!E�TCE�KI,�-PCE*,R;CED�.�S"µ-�&/�*OC#�TD'P�*5/�R;CE V/2K�-ª;¶�¶)¶ z;| ��e|?�O��y ��y ��Vy;�e��| zE�&¶��K� ��E�ez#�� 5g��5�4hn�Ko j��5< =-<�

�-g��^� .�S�� p3� � .�/�03!#�TP�� m�� _7!E�TCE�KI,�-P"I,�-."L��T!EFQ� .�IO*^CE*,R;C7S-*O.�*O!#�4CED'� .M �R�D�.�S&F@ �PdCED'B�P�*^0&X;YÎR�*5JK �*O.�I,*,R7�T.V/$�4¤?*O!EP'� B"hB�D'.�S��s~�� £ �"ªT�&�� £�£�� [�)yT{@{@��r�E| ��ry ��#�7~�z��# �N�i�E�O��z��e�G| �V�M¿:z�y �ny5�Ey-} �E�a%^w:*,.KCE*-��%:��*�l3*OCE��*e!EP´�T.V/"R,�b*,B�CE*,F��*O!�o4� hko-fK�a�-�,=ThE�4o f��,<-< �"�

49

Complete Behavioural Testing (two extensions to state-machine testing)

Mike Stannett

MOTIVE Research Associate Verification and Testing Research Group

Dept of Computer Science, University of Sheffield Regent Court, 211 Portobello Street, Sheffield S1 4DP, United Kingdom.

[email protected] Abstract. We present two extensions to state-machine based testing. The first allows us to extend Chow’s W-method (CHOW) to machines with non-final states, thereby including infinitely many more specifications within the scope of the method. The second is a radical extension to Holcombe and Ipate’s 1998 stream X-machine testing method (SXMT), itself an extension of CHOW. This method involves the construction of a bespoke model of computation, the behavioural machine (β−machine), which extends Eilenberg’s 1974 X-machine concept. Examples of β−machines include X-machines, stream X-machines, semi-automata and automata, and even some concurrent system specifications. Despite this generality, we demonstrate an algorithm for generating complete behavioural test sets for systems specified by β−machines.

Keywords. Algebraic models of computation, Chow’s W-method, complete functional testing, concurrent systems, object-oriented testing, software testing, stream X-machine (SXM).

Acknowledgement. This research is sponsored by the UK-EPSRC through the project, MOTIVE (GR/M56777: Method for Object Testing, Integration and Verification; principal investigator: Dr Anthony J. Simons; co-investigator: Prof W. Mike L. Holcombe).

1 Introduction

This paper describes a unified approach to testing sequential and concurrent systems, which extends both Chow’s W-method (CHOW) for verifying designs presented as state machines [Cho78], and Holcombe and Ipate’s SXMT test-generation method [HI98] for the stream X-machine (SXM) [Lay93]. In addition to covering more classes of specification model, our methods also allow the coverage of more machines within each of the standard classes. Both CHOW and SXMT require the system specification to be a minimal completely specified machine, in which every state is final and precisely one state is initial, and these constraints ensure that infinitely many specifications are untestable within the method. In contrast, we present a simple technique, super-minimisation, that allows machines with non-final states to be put into a form that satisfies the CHOW- and SXMT-style preconditions. Moreover, super-minimisation results in a machine with up to 50% fewer states than the standard minimised variant of the original semi-automaton. Because the number of tests required to characterise a machine’s behaviour depends on the size of the underlying state set, our technique can result in significantly smaller test sets.

Although there are differences between CHOW and SXMT, these are essentially imposed by the different natures of the systems being modelled (automata and stream X-machines, respectively). We present a unified model for state-machine-style specifications, which we call the behavioural machine (β−machine). This model includes many standard sequential models as instances, including automata, stream X-machines and standard X-machines, but also applies to concurrent models. Moreover, β−machines can be equipped with a general purpose test-generation method of which CHOW and SXMT are instances. Just as SXMT can be used to

51

generate�complete�functional�tests�of�sequential�systems,�so�the�β−machine�method�(β−method)�can�be�used�to�generate�complete�behavioural�tests�for�β−machines�of�any�sort.�

1.1� Structure�of�the�paper�

In�Section�2,�we�illustrate�our�simple�super-minimisation�technique�for�including�machines�with�non-final� states� within� the� remit� of� CHOW� and� SXMT.� In� Section� 3� we� present� our� unified�behavioural� model,� the� β−machine,� for� state-machine-style� computations.� We� show� that� X-machines�[Eil74,�Hol89,�Sta90],�automata,�and�even�some�concurrent�specifications�are�all�types�of�β−machine.� In�Section�4,�we�summarise�and�extend�CHOW�and�SXMT.�We�demonstrate�an�algorithm� for� generating� test-sets� for� β−machines,� and� prove� that� they� are� behaviourally�complete.�

1.2� Notation�and�conventions�

Finite�state�machines�can�be�defined�both�with�and�without�outputs.�Following�[LP84],�a�finite�state�machine�(FSM)�without�output�will�be�called�a�semi-automaton,�and�an�FSM�with�output�will�be�called�a�automaton.�Throughout� this�paper,�F�denotes�an�FSM�with� input�alphabet�A�(also�denoted�In),�output�alphabet�Out�(if�F�is�a�semi-automaton,�we�take�Out�=�In�and�regard�each� label� a� as� the� input/output� pair� a/a),� state� set� S,� initial� state� set� I� ⊆� S� and� final� (aka�terminal)�state�set�T�⊆�S.�Given�any�U⊆S�and�a∈A* ,�we�write�U � a�to�mean�that�there�exists�a�path�in�F,�labelled�a,�starting�at�some�s∈U.�Likewise,�U� � a�V�means�there�is�a�path�labelled�a�from�a�state�in�U�to�a�state�in�V.�If�a�=�(a)�is�a�string�of�length�one,�we�write�→a�in�place�of� � a,�and� if�U�=� { s} � is�a�singleton,�we�write�s � a� in�place�of� { s} � a.�F� is�completely� specified� (or�complete)� if,� for�each� s∈S�and�a∈A,� there� is�at� least�one� transition�s→a,�and�deterministic� if�there�is�at�most�one�such�transition.�A�language�L�⊆�A* �is�a�(state)�cover�for�F�if,�for�each�state�s,�there�is�some�a∈L�with�I � as.�Given�any�language�L⊆A* ,�and�any�integer�n,�we�define�L(n)�=�

∪{ Lk�|�1�≤�k�≤�n} ∪{ ε} ,�where�ε�is�the�empty�string�over�A.�For�n≤0,�this�reduces�to�L�(n)�=�{ ε} .��

If�F�has�at�least�one�cover,�we�say�that�F�is�accessible.�If,�given�any�states�s�≠�t,�we�can�find�a�with� s� � a� t,� then�F� is�said� to�be� (strongly)� connected;�any�connected�machine� is�accessible.�Conversely,�if�an�accessible�machine�F�has�only�one�initial�state�and�is�equipped�with�a�‘ reset’�action�which�returns�the�system�to�this�state�on�demand�(i.e.�if�there�is�a�transition�s�→reset�I�from�each�state�s),�then�F�is�strongly�connected.�

2� Testing�semi-automata�with�non-final�states�

Consider�the�simple�semi-automaton�(FSM�without�output)�shown�in�Figure�1a.�We�can�think�of�this�as�the�specification�of�a�system�which�is�allowed�to�perform�any�combination�of�as�and�bs,�provided� the� last� operation� it� performs� it� definitely� an� a� (for� example,� industrial� machinery�might� carry� the�specification� “power�must�be� turned�off�at� the�end�of� the�shift” ).�The� figure�shows�the�minimal�machine�for�the�relevant�language�A*a,�where�A={ a,b} .�It�has�two�states,�of�which�the�one�on�the�right�is�final�and�the�one�on�the�left�initial�(but�not�final).��

�

�

Figure�1a.�Minimal�semi-automaton�for�A*a�

a�

a�

b�

b�

52

b/F�

a/T�

a/T�

b/F�ε/F�

b/F� a/T�

ε/F�

We� can� regard� any� semi-automaton� as� an� automaton� by� interpreting� each� symbol� a� as� the�input/output�pair�a/a,�so�it’s�meaningful�to�consider�this�machine�in�relation�to�CHOW.�In�fact,�however,�neither�Chow’s�W-method�nor�its�functional�extension,�the�SXM�testing�method,�can�be�used�to�generate�tests�for�systems�with�this�sort�of�specification,�because�these�test�methods�require�all�states�in�the�minimised�specification�machine�to�be�final,�and�here�we�have�a�non-final� state.� The� minimal� versions� of� infinitely� many� specifications� fail� the� very� stringent�conditions�of�these�methods.�

To� overcome� this� problem,� we� need� to� re-express� the� specification�as�a�minimal�machine� in�which�all�states�are�final.�We�do�this�by�super-minimising�the�machine.�Rather�than�representing�each� symbol� a� as� the� pair� a/a,� we� instead� append� a� ‘ fake’� output� symbol� to� capture� the�termination�behaviour�of�the�relevant�transition.�If�the�transition�ends�at�a�final�state�we�add�the�‘output’�T�(true),�and�otherwise�F�(false).�The�initial�arrow�is�labelled�ε/F�(in�this�example)�to�indicate�that�ε�is�not�deemed�a�member�of�the�behaviour.�The�distinction�between�final�and�non-final�states� is�now�superfluous,�because�all�of� the�relevant� information� is�encoded�by� the�T/F�components� of� the� transition� labels� (Figure� 1b).� We� can� therefore� declare� all� states� in� this�‘ transducer’�representation�to�be�final,�without�losing�any�information.�

�

�

�

Figure�1b.�Generated�machine�for�A*a�

Because�we�have� imposed�a�new�state�configuration,� there� is�scope� for� further�minimisation.�Minimising�this�particular�machine�yields�the�minimal�machine�in�Figure�1c,�with�just�one�state.�

�

�Figure�1c.�Super-minimised�β−machine�for�A*a.�

Consequently,� we� have� achieved� a� 50%� reduction� in� the� state� set,� even� for� a� very� simple�machine�that�was�already�minimal.�This�is�a�significant�saving,�and�has�the�important�corollary�that�Chow’s�W-method�can�now�be�applied�to�a�behaviour�that�was�previously�untestable�by�this�method.�To�see�how�to�use�the�method,�suppose�we�are�given�a�2-state�implementation�to�test.�In�this� case� the� implementation� under� test� (IUT)� has� one� more� state� than� the� (super-minimal)�specification.�We�use�Figure�1c�to�choose�a�cover,�say�C�=�{ ε} ,�and�a�characterisation�set�W�=�{ a} �and�construct�the�CHOW�test-set�TS�=�CA(2)W,�i.e.�

TS�=�{ �a,�aa,�ba,�aaa,�aba,�baa,�bba} �

Looking�at�the�specification,�we�see�that�the�accept/reject�responses�for�each�of�these�strings�is�

a� T� aaa� TTT�

aa� TT� aba� TFT�

ba� FT� baa� FTT�

� � bba� FFT�

Have�we�successfully�generated�a�test�set?�To�find�out,�suppose�Imp�is�a�2–state�semi-automaton�with�the�accept/reject�patterns�specified.�Call�the�states�L�(left)�and�R�(right),�with�L�initial.�It�is�clear� that� transitions� L� →a� and� L� →b� must� exist,� because� there� are� extensions� of� these� 1-

53

b�

a� b�

a�

b�

a�

b�

a� a�

b�

a�

b�

transition�paths�that�are�accepted.�Moreover,�the�first�clearly�leads�to�an�acceptance�state�and�the�other�to�a�rejection.�There�are�only�two�layouts�that�meet�these�criteria�

�

�

�

�

Looking�at�the�length-2�patterns�in�the�test�set�allows�us�to�complete�the�diagrams�(again�we�use�the�acceptance�of�length-3�paths�to�determine�that�the�second�b�transition�must�exist)�

�

�

�

�

The�languages�accepted�by�these�machines�differ�only�as�to�whether�they�include�ε.�We�contend�that�“ testing�ε” �is�a�meaningless�activity,�because�no�test�based�on�the�empty�input�string�ε�can�be�assured�of�generating�any�observable�output.�This�is�why�we�require�the�designer�to�specify�explicitly� whether� or� not� ε� is� to� be� included� in� the� language.� In� this� case� we� have� the�specification�ε/F,�so�we�reject�the�right-hand�machine.�

Clearly,�the�only�2-state�semi-automaton�that�satisfies�our�test-set�requirements�is�the�machine�we� started� with,� so� our� 2-state-machine� test� set� is� indeed� working.� The� reason� it� works� is�straightforward:�the�super-minimal�machine�precisely�captures�the�accept/reject�behaviour�of�the�original�semi-automaton.�Consequently,�any�machine�constructed�to�match�the�behaviour�of�the�super-minimal� machine� automatically� matches� that� of� the� specification� machine� itself.�Moreover,� we� can� obviously� extend� the� method� to� allow� testing� of� more� complex� machine�types.�So,�for�example,�we�can�generate�tests�for�automata�or�stream�X-machines�with�non-final�states�by�extending�Out�to�include�the�T/F�information,�and�likewise,�by�adding�T/F�information�to� the� fundamental�datatype�X,�we�can�generate� test�sets� for�X-machines�with�non-final�states�(see�below�for�an�explanation�of�X-machines�and�stream�X-machines).�

One�word�of�caution.�We�have�seen�how�we�can� regard�semi-automata�as�automata�with�T/F�outputs,�where�a�transition�emits�T�if�and�only�if�it�leads�to�a�final�state,�and�emits�F�otherwise.�Chow’s�method�applies�to�this�automaton,�and�hence�to�the�underlying�semi-automaton,�but�we�have�to�be�very�careful�when�applying�the�method,�because�the�behaviour�of�the�machine�F�is�different�when�viewed�as�an�automaton,�as�compared�with�its�behaviour�when�viewed�as�a�semi-automaton.�As�a�semi-automaton,�all�that�matters�when�we�supply�an�input�string�a�is�whether�or�not� it� is� recognised.� But� as� an� automaton,� we� also� have� the� history� of� acceptance/rejection�decisions�as�the�string�was�submitted.�This�extra�information�is�vital�to�Chow’s�method,�so�we�need� to�make� it�available.�We�accordingly�require�of�any� test�set� that� it�be�downward�closed.�That�is,�if�a�is�in�the�test�set,�so�is�every�prefix�of�A.�To�make�this�unambiguous,�we�will�write�L↓� to�denote�the�downward-closure�of�the�language�L.�Obviously,� if�L� is�finite,�so�is�L↓.�The�extent�to�which�the�need�to�use�downward�closures�matters� is�open�to�debate.�In�the�example�just�considered,� for� instance,� it� is�clear� that�the�information�obtained�from�the�input�strings�T�and�TT�is�also�available�in�the�output�recorded�for�the�longer�string�TTT.�So�while�downward�closure� is� necessary� as� a� theoretical� precaution,� it� may� have� little� relevance� to� practical� test�generation.�

54

3� Behavioural�frameworks�and�β−β−β−β−machines�

Whenever�we�draw�a�state-machine�diagram,�we�implicitly�make�certain�assumptions�about�the�symbols� used� to� label� the� transitions.� These� labels� can� vary� considerably� in� algebraic�sophistication,�but�always�share�certain�key�properties.�To�put�things�in�context,�let’s�review�the�difference�between�automata,�semi-automata,�X-machines�and�stream�X-machines.�

All�four�machine�types�are�based�on�the�standard�finite�state�machine,�but�differ�as�to�the�labels�they�associate�with�transitions.�Rather�than�deal�with�large�numbers�of�definitions,�we’ ll�assume�instead�that�F�is�a�semi-automaton�with�alphabet�A,�and�that�B�is�some�set�of�behavioural�labels�that�we’ re�going�to�associate�with�transitions.�In�other�words,�each�symbol�a�becomes�the�name�of� a�behaviour� in�B,� and�we�can� represent� this�by�supposing� the�existence�of�some� labelling�function�Λ:�A→B.�

Loosely�speaking,�the�labelling�involved�in�each�of�the�models�is�as�follows.�For�semi-automata�the�labelling�is�the�identity�map,�Λ(a)�=�a,�and�for�automata�we�essentially�take�B�=�In×Out.�For�an�X-machine�(XM),�the�labelling�maps�A�into�R(X),�the�set�of�all�relations�of�type�X↔X.�For�a�stream�X-machine�(SXM),�we�map�A�into�a�set�of�relations�of�type�In×Mem↔Mem×Out,�where�Mem�is�a�potentially�infinite�auxiliary�set�called�the�machine’s�memory.�

The�basic�operations� involved� in� representing� languages�by�semi-automata�are�concatenation�and�aggregation.�Concatenation�occurs�when�one�transition�follows�another.�Thus,�for�example,�when�we�regard�the�two�transitions�→u→v�as�a�single�path� � uv,�we�are�implicitly�assuming�that�the�labels�u�and�v�can�be�concatenated�to�yield�the�string�uv.�Notice�that�the�type�of�uv�differs�from� that�of�u� and�v� themselves.�This� is�unacceptable� for�our�purposes,�because�we�want� to�build�a�model�of�behaviour�which�is�self-contained.�The�concatenation�of�two�behaviours�should�be�another�behaviour�–�it�should�have�the�same�type.�We�can�overcome�the�problem�easily�by�thinking�of�u�and�v�as�the�strings�(u)�and�(v)�of�length�one.�Now,�behaviours�are�represented�as�strings,�and�the�concatenation�of�the�two�strings�(u)�and�(v)�is�again�a�string.�Aggregation�occurs�when�we�combine�the�various�successful�paths�through�a�machine�and�regard�them�as�a�single�language.�Again,�this�seems�to�violate�our�principle�that�all�behaviours�should�be�of�the�same�type,� because�we�are�operating�on�strings�and�generating� sets� of� strings.�Fortunately� there� is�again�a�simple�solution.�Wherever�we�have�a�string�u,�we�regard� it�as�a� language�{ u} �with�a�single�element.� Looked�at� in� this�way,�aggregation� is�simple�set-theoretic�union.�Given� these�interpretations,�we�see� that�semi-automata�can�be�modelled�by� taking�a� labelling�of� the� form�Λ(a)�=�{ (a)} ,�which�replaces�each�symbol�a�with�the�singleton�language�containing�the�single-character�string�(a).�This�is�important�for�our�purposes�because�we�now�have�a�model�of�FSM�computation� in�which�all�components�are�of�the�same�basic�type�(in�this�case�℘A* ),�and�this�type�is�closed�under�concatenation�and�aggregation.�

More�generally,�we�take�B�to�be�any�algebraic�structure�that�satisfies�the�following�conditions.�These�simply�express�basic�rules� that�can�be�established�to�be�necessary�by�considering�FSM�transition� diagrams,� and� asking� the� question� “what� must� be� true� for� B� to� be� closed� in� this�situation?” �

3.1� Regular�sets�over�monoids�

Suppose�(B,⊗)�is�a�monoid,�i.e.�a�semigroup�with�an�identity�element�1.�Given�any�alphabet�A�of�the�same�cardinality�as�B,�we�set�up�a�1-1�correspondence�Λ:�A�→�B.�This�extends�to�a�monoid�homomorphism�Λ* :�A*→B�given�by�Λ(ε)�=�1B,�and�Λ(b1,…,bn)�=�b1�⊗�…�⊗�bn.�This� in�turn�extends�to�a�function�Λ** :�LANG(A)�→�℘B�given�by�Λ** (L)�=�{ �Λ* (a)�|�a∈L} .�If�L�is�a�regular�language�over�A,�we’ ll�say�that�Λ** (L)�is�a�regular�subset�of�B.�The�set�of�all�regular�subsets�of�B�will�be�written�REG(B).�It�includes�∅�=�Λ** (∅)�and�all�finite�subsets�of�B.�

55

Notice�that�℘B�is�itself�a�monoid,�with�identity�element�{1B},�where�we�define�U�⊗�V�=�{u⊗v�|�u∈U,�v∈V},�so�it� is�meaningful�to�discuss�regular�subsets�of�℘B.�Moreover,�REG(B)�is�also�a�monoid�with�these�choices�of�operation�and�identity.��

3.2� Definition�(Behavioural�framework)�

We�will�say�that�a�triple�B�=�(B,⊗,Σ)�is�a�(behavioural)�framework�provided�

1.� (B,⊗)�is�a�semigroup,�with�a�2-sided�identity�element,�1B.�We�call�⊗�concatenation.�

2.� Σ:�REG(B)→B�is�a�function,�called�(regular)�aggregation,�satisfying�

a.� Σ∅�=�1B�

b.� Σ{b}�≡�b�

c.� Σbi�⊗�Σbj�≡�Σ{�bi�⊗�bj�}�

d.� ∀�regular�{Vi�|�i∈I�}�⊆�REG(B)�:�Σ∪{Vi�|�i∈I}�≡�Σ{�ΣVi�|�i∈I}�

If�B�is�a�framework,�we�can�define�a�commutative�binary�addition�⊕�by�u⊕v�=�Σ{u,v}.� � �

Frameworks�are�ubiquitous� in� theoretical�computer�science�and�mathematics.�The�distributive�laws�(2.c)�means�that�frameworks�are�closely�related�to�algebraic�rings,�though�the�concepts�are�not�identical�because�⊕�need�not�allow�inverses.�In�particular,�if�X�is�any�datatype,�the�monoid�R(X)�of�all�relations�X↔X�is�a�framework,�when�we�take�⊗�to�be�relational�composition,�and�⊕�to�be�set-theoretic�union.�Likewise,�if�we�treat�Σ�as�inf�and�⊗�as�sup,�then�every�frame�(hence,�every�topology)�is�a�framework,�but�again�the�converse�is�not�true,�because�we�don’t�require�⊗�to�be�commutative.�

3.3� Definition�(β−β−β−β−machine)�

A�behavioural�machine�(β−machine)�is�a�pair�(F,Λ),�written�FΛ,�where�F�is�a�semi-automaton�over�some�alphabet�A,�and�Λ:�A→B�is�a�function,�where�B�is�a�behavioural�framework.�

Given� a� string� a� recognised� by� F,� the� path� behaviour� computed� by� a� is� the� behaviour� Λ(a),�where�we�define�Λ(ε)�=�1B�and�Λ(a1…an)�=�Λ(a1)�⊗�…�⊗�Λ(an).�The�behaviour�of�FΛ� is� the�aggregate�of�its�path�behaviours,�|FΛ|�=�Σ{�Λ(a)�|�a�∈�|F|�}.��

3.4� Examples�

3.4.1� LANG(A)�

The� set� LANG(A)� of� languages� over� A� is� a� framework,� where� ⊗� is� standard� language�concatenation,�and�Σ�is�set-theoretic�union.��

3.4.2� MAZURKIEWICZ�TRACE�LANGUAGES�

(Mazurkiewicz)� trace� languages� were� introduced� in� [Maz77;� see� also� CF69]� as� a� tool� for�modelling�Petri� net�behaviours.�They�have�since�become�one�of� the�most�popular�models� for�concurrent�semantics�[Gas90,�Arn91,�KS92,�Sta94,�DR95,�DG98,�DG02].��

Each�trace�language�can�be�viewed�as�a�quotient�A*/≡,�where�≡�is�a�congruence�on�A*.�That�is,�whenever� a� ≡� b,� we� also� have� ac� ≡� bc� and� ca� ≡� cb,� for� all� c.�This� congruence� ensures� that�

56

concatenation�of�traces�is�well-defined,�and�we�can�construct�languages�(subsets�of�A* /≡)�just�as�we�could�construct�LANG(A).��

3.4.3� REG(A)�

The�set�REG(A)�⊆�LANG(A)�of�regular�languages�over�A�is�a�sub-framework�of�LANG(A).�This�is�not�obvious�–�indeed,�our�formulation�of�behavioural�frameworks�was�originally�motivated�by�the�related�question:�under�what�circumstances�is�a�union�of�regular�languages�again�regular?�Obviously,� an� arbitrary� union� of� regular� sets� need� not� be� regular,� because� any� non-empty�language� is� the� union� of� its� (necessarily� regular)� singleton� subsets.� The� framework� concept�embraces�one�answer�to�this�question:�any�regular�union�of�regular�languages�is�again�regular.�This� is� what� we� now� prove.� We� need� to� do� this� in� any� case,� to� verify� that� our� choice� of�aggregation�operator�Σ�is�well-defined.�In�general,�aggregation�is�represented�by�the�operator�Σ:�REG(B)�→�B,�and�since�we�are�taking�B�=�REG(A),�our�aggregation�operator�must�have�signature�Σ:�REG(REG(A))�→�REG(A).�By�hypothesis,�we�are�taking�Σ�to�be�set-theoretic�union,�∪,�so�we�need�to�verify�that�whenever�we�are�given�a�regular�set�of�regular�languages,�their�union�is�again�a�regular�language.�

Theorem.�Any�regular�union�of�regular�languages�is�regular.�Formally,�suppose�that�{ Li�|�i∈I�} �is�a�regular�subset�of�REG(A),�and�let�L�=�∪{ Li�|�i∈I�} .�Then�L�∈�REG(A).�

Proof.� By� definition,� there� is� some� regular� language� L0� over� some� alphabet� A0,� and� some�labelling�function�Λ0:�A0�→�REG(A)�with�Λ0** (L0)�=�{ Li�|�i∈I�} .�Because�L0�is�regular�over�A0,�it�can�be�generated�by�a� regular�expression�e0� over� just� finitely�many�of� the�symbols� in�A0,� so�without� loss�of�generality�we�can�assume�that�A0� is�finite.�We�can�also�assume�that�A0� is�non-empty,� since� otherwise� L� would� be� finite� and� we’d� have� nothing� to� prove.� Without� loss� of�generality,�then,�we�can�write�A0�=�{ a01,�…,�a0n} �for�some�finite�non-zero�n.�Setting�L0i�=�Λ0(a0i),�we�observe�that�each�L0i�is�a�regular�language�of�A,�so�we�can�choose�regular�expressions�e1,�…,�en,�all�defined�over�A,�where�each�ei�generates� the�corresponding�L0i.�Let�e�be� the�expression�over�A�obtained�by�simultaneously�replacing�every�occurrence�of�each�symbol�a0i�in�e0�with�the�corresponding�expression�ei.�Then�e� is�a� regular�expression�over�A.� It� is�now�straightforward�(though�rather�tedious)�to�show�that�e�generates�the�required�union,�L�=�∪{ Li�|i∈I} �=�∪Λ0** (L0).�So�L�is�regular.� � �

3.4.4� AUTOMATA�

As� we� saw� in� the� introductory� preamble,� semi-automata� are� simply� β−machines� over� B� =�REG(A).�Automata�are�slightly�more�complex,�but�essentially�straightforward.�We�won’t�prove�the�details�here,�because� the�methods�are� identical� to� those�used� in� the�more�difficult�case�of�stream�X-machines,�below.�

3.4.5� X-MACHINES�

The�X-machine�is�a�computational�model�introduced�by�Eilenberg�[Eil74],�that�forms�the�basis�for� many� subsequent� models� of� computation� [Sta90,� Sta91,� Lay93,� LS93,� BeH96,� BCG+99,�Sta01].�At�its�heart,�an�X-machine�is�essentially�a�semi-automaton�whose�transitions�are�labelled�by� operations� of� type� X↔X.� Each� successful� path� through� the� machine� corresponds� to� an�operation�obtained�by�composing�the�relations�on�the�various�transitions,�and�the�behaviour�of�the�entire�machine�is�defined�to�be�the�union�of�the�path�behaviours.�Clearly,�this�is�just�a�special�case�of� the�β−machine�construction,�where�we�take�B� to�be�the�relational�monoid�R(X)�of�all�relations�on�X,�with�⊗�equal�to�relational�composition�and�Σ�equal�to�set-theoretic�union.��

57

3.4.6� STREAM�X-MACHINES�

Stream� X-machines� were� introduced� by� Laycock� [Lay93]� as� a� version� of� the� X-machine�equipped�with�the�stream�handling�capabilities�of�an�automaton.�The�SXM�captures�the�idea�that�a� system�handles� inputs�by�changing� its� internal�memory�states;�an�SXM�is�given�by�a�semi-automaton�whose� transitions� are� labelled�by�operations�of� type�Mem×In�↔�Out×Mem.� If� the�system�memory�is�currently�mem,�and�the�input�in�is�received,�then�crossing�a�transition�labelled�φ� causes� the�machine� to� change�memory�state� to�new_mem� and� to�generate� some�output�out,�where� (out,�new_mem)�∈�φ(mem,� in).�Clearly,� all� automata� (hence� all� semi-automata)� can�be�modelled�as�SXMs�with�unchanging�memory.�In�fact,�all�SXMs�can�be�modelled�as�standard�X-machines.�

Given�an�SXM�with�operations�of�type�Mem×In�↔�Out×Mem,�we�represent�it�as�an�X-machine�with�type�X�=�Out*�×�Mem�×�In*.�Each�relational�label�φ:�Mem×In�↔�Out×Mem�is�represented�as�the�associated�relation�φ*:�X↔X�given�by�

φ*(�out,�mem,�in::in)�=�{�(out::out,�new_mem,�in)�|�(out,�new_mem)�∈�φ(mem,�in)�}�

In�this�form�it’s�easy�to�see�where�the�name�comes�from.�The�behaviour�of�an�SXM�causes�input�streams�to�be�converted�into�output�streams,�with�the�exact�conversions�being�mediated�by�an�embedded�X-machine�of�type�Mem.�Since�all�X-machines�are�β−machines,�the�same�is�true�of�SXMs�and�automata.� � �

4� A�general�test�method�for �β−β−β−β−machines�

A�key�motivation�behind�Laycock’s�introduction�of�the�SXM�was�the�existence�of�a�general�test-generation� technique� for� automata.� Chow’s� W-method� is� based� on� the� idea� that� states� in� an�automaton�can�be�characterised�by�input-output�behaviours.�

4.1� Chow’s�W-method�

We�presuppose�that�a�system�is�specified�as�an�automaton,�Spec,�and�that�a�second�automaton,�Imp,�has�been�generated�as�an�implementation.�We�have�complete�knowledge�of�Spec,�and�can�therefore�assume�that� it� is�minimal�(if�not�we�minimise� it).�For�technical�reasons,�we�need�to�assume�that�Spec�and�Imp�are�defined�on�the�same�alphabet�A,�and�that�we�can�reliably�estimate�the�number�of�extra�states�in�Imp.�Our�goal�is�to�determine�whether�or�not�|Imp|�exactly�matches�|Spec|,� and� our� lack� of� knowledge� of� Imp’s� internal� structure� forces� us� to� make� this�determination�by�supplying�various�input�streams,�and�observing�the�corresponding�outputs.�The�basic�strategy�of�Chow’s�method�is�as�straightforward�as�it�is�elegant.�We�supply�a�set�of�input�sequences�that�take�us�to�each�state�of�the�machine�in�turn,�and�check,�once�we�get�there,�that�it�admits�precisely�the�right�set�of�‘next-state’�transitions.�In�this�respect�it�has�much�in�common�with�other�early�test�techniques�[Moo56,�Koh78].�

4.1.1� DEFINITION�(CHARACTERISATION�SET�FOR�AUTOMATA)�

Recall�that�S�is�the�state�set�of�the�machine�F.�Given�any�W�⊆�In*,�we�can�define�a�function�fW:�S�→�[W↔Out*]�by�

out� if�s� � (w,out)�T�fW(s)(w)�=�

undefined� if�no�such�path�exists�

58

If�the�function�fW�is�1-1�and�each�of�the�relations�fW(s)�is�actually�a�function�fW(s):�W�→�Out*�(so�that� each� input� stream� w� generates� a� single� well-defined� output� stream� out),� then� W� is� a�characterisation�set.� � �

Remark.�For�F�to�have�a�characterisation�set,�it�must�be�minimal.�For�if�F�is�not�minimal,�there�will� be� states� s� ≠� s’ � which� cannot� be� distinguished� by� their� contributions� to� input-output�behaviour,�and�under�such�circumstances�we�must�have�fW(s)�=�fW(s’ ):�so�W�would�fail�to�be�a�characterisation�set.�

Characterisation�sets�allow�us�to�decide�what�state�the�machine�must�have�been�in,�and�can�be�used�to�check�that�test�sequences�have�caused�the�machine�to�migrate�to�a�required�home�state.�To�construct� a� test� set,�we� first� choose� a� cover�C� for�F� (this� requires�F� to�be�accessible�and�deterministic),� and� then� a� characterisation� set,� W� (requires� F� to� be� minimal).� To� test� an�implementation�we�use�C� repeatedly�to�visit�each�state�in�turn�(this�typically�requires�F� to�be�connected,�i.e.�to�have�a�reset�mechanism);�then�we�supply�each�symbol�in�A�(requires�F�to�be�complete),� so�as� to�exercise�every� transition;� then�we�check� that� the� transition� took�us� to� the�appropriate�next-state�using�W.�

4.1.2� THEOREM�(CHOW)�

Suppose� that� Spec� and� Imp� are� automata� over� the� same� alphabet�A.� Suppose,� moreover,� that�Spec�is�minimal,�complete,�connected�and�deterministic�(so�it�has�precisely�one�initial�state),�and�that�all�states�are�final.�Let�C�be�a�cover,�and�W�a�characterisation�set,�for�Spec.�Suppose�Imp�has�no�more� than�n�more� states� than�Spec.�Then�Spec� and� Imp� are�equivalent� if�and�only� if� they�generate�the�same�output�string�for�every�input�string�in�CA(n+1)W.� � �

Remarks.� (1)� In� its�original� form�Chow’s� theorem� takes� the� test�set� to�be�of� the�form�TA(n)W,�where� T� is� a� ‘transition� cover’� for� F.� In� order� to� keep� things� simple,� our� statement� of� the�theorem�uses�the�fact,�for�complete�machines,� that�CA(1)� is�a�transition�cover�whenever�C�is�a�state� cover,� so� that� a� suitable� test� set� is�CA(1)A(n)W� =�CA(n+1)W.� (2)�Recalling�our�method� for�machines� with� non-final� states,� it� is� clear� that� Chow’s� method� can� be� extended� to� infinitely�many�more�specifications�than�currently�included.�

4.2� SXM�Testing�

The� strong� similarity� between� SXMs� and� automata� was� the� original� motivation� for� their�introduction;� Laycock� [Lay93]� recognised� that� Chow’s� method� could� be� extended� to� cover�systems�specified�by�SXM.�The�technique�was�largely�perfected�in�[Ipa95,�IH97,�HI98]�and�has�been� extended� more� recently� to� include� non-deterministic� specifications� [HH01a,� HH01b].� It�has�been�applied�both�theoretically�and�in�practical�system�testing�[FHI+95,�BH01,�Van01],�and�support�tools�are�becoming�available�[EK00,�KEK00a,�KEK00b].�

As� with� Chow’s� method,� we� assume� the� existence� of� a� minimal,� complete,� connected� and�deterministic�SXM�specification�Spec,� and�an�SXM� implementation� Imp,� and�need� to�decide�whether�or�not�they�have�the�same�behaviour.�The�basic�strategy�involves�constraining�Spec�so�that�the�equivalence�of�Spec�and�Imp�follows�from�that�of�their�underlying�automata.�

Recall�our�basic�requirement�that�Spec�and�Imp�should�be�defined�over�the�same�alphabet.�In�the�present�context,� this�means�that� they�should�use�the�same�transition�relations,�or�equivalently,�that�they�use�the�same�labelling,�Λ.�

In�Chow’s�method,�characterisation�is�used�to�identify�machine�states,�and�relies�on�the�fact�that�individual�letters�can�easily�be�distinguished�(the�output�streams�out1�and�out2�are�distinct�if�and�only� if� they� differ� in� one� or� more� letters,� so� we� only� need� to� be� able� to� distinguish� the�

59

latter).This�principle�no�longer�applies�for�SXMs,�because�it�is�impossible�to�guarantee�a�priori�that�distinct�label�relations�can�be�distinguished.�For�example,�suppose�two�relations�differ�only�at�one�particular�(mem,�in)�pair.�Unless�we�know�a�priori�that�we�need�to�test�the�relations�with�this�particular� (mem,� in)� combination,�we�could�wrongly�conclude� that� the�correct� relation� is�implemented� when� in� fact� it� is� not.�This� is� a� particular� problem� because� Mem� may� well� be�infinite�and�even�uncountable,�so�we�cannot�exhaustively�test�all�(mem,�in)�pairs.�Consequently,�we�strengthen�characterisation�by�requiring�output�distinguishability;� there�should�be�a�priori�known� (mem,� in)�pairs� that�can�be�used� to�distinguish�between�the�relations�used�to� label� the�transitions�of�the�machine.�

The�concept�of�cover�now�needs�to�be�strengthened�as�well,�because�it�is�not�enough�to�ensure�that�we�reach�every�state�in�turn.�When�we�reach�a�given�state�s,�we�need�to�be�certain�that�mem�has� taken�on�a�value�suitable� for�characterisation�to�be�possible�–�we�have�to�arrive�at�s�with�mem�appropriately�set�for�firing�transitions�with�the�key�(mem,in)�input�pairs.�This�is�typically�established�by�imposing�the�(somewhat�stronger)�requirement�that�for�each�mem,�there�is�some�a�priori�known�input�in�for�which�(mem,�in)�can�be�processed�and�at�the�same�time�contribute�to�the�characterisation�process.�This�can�be�regarded�as�the�SXM�version�of�completeness,�though�it�is�not�quite�the�published�Holcombe/Ipate�“ test�completeness” �property�[HI98,�p.�181],�which�omits�the�contribution-to-characterisation�requirement.�

Finally,�of�course,�it�is�not�enough�just�to�know�that�Imp�is�giving�the�correct�responses,�because�this�could�occur�by�accident.�If�the�implementation�is�written�in�a�programming�language�whose�compiler�is�faulty,�we�could�well�be�generating�the�correct�responses�for�each�of�the�key�(mem,�in)�test�inputs,�and�yet�still�not�have�a�correct�system.�We�therefore�impose�the�requirement�that�the�relation�labels�themselves�must�be�a�priori�correct.�

4.2.1� THEOREM�(HI98,�P.185)�

Suppose�that�Spec�and�Imp�start�with�the�same�initial�memory�value,�use�the�same�set�of�relation�labels�Φ,�and�that�Φ�is�output�distinguishable�and�complete�[in�our�sense,�above].�Assume�that�the�associated�automaton�of�Spec� is�minimal,�complete,�connected�and�deterministic�(so�it�has�precisely� one� initial� state),� and� that� all� states� are� final.� Suppose� also� that� the� associated�automaton�of�Imp�has�no�more�than�n�more�states� than�that�of�Spec.�Then�TS� is�a�test�set�for�|Spec|�where�TS�is�Chow’s�test�set.� � �

It� is�normally�stated�that� the�correctness�of� labels�can�be�determined�recursively,�by�applying�this�same� technique� to� the� labels� themselves� (see�e.g.�HI98,�chapter�8).�This� is�only�partially�true,�however,�because�we�have�assumed�extra�properties�for�these�relations�as�part�of�the�price�for�using�them�during�testing.�It�is�not�enough�simply�to�prove�that�the�label�relations�are�correct�in�their�own�terms,�because�they�also�have�to�satisfy�the�consequences�of�our�completeness�and�output�distinguishability�criteria.�This�means�we�have�to�prove�properties�that�hold�for�all�values�of�Mem,�and�this�may�not�be�a�tractable,�or�even�a�possible,�problem.�For�example,�the�function�test:�N�→�BOOL�given�by�the�program�{ while(n>1){�if�(even(n))�n=n/2;�else�n�=�3*n+1;}�return�true;} � is� clearly� computable,� and� we� can� even� prove� that� it� correctly� calculates� a� particular�specification�of� interest� to�number� theorists,�Consequently,�we�can�(by� traditional�arguments)�use�test�as�a�valid�label�in�an�SXM,�because�it�is�correct�in�its�own�terms.�But�this�is�not�valid,�because�no-one�currently�knows�whether�test�is�a�partial�or�a�total�function�–�we�can�prove�its�correctness�in�its�own�terms,�but�we�may�not�necessarily�be�able�to�prove�the�extra�requirement,�totality,�entailed�by�our�completeness�criteria.�

60

4.3� General�behavioural�testing�

It� is� clear� that� the� SXM� test� method� relies� on� properties� that� can� be� expressed� entirely� in�framework-theoretic�language.�It�is�not�surprising,�therefore,�that�the�method�can�be�extended�at�a�stroke�to�include�all�behavioural�frameworks.�

Henceforth,� suppose� that� B� =� (B,� ⊗,� Σ)� is� a� framework,� and� that� FΛ� is� a� β−machine� with�alphabet�A.�Write�Φ�=�Λ(A)�⊆�B.�We�call�the�members�of�Φ�behavioural�labels.�Recall�also�that�theoretical�caution� requires�us� to�regard� test�sets�as�downward�closed;� this� is� reflected� in�our�statement�of�Theorem�4.3.3�below.�

The�first�step�is�to�define�what�we�mean�by�a�characterisation�set�for�a�β−machine,�because�we�can�no�longer�rely�on�the�output�language�Out*�for�characterisation�purposes�(it�isn’t�part�of�the�general�framework�definition).�

4.3.1� DEFINITION�(CHARACTERISATION�SET�FOR�SEMI-AUTOMATON)�

Given�any�W�⊆�A*,�we�can�define�a�function�fW:�S�→�W→BOOL⊥�by�

T� if�s� � a�T�fW(s)(a)�=�

F� if�no�such�path�exists�

If�the�function�fW�is�1-1,�we�call�the�language�W�a�characterisation�set�for�F.�If,�in�addition,�for�each�s�there�is�at�least�one�a∈W�for�which�fW(s)(a)�=�T,�we�call�W�a�positive�characterisation�set.�If�F,�G�are�semi-automata�over�A,�we�say�that�two�states�s∈F�and�t∈G�are�W-equivalent�if�fW(s)�=�fW(t),�where�fW(s)�is�evaluated�in�F�and�fW(t)�in�G.� � �

It� is�worth� recalling� that� characterisation� sets� can�only�be�constructed� for�minimal�machines,�because�non-minimal�machines�contain� indistinguishable� states.�We�can�generally�construct�a�positive�characterisation�set�piecewise.�That�is,�we�first�find�languages�that�distinguish�s1�from�s2,�for�each�pair�(s1,s2),�and�then�take�the�union�of�all�of�these�component�languages.�In�general�this� is� less� efficient� than� constructing� a� global� characterisation� set,� but� may� be� simpler� in�practice.�

4.3.2� DEFINITION�(DISTINGUISHABLE�BEHAVIOUR�LABELS)�

Let�∂:�Φ�→�[B�→�BOOL]�be�the�function�which�maps�each�φ∈Φ�to�the�predicate�

∂(φ)(b)�≡�(b�=�φ)�

We�call�∂�the�distinguishing�function�for�Φ.�If�∂(φ)�is�decidable�for�all�φ∈Φ,�we�say�that�Φ�is�distinguishable.� � �

In� general,� this� is� the� best� we� can� do,� because� the� actual� proof� that� ∂� generates� decidable�predicates� will� depend� on� the� exact� nature� of� B.� For� SXMs,� for� example,� we� avoid� the�requirement� that� ∂(φ)� be� decidable� by� imposing� the� stronger� requirement� of� output-distinguishability�instead.�

4.3.3� THEOREM�(COMPLETE�BEHAVIOURAL�TEST�SETS)�

Suppose�that�SpecΛ�and�ImpΛ�are�β−machines�over�the�same�framework�with�the�same�Φ,�and�that�Φ�is�distinguishable.�Suppose�that�Spec�is�minimal,�complete,�connected�and�deterministic�(so� it� has� precisely� one� initial� state),� and� that� all� states� are� final.� Let� C� be� a� cover� and� W� a�

61

positive�characterisation�set�for�Spec.�Suppose�Imp�has�no�more�than�n�more�states�than�Spec.�Suppose� also� that� the� initial� termination� behaviours� of� Spec� and� Imp� are� identical� (i.e.� the�unique�initial�states�of�the�two�machines�are�W-equivalent).�Then�SpecΛ�and�ImpΛ�have�the�same�behaviour�if�and�only�if�they�generate�the�same�behaviour�for�every�input�string�in�(CA(n+1)W)↓.�

Proof.�We�will� show� that�Chow’s� theorem�can�be� applied� to� the�F/T�automaton� representing�Spec.�To� this� end,�we�have� to�choose�some�a�∈�CA(n+1)W� and�consider� the�stream� translation�function�f*�defined�as�follows,�where�f�=�fA*(ι)�and�ι�is�the�initial�state�of�Spec.�

f*(a1,�…,�an)� � �(�f(a1),��f(a1a2),�…,�f(a1,�…,an)�)�

In�other�words,� the�sequence�on� the�right�simply�gives�the�acceptance/rejection�history�of�the�string,�as�it�evolves�one�symbol�at�a�time.�This�is�the�automata-style�behaviour�of�Spec,�and�we�need� to� show� that� it� is� the� same� as� the� automata� style� behaviour� of� Imp.� It� will� then� follow�immediately�that�|Spec|�=�|Imp|,�and�that,�therefore,�|SpecΛ|�=�|ImpΛ|.�

� By� hypothesis,� SpecΛ� and� ImpΛ� behave� identically� on� all� prefixes� of� a.� In� particular,�|SpecΛ|�is�defined�for�the�prefix�u�if�and�only�if�|ImpΛ|�is�also�defined�for�u,�and�this�occurs�if�and�only�if�u∈|Imp|.�Consequently,�the�corresponding�stream�translation�function�for�Imp�

g*(a1,�…,�an)� � �(�g(a1),��g(a1a2),�…,�g(a1,�…,an)�)�

satisfies�f*(u)�=�T�⇔�g*(u)�=�T�as�required,�and�f*(u)�=�g*(u).� � �

�

5� Summary�

We�have�provided�two�extensions�to�state-machine�testing�theory.�The�first�allows�us�to�extend�Chow’s� W-method� and� the� SXM� testing� method� to� include� specifications� given� by� machines�with�non-final�states,�by�first�encoding�semi-automata�as�automata�with�output�alphabet�BOOL.�The�second�part�of�the�paper�demonstrates�a�general�extension�to�these�test�methods,�that�applies�to�any�system�that�can�be�specified�by�a�behavioural�framework.�Although�a�novel�concept,�the�frameworks� in� question� occur� ubiquitously� in� computer� science,� with� examples� occurring� in�both�sequential�and�concurrent�machine� theory.�We�show� that�Eilenberg’s�X-machine�concept�can� be� extended� to� give� behavioural� machines,� which� are� essentially� semi-automata� whose�transitions�are�labelled�by�elements�of�a�behavioural�framework.�The�SXM�test�method�extends�automatically� to� behavioural� machines,� provided� we� recognise� the� different� natures� of� semi-automaton� and� automaton� behaviours.�Accordingly,� we� need� to�use� the�downward�closure�of�Chow’s�test�set�to�generate�the�test-set�for�a�semi-automaton-based�β−machine.�

There�is�clear�scope�for�future�work�in�this�field.�In�particular,�we�are�studying�the�feasibility�of�modelling�object�oriented�systems�using�β−machines,�by�incorporating�both�the�sequential�and�concurrent�representational�capabilities�into�a�single�framework.�Given�that�tools�are�becoming�available�for�SXM�testing,�we�are�hopeful�that�tools�can�likewise�be�developed�for�β−machine�testing,�though�any�such�tools�will�require�considerable�built-in�user�support.�

6� References�

[Arn91]� Arnold�A.�(1991)�‘An�extension�of�the�notion�of�traces�and�asynchronous�automata.’�Theoretical�Informatics�and�Applications�25,�pp.�355-393.�

[BCG+99]� Balanescu,�T.,�Cowling,�T.,�Georgescu,�H.,�Gheorghe,�M.,�Holcombe,�M.�and�C.�Vertan�(1999)�‘Communicating�stream�X-Machine�systems�are�no�more�than�X-machines.’�J.U.C.S.�5(9),�pp.�492-507.�

62

[BeH96]� Bell,�A.�and�M.�Holcombe�(1996)�“Computational�models�of�cellular�processing” �in�R.�Cuthbertson,�M.�Holcombe�and�R.�Paton,�eds.,�Computation�in�Cellular�and�Molecular�Biological�Systems.�Singapore:�World�Scientific.�

[BH01]� Bogdanov,�K.�and�M.�Holcombe�(2001)�‘Statechart�testing�method�for�aircraft�control�systems.’ �Software�Testing,�Verification�and�Reliability�11,�pp.�39-54.�

[CF69]� Cartier,�P.�and�D.�Foata�(1969)�Problèmes�combinatoires�de�commutation�et�rearrangements.�(Lecture�Notes�in�Mathematics�85),�London�&�Berlin:�Springer-Verlag.�

[Cho78]� Chow,�T.�(1978)�‘Testing�software�design�modelled�by�finite�state�machines.’ �IEEE�Transactions�on�Software�Engineering�SE-4(3),�pp.�178-187.�

[DG98]� Diekert,�V.�and�P.�Gastin�(1998)�‘Approximating�traces.’ �Acta�Informatica�35,�pp.�567-593.�

[DG02]� Diekert,�V.�and�P.�Gastin�(2002)�“Safety�and�Liveness�Properties�for�Real�Traces�and�a�Direct�Translation�from�LTL�to�Monoids” �in�W.�Brauer�et�al.,�eds.,�Formal�and�Natural�Computing�(Lecture�Notes�in�Computer�Science�2300),�London�&�Berlin:�Springer-Verlag;�pp.�26-38.�

[DR95]� Diekert,�V.�and�G.�Rozenberg,�eds.�(1995)�The�Book�of�Traces.�Singapore:�World�Scientific.�

[Eil74]� Eilenberg,�S.�(1974).�Automata,�Languages�and�Machines,�Vol.�A.�Academic�Press.�

[EK00]� Eleftherakis,�G.�and�P.�Kefalas�(2000)�Model�Checking�X-Machines:�Towards�integrated�formal�development�of�safety�critical�systems.�Technical�Report,�Dept�of�Computer�Science,�CITY�Liberal�Studies,�Thessaloniki,�Greece.�

[FHI+95]� Fairtlough,�M.,�Holcombe,�M.,�Ipate,�F.,�Jordan,�C.,�Laycock,�G.�and�Z.�Duan�(1995)�‘Using�an�X-machine�to�model�a�Video�Cassette�Recorder.’ �Current�issues�in�Electronic�Modelling,�3,�pp.�141-161.�

[Gas90]� Gastin,�P.�(1990)�‘Un�modèle�asynchrone�pour�les�systèmes�distributes.’ �Theoretical�Computer�Science�74,�pp.�121-162.�

[HH01a]� Hierons,�R.�and�M.�Harman�(2001)�‘Testing�conformance�to�a�quasi-nondeterministic�stream�X-machine.’ �Formal�Aspects�of�Computing�(Special�Issue�on�X-machines).�

[HH01b]� Hierons,�R.�and�M.�Harman�(2001)�‘Testing�conformance�of�a�deterministic�implementation�against�non-deterministic�stream�X-machine.’ �Working�Paper,�Dept�of�Computer�Science,�Brunel�University,�UK.�

[HI98]� Holcombe,�M.�and�F.�Ipate�(1998)�Correct�Systems:�Building�a�Business�Process�Solution.�London�&�Berlin:�Springer-Verlag.�

[Hol89]� Holcombe,�M.�(1989)�‘X-machines�as�a�basis�for�dynamic�system�specification.’ �Software�Engineering�Journal�3(2),�pp.�69-76.�

[IH97]� Ipate,�F.�and�M.�Holcombe�(1997)�‘An�integration�testing�method�that�is�proven�to�find�all�faults.’ �International�Journal�of�Computer�Mathematics�68,�pp.�159-178.�

[Ipa95]� Ipate,�F.�(1995)�Theory�of�X-machines�with�Applications�in�Specification�and�Testing.�PhD�Thesis,�Dept�of�Computer�Science,�Sheffield�University.�

[KEK00a]� Kefelas,�P.,�Eleftherakis,�G.�and�E.�Kehris�(2000)�Communicating�X-Machines:�A�Practical�Approach�for�Modular�Specification�of�Large�Systems.�Technical�Report�CS-09/00,�Department�of�Computer�Science,�CITY�Liberal�Studies,�Thessaloniki,�Greece.�

63

[KEK00b]� Kehris,�E.,�Eleftherakis,�G.�and�P.�Kefalas�(2000)�“Using�X-Machines�to�Model�and�Test�Discrete�Event�Simulation�Programs” �in�N.�Mastorakis,�ed.,�Systems�and�Control:�Theory�and�Applications.�Singapore�and�America:�World�Scientific�and�Engineering�Society�Press;�pp.�163-168.�

[Koh78]� Kohavi,�Z.�(1978)�Switching�and�finite�automata�theory.�McGraw-Hill.�

[KS92]� Kwiatkowska,�M.�and�M.�Stannett�(1992)�“On�Transfinite�Traces” �in�V.�Diekert�and�E.�Ebinger,�eds.,�ASMICS�Workshop�on�Infinite�Traces,�Bericht�4/92,�Universität�Stuttgart�Fakultät�Informatik;�pp.�123-157.�

[Lay93]� Laycock,�G.�(1993)�The�Theory�and�Practice�of�Specification-Based�Software�Testing.�PhD�Thesis,�Dept�of�Computer�Science,�Sheffield�University,�UK.�

[LP84]� Lidl,�R.�and�G.�Pilz�(1984)�Applied�Abstract�Algebra.�London�&�Berlin:�Springer-Verlag.�

[LS93]� Laycock,�G.�and�M.�Stannett�(1993)�X-machine�Workshop.�Technical�Report,�Dept�of�Computer�Science,�Sheffield�University,�UK.�

[Maz77]� Mazurkiewicz,�A�(1977)�Concurrent�program�schemes�and�their�interpretations.�Technical�Report�DAIMI�Pβ−78,�Aarhus�University,�Denmark.�

[Moo56]� Moore,�E.�F.�(1956)�‘Gedanken-experiments�on�sequential�machines.’ �Automata�Studies,�(Annals�of�Mathematics�Studies,�no�34).�Princeton�University�Press;�pp.�129-153.�

[Sta90]� Stannett,�M.�(1990)�‘X-machines�and�the�Halting�Problem:�Building�a�super-Turing�machine.’ �Formal�Aspects�of�Computing�2,�pp.�331-341.�

[Sta91]� Stannett,�M.�(1991)�An�Introduction�to�post-Newtonian�and�non-Turing�Computation.�Technical�Report�CS-91-02,�Dept�of�Computer�Science,�Sheffield�University,�UK.��Available�online�from�http://www.dcs.shef.ac.uk/research/resmems/.�

[Sta94]� Stannett,�M.�(1994)�‘ Infinite�Concurrent�Systems�–�I.�The�Relationship�between�Metric�and�Order�Convergence.’ �Formal�Aspects�of�Computing�6,�pp.�696-715.�

[Sta01]� Stannett,�M.�(2001)�Computation�over�arbitrary�models�of�time.�Technical�Report�CS-01-08,�Dept�of�Computer�Science,�Sheffield�University,�UK.��Available�online�from�http://www.dcs.shef.ac.uk/research/resmems/.�

[Van01]� Vanak,�S.�K.�(2001)�Complete�Functional�Testing�of�Hardware�Designs.�Preliminary�PhD�Report,�Dept�of�Computer�Science,�Sheffield�University,�UK.�

64

Formal Basis for Testing with Joint-Action

Speci�cations�

Timo Aaltonen and Joni Helin

Tampere University of Technology, Institute of Software Systems

P.O.BOX 553, FIN-33101 Tampere, Finland

Tel: +358-3-31153951, fax: +358-3-31152913

email: ftimo.aaltonen, joni.heling@tut.�

July 3, 2002

Abstract

A new method for formal testing of reactive and distributed systems

is presented. The method is based on having a joint-action speci�cation

of the implementation under test. A testing hypothesis is made to allow

assigning formal meanings to correct and incorrect implementations. Uti-

lizing these we formulate meaning of �nding errors in implementations in

a strict way.

1 Introduction

Traditionally testing and formal methods have had little to do in common.However, recently it has been realized that these two need not be exclusive butthey can complement each other. Rigorous speci�cations give an excellent basisfor testing: notions like correct and erroneous implementations can be assignedan exact meaning and descriptions of test cases become more precise.

One diÆcult �eld for testing are reactive and distributed systems. Reactivesystems obtain stimuli from the environment and react to them. The behaviourof a distributed system is not very predictable. Little changes in timings of theircomplex interactions with the environment and between components make thesystem behave in non-deterministic manners. Therefore testing them thoroughlyis extremely diÆcult. Formal speci�cations allow us to deal with this non-determinism in an exact way.

In this paper we attack problems of testing reactive and distributed systemsby utilizing joint-action speci�cations which are introduced in Section 2. Sys-tems are �rst modelled with them and then they are implemented. We make

�This work was supported by Academi of Finland under project 510005.

65

a testing hypothesis which claims that there exists a joint-action model for ev-ery implementation. If an implementation is correct then this model can beachieved from the speci�cation as a legal re�nement. Testing is searching fora counterexample to this re�nement relation. These aspects are discussed inSection 3. In Section 4 an example of utilizing the proposed testing method isgiven. Finally Section 5 concludes the paper.

2 Joint-Action Speci�cations

Joint actions were introduced by Ralph Back and Reino Kurki-Suonio in [4,5]. The intention with them was to describe the behaviours of reactive anddistributed systems at a high level of abstraction. By abstracting the detailsof communication, a joint action models what several parties of the system dotogether, not how the desired behaviour is achieved.

Basic building blocks of our joint-action speci�cations are class and actiondeclarations. Formally a class is a set of similar objects sharing the same struc-ture. Classes can be inherited in an object-oriented fashion. Then an inheritedclass forms a subset of the base class. Besides class de�nitions, record types canbe declared. Unlike objects of classes, values of record types have no identity.

The state of an object means evaluation of its attributes. The states ofobjects can be changed only by executing multi-object joint actions. A jointaction consists of a name, a set of roles (in which the objects can participate), aboolean-valued guard (which must evaluate to true for the participating objectcombination) and a body (which is a parallel assignment clause assigning newvalues to the attributes of the participating objects). When such a combinationof objects exists that the guard of an action is satis�ed, an action is said to beenabled (for the satisfying object combination). Selection of the next action tobe executed is non-deterministic among the enabled ones. Actions are atomicunits of execution which are executed in an interleaving manner. This is anabstraction of parallel executions of operations.

States of all objects constitute the global state of the system. A new globalstate is obtained form the current one by executing an action which is enabledin the current state. A sequence of global states starting from an initial states0 is called a behaviour : � =< s0; s1; s2; ::: > where s0 is an initial state of thesystem and each state sk+1 is obtained from state sk by executing an actionenabled in state sk. The method is not sensitive to stuttering in behaviours. Inother words a behaviour is considered the same even if its states are arbitrarilyrepeated. A joint-action speci�cation induces potentially an in�nite set of be-haviours whose initial states are legal initial states of the speci�cation and newstates are obtained by executing the actions of the speci�cation.

As an example we give a speci�cation of counters. Objects belonging to classCounter hold the value they count in attribute val, which can be incrementedby executing action inc. The action can be executed for objects having valueless than two in val; the body of the action increments val by one. It is assumedthat all counters are initialized to zero:

66

specification Cntrs = {class Counter = {val: integer}action inc(c: Counter): c.val < 2 ->c.val0 = c.val + 1;

}

From the in�nite set of behaviours the speci�cation induces we show two. Inthe �rst one just one counter has been instantiated, the value of attribute valis given in parenthesis: < (0); (1); (2); (2); � � � >. The second behaviour consists

of two counters: <

�00

�;

�10

�;

�20

�;

�21

�;

�22

�;

�22

�; � � � >.

Formal properties of behaviours are often divided into two categories: safetyand liveness properties. The former are such their violation can be detectedin a �nite pre�x of a behaviour. In terms of temporal logic[10, 13] an exampleof safety property is �p, which states that proposition p holds in every state.For example, �(8c : Counter :: c:val < 3) holds for speci�cation Cntrs, ifcounters are initialized to zero. On the other hand liveness properties are thosewhose violence cannot be detected in a �nite pre�x. An example of such is �qwhich states that eventually q will hold. In this paper we concentrate on safetyproperties.

2.1 Re�nement

Joint-action speci�cations are re�ned towards implementations by superimpos-ing new layers onto an old speci�cation. A superposition step maps the oldspeci�cation to a new one, which is a re�nement of the old one. Our variant ofsuperposition allows adding new attributes to existing classes, introducing newclasses, strengthening the guards of old actions, adding new assignments to oldactions, introducing new actions, but the new assignments are allowed only tonewly introduced attributes.

In terms de�ned in [8] our variant of superposition is regulative. I.e., thesafety properties of the speci�cation being re�ned are preserved by construction,but liveness properties can be violated. This means that if we have an abstractspeci�cation s and its re�nement s0 then all behaviours induced by s0 (denotedbeh(s0)) are also behaviours of s with respect to variables of s: beh(s0) �vars(s)

beh(s).As an example, speci�cation Cntrs can be re�ned by adding running bit to

each counter and introducing actions to set and reset the bit. The guard ofaction inc is strengthened with a conjunct stating that running must be truefor the participating counter; the body of the action remains unchanged:

specification Ena refines Cntrs = {Counter = Counter + {running: boolean}action enable(c: Counter): not c.running -> c.running0 = true;action disable(c: Counter): c.running -> c.running0 = false;action inc(c: Counter) refines Cntrs.inc(c): c.running -> ...;}

In a re�nement the values of abstract variables can be represented by severalvariables distributed in the system. In these cases quanti�ed expressions calledshadow assertions state formally the relationship between the abstract and the

67

concrete variables. To ensure that shadow assertions are not violated they mustbe formally veri�ed. When a variable has become abstract then it is not neededin an implementation.

Several joint-action speci�cations can be composed into one compound spec-i�cation. Applying re�nement and composition lead to abstraction hierarchies,which are directed acyclic graphs.

2.2 Abstraction Function

Remember that our re�nement mechanism allows only adding new variablesto the speci�cation and strengthening guards of existing actions and makingsuch augmentations to the bodies of existing action that assign only to newlyintroduced variables. Therefore, if speci�cation s0 is a re�nement of s then eachbehaviour induced by s0 has an image in behaviours induced by s in terms of s.

To be able to deal with behaviours of one speci�cation in an abstractionhierarchy at the level of another, we de�ne abstraction function: af

ss0 : B 7! B,

where s and s0 are speci�cations and B is the universe of behaviours. Thefunction is de�ned if vars(s) � vars(s0), where vars(s) are the variables (at-tributes of objects) of speci�cation s. The function maps behaviours induced byspeci�cation s0 (more concrete) to behaviours of s (more abstract) by �lteringvariables vars(s0)\ vars(s) from the behaviour and by computing the values ofshadow variables of s.

For example, behaviours induced by Ena can be mapped to behaviours ofCntrs simply by �ltering the values of attribute running from the behaviour.More formally

afCntrsEna � f(bEna; bCntrs) j

(8i 2 N : (8c 2 Counter : c:val(bEna(i)) = c:val(bCntrs(i))))g

where N is the set of natural numbers and c:val(b(i)) is the value of attributeval in the ith state of behaviour b.

3 Testing with Joint-Action Speci�cation

In this paper implementations are created according to the most concrete spec-i�cation (denoted c) in the speci�cation hierarchy. The objective is to producean implementation that is a legal re�nement of c. Our re�nement mechanism issuperposition, thus the implementation should be obtainable by some superpo-sition step on c. Then the implementation can only restrict (not liberate) thebehaviour induced by c. In our approach conformance means that an imple-mentation exhibits only such behaviours that are induced by the speci�cation.

3.1 Testing Hypothesis

A diÆculty in this approach is that an implementation is not a formal entitybut lies in the physical reality, consisting of a compiled program written in some

68

programming language, pieces of hardware in which the program slices are run,an environment with which the actual system interacts etc. No concepts existon which the described correctness can be formally based on; we are not ableto validate whether the implementation actually is a re�nement of its speci�ca-tion. This dilemma is solved by making a testing hypothesis, which states thatevery implementation under test (iut) has such a formal model (miut) that ifit and iut are both put in a black box which transmits behaviours only at theabstraction level �xed by miut then we cannot distinguish iut and miut. Modelmiut is a joint-action speci�cation. More formally the hypothesis states that

8 iut 2 Imps 9 miut 2 Specs : af'miut

iut(beh0(iut)) = beh(miut) (1)

where Imps is the universe of implementations, Specs is a universe of joint actionspeci�cations, beh0 : Imps 7! 2Behaviours

0

maps an implementation to the setof real world behaviours it induces (Behaviours0 is the universe of real worldbehaviours), af'miut

iut: Behaviours0 of iut 7! Behaviours of miut projects the

real world behaviours of iut to the behaviours of model miut and function beh :Specs 7! 2Behaviours maps a joint action speci�cation to the set of behavioursit induces. Behaviours is the universe of behaviours induced by joint-actionspeci�cations.

Believing thatmiut exists is a leap of faith which cannot be formally justi�ed.However, it is easy to believe that all real systems can be modelled with jointaction speci�cations, because their expressive power is reasonably high. Forexample, a speci�cation which contains images of all the variables of iut andan action for each atomically executed piece of software works as the requiredmodel.

The testing hypothesis does not require miut to be actually created, it justassumes that such a model exists. For testing purposes we only need to be ableto produce such behaviours thatmiut would produce. To be correct, modelmiut

should be a re�nement of c. Therefore, behaviours of miut can be mapped tothe behaviours of c by applying abstraction function af

cmiut

.

3.2 De�nitions for Correct and Incorrect Implementation

Correctness of iut can now be de�ned formally:

iut is correct ,def (8b 2 beh(miut) : afcmiut

(b) 2 beh(c)) (2)

In an ideal case we could produce a perfect model miut and formally verifythat it is a legal re�nement of c. Unfortunately, for reasonably sized systemsproducing model miut is not an option and, moreover, utilizing it would not betesting but veri�cation. Instead, we investigate a subset of behaviours inducedby miut and try to catch errors with them. An attempt is to produce behaviourbce to satisfy the right hand side of Equation (3) below, which is achieved bynegating both sides of Equation (2):

iut is not correct, (9 bce 2 beh(miut) : afcmiut

(bce) =2 beh(c)) (3)

69

Behaviour bce is a counterexample for the subset relation which should hold forbehaviours beh(miut) �vars(c) beh(c).

3.3 Setting

Figure 1 illustrates the setting for testing. Implementation iut in the bottomleft-hand corner is created based on speci�cation c in the top left-hand corner.According to the testing hypothesis miut exists and iut is correct if and only ifmiut is a legal re�nement of c. Each speci�cation induces a set of behavioursdepicted as ellipses. Arrows from beh0(iut) to beh(miut) model function af'

miut

iut

which projects real world behaviours to behaviours of miut, and arrows frombeh(miut) to beh(c) model mapping af

cmiut

. Our re�nement mechanism enforcesthe set of behaviour images of the re�ned speci�cation to be in a subset re-lation with the set of behaviours of the speci�cation being re�ned. Testing isan attempt to produce a behaviour bce which is a counterexample to this sub-set relation: bce 2 beh(miut) ^ af

cmiut

(bce) =2 beh(c). Behaviour bm5 is such acounterexample in the �gure.

miut

c

iut

induces

induces

induces

corresponds

re�nes?

bC6

b01

bC2bC1 bC3

b02b03

b04b05

bC4bC5

bm4

bm3bm2 bm5

bm1

Figure 1: The setting for testing.

3.4 Observation Objectives

So far we have discussed what are correct and incorrect implementations andhow errors are detected if some behaviours of miut are observed. If iut doesnothing then it de�nitely does not violate the safety properties of speci�cation c.Therefore, a set of behaviours must be enforced. Similarly to [16] we de�ne some

70

set of behaviours that we whish to observe during testing. These observationobjectives are given in terms of c.

An observation objective is a set of behaviours that intersects the set inducedby c. Objective o is said to be satis�ed if at least one behaviour bo 2 o isobserved. An objective describes behaviours we whish to observe, but it is notdirectly related to the correctness of iut. An example objective for speci�cationEna given Section 2 could be the set of behaviours where the value of somecounter has �rst been one and later it has been incremented; more formallyobjective o = fb j P (b)g whereP (b) = 9i1; i2 2 N j i1 < i2 : (9c 2 Counter : c:val(b(i1)) = 1^ c:val(b(i2)) > 1)where c:val(b(i)) is the value of attribute val in ith state of behaviour b.

The Venn diagram in Figure 2 depicts di�erent sets of behaviours. Thelarge square is an in�nite universe of behaviours. The horizontal large ellipsein the middle models the behaviours induced by speci�cation c (these are legalbehaviours); the horizontal small ellipse is an observation objective (these arethe behaviours we wish to observe) and the vertical large ellipse models thebehaviours af

cmiut

(beh(miut)) (these are the behaviours iut induces). All thesets are in�nite in the general case.

c

mIUT

inducesb5

b9

observation objective

b3

b1

b2

Behaviours

b12 b13b14

b6

b8b7

b4

b11b10

induces

Figure 2: Venn diagram of behaviours.

4 Example: Distributed List

We have applied the proposed testing method for testing an implementation ofDistributed List[12]. Our version of the protocol speci�cation consist of twolayers atomic list and messages.

4.1 Speci�cation atomic list

Distributed List is a protocol for maintaining a circular, singly-linked listof cells. The protocol is an abstraction of a part of a multiprocessor cachecoherence protocol for linked list of processors sharing a cache line. A more

71

comprehensive description of the protocol can be found in [12]. In the list thereis a special cell, called the head cell, which coordinates the addition of cells.

In abstract speci�cation atomic list of the protocol cells can join andleave the list in synchronous actions. First a base class Cell with two derivedclasses HeadCell and NormalCell are given. Objects of class Cell have attributenext a (a for abstract), which is a reference to the next cell in the list or a selfreference if the cell is not in the list. In the initial state there are no cells inthe list. Actions atomicAdd and atomicDelete model joining and leaving thelist, respectively.

Action atomicAdd has two roles: nc, in which the cell willing to join thelist participates, and h, in which the head cell participates. The guard of theaction requires that the object participating in role h is not yet in the list. Inthe body of the action reference next a of the head cell is assigned the referenceto nc and next a of nc get the previous value of h.next a:

action atomicAdd(nc: NormalCell; h: HeadCell) iswhen nc.next_a = nc donc.next_a0 = h.next_a ^ h.next_a0 = nc;

end;

Detailed description of atomicDelete is omitted for brevity.

4.2 Speci�cation messages

Synchronous speci�cation atomic list is re�ned to speci�cation messages, whichis an asynchronous implementation of the atomic speci�cation. In the re�nedversion a cell not in the list may request to be added to the list and successivelyto be removed from the list. Communication is message-based over a reliablebut not order-preserving medium. Every cell has a speci�cation variable next c(c for concrete), which holds the identity of the successor cell, or its own identityif the cell is not on the list.

Cells other than the head cell can perform two types of transactions, addand delete. Addition consists of sending a request message to the head cell,which results in the cell being added to the list in front of the next cell of headcell and a reply containing the identity of the new next cell of the requestingcell.

To delete a cell from the list, knowledge of the predecessor cell is required, soa message called pred carrying the identity of a cell's predecessor is circulated.A cell initiates deletion by sending a message to its predecessor and waits foracknowledgment. Handling of the deletion message depends on intricate detailsabout the scenario, but basically the actual predecessor of the requesting cellupdates its next c variable and acknowledges.

The abstract atomic speci�cation atomic list is superimposed by layer mes-sages, in which abstract atomic actions are implemented by more concrete ones,and abstract variable next a is distributed to several concrete variables. Thetransmission medium is represented with singleton class Net holding a set ofMessages. Class Cell is extended with a state machine for message-based im-plementation of the protocol and variable next c, which together with �elds in

72

addtransaction

initiateAdd processAdd processHead

atomicAdd

Figure 3: Actions of transaction add.

transmitted messages implement the abstract speci�cation variable next a. Aset of shadow assertions state their respective relationships.

Distributed implementation of the add transaction consists of three actionsdepicted in Figure 3. The transaction begins when a cell is in normal operatingstate and wishes to join the list. Action initiateAdd results in an AddMessagesent to the head cell and the cell entering state waiting for a HeadMessage inreply. Set manipulations of Net correspond to message send and reception:

action initiateAdd(nc: NormalCell; net: Net) iswhen nc.state’normal ^ nc.next_c = nc donet.mess0 = net.mess + {AddMessage(src0 = nc, dst0 = nc.theHeadCell)} ^

nc.state0 = w_head();end;

Action processAdd is re�ned from atomicAdd and locally processed by the headcell upon delivery of the AddMessage. The action guard ties the sender of themessage to the shadow role1 nc. Action body consists of sending a reply mes-sage carrying the new value for the concrete variable next c of the requestingcell. The concrete variable in the head cell is updated correspondingly with theabstract variable. Three dots in the guard refer to the guard of the action beingre�ned, and in the body they refer to the original body:

refined processAdd(nc: NormalCell; hc: HeadCell; net: Net; am: AddMessage)of atomicAdd(nc, hc) iswhen ... am 2 net.mess ^ am.dst = hc ^ am.src = nc do...net.mess0 = net.mess - {am} + {HeadMessage(src0 = hc,

dst0 = am.src,new0 = hc.next_c)} ^

hc.next_c0 = am.src;end;

Transaction add is �nished when the initiating cell executes processHead action.The cell updates its concrete variable next c with the value received in theHeadMessage and returns to normal state:

action processHead(nc: NormalCell; net: Net; hm: HeadMessage) iswhen hm 2 net.mess ^ hm.dst = nc donet.mess0 = net.mess - {hm} ^ nc.next_c0 = hm.new ^ nc.state0 = normal();

end;

Implementation of the delete transaction, which is more complicated, is notdescribed here.

1Shadow role means that only shadow attributes of the role are accessed in the action,therefore, it can be left out in implementation.

73

4.3 Implementation and Testing

Implementation (dli) of Distributed List was written in Erlang[1]. As ex-plained in Section 3, we are not able to really create the model miut but iutis instrumented to demonstrate its behaviour according the the most concretespeci�cation messages. In other words, we observe such behaviours that couldhave been produced by miut and abstracted to behaviours of messages. Moreformally:

8b 2 observed behaviours : b 2 afmessagesmdli

(af'mdli

dli (beh0(dli)))The testing was carried out o�ine { behaviours were �rst produced and their

correctness were validated afterwards. The actual validation was done withDisCo Animator [3], a special tool for animating joint-action speci�cations.To be able to exploit Animator observing just states is not enough but wemust be noti�ed of the executed actions as well.

Execution of the add transaction of the protocol is safe-guarded by a precon-dition that the next reference of the node in question must point to itself andthe node must be in normal operation state. However, should an implementa-tion inadvertantly leave the second requirement unenforced, simply relying onchecking the next reference, an error would have been introduced. In that case,initiating a new add transaction in the midst of the previous add transaction,before the next reference is updated, would become possible. A scenario de-picting this situation is given in Figure 4, which contains four states and thethree actions responsible for state changes. In the initial state the network (netin the scenario) contains pred message and the head cell (hc) and both normalcells (nc1 and nc2) refer to themselves and operate in normal state. First nc1wishes to joint the list and, therefore, action initiateAdd is executed; then thehead cell handles its part of the transaction add (action processAdd), but be-fore completing the transaction by executing action processHead nc1 attemptsto initiate joining again. However, action initiateAdd is not enabled in thethird state in the speci�cation and the error is detected.

net(fPredg)hc(hc, normal)nc1(nc1, normal)nc2(nc2, normal)

net(fPred, Addg)hc(hc, normal)nc1(nc1, w head)nc2(nc2, normal)

net(fPred, Headg)hc(c1, normal)nc1(nc1, w head)nc2(nc2, normal)

net(fPred, Head, Addg)

nc1(nc1, w head)nc2(nc2, normal)

hc(c1, normal)

processAdd(nc1,hc,net,Add) initiateAdd(nc1, net)initiateAdd(nc1, net)

Figure 4: Erroneous scenario.

An actual error in our implementation of the protocol was found duringdevelopment when the guard of an action was erroneously enabled. This was aresult of a reference to an incorrect state in the implementation of the guard.Another error resulted in the consumption of the pred message by a cell in themidst of add transaction, never to be put to circulation again. Even though thiswas a violation of a liveness property, the deadlock was detected by the testingengineer, because no cell was able to commit the delete transaction.

74

5 Discussion

We have presented a new technique for formal testing of reactive and distributedsystems. The technique is based on joint-action speci�cations, which modelbehaviours of systems at a high level of abstraction. Testing hypothesis assertsthat each iut has a model miut which is indistinguishable from iut. Now, iutis correct i� miut is obtainable as a legal re�nement of the speci�cation for iut.Correctness is de�ned so that iut is correct i� each behaviour induced by miut

belongs to behaviours induced by its speci�cation. Testing is searching for acounterexample to this relation.

This paper is focused on the ideas behind testing, not how testing is carriedout in practise. Thus, this paper re ects virtually no methodological aspectsof testing. The next step will be on developing a comprehensive method incor-porating these ideas in actual testing. The main contribution of the paper isin giving a formal basis for testing with joint-action speci�cations. Up to ourknowledge joint-action speci�cations have not been researched from this pointof view.

A signi�cant amount of research has been carried out on formal testingmethodologies for reactive and distributed systems[9, 15, 11]. A well-knownformal approach for conformance testing of concurrent systems is presentedby Tretmans in [15]. First a formal framework for testing is developed andthen instantiated for labelled transition systems (lts). Similarly to our approachformal testing is justi�ed by a test hypothesis, which enables the considerationof implementations as formal objects where an implementation relation is usedto link a model of an implementation to its speci�cation.

Compared to our method Tretmans emphasizes the input-output relation(where internal state changes are abstracted away) in testing, whereas, ourstress is laid on more abstract communication where no distinction is madebetween input and output. Therefore, our de�nition for conformance is some-what di�erent. In [2] Aaltonen et al. have presented a mapping of joint-actionspeci�cation instances to timed automata, which is an lts-like formalism. Thismapping can be utilized for clarifying the di�erences of the two methods. Thisis left as future work.

Automatic generation of test suites containing stimulus to iut with the ex-pected response is a considerably researched topic [6, 15, 14]. For the time beingwe do not have any algorithms or methods for generating tests. However, webelieve that by utilizing observation objectives it is possible to create suitablesuites { at least with some guidance by the testing engineer. Presently we aredeveloping a method for producing tests based on observation objectives.

The method for checking that iut behaves correctly is often called test oracle.We have developed a toolset for simulating joint-action speci�cations [3], whichincludes Compiler and Animator. The compiler produces an engine whichmaintains the state of a joint-action speci�cation instance and is utilized by theanimator. This engine can be considered as the test oracle since it veri�es thevalidity of reached states and execution scenarios. In [7] Dillon and Ramakrishnadevelop a generic tableau algorithm for generating oracles from temporal logic

75

speci�cations.The abstraction hierarchy of joint-action speci�cations was not exploited in

this paper. In specifying it is considered as the most essential contribution byour method. Therefore, utilizing the hierarchy also in testing is one branch forfuture work.

To date, research on formalizing testing has been concentrated on �nite stateformalisms. We are making an important contribution by taking testing to areaswhere theorem proving has been the dominant mean of ascertaining correctness.However, di�erent approaches have their respective strengths and selection ofan approach should be based on the nature of the problem.

References

[1] Open source erlang project WWW page. At http://www.erlang.org/ onthe World Wide Web.

[2] Timo Aaltonen, Mika Katara, and Risto Pitk�anen. Verifying real-time jointaction speci�cations using timed automata. In Yulin Feng, David Notkin,and Marie-Claude Gaudel, editors, 16th World Computer Congress 2000,Proceedings of Conference on Software: Theory and Practice, pages 516{525, Beijing, China, August 2000. IFIP, Publishing House of ElectronicsIndustry and International Federation for Information Processing.

[3] Timo Aaltonen, Mika Katara, and Risto Pitk�anen. DisCo toolset { thenew generation. Journal of Universal Computer Science, 7(1):3{18, 2001.http://www.jucs.org.

[4] R. J. R. Back and R. Kurki-Suonio. Distributed cooperation with ac-tion systems. ACM Transactions on Programming Languages and Systems,10(4):513{554, October 1988.

[5] R. J. R. Back and R. Kurki-Suonio. Decentralization of process nets withcentralized control. Distributed Computing, 3:73{87, 1989.

[6] Igor Burdonov, Alexander Kossatchev, Alexander Petrenko, and DmitriGalter. Kvest: Automated generation of test suites from formal speci�ca-tions. In J. Wing, J. Woodcock, and J. Davies, editors, FM'99 { FormalMethods: World Congress on Formal Methods in the Development of Com-puting Systems, number 1708 in Lecture Notes in Computer Science, pages608{621. Springer{Verlag, 1999.

[7] Laura K. Dillon and Y. S. Ramakrishna. Generating oracles from yourfavorite temporal logic speci�cations. In Foundations of Software Engi-neering, pages 106{117, 1996.

[8] Nissim Francez and Ira R Forman. Interacting Processes { A MultipartyApproach to Coordinated Distributed Programming. Addison-Wesley, 1996.

76

[9] Juhana Helovuo and Sari Lepp�anen. Exploration testing. In Proceedingsof ICACSD 2001, 2nd IEEE International Conference on Application ofConcurrency to System Design, pages 201{210. IEEE Computer Society,June 2001.

[10] Leslie Lamport. The temporal logic of actions. ACM Transactions onProgramming Languages and Systems, 16(3):872{923, 1994.

[11] H. L�otzbeyer and A. Pretschner. Testing concurrent reactive systems withconstraint logic programming. In Proceedings 2nd workshop on Rule-BasedConstraint Reasoning and Programming, Singapore, September 2000.

[12] Seungjoon Park and David Dill. Protocol veri�cation by aggregation ofdistributed transactions. In Proceedings of the International Conference onComputer-Aided Veri�cation, Lecture Notes in Computer Science, pages300{310. Springer-Verlag, July 1996.

[13] Amir Pnueli. The temporal logic of programs. In In Proceedings of the 18thIEEE Symposium Foundations of Computer Science (FOCS 1977), pages46{57, 1977.

[14] J. Tretmans. Test Generation with Inputs, Outputs, and Quiescence. InT. Margaria and B. Ste�en, editors, Second Int. Workshop on Tools andAlgorithms for the Construction and Analysis of Systems (TACAS'96), vol-ume 1055 of Lecture Notes in Computer Science, pages 127{146. Springer-Verlag, 1996.

[15] Jan Tretmans. Testing concurrent systems: A formal approach. In Proceed-ings of CONCUR'99 Concurrency Theory, number 1664 in Lecture Notesin Computer Science, pages 46{65. Springer{Verlag, 1999.

[16] Ren�e G. Vries and Jan Tretmans. Towards formal test purposes. InEd Brinksma and Jan Tretmans, editors, Proceedings of workshop on For-mal Approaches to Testiong of Software 2001, pages 61{76, August 2001.

77

Queued Testing of Transition Systemswith Inputs and Outputs

Alex Petrenkoa and Nina Yevtushenkob

a - CRIM, Centre de recherche informatique de Montreal,550 Sherbrooke West, Suite 100, Montreal, H3A 1B9 Canada,E-mail: [email protected]

b - Tomsk State University, 36 Lenin Str., Tomsk, 634050, Russia,E-mail: [email protected]

Abstract The paper studies testing based on input/output transition systems, also known asinput/output automata. It is assumed that a tester can never prevent a systemunder test from producing outputs, while the system does not block inputs fromthe tester either. Thus, input from the tester and output from the system mayoccur simultaneously and should be queued in finite buffers between the testerand system. A framework for a so-called queued-quiescence testing isdeveloped, based on the idea that the tester should consist of two test processes,one process is applying inputs via a queue to a system under test and another oneis reading outputs from a queue until it detects no more outputs from the system,i.e., the tester detects quiescence in the system. The testing framework is thengeneralized with a so-called queued-suspension testing by considering a testerthat has several pairs of input and output processes. It is demonstrated that sucha tester can check finer implementation relations than a queued-quiescencetester. Procedures for test derivation are proposed for a given fault modelcomprising possible implementations.

1. IntroductionThe problem of deriving tests from state-oriented models that distinguish between input andoutput actions is usually addressed with one of the two basic assumptions about therelationships between inputs and outputs. Assuming that a pair of input and outputconstitutes an atomic system’s action, in other words, that a system cannot accept next inputbefore producing output as a reaction to a previous input, one relies on the input/outputFinite State Machine (FSM) model. There is a large body of work on test generation fromFSM with various fault models and test architectures, for references see, e.g., [Petr01],[BoPe94]. A system, where next input can arrive even before output is produced in responseto a previous input, is usually modeled by the input/output automaton model [LyTu89], alsoknown as the input/output transition system (IOTS) model (the difference between them ismarginal, at least from the testing perspective). Compared to the FSM model, this model hasreceived a far less attention in the testing community, see, e.g., [BrTr01], [Phal93],[Sega93]. In this paper, we consider the IOTS model and take a close look on some basicassumptions underlying the existing IOTS testing frameworks.

One of the most important works on test generation from labeled transition systems withinputs and outputs is [Tret96]. In this paper, it is assumed that a tester (implementing a giventest case) and an IOTS interact as two labeled transition systems and not as IOTS.

79

Accordingly, the LTS composition operator used to formalize this interaction does notdistinguish between inputs and outputs, so the tester need not be input-enabled to satisfycompatibility conditions for composing IOTS [LyTu89]. The tester seems to be able topreempt output from the system any time it decides to send input to the system. This allowsthe tester to avoid choosing between inputs and outputs, keeping the test processdeterministic. On the other hand, such a tester appears to be able to override the principlethat “output actions can never be blocked by the environment” [Tret96, p.106].

Another assumption about the tester is taken by Tan and Petrenko [TaPe98]. In this work,it is recognized that the tester cannot block the system’s outputs, it is only assumed that thetester can detect the situation when it offers input to the system, but the latter, instead ofconsuming it, issues an output (a so-called “exception”). An exception halts a current testrun avoiding thus any further non-deterministic behavior and results in the verdictinconclusive. Notice that the tester of [Tret96] has only two verdicts, pass and fail.

Either approach relies on an assumption that is not always justified in a real testingenvironment. As an example, consider the situation when the tester cannot directly interactwith the IUT, because of a context, such as queue or interface, between them. As pointed outin [dVBF02], to apply the test derivation algorithm of [Tret96], one has to take into accountthe presence of a queue context. It also states “the assumption that we can synthesize everystimulus and analyze every observation is strong”, so that some problems in observingquiescence occur.

The case when IOTS is tested via infinite queues is investigated by Verhaard et al[VTKB92]. The proposed approach relies on an explicit combined specification of a givenIOTS and queue context, so it is not clear how this approach could be implemented inpractice. This context is also considered in [JJTV99], where a stamping mechanism isproposed to order the outputs with respect to inputs, while quiescence is ignored. Astamping process has to be synchronously composed with the IUT as the tester in [Tret96].

We also notice that we are aware of the only work [TaPe98] that uses fault models in testderivation from IOTS. In [Tret96] and [VTKB92], a test case is derived from a traceprovided by the user.

The above discussion indicates a need for another approach that does not rely on suchstrong assumptions about the testing environment and incorporates a fault model to derivetests that can be characterized in terms of fault detection. In this paper, we report on ourpreliminary findings in attempts to elaborate such an approach. In particular, we introduce aframework for testing IOTS, assuming that a tester can never prevent a system under testfrom producing outputs, while the system does not block inputs from the tester either and,thus, input and output actions may occur simultaneously and should be queued in finitebuffers between the tester and system.

The paper is organized as follows. In Section 2, we introduce some basic definitions anddefine a composition operator for IOTS based on a refined notion of compatibility of IOTSfirst defined in [LyTu89]. Section 3 presents our framework for a so-called queued-quiescence testing, based on the idea that the tester should consist of two test processes, oneprocess is applying inputs to a system under test via a finite input queue and another one isreading outputs that the system puts into a finite output queue until it detects no moreoutputs from the system, i.e., the tester detects quiescence in the system. We elaborate sucha tester and formulate several implementation relations that can be tested with a queued-quiescence tester. In Section 4, we discuss how queued-quiescence tests can be derived for agiven specification and fault model that comprises a finite set of implementations. In Section5, we generalize our testing framework with a so-called queued-suspension testing by

80

allowing a tester to have several pairs of input and output processes and demonstrate that aqueued-suspension tester can check finer implementation relations than a queued-quiescencetester. We conclude by comparing our contributions with previous work and discussingfurther work.

2. PreliminariesA labeled transition system, or simply a labeled transition system (LTS), is a 4-tuple L = <S,Σ, λ, s0>, where S is a finite non-empty set of states with the initial state s0; Σ is a finite setof actions; λ ∈ S × Σ × S is a transition relation. In this paper, we consider only LTS suchthat (s, a, s′), (s, a, s′′) ∈ λ implies s′ = s′′. These are deterministic LTS.

Let L1 = <S, Σ1, λ1, s0> and L2 = <T, Σ2, λ2, t0>, the parallel composition L1 || L2 is definedas the LTS <R, Σ1 ∪ Σ2, λ, s0t0>, where the set of states R ⊆ S × T and the transition relationλ are smallest sets obtained by application of the following inference rules:• if a ∈ Σ1 ∩ Σ2, (s, a, s′) ∈ λ1, and (t, a, t′) ∈ λ2 then (st, a, s′t′) ∈ λ;• if a ∈ Σ1\Σ2, (s, a, s′) ∈ λ1, then (st, a, s′t) ∈ λ;• if a ∈ Σ2\Σ1, (t, a, t′) ∈ λ1, then (st, a, st′) ∈ λ.

We use the LTS model to define a transition system with inputs and outputs. Thedifference between these two types of actions is that no system can deny an input actionfrom its environment, while this is completely up to the system when to produce an output,so the environment cannot block the output. Formally, an input/output transition system(IOTS) L is a LTS in which the set of actions Σ is partitioned into two sets, the set of inputactions I and the set of output actions O. Given state s of L, we further denote init(s) the setof actions defined at s, i.e. init(s) = {a ∈ Σ | ∃s′ ∈ S ((s, a, s′) ∈ λ)}. The IOTS is input-enabled if each input action is enabled at any state, i.e., I ⊆ init(s) for each s. State s of theIOTS is called unstable if there exists o ∈ O such that o ∈ init(s). Otherwise, state is stable.A sequence a1…ak over the set Σ is called a trace of L in state s if there exist states s1, …,sk+1 such that (si, ai, si+1) ∈ λ for all i =1, …, k and s1 = s. We use traces(s) to denote the setof traces of L in state s. Following [Vaan91] and [Tret96], we refer to a trace that takes theIOTS from a given state to a stable state as to a quiescent trace.

To define a composition of IOTS, we first state compatibility conditions that define whentwo IOTS can be composed by relaxing the original conditions of [LyTu89]. Note that L1 ||L2 for IOTS L1 and L2 means the synchronous parallel composition of LTS that are obtainedfrom IOTS by neglecting the difference between inputs and outputs, so these IOTS aretreated as LTS.

Definition 1. Let L1 = <S, Σ1, λ1, s0>, Σ1 = I1 ∪ O1, and L2 = <T, Σ2, λ2, t0>, Σ2 = I2 ∪ O2, betwo IOTS such that the sets I1 ∩ I2 and O1 ∩ O2 are empty. Let st be a state of thecomposition L1 || L2. The L1 and L2 are compatible in state st if• a ∈ init(s) implies a ∈ init(t) for any a ∈ I2 ∩ O1 and• a ∈ init(t) implies a ∈ init(s) for any a ∈ I1 ∩ O2.The L1 and L2 are said to be compatible if they are compatible in the state s0t0; otherwisethey are incompatible. L1 and L2 are fully compatible if they are compatible in all the statesof the composition L1 || L2.

Clearly, two input-enabled IOTS with I1 = O2 and I2 = O1 are fully compatible, but theconverse is not true. Based on the notion of compatibility we define what we mean by a

81

parallel composition of two IOTS. Let IOTS(I, O) denote the set of all possible IOTS overthe input set I and output set O.

Definition 2. The composition operator ][ : IOTS(I1, O1) × IOTS(I2, O2) → IOTS((I1 ∪I2)\(O1 ∪ O2), O1 ∪ O2), where the sets I1 ∩ I2 and O1 ∩ O2 are empty, is defined as follows.Let L1 = <S, Σ1, λ1, s0>, Σ1 = I1 ∪ O1, and L2 = <T, Σ2, λ2, t0>, Σ2 = I2 ∪ O2 be compatibleIOTS. If L1 and L2 are compatible in state st of the composition L1 || L2, then st –a→ s′t′ in L1

|| L2 implies the same transition in L1 ][ L2. If L1 and L2 are incompatible in state st, thenthere are no outgoing transitions from the state in L1 ][ L2, i.e., st is a deadlock.

The IOTS L1 ][ L2 can be obtained from the LTS L1 || L2 by pruning outgoing transitionsfrom states where the IOTS L1 and L2 are not compatible. For fully compatible IOTS, theresults of both operators, || and ][, coincide.

3. Framework for Queued-Quiescence Testing of IOTSIn a typical testing framework, it is usually assumed that the two systems, an implementationunder test (IUT) and tester, form a closed system. This means that if L1 is a tester, while L2 isan IOTS modeling the IUT, then Σ1 = Σ2, I1 = O2, and I2 = O1. To be compatible with anyIOTS over the given alphabet Σ2 = I2 ∪ O2 the tester should be input-enabled. However, theinput-enableness has two implications on a behavior of the tester. Its behavior becomesinfinite since inputs enabled in each state create cycles and non-deterministic since the testerhas to choose non-deterministically between input and output. Both features are usuallyconsidered undesirable. Testers should be deterministic and have no cycles. The tworequirements are contradicting.

It turns out that a tester processing outputs of an IUT separately from inputs could meetboth requirements. To achieve this, it is sufficient to decompose the tester into twoprocesses, one for inputs and another for outputs. Intuitively, this could be done as follows.The input test process only sends to the IUT via input buffer a given (finite) number ofconsecutive test stimuli. In response to the submitted input sequence, the IUT producesoutputs that are stored in another (output) buffer. The output test process, that is simply anobserver, only accepts outputs of the IUT by reading the output buffer. All the outputsequences the specification IOTS can produce in response to the submitted input sequence,should take the output test process into terminal states labeled with the verdict pass, whileany other output sequence produced by an IUT should take the output test process to aterminal state labeled with the verdict fail. Since the notion of a tester is based on thedefinition of a set of output sequences that the specification IOTS can produce in response toa submitted input sequence, we formalize both notions as follows.

Let L be an IOTS defined over the action set Σ = I ∪ O and pref(α) denote the set of allthe prefixes of a sequence α over the set Σ. The set pref(α) has the empty sequence ε. Alsogiven a set P ⊆ Σ* , let { β ∈ pref(γ) | γ ∈ P} = pref(P).

Definition 3. Given an input word α ∈ I*, the input test process with α is a tuple α =<pref(α), ∅, I, λα, ε>, where the set of inputs is empty, while the set of outputs is I, λα ={ (β, a, βa) | βa ∈ pref(α)} , and the initial state is ε.

82

We slightly abuse α to denote both, the input sequence and the input test process thatexecutes this sequence. It is easy to see that each input test process is fully compatible withany IOTS L that is input-enabled and defined over the set of inputs I. Notice that in thispaper, we consider only input-enabled IOTS specifications, while an implementation IOTS(that models an IUT) is always assumed to be input-enabled.

To define an output test process that complements an input test process α, we have first todetermine all the output sequences, valid and invalid, the output test process has to expectfrom IUT. The number of valid output sequences becomes infinite when the specificationoscillates, in other words, when it has cycles that involve only outputs. Further, we alwaysassume that the specification IOTS Spec = <S, I ∪ O, λ, s0> does not possess this property.Thus, in response to α, the IOTS Spec can execute any trace that is a completed trace[Glab90] of the IOTS α ][ Spec leading into a terminal state, i.e., into state g, where init(g) =∅. Let ctraces(α ][ Spec) be the set of all such traces. It turns out that the set ctraces(α ][Spec) is closely related to the set of quiescent traces of the specification qtraces(Spec), viz. itincludes each quiescent trace β whose input projection, denoted β↓I , is the sequence α.

Proposition 4. ctraces(α ][ Spec) = {β ∈ qtraces(Spec) | β↓I = α}.

Thus, the set ctraces(α ][ Spec)↓O = {β↓O | β ∈ qtraces(Spec) & β↓I = α} contains all theoutput sequences that can be produced by the Spec in response to the input sequence α.

Let qtraces(s) be the set of quiescent traces of Spec in state s. Given a quiescent trace β ∈qtraces(s), the sequence β↓Iβ↓Oδ is said to be a queued-quiescent trace of Spec in state s,where δ ∉ Σ is a designated symbol that denotes the absence of outputs, i.e., quiescence. Weuse Qqtraces(s) to denote the set of queued-quiescence traces of s {(β↓Iβ↓Oδ) | β ∈qtraces(s)} and Qqtraceso(s, α) to denote the set {β↓Oδ | β ∈ qtraces(s) & β↓I = α}. Next, wedefine the output test process itself.

Given the input test process α and the set Qqtraceso(s0, α), we define a set of outputsequences out(α) the output test process can receive from an IUT. Intuitively, it is sufficientto consider all the shortest invalid output sequences along with all valid ones. Any validsequence should not be followed by any further output action, as the specification becomesquiescent, while any premature quiescence indicates that the observed sequence is not avalid output sequence. The set out(α) is defined as follows. For each β ∈ pref(Qqtraceso(s0,α)) the sequence β ∈ out(α) if β ∈ Qqtraceso(s0, α), otherwise βa ∈ out(α) for all a ∈ O ∪{δ} such that βa ∉ pref(Qqtraceso(s0, α)).

Definition 5. The output test process for the IOTS Spec and the input test process α is atuple <pref(out(α)), O ∪ {δ}, ∅, λα, ε>, where pref(out(α)) is the state set, O ∪ {δ} is theinput set, the output set is empty, λα = {(β, a, βa) | βa ∈ pref(out(α))} and ε is the initialstate. State β ∈ pref(out(α)) is labeled with the verdict pass if β ∈ Qqtraceso(s0, α) or withthe verdict fail if β ∈ out(α)\Qqtraceso(s0, α).

We reuse out(α) to denote the output test process that complements the input test processα. For a given input sequence α ∈ I* the pair (α, out(α)) is called a queued-quiescencetester or test case.

To describe the way the output tester interacts with an IOTS Imp ∈ IOTS(I, O) after theinput test process α has terminated its execution against Imp, we denote (α ][ Imp)↓O,δ the

83

IOTS that is obtained from (α ][ Imp) by first projecting it onto the output alphabet O andsubsequent augmenting all the stable states of the resulting projection by self-loopingtransitions labeled with δ. In doing so, we treat the symbol δ as an input of the output testprocess, assuming that the tester synchronizing on δ just detects the fact that its buffer has nomore symbols to read. Strictly speaking, treated as an output, a repeated δ violates thecompatibility of a system in a stable state and a tester that reaches its terminal state. Withthis in mind, the correctness of the construction of the output test process (the soundness ofthe tester) can be stated as follows.

Proposition 6. For any Imp ∈ IOTS(I, O) if the IOTS (α ][ Imp)↓O,δ ][ out(α) reaches a statewhere (α ][ Imp)↓O,δ and out(α) are incompatible, then the output tester out(α) is in aterminal state. For the Spec a state, where (α ][ Spec)↓O,δ and out(α) are incompatible isreached only after quiescence, while the output tester is in a terminal state labeled with theverdict pass.

Thus, the tester composed of two independent processes meets both requirements,namely, it is compatible in all the states, save for the terminal ones, with any IOTS, it has nocycles and never need choosing between input and output, thus the tester possesses therequired properties.

The composition (α ][ Imp)↓O,δ ][ out(α) of a queued-quiescence tester for a givenspecification with an implementation IOTS Imp over the same action set as the specificationhas one or several terminal states. In a particular test run, one of these states with the verdictpass or fail is reached. Considering the distribution of verdicts in the terminal states of thecomposition, the three following cases are possible:

Case 1. All the states have fail.Case 2. States have pass as well as fail.Case 3. All the states have pass.These cases lead us to various relations between an implementation and the specification

that can be established by the queued-quiescence testing.In the first case, the implementation is distinguished from the specification in a single test

run.

Definition 7. Given IOTS Spec and Imp, Imp is queued-quiescence separable from Spec, ifthere exists a test case (α, out(α)) for Spec such that the terminal states of the IOTS (α ][Imp)↓O,δ ][ out(α) are labeled with the verdict fail.

In the second case, the implementation can also be distinguished from the specificationprovided that a proper run is taken by the implementation during the test execution.

Definition 8. Given IOTS Spec and Imp, Imp is queued-quiescence distinguishable fromSpec, if there exists a test case (α, out(α)) for Spec such that the terminal states of (α ][Imp)↓O,δ ][ out(α) are labeled with the verdicts pass and fail.

Consider now case 3, when for a given test case (α, out(α)) all the states have pass. Inthis case, the implementation does nothing illegal when the test case is executed, as itproduces only valid output sequences. Two situations can yet be distinguished here. Eitherthere exists a pass state of the output test process that is not included in any terminal state of

84

(α ][ Imp)↓O,δ ][ out(α) or there is no such a state. The difference is that with the given testcase in the former situation, the implementation could still be distinguished from itsspecification, while in the latter, it could not. This motivates the following definition.

Definition 9. Given IOTS Spec and Imp,• Imp is said to be queued-quiescence trace-included in the Spec if for all α ∈ I* no

terminal state of the IOTS (α ][ Imp)↓O,δ ][ out(α) is labeled with the verdict fail.• Imp and Spec are queued-quiescence trace-equivalent if for all α ∈ I* all the terminal

states of the IOTS (α ][ Imp)↓O,δ ][ out(α) include all the pass states of out(α) and onlythem.

• Imp that is queued-quiescence trace-included in the Spec but not queued-quiescencetrace-equivalent to the Spec is said to be queued-quiescence weakly-distinguishable fromSpec.

We characterize the above relations in terms of queued-quiescent traces.

Proposition 10. Given IOTS Spec with the initial state s0 and Imp with the initial state t0,• Imp is queued-quiescence separable from Spec iff there exists an input sequence α such

that Qqtraceso(t0, α) ∩ Qqtraceso(s0, α) = ∅.• Imp that is not queued-quiescence separable from Spec is queued-quiescence

distinguishable from it iff there exists an input sequence α such that Qqtraceso(t0, α) Qqtraceso(s0, α).

• Imp that is not queued-quiescence distinguishable from Spec is queued-quiescenceweakly-distinguishable from it iff there exists an input sequence α such thatQqtraceso(t0, α) ⊂ Qqtraceso(s0, α).

• Imp is queued-quiescence trace-included into Spec, iff Qqtraces(t0) ⊆ Qqtraces(s0).• Imp and Spec are queued-quiescence trace-equivalent iff Qqtraces(t0) = Qqtraces(s0).

Figure 1 provides an example of IOTS that are not quiescent trace equivalent, but arequeued-quiescence trace-equivalent. Indeed, the quiescent trace aa1δ of the IOTS L2 is not atrace of the IOTS L1. In both, the input sequence a yields the queued-quiescent trace a1δ, aayields the queued-quiescent traces aa1δ and aa2δ, any longer input sequence results in thesame output sequences as aa.

L1 L2

Figure 1: Two IOTS that have the different sets of quiescent traces, but are queued-quiescence trace-equivalent; inputs are decorated with “?” , outputs with “ !” ;

stable states are depicted in bold.

?a

?a !2 ?a

!1 ?a

?a

?a!1, !2

?a

!1 ?a

85

The IOTS L1 and L2 are considered indistinguishable in our framework, while accordingto the ioco relation [Tret96], they are distinguishable. The IOTS L2 has the quiescent traceaa1 that is not a trace of L1, therefore, to distinguish the two system, the tester has to applytwo consecutive inputs a. The output 1 appearing only after the second input a indicates thatthe system being tested is, in fact, L2 and not L1. However, to make such a conclusion, thetester should be able to prevent the appearance of the output 1 after the first input a. Underour assumption, it is not possible. The tester interacts with the system via queues and has noway of knowing when the output is produced. The presence of a testing context that is a pairof finite queues in our case, makes implementation relations that could be tested via thecontext coarser, as is usually the case [PYBD96].

4. Deriving Queued-Quiescence Test CasesProposition 10 indicates the way test derivation could be performed for the IOTS Spec andan explicit fault model when we are given a finite set of implementations. Namely, for eachImp in the fault model, we may first attempt to determine an input sequence α such thatQqtraceso(t0, α) ∩ Qqtraceso(s0, α) = ∅. If fail we could next try to find α such that

Qqtraceso(t0, α) Qqtraceso(s0, α). If Qqtraceso(t0, α) ⊆ Qqtraceso(s0, α) for each α thequestion is about an input sequence α such that Qqtraceso(t0, α) ≠ Qqtraceso(s0, α), thusQqtraceso(t0, α) ⊂ Qqtraceso(s0, α). Based on the found input sequence, a queued-quiescence test case for the Imp in hand can be constructed, as explained in the previoussection. If no input sequence with this property can be determined we conclude that theIOTS Spec and Imp are queued-quiescence trace-equivalent, they cannot be distinguished bythe queued-quiescence testing.

Search for an appropriate input sequence could be performed in a straightforward way byconsidering input sequences of increasing length. To do so, we just parameterize Definitions7, 8 and 9 and accordingly Proposition 10 with the length of input sequences. Given a lengthof input sequences k, let Qqtracesk(s0) = {(β↓Iβ↓Oδ) | β ∈ qtraces(s0) & |β↓I| ≤ k}. The setQqtracesk(s0) is finite for the IOTS L with a finite set of quiescence traces. Then, e.g., Impand Spec are queued-quiescence k-trace-equivalent iff Qqtracesk(t0) = Qqtracesk(s0). If

length of α such that Qqtraceso(t0, α) Qqtraceso(s0, α) is k then Imp is said to be queued-quiescence k-distinguishable from Spec. With these parameterized definitions, we examineall the input sequences starting from an empty input action. The procedure terminates whenthe two IOTS are distinguished or when the value of k reaches a predefined maximumdefined by the input buffer of the IUT available for queued testing.

Spec ImpFigure 2: The IOTS that are queued-quiescence 2-distinguishable,

but not queued-quiescence 1-distinguishable.

Consider the example in Figure 2. By direct inspection, one can assure Imp is not queued-quiescence 1-distinguishable from Spec, for both produce the output 1 in response to the

?a ?a

?a!1

!2

?a

?a

?a!1

!2

?a?a

86

input a. However, it is queued-quiescence 2-distinguishable from Spec. Indeed, in responseto the sequence ?a?a the Spec can produce the output 1 or 12. While the Imp - 2 or 12.It is interesting to notice that the notion of k-distinguishability applied to the IOTS and FSMmodels exhibits different properties. In particular, two k-distinguishable FSM are also k+1-distinguishable. This does not always hold for IOTS. The system Imp in Figure 3 is queued-quiescence 1-distinguished from Spec; however, it is not queued-quiescence k-distinguishedfrom Spec for any k > 1.

Spec ImpFigure 3: The IOTS that are queued-quiescence 1-distinguishable,

but not queued-quiescence k-distinguishable for k > 1.

This indicates that a special care has to be taken when one attempts to adapt FSM-basedmethods to the queued testing of IOTS.

There is at least one special case when distinguishability can be decided withoutdetermining the sets of queued-quiescence k-traces for various k.

Let Imp↓O denote the set of output projections of all traces of Imp.

Proposition 11. Given two IOTS Spec and Imp, if the set Imp↓O is not a subset of Spec↓O

then Imp is queued-quiescence distinguishable from Spec, moreover, any quiescence trace β∈ qtraces(Spec) such that β↓O ∈ Imp↓O\Spec↓O yields a queued-quiescence test case (β↓I,out(β↓I)) that when executed against the Imp produces the verdict fail.

The statement suggests a procedure for deriving test cases.

Procedure for deriving a test case that distinguishes the IOTS Imp from Spec.Input: IOTS Spec and Imp such that the set Imp↓O is not a subset of Spec↓O.

Output: A queued-quiescence test case (α, out(α)) such that Qqtraceso(t0, α) Qqtraceso(s0, α).

Step 1. By use of a subset construction, project Imp and Spec onto the output set O.Step 2. Using the direct product of the obtained projections, determine a trace ρ that isa trace of the output projection of Imp while not being a trace of that of Spec.Step 3. Compose LTS <pref(ρ), O, λρ, ε> with the Imp and obtain the LTS, whereeach trace is a trace of the Imp with the output projection ρ. Determine the inputprojection α of any trace of the obtained LTS and the queued-quiescence test case (α,out(α)).

?a

?a!2

?a

!1

?a

!1

?a

?a

?a!2

?a

!1

?a

!1?a

?a

!1

87

Proposition 12. Given two IOTS Spec and Imp, let (α, out(α)) be the queued-quiescencetest case derived by the above procedure. Then the queued-quiescence test case executedagainst the Imp produces the verdict fail. Moreover, if no pass verdict can be produced thenImp is queued-quiescence separable from Spec.

5. Queued-Suspension Testing of IOTSIn the previous sections, we explored the possibilities for distinguishing IOTS based on theirqueued-quiescent traces. The latter are pairs of input and output projections of quiescenttraces. If systems with different quiescent traces have the same set of queued-quiescenttraces, no queued-quiescence test case can differentiate them. However, sometimes suchIOTS can still be distinguished by a queued testing, as we demonstrate below.

Consider the example in Figure 4. Here the two IOTS have different sets of quiescenttraces, however, the have the same set of queued-quiescent traces {a1δ, aa1δ, aa12δ, aaa1δ,aaa12δ, … }. In the testing framework presented in Section 3, they are not distinguishable.Indeed, we cannot tell them apart when a single input is applied to their initial states.Moreover, in response to the input sequence aa and to any longer sequence, they producethe same output sequence 12. The difference is that IOTS Imp, while producing the outputsequence 12, becomes quiescent just before the output 2 and the IOTS Spec does not. Theproblem is that this quiescence is not visible through the output queue by the output testprocess that expects either 1 or 12 in response to aa. The queued-quiescence tester candetect the quiescence after reading the output sequence 12 as an empty queue, but it cannotdetect an “intermediate” quiescence of the system. It has no way of knowing whether thesystem becomes quiescent before a subsequent input is applied. Both inputs are in the inputbuffer and it is completely up to the system when to read the second input.

Spec ImpFigure 4: The queued-quiescence equivalent IOTS.

Intuitively, further decomposing the tester for the Spec into two input and two output testprocesses could solve the problem. In this case, testing is performed as follows. The firstinput test process issues the input a. The first output test process expects the output 1followed by a quiescence δ, when the quiescence is detected, the control is transferred to thesecond input test process that does the final a. Then the second output test process expectsquiescence. If, instead, it detects the output 2 it produces the verdict fail which indicates thatthe IUT is Imp and not Spec. Opposed to a queued-quiescence tester, such a tester can detectan intermediate quiescence of the system. The example motivates the following definitions.

Let α1 … αp be a finite sequence of input words such that αi ∈ I*, i = 1, …, p, and αi ≠ εfor i ≠ 1. Each word αi defines the input test process αi (see Definition 3). To define outputtest processes that complement input test processes α1 … αp, we first notice that the first

?a

!2

?a

!1?a

!1

?a

?a

?a

!2

?a?a

!1?a

?a

88

output test process is designed based on the fact that the Spec starts in the only state that isits initial state. This is no longer true for any subsequent output test process; the Spec canstart in one of several stable states, depending on an output sequence it has produced inresponse to the stimuli from the previous input test processes. Let αβδ ∈ Qqtraces(s0), thenwe use Spec-after-(α, β) to denote the set of stable states that are reached by Spec when itexecutes all possible quiescent traces with the input projection α and output projection β.Consider the input test process α2, before it starts, the Spec has produced one of|Qqtraceso(s0, α1)| output sequences, each of which defines the set of stable states Spec-after-(α1, β), where β ∈ Qqtraceso(s0, α1), these are the starting states for the second inputtest process α2. Thus, we have to define |Qqtraceso(s0, α1)| output test processes thatcomplement the input test process α2. Each valid output sequence produced by the IUT sofar is used to decide which pair of input and output test processes should execute next, whileeach invalid sequence terminates the test execution. Thus, testing becomes adaptive. For anoutput sequence β ∈ Qqtraceso(s0, α1), the Spec can produce in response to α2 any outputsequence in the set Qqtraceso(Spec-after-(α1, β), α2). Generalizing this to αi+1, we have thefollowing. The set of output sequences the Spec can produce in response to αi+1 isQqtraceso(Spec-after-(α1…αi, β1…βi), αi+1), where for the output projection β1…βi it holdsthat β1 ∈ Qqtraceso(s0, α1) and βj ∈ Qqtraceso(Spec-after-(α1…αj-1, β1…βj-1), αj) for each j= 2, …, i. A sequence of output words β1…βi with such a property is said to be consistent(with the corresponding sequence of input words α1…αi).

Each output projection β1…βi defines, therefore, a distinct test output process for the(i+1)-th input test process. The set of output sequences out(αi+1, β1…βi) the output testprocess for the given sequence β1…βi can receive from an IUT is defined as follows. Foreach γ ∈ pref(Qqtraceso(Spec-after-(α1…αi, β1…βi), αi+1) the sequence γ ∈ out(αi+1,β1…βi) if γ ∈ Qqtraceso(Spec-after-(α1…αi, β1…βi), αi+1), otherwise γa ∈ out(αi+1, β1…βi)for all a ∈ O ∪ {δ} such that γa ∉ pref(Qqtraceso(Spec-after-(α1…αi, β1…βi), αi+1).

Let β1…βi⋅pref(out(αi+1, β1…βi)) denote the set {β1…βiα | α ∈ pref(out(αi+1, β1…βi))}.Now we are ready to generalize the definition of output test processes (Definition 5), takinginto account a valid output sequence produced by an IUT with the preceding test processes.

Definition 13. Let α1 … αi+1 be a sequence of input words and β1…βi be a consistentsequence of output words. An output test process for the IOTS Spec, sequence β1…βi andthe input test process αi+1 is a tuple <β1…βi⋅pref(out(αi+1, β1…βi)), O ∪ {δ}, ∅, λαi+1, β1…βi,β1…βi>, where β1…βi⋅pref(out(αi+1, β1…βi)) is the state set, O ∪ {δ} is the input set, theoutput set is empty, λαi+1, β1…βi = {(β1…βiγ, a, β1…βiγa) | γa ∈ pref(out(αi+1, β1…βi))} andβ1…βi is the initial state. Each state β1…βiγ is labeled with the verdict pass if γ ∈Qqtraceso(Spec-after-(α1…αi, β1…βi), αi+1) or with the verdict fail if γ ∈ out(αi+1,β1…βi)\Qqtraceso(Spec-after-(α1…αi, β1…βi), αi+1).

We use out(αi+1, β1…βi) to denote an output test process that complements the input testprocess αi+1 and the output sequence β1…βi. For a given sequence of input words α1…αp,the set of the tuples of pairs (α1, out(α1)), …, (αp, out(αp, β1…βp−1)) for all consistent outputsequences β1…βp−1 is called a queued-suspension tester or a queued-suspension test caseand is denoted (α1…αp, Out(α1…αp)).

It is clear that for a single input test process, a queued-suspension tester reduces to aqueued-quiescence tester. The queued-suspension testing is more discriminative than

89

queued-quiescence testing, as Figure 4 illustrates. In fact, consider a queued-quiescencetester derived from a single sequence α1…αp and a queued-suspension tester derived fromthe sequence of p words α1, …, αp, the former uses just the output projection of quiescenttraces that have the input projection α1…αp while the latter additionally partitions thequiescent traces into p quiescent sub-traces. Then the two systems that cannot bedistinguished by the queued-suspension testing have to produce the same output projection,moreover, the output projections have to coincide up to the partition defined by the partitionof the input sequence. This leads us to the notion of queued-suspension traces.

Given a finite sequence of finite input words α1…αp, a sequence of queued-quiescencetraces (α1β1δ)…(αpβpδ) is called a queued-suspension trace of Spec if α1β1δ ∈ Qqtraces(s0)and for each i = 2, …, p it holds that βiδ ∈ Qqtraceso(Spec-after-(α1…αi-1, β1…βi-1), αi). Weuse Qstraces(s) to denote the set of queued-suspension traces of Spec in state s.

We define the relations that can be characterized with queued-suspension testing byadapting Definitions 7, 8, and 9.

Definition 14. Given IOTS Spec and Imp,• Imp is queued-suspension separable from Spec, if there exist a test case (α1…αp,

Out(α1…αp)) for Spec such that for any consistent output sequence β1…βp−1 the terminalstates of the IOTS (αp ][ Imp after(α1…αp-1, β1…βp−1))↓O,δ ][ out(αp, β1…βp−1) arelabeled with the verdict fail.

• Imp is queued-suspension distinguishable from Spec, if there exist test case (α1…αp,Out(α1…αp)) for Spec and consistent output sequence β1…βp−1 such that the terminalstates of the IOTS (αp ][ Imp after(α1…αp-1, β1…βp−1))↓O,δ ][ out(αp, β1…βp−1) arelabeled with the verdicts pass and fail.

• Imp is said to be queued-suspension trace-included in the Spec if for all α ∈ I* and allpossible partitions of α into words α1, …, αp, no terminal state of IOTS (αp ][ (αp ][ Impafter(α1…αp-1, β1…βp−1))↓O,δ ][ out(αp, β1…βp−1) is labeled with the verdict fail.

• Imp and Spec are queued-suspension trace-equivalent if for all α ∈ I*, all possiblepartitions of α into words α1, …, αp, and all consistent output sequence β1…βp−1, all theterminal states of the IOTS (αp ][ Imp after(α1…αp-1, β1…βp−1))↓O,δ ][ out(αp, β1…βp−1)include all the pass states of out(αi) and only them.

• Imp that is queued-suspension trace-included in the Spec but not queued-suspensiontrace-equivalent to the Spec is said to be queued-suspension weakly-distinguishable fromSpec.

Accordingly, the following is a generalization of Proposition 10.

Proposition 15. Given IOTS Spec and Imp,• Imp is queued-suspension separable from Spec iff there exists a finite sequence of input

words α1…αi such that Qstraceso(Imp-after-(α1…αi-1, γ1…γi-1), αi) ∩ Qstraceso(Spec-after-(α1…αi-1, γ1…γi-1), αi) = ∅ for any consistent γ1…γi-1.

• Imp that is not queued-suspension separable from Spec is queued-suspensiondistinguishable from it iff there exist a finite sequence of input words α1…αi and

consistent γ1…γi-1 such that Qstraceso(Imp-after-(α1…αi-1, γ1…γi-1), αi) Qstraceso(Spec-after-(α1…αi-1, γ1…γi-1), αi).

90

• Imp that is not queued-suspension distinguishable from Spec is queued-suspensionweakly-distinguishable from it iff there exist a finite sequence of input words α1…αi andconsistent γ1…γi-1 such that Qstraceso(Imp-after-(α1…αi-1, γ1…γi-1), αi) ⊂Qstraceso(Spec-after-(α1…αi-1, γ1…γi-1), αi).

• Imp is queued-suspension trace-included into Spec, iff Qstraces(t0) ⊆ Qstraces(s0).• Imp and Spec are queued-suspension trace-equivalent iff Qstraces(t0) = Qstraces(s0).

The queued-suspension testing also needs input and output buffers as the queued-quiescence testing. The size of the input buffer is defined by the longest input word in achosen test case (α1…αp, Out(α1…αp)), while that of the output buffer by the longest outputsequence produced in response to any input word. We assume the size of the input buffer kis given and use it to define queued-suspension k-traces and accordingly, to parameterizeDefinition 14 obtaining appropriate notions of k-distinguishability. In particular, a queued-suspension trace of Spec α1β1δ…αpβpδ ∈ Qstraces(s0) is called a queued-suspension k-traceof Spec if |αi| ≤ k for all i = 1, …, p. The set of all these traces Qstracesk(s0) has a finiterepresentation.

Definition 16. Let Sstable be the set of all stable states of an IOTS Spec = <S, I ∪ O, λ, s0>and Ik denote the set of all words of at most k inputs. A queued-suspension k-machine forSpec is a tuple <R, IkO*δ, λk

stable, s0>, denoted Specksusp, where the set of states R ⊆ P(Sstable)

∪ {s0}, (P(Sstable) is a powerset of Sstable), and the transition relation λkstable are the smallest

sets obtained by application of the following rules:• (r, αβ, r′) ∈ λk

stable if αβ ∈ IkO*δ and r′ is the union of sets s-after-(α, β) for all s ∈ r.• In case the initial state s0 is unstable (s0, αβ, r′) ∈ λk

stable if αβ ∈ IkO*δ, α = ε and r′ = s0-after-(ε, β).

Notice that each system that does not oscillate has at least one stable state.

Proposition 17. The set of traces of Specksusp coincides with the set of queued-suspension k-

traces of Spec.

Corollary 18. Imp is queued-suspension k-distinguishable from Spec iff the Impkstable has a

trace that is not a trace of Specksusp.

Figure 1 gives the example of IOTS that are queued-suspension trace equivalent, recallthat they are also queued-quiescent trace-equivalent, but not quiescent trace equivalent.

We notice that a queued-suspension k-machine can be viewed as an FSM with the inputset Ik and output set Om for an appropriate integer m, so that FSM-based methods could beadapted to derive queued-suspension test cases.

6. ConclusionWe addressed the problem of testing from transition systems with inputs and outputs andelaborated a testing framework based on the idea of decomposing a tester into input andoutput processes. Input test process is applying inputs to a system under test via a finiteinput queue and output test process is reading outputs that the system puts into a finiteoutput queue until it detects no more outputs from the system, i.e., the tester detects

91

quiescence in the system. In such a testing architecture, input from the tester and outputfrom the system under test may occur simultaneously. We call such a testing scenario aqueued testing. We analyzed two types of queued testers, the first consisting of single inputand single output test processes, a so-called queued-quiescence tester, and the secondconsisting of several such pairs of processes, a so-called queued-suspension tester. Wedefined implementation relations that can be checked in the queued testing with both typesof testers and proposed test derivation procedures.

Our work differs from the previous work in several important aspects. First of all, wemake a liberal assumption on the way the tester interacts with a system under test, namelythat the system can issue output at any time and the tester cannot determine exactly itsstimulus after which an output occurs. We believe this assumption is less restrictive than anyother assumption known in the testing literature [BrTr01], [Petr01]. Testing with thisassumption requires buffers between the system and tester. These buffers are finite, opposedto the case of infinite queues considered in a previous work [VTKB92]. We demonstratedthat in a queued testing, the implementation relations that can be verified are coarser thanthose previously considered. Appropriate implementation relations were defined and testderivation procedures were elaborated with a fault model in mind. Thus, the resulting testsuite becomes finite and related to the assumptions about potential faults, opposed to theapproach of [Tret96], where the number of test cases is, in fact, uncontrollable and notdriven by any assumption about faults. The finiteness of test cases allows us, in addition, tocheck equivalence relations and not only preorder relations as in, e.g., [Tret96].

Concerning future work, we believe that this paper may trigger research in variousdirections. One possible extension could be to consider non-rigid transition systems,allowing non-observable actions. Procedures for test derivation proposed in this paper couldbe improved, as our purpose here was just to demonstrate that the new testing problem withfinite queues could be solved in a straightforward way. It is also interesting to see to whichextent one could adapt FSM-based test derivation methods driven by fault models, as it isdone in [TaPe98] with a more restrictive assumption about a tester in mind.

AcknowledgmentThis work was in part supported by the NSERC grant OGP0194381. The first authoracknowledges fruitful discussions with Andreas Ulrich about testing IOTS. Comments of JiaLe Huo are appreciated.

References[BoPe94] G. v. Bochmann and A. Petrenko, Protocol Testing: Review of Methods and

Relevance for Software Testing, the proceedings of the ACM InternationalSymposium on Software Testing and Analysis, ISSTA’94, USA, 1994.

[BrTr01] E. Brinksma and J. Tretmans, Testing Transition Systems: An AnnotatedBibliography, LNCS Tutorials, LNCS 2067, Modeling and Verification of ParallelProcesses, edited by F. Cassez, C. Jard, B. Rozoy and M. Ryan, 2001.

[dVBF02] R. G. de Vries, A. Belinfante and J. Feenstra, Automated Testing in Practice: TheHighway Tolling System, the proceedings of the IFIP 14th InternationalConference on Testing of Communicating Systems, TestCom’2002, Berlin,Germany, 2002.

92

[Glab90] R. J. van Glabbeek, The Liear Time-Branching Time Spectrum, the proceedings ofCONCUR’90, LNCS 458, 1990.

[JJTV99] C. Jard, T. Jéron, L. Tanguy and C. Viho, Remote Testing Can Be as Powerful asLocal Testing, the proceedings of the IFIP Joint International Conference,Methods for Protocol Engineering and Distributed Systems, FORTE XII/PSTVXIX, China, 1999.

[LyTu89] N. Lynch and M. R. Tuttle, An Introduction to Input/Output Automata, CWIQuaterly, 2(3), 1989.

[Petr01] A. Petrenko, Fault Model-Driven Test Derivation from Finite State Models:Annotated Bibliography, LNCS Tutorials, LNCS 2067, Modeling and Verificationof Parallel Processes, edited by F. Cassez, C. Jard, B. Rozoy and M. Ryan, 2001.

[Phal93] M. Phalippou, Executable Testers, the proceedings of the IFIP Sixth InternationalWorkshop on Protocol Test Systems, IWPTS’93, France, 1993.

[PYBD96] A. Petrenko, N. Yevtushenko, G. v. Bochmann, R. Dssouli, Testing in Context:Framework and Test Derivation, Computer Communications, 19, 1996.

[Sega93] R. Segala, Quiescence, Fairness, Testing and the Notion of Implementation, theproceedings of CONCUR’93, LNCS 715, 1993.

[TaPe98] Q. M. Tan, A. Petrenko, Test Generation for Specifications Modeled byInput/Output Automata, the proceedings of the 11th International Workshop onTesting of Communicating Systems, IWTCS'98, Russia, 1998.

[Tret96] J. Tretmans, Test Generation with Inputs, Outputs and Repetitive Quiescence,Software-Concepts and Tools, 17(3), 1996.

[Vaan91] F. Vaandrager, On the Relationship between Process Algebra and Input/OutputAutomata, the proceedings of Sixth Annual IEEE Symposium on Logic inComputer Science, 1991.

[VTKB92] L. Verhaard, J. Tretmans, P. Kim, and E. Brinksma, On Asynchronous Testing,the proceedings of the IFIP 5th International Workshop on Protocol Test Systems,IWPTS’92, Canada, 1992.

93

Optimization Problems in Testing Observable Probabilistic Finite-State

Machines

Fan Zhang1 and To-yat Cheung2

1Department of Computing, Hong Kong Polytechnic University e-mail: [email protected]

2Department of Computer Science, City University of Hong Kong e-mail: [email protected]

Abstract: In this paper, we investigate the transfer sequence and diagnosis sequence for

testing a probabilistic finite-state machine whose transitions have weights. These

sequences are adaptive and are measured by their average length. We discuss the problem

of optimal strategies for selecting input and thus for generating these sequences. In

particular, we show that, if the probabilistic machine is observable (i.e., the next-state of

each transition can be uniquely determined by its output), then, polynomial-time

algorithms can be obtained for the following problems: (1) Find the shortest transfer

sequence from a start state to a target state, or prove that no such a sequence exists. (2)

Find the shortest pair-wise distinguishing sequences for a given pair of states, or prove

that no such sequence exists.

Keywords: Average weight, Diagnosis tree, Probabilistic finite-state machine, Software

testing, Transfer tree.

I. INTRODUCTION

Nondeterminism is common in testing systems that have concurrent processes and

internal actions. Recently, research interest in testing has been extended from

deterministic finite-state machines (DFSM) [1,4,8,13] to nondeterministic finite-state

machines (NFSM) [2,3,5,7,9,12] and probabilistic finite-state machines (PM)

[2,3,14,15]. A PM is an NFSM with transition probabilities that represent the chance of a

transition to be triggered by the input.

In the state-based approach of testing, the system under test is specified as an finite-

state machine M and a test sequence is designed based on M. During testing, the input

portion of the sequence is applied to the implementation under test (IUT) and the actual

outputs are compared with the expected ones to uncover any possible output or state-

transition errors. Two major test activities must be carried out in this approach: state-

transfer and state-identification. For state-transfer, the problem is to find a sequence of

95

inputs that drives the IUT from its initial state s to a targeted state t. For a DFSM, the

inputs along any directed path connecting s to t will serve this purpose. For an NFSM,

however, this problem becomes much more complex because the same input sequence

may bring the IUT sometimes to t and sometimes elsewhere. Therefore, instead of a

single path, we have to find a transfer-tree (TT) of which every path terminates at t, so as

to always bring the IUT to the expected targeted state.

State-identification is to verify the identification of a state. During testing, the current

state of the IUT cannot be observed directly but it can only be inferred from the output

observed. After the IUT is brought to a state t' that is expected to be t, the identification

of t' need to be checked to make sure the reached state t' is t indeed. For DFSM, a

diagnosis sequence of input/output pairs for t is derived. The following three kinds of

diagnosis sequences have been used most frequently: A distinguishing sequence can

identify the current state among all possible states. That is, the same distinguishing

sequence can be used for every state. A UIO sequence can differentiate a specific state r

from all other states. Different UIO sequences may be needed for different specified

states [11]. A pair-wise distinguishing sequence can identify the current state between

two given states. For an NFSM, similar to generalizing a transfer sequence to a TT, a

diagnosis sequence is generalized to a diagnosis tree (DT). For a general NFSM or PM,

most of the problems are computationally difficult. For example, deciding the existence

of a TT or DT is Exptime-complete; also, the algorithms for finding TTs and DTs require

exponential time [2].

For testing purpose, we believe that the PM is a better model than the NFSM. The

main reason is that the test sequence for a PM can be measured but cannot be (at least not

fairly) for an NFSM. Another reason is that the PM can reflect the stochastic behavior

pattern of the system under test but the NFSM cannot.

This paper reports our recent investigation on TTs and DTs for an observable PM

(OPM), a special but important class of PM [10]. In such a machine, the next-state of

each transition can be uniquely determined by its output. The transitions of the PM have

weight representing cost or time. The test sequences can be measured by their average

length. We discuss the problem of optimal strategies for selecting input and thus for

generating test sequences. In particular, we show that for an OPM, polynomial-time

algorithms can be obtained for the following problems: (1) Find the shortest transfer

sequence from a start state to a target state, or prove that no such a sequence exists

96

(Section III). (2) Find the shortest pair-wise distinguishing sequences for a given pair of

states, or prove that no such sequence exists (Section IV).

II. DEFINITIONS

This section gives definitions. Most of them can be found in [15].

Definition 2.1 A nondeterministic finite-state machine M is a quintuple (S, I, O, D, λ),

where S is a finite set of states, I is a finite set of inputs, O is a finite set of outputs, D ⊆ S

× I is the domain of the state-input pairs, and λ is a mapping from D to O × S. A

transition (i,j;a/y) starts at state i, ends at state j and is associated with an input/output

pair a/y. The symbol ε denotes “no input” or “no output”.

• M is called a probabilistic machine (PM) if it is associated with a probability function

ρ: S × S × I × O → [0,1] such that ρ(i,j;a/y) > 0 if and only if (i,j;a/y) is a transition

and that ∑y,j ρ(i,j;a/y) = 1 for every (i,a) ∈ D.

• M is further said to be an observable PM (OPM) if, for any two transitions (i,j1; a/y1)

and (i,j2; a/y2) with the same (i,a), y1 = y2 implies j1 = j2.

• For the rest of the paper, M always represents an OPM with a weight function ω: S ×

S × I × O → [0,∞) such that ω(i,j;a/y) > 0 for every transition (i,j;a/y).

Example 1. Figure 1 shows an OPM N represented by a directed graph. In this OPM,

every transition has weight 1 and probability either 1 or 0.5 (not shown), depending on

whether there are one or two outgoing transitions with the same input. N is strongly

connected, i.e., for any two states s and s', there is a (directed) path from s to s'.

1

3

2

a/z

c/ya/y

a/x

a/xc/y

a/yc/x

a/yc/y

Figure 1. An OPM N.

Definition 2.2 A single-input tree T for M is formed by all possible execution paths

under an input-select strategy g. It is defined as follows: (1) T contains the starting state s

as its root. (2) At any node v of T whose corresponding state is i, there are two cases:

Case 1. No input is selected (as a testing goal has been achieved), v is a terminal node

and has label (i, ε). Case 2. An input a is selected by g, and the node in T has label (i, a);

97

also, for every outgoing transition (i,j;a/y) from i, an arc with label y and ending node j

will be attached to the node in T. (Note that a single-input tree may be infinite.)

Definition 2.3 Let T be a single-input tree for M and P be a path of T.

• ρ(P), the probability of P, is the product of the probabilities of its arcs (transitions).

• ω(P), the weight of P, is the sum of the weights of its arcs.

• P is called a full path if it starts from the root and ends at a terminal node of T.

• ρ(T), the probability of reaching a terminal node of T is defined as limitm→ ∞∑(ρ(P):

for all full paths P of T with length ≤ m) and is denoted by ∑P⊆ T ρ(P).

• T is said to be almost sure if ρ(T) = 1.

• When T is almost sure, its average weight ω(T) is defined as ∑P⊆ T ρ(P)ω(P). ω(T)

measures the efficiency of reaching a terminal node of T from its root.

• T is said to be a t-targeted transfer tree (TT) at state s if it is an almost sure single-

input tree whose root is s and terminal nodes all have label (t,ε).

• A policy f of M selects an input for each state, that is, f: S → I ∪ {ε}.

• Tsf denotes the single-input tree at s determined by f, whose labels are (i,f(i)).

Example 2. Figure 2 shows the top part of a t-targeted TT (t = 1) at state 3 for OPM N

(Figure 1): T3 is determined by policy f: f(1) = ε, f(2) = c and f(3) = c. The probability

and weight of every arc of T2 are 1/2 and 1, respectively. T3 is almost sure, as ρ(T3) = 1/2

+ (1/2)2 +...+ (1/2)k + ... = 1. It average weight is ω(T3) = 1(1/2) + 2(1/2)2 + 3(1/2)3 +...+

k(1/2)k + ... = 2. (3,c)

(1,ε)

xy

x

x

y

y

(3,c)

(3,c)(1,ε)

(1,ε)

Figure 2. A t-targeted TT T3 for OPM N.

Definition 2.4 Let M be an OPM with target t and f be a policy for M.

• Mf denotes the submachine induced on M by f. That is, Mf = (S, I, O, Df, λ), where Df

is the domain {(i,f(i)): i ∈ S}.

• M is said to be t-targeted if for every state v of M there is a directed path from v to t.

• f is a t-policy if Mf is t-targeted.

98

We mention two useful facts about t-policies [15]: (a) If f is a t-policy, then Tif is a t-

targeted TT for every i ∈ S. (b) If M is t-targeted, then there is a polynomial-time

algorithm for finding a t-policy f for M.

III. OPTIMAL TRANSFER-TREES

Now we consider the problem of finding an optimal policy for M that generates TTs

having minimum average weight. We first consider the case where M has a t-policy.

Definition 3.1 Let f be a policy for M = (S, I, O, D, λ), n = |S|, i, j ∈ S and a ∈ I ∪ {ε}.

• µ(i,a,j) denotes the total probability of all the transitions which start at state i, have

input a and end at state j, i.e., µ(i,a,j) = ∑y ρ(i,j;a/y) and µ(i,ε,j) = 0.

• Af denotes the n × n matrix (aij), where aij = µ(i,f(i),j).

• E denotes the n × n identity matrix.

• bia denotes the average weight of those transitions outgoing from i and activated by

input a, i.e., bia = ∑ y,j ρ(i,j;a/y)ω(i,j;a/y) and biε = 0.

• bf denotes the vector (bi: i ∈ S), where bi = bif(i).

Optimality Condition of a t-policy f [15]: f is optimal if and only if z = (E − Af)−1bf

satisfies the following inequalities:

zi ≤ bia + ∑j∈ S µ(i,a,j)zj, for every (i,a) ∈ D and i ≠ t.

Algorithm Optimal-Policy

Given: A t-targeted OPM M = (S, I, O, D, λ).

Result: An optimal policy h for generating the shortest transfer trees.

Step 1: Find an optimal solution z* to the following linear program (LP):

LP: maximize ∑(zj: j ∈ S)

Subject to: zi − ∑j∈ S µ(i,a,j)zj ≤ bia, for every (i,a) ∈ D

zt = 0

Step 2: Let M* be the OPM induced by D* = {(i,a) ∈ D: z*i − ∑ j µ(i,a,j)z*j = bia }. Find

a t-policy h of M*.

Theorem 1: Algorithm Optimal-Policy is correct and has polynomial-time complexity.

Sketch Proof: Consider the dual linear program of the LP:

DLP: minimize ∑( biaxia: (i,a) ∈ D)

Subject to ∑a∈ I xja − ∑(i,a)∈ D xiaµ(i,a,j) = 1, j ∈ S\{t}

xia ≥ 0, (i,a) ∈ D

99

As M has a t-policy, say f, we construct x* based on this f as follows: For all (i,a) ∈ D,

x*ia = x* if(i) if a = f(i); x*ia = 0 if a ≠ f(i); and x*iε = 0. x* satisfies the equations of the

DLP and especially,

xjf(j) − ∑i µ(i,f(i),j)xif(i) = 1, for all j ∈ S\{t}, and xtf(t) = 1,

which is, in matrix form,

(xif(i): i ∈ S)(E − Af) = (1,1, …,1).

Furthermore, as (E − Af)−1 exists and is non-negative, (x*if(i): i∈ S) = (1,1,…,1)(E − Af)−1

is non-negative. Hence, x* is a feasible solution to the DLP, and the LP has a finite

solution z*.

It can be easily shown that M* has a t-policy h. As all (i, h(i)) ∈ D*, z* satisfies

z*i − ∑j µ(i,h(i),j)z*j = bih(i), and hence z* = (E − Ah)−1bh. Because z* satisfies the

Optimality Condition, h is an optimal t-policy.

The LP can be solved in polynomial time [6], yielding a finite optimal solution z*. As

mentioned in Section II, a t-policy for M can be obtained in polynomial-time. !

For an arbitrary OPM M, one can reduce M into an OPM M' that has a t-policy [15]

and then apply the algorithm presented here.

IV. DIAGNOSIS TREES

This section investigates the problem of finding a pair-wise distinguishing tree that

has a minimum average weight for an OPM, and also discusses UIO trees and

distinguishing trees.

Definition 4.1 For two states t and r of an OPM M, a pair-wise distinguishing tree (PDT) T

is an almost-sure single-input tree rooted at (t, r) that can decide the state under test to be

either t or r whenever the input/output sequence of any full path of T is executed.

An example of such a PDT for OPM N (Figure 3a) is given in Figure 3b. The symbol

“~” stands for “state does not exist”.

100

1

3

2

a/z

c/ya/y

a/x

a/xc/y

a/yc/x

a/yc/y

((1, 2), a)

((1, ~), ε ) ((2, 1), a) ((~, 3), ε)

((1, ~), ε)

x zy

zxy

((~, 3), ε) ((1, 2), a)x z

y

Figure 3a. An OPM N Figure 3b. A PDT for (1, 2).

The problem of creating a general PDT was first investigated by Alur et al [2]. We

shall find the minimum-length PDT by a similar approach, that is, to transform the

problem of finding a PDT to a problem of finding a TT. It can be briefly described as

follows: First, construct an auxiliary ONFSM M' from M. The state set of M' is a subset

of (S×S) ∪ {θ}, where S is the state set of M and θ is the target state representing the

cases where an inference of the state identification can be drawn. Next, find an optimal

TT for M' from the start state (t, r) to the targeted state θ. One can show that an optimal

TT for M' with weight and probability assigned according to the algorithm below is

essentially an optimal PDT for M. For the following algorithm, we assume that M is

completely specified, that is, D = S × I.

Algorithm Optimal-PDT

Given: An OPM M = (S, I, O, D, λ) and two states t, r ∈ S, where the probability of the

state being t is p and the probability being r is q = 1 – p.

Result: An OPM M' = (S', I', O', D', λ ') and an optimal θ-policy f for M'. If f(t, r) ≠ ε,

then an Optimal PDT can be obtained by applying f on M'. Otherwise, PDT for (t, r)

does not exist.

Method:

Step 1. Construct M' from M as follows, where ρ' and ω' are the probability and

weight functions of M', respectively:

S' ← (S × S) ∪ {θ}, I' ← I, O' ← O, D' ← (S' \{(v,v): v ∈ S}) × I;

for (every (i,j) ∈ S'\{θ} such that i ≠ j and every input a)

for every transition e1 = (i, i'; a/y), construct a transition e of M' as follows:

If there exists j' such that e2 = (j, j'; a/y) is a transition of M,

e = ((i,j), (i',j'); a/y); /* add ((i',j'), y) to λ '((i,j), a) */

101

ρ'(e) = pρ(e1) + qρ(e2), ω'(e) = pω(e1) + qω( e2)

else (no such j' exists)

e = ((i,j), θ; a/y). /* add (θ, y) to λ '((i,j), a) */

ρ'(e) = pρ(i, i'; a/y), ω'(e) = pω(e1);

end for

for every transition e2 = (j, j'; a/y) such that no transition (i, i'; a/y) exists,

construct a transition e of M' as follows:

e = ((i,j), θ; a/y). /* add (θ, y) to λ '((i,j), a) */

ρ'(e) = qρ(e2), ω'(e) = qω(e2);

end for

end for

Step 2. Find an optimal policy f for M' with targeted state θ by applying Algorithm

Optimal-Policy of Section III.

Theorem 2 Algorithm Optimal-PDT finds a policy f for generating a PDT with minimum

average weight (when f(t, r) ≠ ε) or concludes that no PDT exists for the pair (t, r) (when

f(t, r) = ε).

Remark on the Algorithm Optimal-PDT:

(a) If p = 1 and q = 0, then the policy f is to verify the current state is t but not r.

(b) If p = 0 and q = 1, then the policy f can be used to verify the current state is r but

not t.

(c) If both p and q are not 0, then the policy f can identify the state as either t or r.

(d) The way of assigning the transition probability and weight of M' ensures that M' is

an OPM and that the PDT is optimal.

Definition 4.2: For a given state s of M, a unique input output tree (UIOT) is an almost

sure single-input tree T of M rooted at s such that, when the input sequence of any full

path P of T is applied to a different state, the output sequence is always different from

that of P.

One of the approaches for obtaining the shortest UIOT for a state s is to look into the

state space Sn, using ideas similar to the PDT. A UIOT for state 1 of OPM N is shown in

Figure 4a in the space Sn, where T1 is a PDT (p = 1, q = 0) for the pair (1, 3) and T2 is a

PDT (p = 1, q = 0) for the pair (2, 1). For the arc from ((1,2,3), a) to ((1,∼ ,3), a) of the

UIOT, its probability and weight are respectively assigned 0.5 and 1, same as those of the

transition (1, 1; a/x) of N. For the arc from ((1,2,3), a) to ((2,1,1), a), its probability and

102

weight are respectively assigned those of the transition (1, 2; a/y). In general, the

probabilities and weights of a UIOT for state s are the same as those of the corresponding

single-input tree starting at s.

((1,2,3), a)

((1,~,3), c) ((2,1,1), a)

x y

T2T1

((1,2,3), c)

((~,2,1), a) ((2,1,3), c)

x

y

T3

((2,~,1), a)

x

y

T3

((1,2,3), c)

x y

Figure 4a. A UIOT for state 1 Figure 4b. A distinguishing tree for OPM N

Definition 4.3: A distinguishing tree for M is an almost sure single-input tree T such that,

whenever the end of a full path of T is reached, the initial state is uniquely identified.

As an example, Figure 4b shows a distinguishing tree for OPM N (Figure 3a), where

T3 is a PDT for the pair (2, 1). As for a PDT, the average weight of a distinguishing tree

is related to the probabilities p1, …, pn, where pi represents the probability of the state

under test being state i.

V CONCLUDING REMARKS

In this paper, we described a polynomial-time algorithm for finding the shortest

transfer tree for an observable probabilistic finite-state machine. We also reduced the

problem of finding the shortest pair-wise distinguishing tree into the shortest transfer-tree

problem.

Many problems remain unsolved and require further research. For example, for state

transfer, a direct combinatorial and polynomial-time algorithm for finding an optimal

policy is desirable. For state identification, algorithms for generating the optimal UIOT

and DT need to be investigated.

ACKNOWLEDGEMENT

We thank the referees for their comments. This work is supported by the Hong Kong

Polytechnic University Research Grant G-YC51.

103

REFERENCES 1. Aho, A.V., Dahbura, A.T., Lee, D. and Uyar, M.U. (1991), “An optimization technique

for protocol conformance test generation based on UIO sequences and rural Chinese postman tours,” IEEE Trans. on Commun., 39 (11), pp. 1604-1615.

2. Alur, R., Courcoubetis, C. and Yannakakis, M. (1995), “Distinguishing tests for nondeterministic and probabilistic machines”, Proc. Twenty-Seventh Annual ACM Symposium on Theory of Computing, Las Vegas, Nevada, pp. 363-372.

3. Cheung, T. and Ye, X. (1995), “A fault-detection approach to the conformance testing of nondeterministic systems”, Journal of Parallel and Distributed Computing 28, pp. 94-100.

4. Chow, T.S. (1989), “Testing software design modeled by finite-state machines”, IEEE Trans. on Software Eng. 4 (3), pp. 178-187.

5. Fujiwara, S. and Bochmann, G.v. (1992), “Testing non-deterministic state machines with fault coverage”, Protocol Test Systems, IV, (J. Kroon, R.J. Heijink, and E. Brinksma eds.), pp. 267-280.

6. Khachiyan, L.G. (1979), “A polynomial algorithm in linear programming”, Soviet Math Dolk. 20, pp. 191-194.

7. Kloomsterman, H. (1993), “Test derivation from nondeterministic finite-state machines”, Protocol Test Systems V, (Bochmann, G.v., Dssouli, R. and Das, A. Eds.), North Holland, pp. 297-308.

8. Lee, D. and Yannakakis, M. (1996), “Principles and methods of testing finite state machines - a survey”, Proc. IEEE 84, pp. 1090-1126.

9. Low, S. (1993), “Probabilistic conformance testing of protocols with unobservable transitions”, Proc. Intl. Conf. on Network Protocols, pp. 368-375.

10. Luo, G., Bochmann, G.v., Das, A. and Wu, C. (1992), “Failure-equivalent transformation of transition systems to avoid internal actions”, Infor. Processing Letters 44, pp. 333-343.

11. Sabnani, K. and Dahbura, A. (1988), “A protocol test generation procedure”, Computer Networks and ISDN Systems 15, pp. 285-297.

12. Tripathy, P. and Naik, K. (1993), “Generation of adaptive test cases from nondeterministic finite state models”, Protocol Test Systems V, (Bochmann, G.v., Dssouli, R. and Das, A. Eds.), North Holland, pp. 309-320.

13. Ural, H., Wu, X. and Zhang, F. (1997), “On minimizing the lengths of checking sequences”, IEEE Trans. on Computers 46 (1), pp. 93-99.

14. Yi, W. and Larsen, K.G. (1992), “Testing probabilistic and nondeterministic processes”, Protocol Specification, Testing, and Verification XII, pp. 47-62.

15. Zhang, F and Cheung T.Y. (2002) “Optimal transfer trees and distinguishing trees for testing observable nondeterminstic finite-state machines”, IEEE Trans on Soft Eng, accepted.

104

BZ-TT: A Tool-Set for Test Generation from Z and

B using Constraint Logic Programming

F. Ambert, F. Bouquet, S. Chemin, S. Guenaud,

B. Legeard, F. Peureux, N. Vacelet

Universit�e de Franche-Comt�e, France

M. Utting

The University of Waikato, New Zealand

Abstract

In this paper, we present an environment for boundary-value test generationfrom Z and B speci�cations. The test generation method is original and wasdesigned on the basis of several industrial case-studies in the domain of criticalsoftware (Smart Card and transport areas). It is fully supported by a tool-set:the BZ-Testing-Tools environment. The method and tools are based on a novel,set-oriented, constraint logic programming technology. This paper focusses onhow this technology is used within the BZ-TT environment, how Z and Bspeci�cations are translated into constraints, and how the constraint solver isused to calculate boundary values and to search for sequences of operationsduring test generation.

Key words: Computer-Aided Software Testing Tool, Speci�cation-based test gen-eration, boundary value testing, B notation, Z notation

1 Introduction

From the end of the 1980's, speci�cation-based test generation has been a veryactive and productive research area. In particular, formal speci�cation has beenclearly recognized as a very powerful input for generating test data [BGM91, DF93,Tre96, FJJV96], as well as for oracle synthesis [RO92].

In [LPU02b], we presented a new approach for test generation from set-oriented,model-based speci�cations: the BZ-TT method. This method is based on constraintlogic programming (CLP) techniques. The goal is to test every operation of thesystem at every boundary state using all input boundary values of that operation.The unique features of the BZ-TT method are that it:

� takes both B [Abr96] and Z [Spi92] speci�cations as input;

� avoids the construction of a complete �nite state automaton (FSA) for thesystem;

� produces boundary-value test cases (both boundary states and boundary inputvalues);

� produces both negative and positive test cases;

105

� is fully supported by tools;

� has been validated in several industry case studies (GSM 11-11 smart cardsoftware [LP01, BLLP02], Java Card Virtual Machine Transaction mecha-nism [BJLP02], and a ticket validation algorithm in the transport industry[CGLP01]). The method is currently being used in another industrial projectto generate tests for an automobile windscreen wiper controller.

Integer Sequence

Solvers

BondaryValue

Relation Set

SequencesTest

Reducer

Executer

Tests sequences

GUI

ROT

ER

NEG

Test

A

N

TI

A

GUI

NO

M

A

I

GUI

Table FileScript

TestGeneration

Executable

Generator GeneratorIntermediate Form

Type−Checking

ParsingParsing

Type−Checking

Intermediate Form

FileB Source Z Source

File

Test sourceExecutable

Test Patern

File

Java Module

Sicstus Prolog Module

XML Format File

Source Format File

Intermediate Form FileBZP

CLPS−BZTESTBuilder

Table Generator

Figure 1: Overall Architecture of the BZ-TT Environment

Figure 1 shows the architecture of the BZ-TT environment. The key componentin this environment is the CLPS-BZ solver, which is used to calculate boundariesand simulate the execution of operations. It is this solver which enables the testgeneration process to be e�ectively automated. Furthermore, since it is a generalreasoning engine, whose input is a pre/post speci�cation format, it could poten-tially be used with notations other than Z or B, and for purposes other than testgeneration.

This paper describes how the CLPS-BZ solver is used to support the BZ-TTmethod of test generation and how it enables both Z and B speci�cations to berepresented as constraint systems. Section 2 gives an overview of the BZ-TT testgeneration method. Section 3 describes how Z and B speci�cations are mappedinto a common format: the BZP intermediate form. Section 4 describes the CLPS-BZ constraint solver, and how BZP predicates are represented as sets of constraints.Section 5 describes how the test generation modules use the CLPS-BZ solver. Section6 discusses related work; Section 7 gives conclusions and outlines future work.

106

2 Overview of the BZ-TT test generation method

Our goal is to test some implementation, which is not derived via re�nement fromthe formal model. The implementation is usually a state machine with hidden state.We specify this state machine by a B or Z formal speci�cation, which has a statespace (consisting of several state variables) and a number of operations that modifythis state.

A behavior of such a system can be described in terms of a sequence of operations(a trace) where the �rst is activated from the initial state of the machine. However,if the precondition of an operation is false, the e�ect of the operation is unknown,and any subsequent operations are of no interest, since it is impossible to determinethe state of the machine. Thus, we de�ne a positive test case to be any legal trace,i.e. any trace where all preconditions are true. A positive test case corresponds to asequence of system states presenting the value of each state variable after each oper-ation invocation. The submission of a legal trace is a success if all the output valuesreturned by the concrete implementation during the trace are equivalent (througha function of abstraction) to the output values returned by its speci�cation duringthe simulation of the same trace (or included in the set of possible values if thespeci�cation is non-deterministic). A negative test case is de�ned as a legal traceplus a �nal operation whose precondition is false. The generation of negative testcases is useful for robustness testing.

The BZ-TT method consists of testing the system when it is in a boundary state,which is a state where at least one state variable has a value at an extremum {minimum or maximum { of its sub-domains. At this boundary state, we want totest all the possible behaviors of the speci�cation. That is, the goal is to invoke eachupdate operation with extremum values of the sub-domains of the input parameters.The test engineer partitions the operations into update operations, which may modifythe system state, and observation operations, which may not.

We divide the trace constituting the test case into four subsequences:1

Preamble: this takes the system from its initial state to a boundary state.

Body: this invokes one update operation with input boundary values.

Identi�cation: this is a sequence of observation operations to enable a pass/failverdict to be assigned.

Postamble: this takes the system back to the boundary state, or to an initial state.This enables test cases to be concatenated.

The body part is the critical test invocation of the test case. Update operationsare used in the preamble, body and postamble, and observation operations in theidenti�cation part.

The BZ-TT generation method is de�ned by the following algorithm, wherefbound1; bound2; :::; boundng and fop1; op2; :::; opmg respectively de�ne the set of allboundary states and the set of all the update operations of the speci�cation:

1The vocabulary follows the ISO9646 standard [ISO].

107

for i 1 to n % for each boundary statepreamble(boundi); % reach the boundary statefor j 1 to m % for each update operation

body(opj); % test opjidentification; % observe the statepostamble(boundi); % return to the boundary state

endfor

postamble(init); % return to the initial stateendfor

This algorithm computes positive test cases with valid boundary input values atbody invocations. A set of one or more test cases, concatenated together, de�nes atest sequence. For negative test cases, the body part is generated with invalid inputboundary values, and no identi�cation or postamble parts are generated, becausethe system arrives at an indeterminate state from the formal model point of view.Instead, the test engineer must manually de�ne an oracle for negative test cases(typically something like the system terminates without crashing).

After positive and negative test cases are generated by this procedure, they areautomatically translated into executable test scripts, using a test script pattern anda rei�cation relation between the abstract and concrete operation names, inputs andoutputs.

3 The BZP intermediate form

B and Z have many similarities. They both support model-oriented speci�cation andthey have similar operator toolkits and type systems. The main di�erence betweenthem is that in Z the schema calculus is used to structure speci�cations and specifystates and operations in a exible way, whereas B provides an abstract programmingnotation (the generalized substitution language) for specifying operations, plus aspecialized machine construct for specifying hierarchies of state machines.

The BZ-TT environment supports both B and Z speci�cations by translatingthem into a common notation, called BZP (B/Z Prolog format). Since the underlyingCLPS-BZ solver manipulates constraints, which are restricted kinds of predicates,operations are speci�ed in BZP using pre/post predicates.

Figure 2 gives an overview of the translation process. The generation and dis-charge of well-formedness proofs for B is done using standard B tools (typicallybefore test generation begins). The B to BZP translator is written in Java, and usesthe rules from the B book [Abr96, Chap. 6] to translate the generalized substitutionlanguage into pre/post predicates. The �rst stage of the Z to BZP translator usesstandard Z tools, while the second stage is a speci�c translator.

For simplicity, and to improve the scalability of the test generation process, weimpose three restrictions on the input speci�cation. Firstly, it must specify a singlemachine. For B, this means that we allow only one abstract machine, withoutlayering etc. For Z, we must identify the state, initialization and operation schemasof the machine. Secondly, operations must have explicit preconditions. For Z thismeans preconditions must be calculated (either manually, or using a theorem prover)before translation. This is good engineering practice anyway. In B, operationsusually have explicit preconditions, but it is possible for the precondition to bedistributed throughout the operation. We require the entire precondition to appearat the beginning of the operation, and also require this precondition to be strong

108

enough to ensure that the operation is feasible. Third, all the data structures mustbe �nite, which means that the given sets are either enumerated or of a known �nitecardinality. If everything is �nite, then all speci�cations are executable (by labellingif necessary).

B Specification Z specification

BZP File

Z + explicit preconds

pre/post format;Translation to

Typechecking;

Translation toBZP syntax

Well−formednessand feasibility proofs

Typechecking;

Precondition calculation

BZP syntaxTranslation to

Schema expansion;

Figure 2: Translation of B and Z speci�cations into common BZP format.

The BZP format is a Prolog-readable syntax which supports the union of theB and Z toolkits and provides special constructs for de�ning state machines andoperations. The syntax of expressions and predicates is similar to the Atelier-BASCII notation for B (*.mch syntax). A BZP speci�cation contains an unorderedset of facts, each of which has one of the following forms:

speci�cation(Spec Name):predicat(Spec Name;PREDICAT KIND ; ID ;Pred):declaration(Spec Name;DECL KIND ;Name;Type):operation(Spec Name;Operation Name):

The ID terms are used only for reporting errors, and are typically the line numberwhere that predicate appeared in the original speci�cation source.

The PREDICAT KIND and DECL KIND terms relate each fact to some sectionof the original B machine (and similar constructs in Z), and are de�ned as follows.PREDICATE KIND indicates the role of the predicate, and must be one of theconstants: constraint, property, invariant, initialisation, assertion or oneof the terms pre(OpName) or post(OpName).

Similarly, DECL KIND indicates what kind of name is being declared, and mustbe one of the constants: parameter, set, constant, variable, definition or oneof the terms input(OpName) or output(OpName). For definition, the type is asingleton set containing the right-hand-side of the de�nition.

Invariants have di�erent roles in B and Z. This di�erence is visible in the resultingBZP �le, since when we translate a Z operation, we include the (primed) invariantin its postcondition because it often contributes to the e�ect of the operation, butwhen we translate a B operation we do not include the invariant. However, the well-formedness proofs for a B machine check that every operation preserves the invariant,so discharging these proofs ensures that the B and Z approaches are equivalent.

To illustrate how Z speci�cations are translated to BZP format, we translate thefollowing fragment of a simple process scheduler [DF93]

PID ::= p1 j p2 j p3 j p4

109

Scheduleractive; ready ;waiting : F PID

#active � 1ready \ waiting = ;active \ waiting = ;active \ ready = ;(active = ;)) (ready = ;)

New�Schedulerpp? : PID

pp? =2 active [ ready [ waitingwaiting 0 = waiting [ fpp?gready 0 = readyactive 0 = active

The declaration of PID and the state schema produce:

machine(scheduler).

declaration(scheduler, set, pid, {p1, p2, p3, p4}).

declaration(scheduler, variable, ready, power(pid)).

declaration(scheduler, variable, active, power(pid)).

declaration(scheduler, variable, waiting, power(pid)).

predicat(scheduler, invariant, 3 , card(active) =< 1).

predicat(scheduler, invariant, 4 , ready /\ waiting = {}).

predicat(scheduler, invariant, 5 , active /\ waiting = {}).

predicat(scheduler, invariant, 6 , active /\ ready = {}).

predicat(scheduler, invariant, 7 , (active = {}) => (ready ={})).

The New operation produces:

operation(scheduler, new).

declaration(scheduler,input(new), pp, pid).

predicat(scheduler, pre(new), 10 , pp /: active \/ ready \/ waiting).

predicat(scheduler, post(new), 11 , prime(waiting) = waiting \/ {pp} ).

predicat(scheduler, post(new), 12 , prime(ready) = ready).

predicat(scheduler, post(new), 13 , prime(active) = active).

predicat(scheduler, post(new), 3 , card(prime(active)) =< 1).

predicat(scheduler, post(new), 4 , prime(ready) /\ prime(waiting) = {}).

predicat(scheduler, post(new), 5 , prime(active) /\ prime(waiting) = {}).

predicat(scheduler, post(new), 6 , prime(active) /\ prime(ready) = {}).

predicat(scheduler, post(new), 7 , (prime(active) = {}) => (prime(ready) ={})).

4 The CLPS-BZ solver

The CLPS-BZ solver is implemented in SICStus Prolog, and is comprised of threesubsystems:

The Executer: which manages the execution of the speci�ed machine. The Exe-cuter obtains predicates from the BZP speci�cation, and passes them to theother modules to achieve the e�ect of executing the desired operation.

110

The Reducer: which translates BZP predicates into lower-level constraints.

The Constraint Store: which records the current state of the speci�ed machineafter some sequence of operations. In fact, we use symbolic execution, so asingle constraint store typically corresponds to many possible concrete statesof the speci�ed machine.

We now describe these three subsystems, in a bottom-up fashion.

4.1 The Constraint Store

The CLPS-BZ solver manages a constraint store, which encodes a predicate (or aset of states) over the variables of the formal model. The constraint store containsboth set-oriented constraints and �nite domain (integer) constraints. The formerare managed by a customized set-constraint solver called CLPS, while the latter aremanaged by the SICStus Prolog CLP(FD) solver. In this section we focus only onthe set part of the store (CLPS).

The CLPS solver was originally developed for solving combinatorial problems,and is designed to work on homogeneous hereditary �nite sets [ALL96]. It provides�ve primitive constraint relations, which are the classical set relations, 2; 62;�;=; 6=,and three operators ([;\; n). It also provides the cardinality operator, which isimportant because it links the set constraints to the numerical constraints. Cardi-nality constraints are one way that information propagates between the CLPS andCLP(FD) solvers. The API of the solver includes procedures for adding each kindof primitive constraint, query procedures for �nding information about the domainsof variables, and labelling procedures for iterating through all possible values of agiven variable.

Internally, the CLPS solver represents the domain of each variable using one ormore of the following representations: unde�ned, min-max (bounded) and enumer-ated. Initially, the domain of a new domain variable (say X ) is set to unde�ned.When a membership constraint (e.g., X 2 PID) is added, an enumerated domainis used to record all the possible values that X can take. When a subset constraint(e.g., X � Expr or Expr � X ) , a min-max domain is used to record the lowerbound and upper bound of X .

Usually in Constraint Satisfaction Problems (CSP), solvers allow only valueddomains, where domains are sets of values. CLPS extends this by introducing thenotion of V-CSP [BLP02], which allows variables to appear in the domains of othervariables. This means that more complex rules are needed to manipulate thesesymbolic domains, but the advantage is that a higher level of abstraction can beachieved. CLPS allows variables within min-max domains and within enumerateddomains under the condition that all elements are di�erent in a variable domain.When two variables are uni�ed, the intersection of their valued domains can becalculated immediately. However, for the variable domains representation, it is notalways possible to combine the two symbolic domains, so the variable domain storesa set of domains and the true domain of the variable is the intersection of thesedomains.

The execution model of CLPS can be viewed as a transition system, where tran-sitions represent reduction, inference and consistency rules [JM94]. The consistencyalgorithm used by CLPS ensures partial consistency, using on one hand the domainrepresentations, and on the other hand the constraints store. To maintain domainconsistency, CLPS combines arc-consistency techniques derived from AC3 [Mac77]and interval-narrowing over valued domains. So it is possible to have some elements

111

in domains not removed by these techniques, because only couple of variables arechecked. The solver uses similar methods to reduce variable domains except thatinstead of manipulating one domain per variable, it manipulates a conjunction ofdomains (enumerated and min-max).

The constraint store is used for two purposes. Firstly, it allows the propagationof domain reductions, which enables consequences of constraints to be deduced. Sec-ondly, it allows the solver to detect some semantic inconsistencies, which is crucial forpruning the search space. The following example shows how propagation works whenconstraints are acquired by the solver. In this example, B ;C ;D ;G ;X ;Y are vari-ables, Val DomX represents values included in the valued domain and Var DomX

represents the conjunction of variable domains.

Acquired constraints Val DomX Var DomX

1 X 2 fB ;C ;D ;Y g undef ffB ;C ;D;Y gg

2 X 2 fB ;C ;D ; 2g undef ffB ;C ;D;Y g; fB ;C ;D; 2gg

3 X 2 f3; 4;Gg undef ffB ;C ;D;Y g; fB ;C ;D; 2g; f3; 4;Ggg

4 X 2 f1; 2; 3; 4g f1; 2; 3; 4g ffB ;C ;D;Y g; fB ;C ;D; 2g; f3; 4;Ggg

5 Y 6= X f1; 3; 4g ffB ;C ;Dg; f3; 4;Ggg

6 G = 5 f3; 4g ffB ;C ;Dgg

Constraints from line 1 to line 4 build up variable domains and the valued domainfor X . On line 5, one of the variable domains is reduced from fB ;C ;D ;Y g tofB ;C ;Dg. When a domain is included in another domain, the solver uses thefollowing rule: V 2 Dom1;V 2 Dom2;Dom1 � Dom2;T = Dom2 nDom1 ) V 62 T .In this case, due to the fact that all elements are di�erent in a variable domain, itinfers X 62 f2g, which is equivalent to X 6= 2. On line 6, one of the variable domainsbecomes valued, which causes the valued domain to be recalculated by intersection:Dom ValX = f1; 2; 3; 4g \ f3; 4; 5g.

After all 6 constraints have been added, we can conclude that X = 3 or X = 4,and that at least one of B , C or D must also equal 3 or 4. If a unique solutionis not obtained after all constraints have been added, a user of CLPS-BZ typicallyuses the labelling procedures to explore the possible solutions, one at a time.

4.2 The Reducer

The Reducer reduces BZP predicates into the basic constraints of the solver CLPS.The most important procedure in the reducer API is add(P), which conjoins thepredicate P with the current constraint store, by reducing P into primitive con-straints which are added into the constraint store. The reducer API also includesprocedures for adding and deleting variables, so that the association between eachspeci�cation variable and the corresponding Prolog constraint variable can be main-tained.

The reduction of predicates to constraints is speci�ed by a function �, whichtakes a predicate as input, and returns a constraint as output. Generally, we have:

�(Expression1 Operator Expression2) =�(Expression1) Constraint Operator �(Expression2)

In the Process Scheduler example, the precondition of the New operation ispp /: active n/ ready n/ waiting. This can be translated into constraints as follows( Active, Ready, Waiting, PP are Prolog variables that represent the constrainedvalues of the speci�cation variables active, ready, waiting and pp).

112

�( pp /: active n/ ready n/ waiting)= �( pp) nin �(active n/ ready n/ waiting))= PP nin �(active) union �(ready n/ waiting)= PP nin Active union �(ready) union �(waiting)= PP nin Active union Ready union Waiting

where \nin" and \union" are operators of the solver CLPS. They respectivelyrepresent non membership and the union of two constrained values.

4.3 The Executer

The Executer is used to animate a machine speci�ed in a BZP �le. The executerAPI provides commands for loading a particular BZP �le, initializing the machinespeci�ed in that �le, and executing the operations of that machine.

To initialize a machine, it simply declares all the state variables of the machinethen sends all the initialization predicates to the reducer.

The execution of an operation takes place in two stages:

� validation of preconditions, then

� execution of postconditions.

First, all the precondition predicates are added. If no inconsistencies are found,all the postcondition predicates are added, and the primed state variables becomethe new machine state. If inconsistencies are found, the operation is not executed.

5 The Test Generation Modules

The generation of boundary Goal is performed in two main stages. The �rst iscomputed a set of boundary goals from the Disjunctive Normal Form (DNF) ofthe speci�cation, The secound is instantiated each boundary goal into a reachableboundary state. Finally, the boundary states of the speci�cation are used as a basisto generate test cases.

5.1 Generation of Boundary Goals

For test generation purposes, the postcondition of each operation is transformed intoDNF, obtaining

Wj Postj (op). The DNF transformation is not in general purpose,

but only computes one by one operation and the conditions described in it. Thenwe project each of these disjuncts onto the input state, using the formula [LPU02b]:

(9 inputs ; state 0; outputs � Pre ^ Postj )

We call these state subsets precondition sub-domains. The aim of boundary goalgeneration is to �nd boundaries within each of these precondition sub-domains.

In practice, the CLPS-BZ solver reduces each sub-domain to a set of constraints.For example, when the New operation of the Process Scheduler example is translatedto BZP format, and each of its precondition and postcondition is transformed intoDNF, we get the following predicates:

pre(new)1 == pp 62 waiting [ ready [ activepost(new)1 == prime(waiting) = waiting [ fppg ^

prime(ready) = ready ^ prime(active) = active ^ :: ^prime(active) = fg ) prime(ready) = fg

113

which is reduced by the BZ-TT solver to the predicate PS such that:PS == fInv ^ #(waiting [ ready [ active) < #PIDg

We compute boundary goals on the basis of the partition analysis by minimiza-tion and maximization using a suitable metric function chosen by the test engineer.(e.g., minimize or maximize the sum of the cardinalities of the sets). Accordingto the optimization function, this results in one or several minimal and maximalboundary goals for each predicate.

Given the invariant properties Inv , a precondition subdomain predicate PSi , avector of variables Vi which comprises all the free state variables within PSi , and fan optimization function, the boundary goals are computed as follows:

BGmini = minimize(f (Vi ); Inv ^ PSi )

BGmaxi = maximize(f (Vi ); Inv ^ PSi )

The optimization function f (Vi ), where Vi is a vector of variables v1 : : : vm , isde�ned as g1(v1)+ g2(v2)+ : : :+ gm(vm), where each function gi is chosen accordingto the type of the variable vi .

For example, from the predicate PS of the process scheduler example, bound-ary goals BGmin and BGmax are computed with the optimization function f (Vi ) =P

v2Vi#v2. The result of constraint solving is a set of constraints on the cardinal-

ities of the set variables waiting , ready and active such that: BGmin = fwaiting =fg ^ ready = fg ^ active = fgg, and BGmax = fwaiting = fX1g ^ ready = fX2g ^active = fX3gg where (8 i � Xi 2 fp1; p2; p3; p4g) and (8 i � i 6= j ) Xi 6= Xj ).It should be noted that other optimization functions could be used (

Pv2Vi

#v ,P

v2Vi

pv ,...).

5.2 Test Construction

This section describes the generation process of each test case, which is comprisedof a preamble, a body, an identi�cation and a postamble part [LP01].

5.2.1 Preamble Computation

Each boundary goal is instantiated to one or more reachable boundary states byexploring the reachable states of the system, starting from the initial state. TheCLPS-BZ solver is used to simulate the execution of the system, recording the set ofpossible solutions after each operation. A best-�rst search [Pre01] is used to try toreach a boundary state that satis�es a given boundary goal. Preamble computationcan thus be viewed as a traversal of the reachability graph, whose nodes representthe constrained states built during the simulation, and whose transitions representan operation invocation. A consequence of this path computation is that statevariables which are not already assigned a value by the boundary goal, are assigneda reachable value of their domain.

Some boundary goals may not be reachable via the available operations (this hap-pens when the invariant is weaker than it could be). By construction, every boundarygoal satis�es the invariant, which is a partial reachability check. In addition to this,we bind the search for the boundary state during the preamble computation, sothat unreachable boundary goals (and perhaps some reachable goals) are reportedto the test engineer as being unreachable. If all boundary goals in a preconditionsub-domain PS are unreachable, we relax our boundary testing criterion and searchfor any preamble that reaches a state satisfying PS . Finally, the test engineer can

114

add and delete boundary goals, to customize the test generation, or to satisfy othertest objectives.

5.2.2 Input Variable Boundary Analysis and Body Computation

The purpose of the body computation, or critical test invocation, is to test, for a givenboundary state (a preamble), all the update operations, with all boundary valuesof their input variables. For the boundary values which satisfy the precondition,we get a positive test case, otherwise we get a negative test case. Note that, fromthe same preamble and boundary state, several bodies are usually obtained for eachoperation, with di�ering input values.

The process of boundary analysis for input variables is similar to that for statevariables, except that invalid input values are kept, which is not the case for unreach-able boundary states. Given an operation Op with a set of input variables Ii and aprecondition Pre, let BGi be a boundary goal. Note that BGi is a set of constraintsover the state variables, typically giving a value to each state variable. Then, given fan optimization function chosen by the test engineer, the input variable boundariesare computed as follows:

{ for positive test cases:minimize(f (Ii );Pre ^ BGi )maximize(f (Ii );Pre ^ BGi )

{ for negative test cases:minimize(f (Ii );:Pre ^ BGi )maximize(f (Ii );:Pre ^ BGi )

5.2.3 Identi�cation and Postamble

The identi�cation part of a test case is simply a sequence of all observation opera-tions whose preconditions are true after the body. The postamble part is computedsimilarly to the preamble, using best-�rst search.

6 Related work

The BZ-TT proposal follows an important stream of work in test generation fromformal speci�cation, particularly from model-based speci�cation. But despite theenormous popularity of boundary-value testing strategy for black-box testing inthe software practitioner guides, this approach has not been widely investigatedfor automatic speci�cation-based test generation. But boundary-value analysis isrelated to partition analysis which has been the subject of systematic research sincethe early testing literature [Mye79] [WO80] [OB88].

Dick and Faivre [DF93] present an approach for partition analysis by computinga Disjunctive Normal Form - DNF - both for input variables and system states.The idea of automatic partition analysis was already present in the work of Gaudelet. al. [BGM91, DGM93] by unfolding axioms from an algebraic speci�cation. InTTF [Sto93, CS94], and extensions of it [PA01], partition analysis and DNF trans-formation are used as heuristics for manually de�ning test templates. In [LPU02a],we present a precise comparison between BZ-TT and TTF on the basis of the GSM11-11 Standard case-study.

Various works [DF93, HP95, vABlM97, Hie97], use the partition analysis to builda Finite State Automaton - FSA - corresponding to an abstraction of the reachabilitygraph denoted by the speci�cation. Test cases are then generated by �nding a

115

path (or several) \which traverses every transition with the minimum number ofrepetitions" [DF93]. Unfortunately, this method is not easily automated, because itis diÆcult to choose an appropriate abstraction of the state space to generate theFSA. In the BZ-TT approach, due to the transformation of the B or Z speci�cationinto a constraint system, the FSA is never explicitly computed.

During the last few years, the use of constraint logic programming for test gen-eration has seen growing interest [Pre01]. For code-based test generation, Gotliebet. al. [GBR00] present a framework where a system of constraints is built from aStatic Single Assignment form of the source code (for C programs). The resolutionof the constraint system allows �nding a path in the control ow graph to sensitizea given point (statement or decision) in the source code. Meudec [Meu01] uses CLPfor symbolic execution of Ada code in order to generate tests. In speci�cation-basedtest generation, Marre et. al. [MA00] interpret LUSTRE speci�cations in terms ofconstraints over boolean and integer variables and solve them to generate test se-quences. Pretschner et. al. [PL01] translate System Structure Diagrams and StateTransition Diagrams into Prolog rules and constraints to allow symbolic executionof the speci�cations and thus test generation. Van Aertryck et. al. [vABlM97] useDNF and constraint solving to generate an FSA and test sequences from a B-likespeci�cation, but this is not fully automated. Mostly, these techniques use existingconstraint solvers (Boolean and �nite domains in general). In BZ-TT, due to thespeci�city of set oriented notations of Z and B, we developed an original solver ableto treat constraints over sets, relations and mappings. This solver co-operates withthe integer �nite domain solver.

7 Conclusions and future work

We have presented an environment for automatic boundary-value testing from set-oriented formal speci�cation notation. This environment is strongly based on aconstraint technology which o�ers specialized support for the B and Z toolkits (sets,relations, functions and sequences).

The major advantage of using this constraint technology is that it dramaticallyreduces the size of the search spaces during test generation, which allows the methodto scale to larger applications.

Firstly, the constraint technology enables boundary goals to be found more ef-�ciently, due to the constraint representation, which is based on min/max intervaldomain representation (both for sets and numeric variables). This means that somemax/min limits can be obtained directly from the constraint store, without search.Even when labelling is used, the search space is reduced because the constraintsystem prunes the search tree.

Secondly, the boundary goals that we obtain are also a set of constraints, ratherthan a speci�c value for each variable. Typically, some key variables will haveextremum values, but others will just be constrained. This allows the boundarygoals to be more abstract, which makes it easier to �nd a preamble that reachesthe goal. In other words, the constraint approach avoids premature commitment toprecise values for every state variable, which could result in choosing unreachablestates.

Thirdly, the search for a preamble is reduced in complexity. At each point duringthe best-�rst search, we must still consider every operation, but with constraints itis not necessary to consider every input value to each operation, because the entireset of allowable inputs can be represented as a set of constraints.

116

These three reductions in search space give this boundary-value test generationmethod good scalability, and allow us to handle applications that would not bepossible without the constraint technology.

Typically, the number of boundary goals (and thus preambles) generated is pro-portional to the number of operations, while the number of tests generated is pro-portional to the square of the number of operations (because we try to test eachoperation at every preamble). The time taken to produce each test is more diÆ-cult to predict, because it depends upon the complexity of the constraints and theaverage length of each preamble. The �rst factor is bounded by the worst case com-plexity of the CLPS-BZ solver, which is n2 �nd � d [BLP02], where n is the numberof variables, nd is the highest number of sub-domains and d is the size of the largestdomain. The second factor depends upon how easily each boundary goal can bereached, which is highly speci�cation dependent.

In the realistic industry case studies that we have completed, the speci�cationswere quite complex, but the test generation time was acceptable on a typical per-sonal computer. For example, in a recent case study on the Java Card transactionmechanism [BJLP02], the 15 page B speci�cation contained 20 operations and 15state variables, where some state variables had sizable domains, such as the backupmemory variable, which was a total function from addresses (0 : : 255) to bytes.In this case study, 60 boundary goals were computed, producing around 4500 testsequences, taking around 15 hours of computation time on a 1GHz Pentium.

We have also used this technology to generate tests for other smart card ap-plications. In the GSM 11-11 standard case study [LP01, BLLP02], the �ve pagespeci�cation contained 11 operations and 12 variables, and produced 38 boundarygoals and around 1000 tests, with a computation time of 50 minutes. In the trans-port ticket validation algorithm [CGLP01], there was only one operation, but it wascomplex (5 pages) with 15 variables, and generated around 100 test cases in 20 min-utes. The number of test are huge but one human test must be 5 to 10 automatictests.

Until now, the BZ-TT environment has been usable only by the developmentteam, because it lacked user interfaces and integration between components. How-ever, we are currently developing Java interfaces for animation and test generationand consolidating the CLPS-BZ solver and the overall environment. The objectiveis to produce a beta release for Windows and Linux by the end of 2002, under afree license for academic use. See the BZ-TT website [BZT02] for updated releaseinformation.

In the future, we will be focusing on several areas:

� Supporting the full B and Z notation, such as parts of the toolkits that arecurrently missing (sequences, trees etc.) and layered machines in B.

� Extending the CLPS-BZ solver for continuous domains to be able to addressproblems with real or oating variables.

� Extending the solver and the BZP notation to support other speci�cationnotations, such as state charts and the UML object constraint language (OCL).

Acknowledgment

This research was supported in part by a grant of the French ANVAR - AgenceNationale de Valorisation des Actions de Recherche. The visits of Mark Utting aresupported under the French/New Zealand scienti�c cooperation program.

117

References

[Abr96] J-R. Abrial. The B-BOOK: Assigning Programs to Meanings. Cambridge UniversityPress, 1996. ISBN 0 521 49619 5.

[ALL96] F. Ambert, B. Legeard, and E. Legros. Programmation en logique avec contraintessur ensembles et multi-ensembles h�er�editairement �nis. Technique et Science Informa-tiques, 15(3):297{328, 1996.

[BGM91] G. Bernot, M-C. Gaudel, and B. Marre. Software testing based on formal speci�cations:a theory and a tool. Software Engineering Journal, 6(6):387{405, November 1991.

[BJLP02] F. Bouquet, J. Julliand, B. Legeard, and F. Peureux. Automatic reconstruction andgeneration of functional test patterns - application to the Java card transaction mech-anism (con�dential). Technical Report TR-01/02, LIFC - University of Franche-Comt�eand Schlumberger Montrouge Product Center, 2002.

[BLLP02] E. Bernard, B. Legeard, X. Luck, and F. Peureux. Generation of test sequences fromformal speci�cations: GSM 11.11 standard case-study. Submitted to the Journal ofSoftware Practice and Experience, 2002.

[BLP02] F. Bouquet, B. Legeard, and F. Peureux. CLPS-B { A constraint solver for B. In Pro-ceedings of the conference on Tools and Algorithms for the Construction and Analysisof Systems (TACAS'02), Grenoble, France, April 2002.

[BZT02] The BZ-TT web site. http://lifc.univ-fcomte.fr/RECHERCHE/TFC/Page_BZ-TT.

html, April 2002.

[CGLP01] N. Caritey, L. Gaspari, B. Legeard, and F. Peureux. Speci�cation-based testing {Application on algorithms of Metro and RER tickets (con�dential). Technical ReportTR-03/01, LIFC - University of Franche-Comt�e and Schlumberger Besanon, 2001.

[CS94] D.A. Carrington and P.A. Stocks. A tale of two paradigms: formal methods andsoftware testing. In Proceedings of the Z user workshop (8th Z User Meeting), pages51{68, Cambridge, June 1994.

[DF93] J. Dick and A. Faivre. Automating the generation and sequencing of test casesfrom model-based speci�cations. FME'93: Industrial-Strength Formal Methods, LNCS670:268{284, April 1993.

[DGM93] P. Dauchy, M-C. Gaudel, and B. Marre. Using Algebraic Speci�cations in SoftwareTesting : A case study on the software of an automatic subway. Journal of Systemsand Software, 21(3):229{244, June 1993.

[FJJV96] J-C. Fernandez, C. Jard, T. J�eron, and G. Viho. Using on-the- y veri�cation techniquesfor the generation of test suites. In Computed Aided Veri�cation (CAV'96), volumeLNCS 1102, New Brunswick, New Jersey, July 1996. Springer-Verlag.

[GBR00] A. Gotlieb, B. Botella, and M. Rueher. A CLP framework for computing structuraltest data. In Springer-Verlag, editor, Proceedings of the First International Conferenceon Computational Logic (CL'00), pages 399{413, London, UK, July 2000.

[Hie97] R. Hierons. Testing from a Z speci�cation. The Journal of Software Testing, Veri�ca-tion and Reliability, 7:19{33, 1997.

[HP95] H.M. H�orcher and J. Peleska. Using formal speci�cations to support software testing.Software Quality Journal, 4(4):309{327, 1995.

[ISO] ISO. Information Processing Systems, Open Systems Interconnection. OSI Confor-mance Testing Methodology and Framework { ISO 9646.

[JM94] J. Ja�ar and M.J. Maher. Constraint logic programming : A survey. Journal of LogicProgramming, 19/20:503{582, May/July 1994.

[LP01] B. Legeard and F. Peureux. Generation of functional test sequences from B formalspeci�cations { Presentation and industrial case-study. In 16th IEEE InternationalConference on Automated Software Engineering (ASE'01), San Diego, USA, November2001.

[LPU02a] B. Legeard, F. Peureux, and M. Utting. A comparison of the BTT and TTF test-generation methods. In ZB2002: Formal Speci�cation and Development in Z and B,volume LCNS 2272, pages 309{329, Grenoble, France, January 2002. Springer-Verlag.

[LPU02b] B. Legeard, F. Peureux, and M. Utting. Automated boundary testing from Z and B.In Lars-Henrik Eriksson and Peter Lindsay, editors, Formal Methods Europe, 2002,LNCS. Springer-Verlag, July 2002. To be published.

118

[MA00] B. Marre and A. Arnould. Test Sequence generation from Lustre descriptions: GATEL.In Proceedings of the 15th IEEE International Conference on Automated SoftwareEngineering (ASE'00), pages 229{237, Grenoble, France, 2000.

[Mac77] A.K. Macworth. Consistency in network of relations. Journal of Arti�cial Intelligence,8(1):99{118, 1977.

[Meu01] C. Meudec. ATGEN: Automatic test data generation using constraint logic program-ming and symbolic execution. The Journal of Software Testing, Veri�cation and Re-liability, 11(2):81{96, 2001.

[Mye79] G.J. Myers. The Art of Software Testing. Wiley-InterScience, 1979.

[OB88] T.J. Ostrand and M.J. Balcer. The Category-Partition Method for Specifying andGeneration Functional Test. Proceedings of the ACM Conference, 31(6):676{686, June1988.

[PA01] K. Periyasamy and V.S. Alagar. A rigorous method for test templates generationfrom object-oriented speci�cations. The Journal of Software Testing, Veri�cation andReliability, 11(1):3{37, 2001.

[PL01] A. Pretschner and H. L�otzbeyer. Model Based Testing with Constraint Logic pro-gramming : First Results and Challenges. In Proceedings of the 2nd ICSE Workshopon Automated program Analysis, Testing and Veri�cation (WAPATV'01), pages 1{9,may 2001.

[Pre01] A. Pretschner. Classical search strategies for test case generation with Constraint LogicProgramming. In BRICS, editor, Proceedings of the Workshop on Formal Approachesto Testing of Software (FATES'01), pages 47{60, Aalborg, Denmark, August 2001.

[RO92] D.J. Richardson and S.L. Aha T.O. O'Malley. Speci�cation-based test oracles forreactive systems. In Proceedings of the 14th International Conference on SoftwareEngineering (ICSE'92), pages 105{118, Melbourne, Australia, May 1992. ACM Press.

[Spi92] J.M. Spivey. The Z notation: A Reference Manual. Prentice-Hall, 2nd edition, 1992.ISBN 0 13 978529 9.

[Sto93] P. Stocks. Applying Formal Methods for Software Testing. Phd thesis, The Universityof Queensland, 1993.

[Tre96] J. Tretmans. Test generation with inputs, outputs and repetitive quiescence. Software-Concepts and Tools, 17(3):103{120, 1996.

[vABlM97] L. van Aertryck, M. Benveniste, and D. le Metayer. CASTING: a formally basedsoftware test generation method. In 1st IEEE International Conference on FormalEngineering Methods (ICFEM'97), pages 99{112, 1997.

[WO80] E.J. Weyuker and T.J. Ostrand. Theories of program testing and the application ofrevealing subdomains. IEEE Transactions in Software Engineering, 6(3):236{246, May1980.

119

Using a Virtual Reality Environment to GenerateTest Specifications

Stefan Bisanz Aliki Tsiolakis

University of Bremen, Germany{bisanz,tsio}@informatik.uni-bremen.de

Abstract

The creation of test specifications that can be used for automated testing re-quires considerable skill in the field of formal methods. This article proposesa method that enables the development of test specifications by interactionwith a virtual reality representation of the system under test. From theseinteractions, a formal test specification is generated. Its goal is to reduce theneed for formal methods expertise and therefore concentrates on the knowl-edge of the application to be tested. It addresses domain experts who are notfamiliar with formal methods.

In this article, the character of the virtual reality model as well as its cre-ation are discussed. Further, the generation of test specifications is explained.Statecharts are used as formal specification language for the result of thegeneration step.

1 Introduction

Testing embedded real-time systems is a complex and time-consuming task and thusa high level of automation is advisory. Ideally, the test team receives a completeand consistent system specification in a formal specification language. By use of atest tool, the automatic generation of test cases, the automatic execution of the testand the automatic evaluation can be supported based on this specification. Thisidea relies on two main preconditions: On the one hand, the existence of a formalsystem specification developed by the domain experts and, on the other hand, onthe availability of an appropriate test tool.

However, most system specifications are informal, natural language descriptions ofthe system’s behaviour and the test experts have to develop the necessary test spec-ifications manually based on these system specifications. Since the formal specifica-tions require considerable skills in the field of formal methods, the domain expertscan usually not generate the test specifications themselves. Nevertheless, approriate

121

test tools can be found. For example, RT Tester1 supports automatic test gener-ation, execution and evaluation based on formal test specifications in Timed CSP.These Timed CSP specifications are then translated into labelled transition systems(LTS). RT Tester has been applied in many application areas – from avionics torailway controllers.

Thus, the process of automatic test execution and evaluation is sufficiently sup-ported by existing test tools. To fill the gap, we want to introduce a new approachof generating formal test specifications by interacting with a virtual reality repre-sentation of the system under test (SUT) called the Virtual Periphery. The VirtualPeriphery represents the functional interface of the SUT embedded into its envi-ronment. For example, consider as a SUT the fasten-seatbelt signs in an airplanethat can be switched on or off automatically depending on the status of specificsensors or manually by a dedicated switch in the cockpit. The functional interfaceconsists of interface objects like signs, switches or sensors which are representedas interactive objects in the Virtual Periphery. The additional non-interactive ob-jects constitute the geometry that is not of functional relevance to the SUT butserve to model the SUT’s environment. To specify that the fasten-seatbelt signsare switched on by toggling the switch, one has to interact with the correspondinginterface objects. Thus, the approach assists the domain experts intuitively duringthe specification process because the interaction’s semantics can easily be learned.Interactions with VR components are mapped to specification fragments of a formalspecification language that can be composed into the complete test specification.

Nevertheless, this basic Virtual Periphery is not sufficient to specify specific con-cepts, e. g., parallelism, or alternative interactions. For example, it is not possibleto express by these interactions that all fasten-seatbelt signs have to be switchedon in parallel because it is not possible to perform several simultaneous actions inthe Virtual Periphery. To reduce this drawback, it is necessary to enhance the Vir-tual Periphery with visual representations of commands, graphical menues, gestureinteractions, or voice commands. Furthermore, the Virtual Periphery only reflectsthe ”present point in time” while it is not possible to investigate the history of pastinteractions or the potential future events. In order to overcome this, we have cho-sen statecharts as a formal but as well graphical specification technique. Statechartsprovide an alternative view on the test specification fragments and facilitate theirunderstanding. This choice has essential impact on our specification approach be-cause, on the one hand, it affects the semantics of the VR interactions and, on theother hand, it defines the maximum expressive power of the resulting specifications.

In the next section, we give a detailed overview about the Virtual Periphery andsome possible enhancements. The representation of the test specification fragmentsas statecharts is described in section 3. Section 4 refers to the integration of thegenerated statechart specifications with RT Tester. In section 5, we discuss ways toautomatically generate the Virtual Periphery.

1RT Tester has been developed by Verified Systems International GmbH(http://www.verified.de) in cooperation with University of Bremen.

122

http://www.verified.de

2 Virtual Periphery

The Virtual Periphery is an incomplete simulation model of the SUT, i. e., it is amodel of the real world that only contains those objects that are relevant for theSUT’s interface. Additional non-functional geometry enriches the Virtual Peripheryand serves to model the SUT’s environment such that it resembles the real world.The interface objects consume inputs (e. g., switches, buttons, sensors), yield output(e. g., signs, loudspeakers) or process input as well as generate output (e. g., touchscreens, buttons with back light). Each interface object can be in a number ofdifferent states, and only specific state changes are possible. For example, a specifictwo-state toggle’s states are on and off, and a specific indicator can yield thestates red, yellow and green. Each interface object is associated with specificattributes which include the interface object’s type. Returning to our previousexample, the fasten-seatbelt signs in an airplane denote a specific type of sign whichhas the attributes seat row and aisle. Thus, specific objects of the same type canbe identified. Furthermore, similar interface objects can be grouped, e. g., applyingthe condition type = "Fasten-Seatbelt Sign" and seat row > 20 and aisle

= left identifies all interface objects of type Fasten-Seatbelt Sign in the left aisle ofan aircraft at seat row 21 or higher.

As interface objects of the same type share geometry, possible states and attributes,interface object templates can be provided by interface object libraries. Generalpurpose libraries contain general switches, indicators, etc. while domain specificinterface objects (e. g., the fasten-seatbelt signs) are defined in domain specific li-braries. The interface object templates and thus the libraries are modelled manuallyand are utilised within the Virtual Periphery creation process (see section 5).

The use of our Virtual Periphery exceeds simple simulation. By interacting withinterface objects the user generates test specification fragments. This means thatspecific state changes in one input interface object are reflected in state changes ofother output (or input/output) objects. More precisely, the state changes in theinput interfaces are initiated by interactions and are used as stimuli for the SUT.The expected reaction is represented by the correct output.

Interaction with interface objects takes place by navigating a 3D cursor that lookslike a human hand. By touching an interface object (i. e., more exactly by collidingthe 3D cursor with it), it gets selected for further interactions. Moving or rotatingthe 3D cursor generates a basic test specification element.2 What movement orrotation is appropriate depends on the type of the selected interface object, butit should conform to the direct manipulation metaphor. This direct manipulationchanges the interface object’s state and its visual representation. For example, atoggle switch changes its state according to the rotation direction: the movement ofthe 3D cursor’s fingertips chooses which part of the toggle switch is pressed down.Figure 1 shows a 3D cursor and three-state toggle switches in the cockpit of anairplane. For an introduction to 3D interaction see [BKLP01] and for a generaldiscussion on direct manipulation see [Shn83] and [HHN86].

2If a conventional mouse is used for interactions, there are two dimensional mouse interactionsthat correspond to these three dimensional ones.

123

Figure 1: 3D cursor interaction with toggle switch

However, the direct manipulation metaphor is not appropriate for all interface ob-jects. Consider interface objects that are not targets of tactile interaction in the realworld (e. g., a sign or a sensor). Their state changes are selected using a graphical3D menu within the Virtual Periphery that is triggered by a 3D metaphor of a mouseclick, i. e., by a short movement of the 3D cursor’s fingertips towards the interfaceobject. An example of a 3D menu to select the state change of a sensor is given inFigure 2.

Figure 2: Selection of a sensor’s state change using graphical 3D menu

Besides the central direct manipulation metaphor, we make use of a technique thatintegrates naturally within virtual reality: voice commands. While direct manipu-lation is used for interaction within the Virtual Periphery, speech input is used forsystem control and therefore for interaction with the Virtual Periphery itself.

In order to realize different semantics of direct manipulation interaction, the VirtualPeriphery must provide different interaction modes. For example, a causality modewould enable specification fragments like

124

if switch SW changes to state on, then sign SI will be lighted,

and a parallel mode would enable

all signs SI1 ... SIn change to state lighted in arbitrary order

Note that speech based system control is superior to graphical system control be-cause it does not interrupt the interaction within the Virtual Periphery. Simplenavigation is also controlled by speech: predefined viewpoints can be activated suchthat the viewer3 is immediately transported to the corresponding location withinthe virtual world.

Another feature supported by speech input is the selection of interface objects: inorder to use several similar interface objects within a specification fragment, oneselects them before interacting with one of them that then acts as a placeholder forall these objects.

While speech selection provides selection of currently visible interface objects, alter-natives are mouse based selection on the one hand and attribute based selection onthe other hand.

Figure 3: Reference gesture (left) and time gesture (right)

In order to switch specific interaction modes, gestures can be used. For example, theso-called reference gesture is a rotation of the 3D cursor so that it looks like an openhand, palm up. In combination with a subsequent direct manipulation interaction asdescribed above, it references the complete interface object and defines the currentspecification context. The so-called time gesture will switch the specification modeso that further interactions are time dependant. Thereby, the 3D cursor which isequipped with a watch is rotated as if the user is taking a look on it. Both gesturesare shown in figure 3.

3That is the person interacting with the Virtual Periphery.

125

3 Incremental Development of Statecharts by

Interaction

Behaviour Template With each interface object a pre-defined behaviour tem-plate is associated: a statechart consisting of its possible states and appropriatetransitions. The behaviour template of an interface object is created manually basedon its interface and stored as an additional attribute of its template in the inter-face object library (see section 2). Note that the states in the behaviour templatecorrespond to the informally described states of the interface object. Additionally,the behaviour template contains transitions between the states based on the inter-face description of the interface object. Considering a simple two-state switch as anexample, the corresponding statechart contains two states on and off. The statechanges would be switching from on to off and vice versa, therefore the statechartcontains two transitions triggered by the events Switch.off and Switch.on, re-spectively. Figure 4a shows the behaviour template of the two-state switch.

dark_checked

light_checked

light_pending

dark_pending

dark light

dark_not_yet

light_not_yet

off on

(b) Lamp template(a) Switch template

(c) Lamp checker template

[in(light)]

[in(dark)]

Lamp.light

Lamp.dark

Switch.on

Switch.off

Figure 4: Behaviour template of switch and lamp

Additionally, the behaviour template can contain a checker component that is typ-ically needed for our test purposes. As an example, consider a simple lamp or signthat provides outputs to the SUT’s environment: while on the one hand the reallamp is in one of its states dark or light (see figure 4b), we want to check if itsstate changes occur appropriately depending on certain events or conditions withinthe SUT. While these events and conditions are subject to the specification process,the checker component generally distinguishes valid and pending situations. Fig-ure 4 shows the behaviour template of a lamp consisting of a statechart for the reallamp and the checker statechart. The latter is denoted in figure 4c and containsdifferent states: The states dark checked and light checked represent the cor-rect (and checked) states and thus correspond conceptually to the states dark andlight in figure 4b. The states dark pending and light pending represent the

126

situation when the event (or condition) to change the state has already occured butthe correct reaction of the SUT has not been checked yet. Finally, dark not yet

and light not yet denote that after the occurence of the change event the SUTis not expected to react yet.

Interaction Scenario Let us now consider the interaction scenario for the follow-ing requirement:

The lamp must be dark, if the switch is off

and it must be lighted, if the switch is on.

The interface objects are a two-state switch and a lamp whereby the former isinitially in state off and the latter is initially dark. On template base, the ap-plication specific dependencies between switch, lamp and checker component arenot yet defined. The following steps describe in a step-by-step manner how thesedependencies are introduced to the templates of figure 4 for the concrete applicationcontext. Since only correct behaviour should be specified, the system state has tobe consistent with respect to the current specification context.

1. The process is started by choosing the specification context, i. e., this is thelamp in the example. Therefore, we navigate to the lamp within the Vir-tual Periphery by issuing the voice command view lamp. By applying thereference gesture and touching the lamp, we reference the lamp’s behaviourtemplate (i. e., the corresponding statechart).

2. To define the trigger for the state change of the context object, we navigateto the trigger object, i. e., in this example to the switch, by voice commandview switch. The following manipulation of the switch – a rotation of the 3Dcursor – changes the state of the switch to on. This state change is representedby a transition in the switch’s statechart.

3. To define the effect of the trigger on the context object, the current state ofthe context object is considered as the source state for a transition. Sincethe lamp cannot be manipulated directly, the target state (i. e., the statelight) has to be selected using a 3D menu. Although the corresponding 3Dmenu provides the states light and dark (i. e., states defined in the lamp’sstatechart), the checker statechart is affected. The transition with source statedark checked and target state light not yet is labelled with the guardin(Switch.on).

4. The same steps have to be applied for specifying the second part of our speci-fication, respectively. Thereby, the transition from state light to target statedark not yet is labelled with in(Switch.off).

In the above specification scenario, the resulting specification fragment is onlycausally coherent but does not contain any timing constraints. Moreover, the checkermight stay in state light pending without detecting any errors. Since the systemspecifications usually imply specific requirements to react in a certain time interval,

127

it is necessary to apply as well the time gesture (see section 2). Thus, before start-ing the above described specification process, the time gesture is applied to indicatethat the following specification mode is time dependant. The effect of the timedspecification mode is that when the trigger of a state change is defined, additionaltransitions and labels are inserted in the checker statechart that check the lower andupper bounds of the time interval.

In the above example, in order to check the upper bound two transitions areadded – one at state light pending and the other one at state dark pending.The transitions are labelled with a timeout event tm(en(light pending),t2) andtm(en(dark pending),t4), respectively, and a resulting ERROR action.4 Theevents are triggered tn time units after the last entry to state light pending ordark pending, respectively. The lower bound check of the state change to light

is realised by the timeout event tm(en(light not yet),t1) in combination with anew transition between light not yet and light checked. The latter can onlybe taken before t1 time units elapse and therefore results in an ERROR action.The lower bound check of the state change to dark is specified in a similar way.The concrete timer values tn cannot be set directly, therefore default values areused that have to be further adjusted (e. g., by the use of a 3D menu in the VirtualPeriphery). Note that the lower bound check as well as the upper bound check ofthe time interval can be omitted.

The resulting statecharts are shown in figure 5. In addition to the above mentionedstatecharts for interface objects, another statechart is generated during the spec-ification process. While interacting with the Virtual Periphery, the user triggerscertain input interface objects (e. g., a switch) to change state. These user state-charts cannot be defined as behaviour templates in a library, since their states andtransitions depend entirely on the test specification for the SUT.

dark_checked

light_checked

light_pending

dark_pending

dark light

dark_not_yet

light_not_yet

[in(light)]

[in(dark)]

tm(en(dark_pending),t4) / ERROR

tm(en(light_pending),t2) / ERROR

Lamp.light

Lamp.dark

[in(Switch.on)] tm(en(light_not_yet),t1)

[in(light)] / ERROR

[in(Switch.off)]tm(en(dark_not_yet),t3)

[in(dark)] / ERROR

off on

Switch.on

Switch.off

(b) Lamp(a) Switch

(c) Lamp checker

Figure 5: Instantiated and extended statecharts

4A more detailed error handling is necessary but is not discussed in this paper.

128

4 Testing with Statecharts

Test execution

Test specification session

generation

is read byTestlog

Input

Output

Inputand

output

VR model

Virtual Periphery

Test specification(Statecharts)

Testsystem

Systemunder test

(SUT)

Figure 6: Test process overview

An overview about the complete test process is given in figure 6. While, on the onehand, the statecharts (as discussed in Section 3) are the result of a test specificationsession, they are, on the other hand, the input to the test system. We focus inour work on RT Tester. RT Tester generates and executes tests automatically bysending inputs to the SUT. The tests are evaluated on the fly based on the giveninputs and the outputs coming from the SUT. See [Pel02] and [PT02] for applicationexamples and [Pel98] for the theoretical background.

Since the RT Tester tool accepts test specifications as labelled transition systems(LTS) to allow the use of arbitrary formal test specification languages that can betranslated into an LTS, we have to provide such a translation relation.

This translation depends on the statechart semantics used during the specificationprocess. Different semantics are available for statecharts: Harel introduced state-charts in 1987 (see [Har87]) and gave a formal semantics in [HPSS87]. A variantdescribed in [HN96] has been implemented in the STATEMATE tool5. Statechartshave as well been integrated in UML (see [Obj]) with a slightly different semantics.Other semantics have been discussed as well, and a comparision of different state-chart semantics is given in [vdB94]. As well, different approaches for the translationof statecharts into LTS have been discussed, see e. g. [US94], [Lev96] and [Joh99].Most variants are tailored to meet specific needs. We need a semantics that can atleast deal with our timing constraints and which has a step semantics with a greedyapproach. Nevertheless, we are currently investigating the specific needs of our ap-proach with respect to the statechart semantics. Thus, we can yet neither provide

5STATEMATE is a commercial tool by i-logix (http://www.ilogix.com) and is actually appliedto industrial projects.

129

http://www.ilogix.com

a complete algorithm for the translation nor a precise semantics for the statechartsused in our approach.

5 Virtual Periphery Generation and Reuse

One crucial point within our approach is the creation of the Virtual Periphery itself.Since the manual generation of the Virtual Periphery is a very time consuming andthus expensive task and moreover highly SUT dependant, it is desirable to minimiseany manual effort to create the Virtual Periphery. Hence, we want to discuss in thefollowing an approach to support the generation of the Virtual Periphery. Figure 7gives a first overview.

Testexecution

VR specification environmentCAD document

VR model (interactive):

Virtual PeripheryParameter

specification

Virtualperiphery

generation

Test specification template

Test specificationinstantiation

Test specification

Testspecificationsession

Figure 7: Virtual Periphery generation and test process

In most application areas, there are static geometry models of the SUT’s environ-ment and/or the SUT itself. This collection of documents – typically CAD docu-ments – can be converted straight-forward into an appropriate virtual reality model.

Additionally, some SUTs are equipped with some kind of parameterisation mod-ule in order to configure system features. Consider the Cabin IntercommunicationData System that is used within Airbus airplanes. It contains the so-called CabinAssignment Module that parameterises for example, how many attendant handsetsare available in the cabin and to which controllers they are connected. A similarexample is the number and mapping of passenger service units6 to seat rows andaisles. Although the parameterisation modules are typically domain specific, once anevaluation is realised it can be used to generate appropriate variants of the VirtualPeriphery depending on the specific parameter values.

6A passenger service unit is a collection of signs, keys, lamps, . . . above the passenger’s seat.

130

Typically, only an intermediate format – a non-interactive virtual reality model– can be derived automatically from the given documents. Hence, the interfaceobjects have to be inserted or replaced manually by interactive objects in order tospecify the tests as discussed in the previous sections. This process can be supportedby libraries of interface objects which contain for each type of interface object itsgeometry as well as the corresponding behaviour template (see sections 2, 3).

CAD document

VR model(non−interactive)

Parameterspecification

VR model (interactive):

Virtual Periphery

CAD−to−VRconverter

++Parameterevaluator

Interactiontoolkit

Decorationtoolkit

EnhancedVR model

(non−interactive)

Interface object libraries

general + domain specific

Figure 8: Detailed Virtual Periphery generation

Figure 8 gives a detailed view of the Virtual Periphery generation. It also containsan optional step via an enhanced non-interactive model. This may be desired if theVirtual Periphery is supposed to contain decorations like textures, which usually arenot provided within the CAD documents. Enhancing the model is a manual activitysimilar to the insertion of interface objects.

While the previously described generation approach itself reuses the CAD docu-ments and the parameterisation module (i. e., documents generated not specificallyfor the purpose of testing), it is as well possible to reuse parts of the test specifica-tion fragments based on concrete parameter values. Considering, for example, thereading lights in an airplane, all reading lights can be switched on or off by a centralbutton (using the selection mechanism described in Section 2 to select all readinglights). Additionally, each reading light can be switched on or off by a toggle switchabove the passenger seat. Nevertheless, it is neither desirable to specifiy this speci-fication part for each reading light separately nor should it be necessary to specifythe behaviour of all reading lights once again, if the parameter value denoting thenumber of reading lights has changed. In contrast, a test specification templatecould be used which is instantiated with a concrete set of parameter values beforetesting (i. e., more precisley before generating the LTS). This approach is visualisedin the lower left part of Figure 7 focussing on the test specification instantiationbased on the generic test specification template and the concrete parameter valuesdefined in the parameterisation module.

131

6 Conclusion

This article proposed an approach to facilitate the creation of formal test specifi-cations providing interactive virtual reality components. The approach addressesdomain experts who are not familiar with formal specification languages and allowsthem to create basic test specifications quickly and intuitively. Nevertheless, theperson interacting with the Virtual Periphery should have a precise understandingof concepts like parallelism and the sequencing of events.

Thus we expect the benefit of our approach to be:

Simple specifications Simple specifications can be developed without applyingelaborate concepts and thus without a detailed understanding of the underly-ing concepts of the formal specification language.

Team development Within a test team, domain experts and test experts cancooperate to extend the simple specifications.

Introduction to formal specification languages Additionally, our approach canbe used to become familiar with formal specification languages in an intuitiveway and thus to gain necessary expertise in it. Eventually, the expert will theneven prefer to define the test specifications using directly the formal specifica-tion language.

The Virtual Periphery described in this article is partially implemented using Java3Dwhich is an API for the general purpose, object oriented programming language Java.It is proved to be superior to VRML which we used during earlier efforts (see [BF99],[PBFE99]), because Java3D allows more flexible modelling. For further informationconcerning Java, Java3D and VRML see [GJS97], [Jav00] and [VRM97].

One main design guideline during the implementation is the use of conventionalpersonal computers without extraordinary input or output devices. Hence, all in-teraction must be possible by mouse, keyboard and low cost microphone. Our 3Dcursor is carefully designed to be used with the mouse to allow movements and rota-tions to be gained from two-dimensional mouse movements combined with so-calledmodifier keys (e. g., pressing of mouse buttons). Furthermore, the output has tobe appropriate for conventional monitor screens and stereo pairs of speakers. Notethat this is the reason why no haptical output like force feedback is available withthe Virtual Periphery.

Nevertheless, it is possible to enhance the virtual reality feeling with special equip-ment. There is no inherent restriction of our 3D cursor to be used with the mouse,so that alternatively a data glove could be used. For visual output, a head mounteddisplay as well as stereoscopic viewing solutions can be applied. As virtual realityaudio enhancement, dolby surround or similar techniques are available. To gain anoverview about virtual reality equipment refer for example to [MG96].

Future work will include the definition of a formal statecharts semantics and a cor-responding translation to LTS that can be used by the RT Tester tool. Since the

132

formal language is exchangeable as far as there is an appropriate LTS representa-tion, further evaluation of appropriate formal specification languages is planned. Inparticular, we will consider hybrid automata (see [Hen96]) that enable modellingof continuous behaviour and are in this respect more expressive than statecharts.However, the chosen language has essential impact on the interaction’s semanticswithin the virtual reality.

Another point that is subject to further research concerns the test evaluation thatis so far based on the generated test specification. A way to map an event from thetest log of a test run to the corresponding Virtual Periphery representation wouldbe valueable in order to interpret errors and warnings or even to find inconsistencieswithin the test specification itself. Since the test execution is based on labelledtransition systems, this is not a trivial task. Even the mapping to the correspondingpart of the statechart is non-trivial.

Finally note that although we focus on developing test specifications, our approachis not restricted to this kind of specifications but can be expanded to more generalspecifications.

References

[BF99] Stefan Bisanz and Ingo Fiß. Grafischer Entwurf von CSP-Spezifikationenfur den Test eingebetteter Echtzeitsysteme. Master’s thesis, UniversitatBremen, February 1999.

[BKLP01] D. Bowman, E. Kruijff, J. LaViola, and I. Poupyrev. An Introduction to3D User Interface Design. Presence: Teleoperators and Virtual Environ-ments, 10(1):96–108, 2001.

[GJS97] James Gosling, Bill Joy, and Guy Steele. The Java Lan-guage Specification. The Java Series. Addison-Wesley, 1997.http://java.sun.com/docs/books/jls/html/.

[Har87] David Harel. Statecharts: A visual formalism for complex systems. Sci-ence of Computer Programming, 8(3):231–274, June 1987.

[Hen96] Thomas A. Henzinger. The theory of hybrid automata. In Proceedings ofthe 11th Annual Symposium on Logic in Computer Science (LICS), pages278–292. IEEE Computer Society Press, 1996.

[HHN86] E. L. Hutchins, J. D. Hollan, and D. A. Norman. Direct manipulationinterfaces. In D. A. Norman and S. W. Draper, editors, User CenteredSystem Design: New Perspectives on Human-Computer Interaction, pages87–124. Erlbaum, Hillsdale, NJ, 1986.

[HN96] David Harel and Amnon Naamad. The STATEMATE semantics of stat-echarts. ACM Transactions on Software Engineering and Methodology,5(4):293–333, October 1996.

133

http://java.sun.com/docs/books/jls/html/

[HPSS87] D. Harel, A. Pnueli, J. P. Schmidt, and R. Sherman. On the formal se-mantics of statecharts. In Proceedings, Symposium on Logic in ComputerScience, pages 54–64. The Computer Society of the IEEE, June 1987.Extended abstract.

[Jav00] The Java 3DTM API Specification. Version 1.2.http://java.sun.com/products/java-media/3D/index.html, April 2000.

[Joh99] Sebastian John. Zur kompositionalen Semantik von objektorientiertenStatecharts. Master’s thesis, Technische Universitat Berlin, August 1999.

[Lev96] Francesca Levi. A process language for statecharts. In Logical and Opera-tional Methods in the Analysis of Programs and Systems, pages 388–403,1996.

[MG96] Tomasz Mazuryk and Michael Gervautz. Virtual reality - his-tory, applications, technology and future. Technical Report TR-186-2-96-06, Vienna University of Technology, Institute of Com-puter Graphics and Algorithms, A-1040 Wien, February 1996.Available as http://www.cg.tuwien.ac.at/research/TR/96/TR-186-2-96-06Abstract.html.

[Obj] Object Management Group (OMG). OMG Unified Modeling Language,Specification. Available at http://www.omg.org/uml/.

[PBFE99] J. Peleska, S. Bisanz, I. Fiß, and M. Endreß. Non-Standard GraphicalSimulation Techniques for Test Specification Development. In H. Szczer-bicka, editor, Modelling and simulation: A tool for the next millenium.13th European Simulation Multiconference 1999, volume 1, pages 575–580, Delft, 1999. Society for Computer Simulation International.

[Pel98] Jan Peleska. Testing reactive real-time systems. Tutorial,held at the FTRTFT ’98, Denmark Technical University, Lyngby,1998. Updated revision. Available as http://www.informatik.uni-bremen.de/agbs/jp/papers/ftrtft98.ps.

[Pel02] Jan Peleska. Formal methods for test automation - hard real-time test-ing of controllers for the airbus aircraft family. In Proc. of the SixthBiennial World Conference on Integrated Design & Process Technology(IDPT2002), Pasadena, California. Society for Design and Process Sci-ence, June 2002. To appear.

[PT02] J. Pelska and A. Tsiolakis. Automated Integration Testing for AvionicsSystems. In Proceedings of the 3rd ICSTEST – International Conferenceon Software Testing, April 2002.

[Shn83] Ben Shneiderman. Direct manipulation: A step beyond programminglanguages. IEEE Computer, 16(8):57–69, 1983.

134

http://java.sun.com/products/java-media/3D/index.html

http://www.cg.tuwien.ac.at/research/TR/96/TR-186-2-96-06Abstract.html

http://www.cg.tuwien.ac.at/research/TR/96/TR-186-2-96-06Abstract.html

http://www.omg.org/uml/

http://www.informatik.uni-bremen.de/agbs/jp/papers/ftrtft98.ps

http://www.informatik.uni-bremen.de/agbs/jp/papers/ftrtft98.ps

[US94] Andrew C. Uselton and Scott A. Smolka. A compositional semantics forstatecharts using labeled transition systems. In International Conferenceon Concurrency Theory, pages 2–17, 1994.

[vdB94] M. von der Beeck. A comparison of StateCharts variants. In Proc. ofFormal Techniques in Real Time and Fault Tolerant Systems, pages 128–148, Berlin, 1994. Springer-Verlag.

[VRM97] VRML Consortium. The Virtual Reality Modeling Language.http://www.web3d.org, 1997. International Standard ISO/IEC 14772-1:1997, Part 1 – 3.

135

http://www.web3d.org

Towards a Formalizationof Viewpoints Testing

Marius Bujorianu1, Savi Maharaj2, Manuela Bujorianu2

.

1Computing Laboratory, University of Kent,Canterbury, Kent, CT2 7NF [email protected].

2Department of Computing Science and Mathematics,University of Stirling, Stirling, Scotland, FK9 4LA, UK

{mlb, sma}@cs.stir.ac.uk

25 June 2002

Abstract. Test case generation from formal specifications is now a very ma-ture field. Partial specification or viewpoints represents a co-operative approach insoftware specification. Although partial specification has a long history, only a littlewas done towards application of the methodology to formal test case generation. Inthis work we propose a categorical foundation of viewpoints oriented testing, obtain-ing a sound methods integration and a formal testing methodology for composite(heterogeneous) software systems. In particular, we plan to address the combinationof specification based testing and test case generation from proofs.

.

Keywords: formal testing, viewpoints specification, category theory.

1. INTRODUCTION

The most challenging issue of software engineering still is the question how to masterthe complexity of the development of large software systems. For projects involving thespecification and development of large systems, the structuring of their descriptions iscrucial to the project’s success. Traditionally, systems were decomposed according tofunctionality; modern approaches favour, in addition to this, decompositions accordingto “aspects” or ”viewpoints”. Also, these viewpoints may be views of the system’s func-tionality from different participants. Viewpoints mean different perspectives on the samesystem, aspect oriented specifications written in different languages by teams having dif-ferent backgrounds, etc. Of course, for an implementation we need an integration of allthese formal descriptions, more specifically a minimal one, called unification.The increasing importance of the viewpoint model in software engineering is exempli-

fied by its use in the Open Distributed Processing (ODP) standard, OO design methodol-ogy, requirements engineering, software architecture, reverse engineering and the UnifiedModeling Language (UML). ODP, for example, defines a viewpoint framework for spec-ification of distributed systems using a fixed collection of five viewpoints: enterprise,information, computational, engineering and technology. We are particularly interestedin the construction of a general model applicable to most of these application fields.Different models for viewpoints have been proposed, like the VOSE framework [11]

and the ’Development’ approach [5]. Our approach follows the general model presentedin [6] and [16]. In this work we extend the categorical framework developed for thehomogenous case in [7]. Viewpoints are written using the specification language associatedwith a general logic [22]. The correspondences between viewpoints are expressed usingdiagrams, specifically spans from the correspondence specification to the viewpoints whichare unified. Unification is given then by the pushout of the diagram.

1

137

Towards a Formalizationof Viewpoints Testing2

Although viewpoints oriented specification like techniques are used in a great varietyof development technologies, there is no mature use of them in testing. Notable excep-tions are MacColl and Carrington’s framework MATIS [17] and Pemberton’s VOCAL[23]. VOCAL: ’Viewpoint-Oriented verifiCation And vaLidation’ is an application of theVOSE framework to software testing. Viewpoints have been applied for the identificationand structuring of test deployment. Using such an organization helps to ensure that allimportant test perspectives are taken into account. In the VOCAL approach, viewpointsare classified in group viewpoints, verification viewpoints, validation viewpoints and qual-ity viewpoints. The test technique applied within viewpoints provides test coverage. Incontrast, MATIS is specification oriented and is much closer to the idea of our work.Tests are derived from viewpoint specifications specifically, according to the formal

language used by each team. Viewpoints could have different concepts for tests, differentlanguages to describe them precisely, and different techniques to derive them. When wehave a big heterogeneity of viewpoints, and implicitly of tests derived from them, we needa common definition and understanding of them, as well a set of tests for the whole systemdescription (i.e. unification).We suppose the reader is familiar with the basics of category theory. The space limit

of this work doesn’t allow a background presentation of the category theory, which hasbeen used. We recommend the book [1] for the necessary background information.The paper is structured as follows. In the next section we give a brief summary of a

categorical and logical approach to software specification. In this section we study alsothe unification process and the development relations involved. In Section 3 we sketch aformal theory for composite viewpoints. In Section 4 we present the formal testing theoryfor axiomatic specifications as application introduced and developed by M.C. Gaudel [13].In Section 5 the formal frameworks are applied to unify the tests generated from theviewpoints in order to obtain tests for the whole system. The partial conclusions of thisformal experiment are sketched in the last section.

2. Axiomatic Viewpoint SpecificationThis section defines the formal concept of viewpoints used in the rest of the paper. Westress here especially the logical and categorical aspects of formal software specifications.

2.1. Categorical Specification Logics. The categorical logic we describe in this para-graph is based on the papers [??] and [22].

• Syntax.Vocabulary : is given by a category of signatures SIGN. Associated with the cate-

gory SIGN we have a functor Sort : SIGN → SET, called the sort functor for SIGN;for any signature Σ , the elements Sort[Σ] (or S) are called the sorts of Σ. By SIGNV ar

we denote the category where an object is a pair (Σ,X) where X is a Sort(Σ)-sorted setwhose elements are called variables, and a morphism from (Σ,X) to (Σ0,X 0) is a pair(σ, v) with σ : Σ1 → Σ2 a morphism of signatures and v : X1 → (X2)|σ.We call an objectin SIGNV ar a signature with variables. We often ask for this category to be cocomplete.For the case studies we will consider in our work, SIGN is cocomplete.Formulas are given by a functor Syn : SIGN→ SET, assigning to each signature Σ

in SIGN a set of Σ−sentences Syn(Σ).We do not use here any specific language. We will introduce the syntax gradually, as wewill use it.

• Model Theory

The interpretation is given by

138


i) a functor called interpretation functor Int : SIGN→ CATop contravariant in SIGN,which gives to each signature Σ in SIGN a small category Int(Σ) of Σ−models. TheseΣ−models provide the interpretations for the names in the vocabulary. Thus we cansuppose that there are some concrete entities, to which sentences can refer. For anysignature morphism σ : Σ1 → Σ2 in SIGN, there is a functor Int(σ) : Int(Σ2)→ Int(Σ1)is called the reduct functor and denoted by −|σ.ii) a family of Logical Satisfaction Relations ²= {|=Σ,Σ ∈ SIGN}, |=Σ⊆ |Int(Σ)| ×Syn(Σ), such that we have the Logical Satisfaction Condition M2 ²Σ2 Syn(σ(a1))⇔Int(σ(M2)) ²Σ1 a1is fulfilled for all signatures morphisms σ : Σ1 → Σ2 in SIGN, allΣ2-structures M2 ∈ |Int(Σ2)| and all Σ1-axioms a1 ∈ Syn(Σ1)• Proof Theory

Proof theoretic methods have been successfully applied in formal software develop-ment. Notable examples are the work in [3] for formal integration of VDM and B specifi-cation languages and in [19], where correctness proofs have been used as a source for testsgeneration. Anyway, in this work we will present only background introduction in prooftheory for specification logics, necessary for a further implementations into a theoremprover.A consequence relation (shortly CR) is a pair (S,`) where S is a set of formulas and

`⊆ ℘f (S)× S is a binary relation such that : (Reflexivity) a ` a; (Transitivity) If Γ ` aand a,Γ0 ` b then Γ,Γ0 ` b; (Weakening) If Γ ` a then Γ, b ` a.The closure operation on sets of formulas Λ ⊆ S of a CR (S,`) is defined by

Cl`(Λ) = Λ = {a|Γ ` a,Γ ⊆ Λ}

A set of formulas Λ is closed under ` iff Cl`(Λ) = Λ.

Definition 1. A theory (wrt `) is a set of formulas closed under ` .Definition 2. (CR morphism) A morphism of consequence relations τ : (S,`)→ (S0,`0)is a function τ : S → S0 (the translation of formulas) such that if Γ ` a then τ(Γ) `0 τ(a).

Definition 3. (Category CR) The consequence relations as objects and morphismsof consequence relations as arrows form a category, denoted CR, with identities andcomposition inherited from the category of sets.

If τ : (S,`) → (S0,`0) is a CR morphism and Λ ⊆ S then τ(Λ) ⊆ τ(Λ). Thus theimage of a theory under a CR morphism is not always a theory. Moreover τ(Λ) = τ(Λ).

Definition 4. (Logical system) A logical system is a functor L : SIGL → CRL, suchthat the deduction relation `Σ is sound for the logical satisfaction relation |=Σ for everysignature Σ ∈ SIGN.

A Σ−theory is a theory in L(Σ). A L−theory is a Σ−theory for Σ ∈ |SIGL|. Thecategory of theories will be denoted TH.DCL = (SIGN, Syn,`) forms general deduction system and the structureMCL=(SIGN, Syn, Sem,²

) gives the model theory (the institution) of the general logic CL .

• Examples of Specification Logics

Example 5. The logic FOL= : many-sorted first order logic with equality

139


Signatures are many-sorted first order signatures. Models are many-sorted first orderstructures. Formulas are many-sorted first order formulas. Formula translations meanreplacements of the translated symbols. Satisfaction is the usual satisfaction of a firstorder formula in a first order structure.

Example 6. The logic LT SHL: the labelled transition systems hidden logicSignatures are many-sorted first order signatures enriched with hidden sorts. Each hiddensort models the states of an lts. As used in hidden logic, we ask operations to be monadicon hidden sorts. Formulas are many-sorted first order sentences, models are simply many-sorted first order structures, satisfaction is defined also like in first order logic. Labelledtransition systems (lts’s) (S,L,→) are modelled as first order structure, where the supportof a hidden sort models the state set S. Labels of L are behavioral formulas of theform precondition⇒ action. Actions are simply assignment statements as in imperativelanguages. The transition relation is a predicate →⊆ S × L × S. We use the notations − {l} → s0 = op(s) for the transition s op,l→ s0, where op is an operation from a hiddensort to a hidden sort from the algebraic signature.

2.2. Viewpoint Specification and Unification in General Logics. AΣ−presentationin a general logic is a signature extended with a set of axioms. In most specifications anaxiom consists of a set of variables and two terms of the same sort belonging to the termlanguage of the signature with respect to the set of variables.The semantics of a viewpoint is an element in a category, often an algebra. An algebra

is presented by a presentation if it is denoted by the signature of the presentation andsatisfies the axioms of the presentation.Any specification formalism based on a general logic L determines a class of speci-

fications, and then, for any viewpoint PSP , its signature Sig[PSP ] ∈ |SIGN| and thecollection of its models Sem[PSP ] ⊂ Int[Sig[PSP ]]. If Sig[PSP ] = Σ, we refer to PSPas a Σ−specification.Consider an arbitrary but fixed general logic,

Definition 7. For every signature Σ in SIGN we define Σ−viewpoints PSP by• any Σ−presentation PRES = (Σ, Eq) is a viewpoint PSP with the following se-mantics

Sig[PRES] = ΣSem[PRES] = {M ∈ |Sem(Σ)|,M |= Eq} not= SemΣ[Eq]

• enrichment : unif(PSP,PSP 0) of the Σ−viewpoint PSP with the Σ0−viewpointPSP 0 , where Σ ∩Σ0 = ∅, is a viewpoint with the following semantics

Sig[unif(PSP,PSP 0)] = Σ ∪Σ0Sem[unif(PSP,PSP 0)] = Sem[PSP ] ∪ Sem[PSP 0]A bit of syntactic sugar: we write the enrichment operation asspec ENRICHMENT isenrich PSP_name withPSP 0

endspec.

Example 8. Consider the parallel specification of a telephone account by two differentteams. The first team’s perspective is that of an account in credit. It uses the partiallogic LT SHL to define a general consume operation on the account. The second teamconcentrates on deposit operation on the account and uses the FOL= logic.

140


spec CONS isenrich AMOUNT withsort Sumhidden sort Stateconst ok, outm : State;opns Consume : State Sum 9 State

Balance : State→ Sumvar S : State; X : Sum;axioms(S = ok)−{ Balance(S) ≥ X ⇒ Balance(Consume(S,X)) = Balance(S)−X}→ (S =ok).(S = ok)− { Balance(S) < X ⇒ Balance(Consume(S,X)) = Balance(S)−X}→ (S =outm).endspecThe specification AMOUNT defines a standard numerical datatype like integers. Ob-

serve that the operation Consume is partial because is not defined in the state outm.spec DEP isenrich AMOUNT, BOOLEAN withsort State, Amountconst init : State;opns Add : Credit Amount → Credit

Acc V alue : Credit→ Amountvar S : Credit; X : Amount;axiomsPositive(init) = true.(Positive(S) = true) ⇒ (Positive(Add(S,X)) = true) ∧ (Acc V alue(Add(S,X)) =Acc V alue(S) +X).(Positive(S) = false) ∧ (Acc V alue(S) +X < 0) ⇒ (Positive(Add(S,X)) = false) ∧(Acc V alue(Add(S,X)) = Acc V alue(S) +X).(Positive(S) = false) ∧ (Acc V alue(S) + X ≥ 0) ⇒ (Positive(Add(S,X)) = true) ∧(Acc V alue(Add(S,X)) = Acc V alue(S) +X).endspec.

Definition 9. (MC-refinement) A (partial) specification REF refines (by model con-tainment MC) a viewpoint PSP , and we note this by REFwPSP if

Sig[REF ] ⊆ Sig[PSP ]

Sem[REF ] ⊆ Sem[PSP ]

We adopt the view on viewpoints consistency expressed in [6] by

”A collection of viewpoints is consistent if and only if it is possible for at leastone example of an implementation to exist that can conform to all viewpoints.”

Definition 10. (unification) ([6]) The unification UNIF [PSP,PSP 0] of two viewpointsPSP and PSP 0 is defined as the smallest common refinement

UNIF [PSP,PSP 0] w PSPUNIF [PSP,PSP 0] w PSP 0SP w PSP 0, SP w PSP ⇒ SP w UNIF [PSP,PSP 0]An effective procedure for constructing the unification of axiomatic specified view-

points can be found in our paper [7].

141


Example 11. Consider the viewpoints DEP and CONS from the Example 8. Theirunification is

spec UNIF isenrich AMOUNT, BOOLEAN withsort Amounthsort Stateconst ok, outm : State;opns Consume : State Amount 9 State

Add : State Amount → StateBalance : State→ Amount

var S : State; X : Amount;axioms(S = ok)− { Balance(Add(S,X)) = Balance(S) +X }→ (Add(S,X)) = ok).(S = outm) −{Balance(S) + X < 0 ⇒ Balance(Add(S,X)) = Balance(S) + X }→(Add(S,X)) = outm).(S = outm) −{ Balance(S) + X > 0 ⇒ Balance(Add(S,X)) = Balance(S) + X }→(Add(S,X)) = ok).(S = ok) −{ Balance(S) ≥ X ⇒ Balance(Consume(S,X)) = Balance(S) − X }→(Consume(S,X)) = ok).(S = ok) −{ Balance(S) < X ⇒ Balance(Consume(S,X)) = Balance(S) − X }→(Consume(S,X)) = outm).endspecOf course, the concrete method (pushout applied to some translations of the viewpoints)for construction of the unification makes necessary supplementary constructions, whichwill be given in the rest of the paper. In particular, the following signature morphism hasbeen applied to DEPCredit→ State, Acc V alue→ Balance, true→ ok, false→ outm, Positive→ Current

3. A Framework for Composite Viewpoints3.1. Translation Between Specification Logics. Over the last ten years there havebeen a lot of variations in defining morphisms of logics. These notions have been givenmany different names, including morphism, map, embedding, simulation, transformation,coding, representation, and more, most of which do little or nothing to suggest theirnature. We present in this paragraph what are, in our view, the most useful and logicallyarticulated definitions..Let L = (SIGN, Syn, Sem,²,`) and L0 = (SIGN0, Syn0, Sem0,²0,`0) be two cate-

gorical specification logics.

Definition 12. A logic morphism (Goguen [14]) Mor between logics

∂ = (φ,α,β) : L→ L0

is given by

• a functor φ : SIGN→ SIGN0

• a natural transformation α : φ;Syn0 ⇒ Syn : SIGN→ SET

• a natural transformation β : Sem ⇒ φ;Sem0 : SIGNop → CAT such that thesimple map of institutions condition

142


β(Σ)(M) |=0φ(Σ) f 0 ⇐⇒M |=Σ α(Σ)(f 0) (Satisfaction Condition)holds for each Σ ∈ |SIGN| , M ∈ |Sem(Σ)| , f 0 ∈ Syn0(φ(Σ)).The functor φ on signatures and the natural transformation β on models go in the

same direction in this definition, while the natural transformation α goes in the oppositedirection.Logic morphisms compose and form a category LOG.

Definition 13. A logic comorphism CMor (or a plain map -Meseguer [22]) between logics

∂op = (φ,α,β) : L→ L0

is given by

• a functor φ : SIGN→ SIGN0

• a natural transformation α : Syn⇒ φ;Syn0 : SIGN→ SET

• a natural transformation β : φ;Sem0 ⇒ Sem : SIGNop → CAT such that thesimple map of institutions condition

β(Σ)(M 0) |=Σ f ⇐⇒M 0 |=φ(Σ) α(Σ)(f) (Co-Satisfaction Condition)holds for each Σ ∈ |SIGN| , M ∈ |Sem(Σ)| , f 0 ∈ Syn0(φ(Σ)).Logic comorphisms compose and form a category COLOG.

Proposition 14. LOG and COLOG are both complete.

Because we are primarily interested in specification morphisms, and in our approachspecifications are theories, we need to consider generalizations of logic morphisms thatinvolve mapping theories instead of just signatures.Let Sg : TH→ SIGN be the functor which forgets the formulas of a theory.

Definition 15. The logic of specifications over a general logic L = (SIGN, Syn, Sem,²,`) is LSP = (THL, SynSP , SemSP ,²SP ,`SP ) where THL is the category of theoriesover L , SynSP is Sg;Syn , SemSP is the extension of Sem to theories, ²SP is Sg;² .

Definition 16. A specifications morphism is a morphism from LSP to L0SP which issignature preserving.

We denote by SPLOG the category of logics of specifications and their morphisms.In the rest of this paper we will use the notation LOGICS to denote anyone of the

categories LOG, COLOG and SPLOG.

Example 17. (A translation between PFOL= and LT SHL ) Consider the specificationlogics presented Examples 5 and 6.

∂(Credit) = State , ∂(Sum) = Amount ,∂(Consume) = (Consume, {a1, a2, a3})∂(x) = x otherwise

143


Figure 1:

3.2. A Category for Composite Viewpoints.

Definition 18. Given a functor G : Cop → CAT, the Grothendieck construction con-structs the fibration induced by G, i.e. a category F(C, G) defined as follows:

• an object of (C,G) is a pair < a, x >, where a ∈ |C| and x ∈ |G(a)|• an arrow < α, ρ >:< a, x >→< a0, x0 > has α : a → a0 an arrow of C and ρ : x →Gα(x0) an arrow of F (a)

• if < α, ρ >:< a, x >→< a0, x0 > and < β,σ >:< a0, x0 >→< a00, x00 > then < α, ρ >;< β,σ >:< a, x >→< a00, x00 > is defined as< α, ρ >;< β,σ >=< α;β, ρ;Gα(ρ) >

This construction provides us with a way to give a domain where objects are verygeneral logical structures and whose arrows are compatible relations between them.Let ∂ = (φ,α,β) : L → L0 be a (co)morphism of logics and < Σ,Γ > , < Σ0,Γ0 >

theories from TH and TH0.

Definition 19. A ∂−composite viewpoint translation between < Σ,Γ > and < Σ0,Γ0 >is an arrow ♣ :< Σ,Γ >→< Σ0,Γ0 > such that ♣ : φ(Σ) → Σ0 is a morphism in SIGN0

and such that Γ0 `Σ0 Syn(φ(Σ))(α(Σ)(Γ) ∪ ∅0Σ).The composite viewpoint translations compose and build a category which is on top of

the category LOGICS.Theories from arbitrary logics as objects and composite viewpoint translations as mor-

phisms define the category HPSPEC.The categoryHPSPEC is exactly the Grothendieck category G(LOGICS, Th) where

Th : LOGICS→ CAT.

144


Given a composite viewpoint translation ♣ :< Σ,Γ >→< Σ0,Γ0 > , its denotation isthe reindexing functor Sem(♣) : Sem0

|=(< Σ0,Γ0 >) → Sem|=(< Σ,Γ >), which maps

models from the target to the source logic.

Definition 20. (Indexed Category of Composite Models) Let G(LOGICS, Th) be theGrothendieck category. and < Σ,Γ > , < Σ0,Γ0 > theories from THL and TH0

L0 . Thenthe assignment < Σ,Γ >7→ Sem|=,L(< Σ,Γ >) ,

♣ :< Σ,Γ >→< Σ0,Γ0 >→ Sem(♣) : Sem0|=,L(< Σ

0,Γ0 >) → Sem|=,L(< Σ,Γ >)defines an indexed functor HSem : G(LOGICS, Th)op → CAT.

Definition 21. We define the category of composite models and composite morphismsas the split fibration induced by HSem : G(LOGICS, Th)op → CAT, i.e. the categoryF(G(LOGICS, Th),HSem).

In general the indexed category of composite models and composite model functorsHSem : G(LOGICS, Th)op → CAT as the semantically functor which maps compositeviewpoints to their model theoretical counterparts.

3.3. A Logic for Composite Viewpoints. A general logic for specifying the uni-fication must be able to keep some original viewpoint specification logics. A candidatelogics for this are the Grothendieck logics.

Definition 22. (Diaconescu [10]) Given an indexed logic L : Indop → Log, define theGrothendieck logic L# as follows:

-Signatures in L# are pairs (P, i), where i ∈ |Ind| and P a signature in the logic L(i) ,-signature morphisms (σ, d) : (

P1, i) → (

P2, j) consist of a morphism d : i → j ∈ Ind

and a signature morphism σ :P1 → ΦL(d)(

P2) (here, L(d) : L(j) → L(i) is the logic

morphism corresponding to the arrow d : i → j in the logic graph, and ΦL(d) is itssignature translation component),-the (

P, i)−sentences are the P-sentences in L(i), and sentence translation along (σ, d)

is the composition of sentence translation along σ with sentence translation along L(d),-the (

P, i)−models are the P−models in L(i), and model reduction along (σ, d) is the

composition of model translation along L(d) with model translation along σ, and-satisfaction (resp. entailment) w.r.t. (

P, i) is satisfaction (resp. entailment) w.r.t.

Pin

L(i).

4. Formal Testing for Axiomatic SpecificationsWe develop our formal approach to software testing in the algebraic tradition initiated byM.C. Gaudel and B. Marre in [2] and [21].A testing hypothesis describes assumptions about the system or the test process to

reduce the size of the test set. But too strong hypotheses could weaken the generatedtests, as an industrial experiment [21] shows. We consider here only uniformity hypotheses:we define sub-domains of interpretation for items, such that the system has the samebehavior for all the values of the sub-domain. Then we assume that testing for a value ofa sub-domain is enough to test for all its values. The sub-domains are defined in a logicalform by the concept of test cases.

Definition 23. A test instance is a couple (C,D) where C is a test case correspondingto a test hypothesis and D is a test data defined with respect to this test hypothesis.

145


Let Prog be the program under test and a a specific test goal (like a axiom of theprogram specification or a desirable program property). If an execution of Prog satisfiesone Σ−test data set D , we say ”Prog satisfies the test data set D” and we noticeProg mΣ D and Prog mΣ C. We use the same notation for a test case C: Prog mΣ Cmeans that all the executions of the program Prog satisfies C (and we say ”P satisfiesthe test case C”).

Definition 24. A test instance (C,D), with respect to a program Prog, is called

• unbiased if (Prog m C) ∧ (Prog |=Σ a)⇒ Prog mΣ D.

• valid if (Prog m C) ∧ (Prog mΣ D)⇒ Prog |=Σ a.• correct if it is valid and unbiased: (Prog m C)⇒ (Prog |=Σ a⇐⇒ Prog mΣ D))

Unbiased test sets are ones which accept all correct programs, but incorrect programscan also be accepted as correct. Valid tests do not accept incorrect programs, but correctprograms can be rejected. Thus, an ideal test must be valid and unbiased, i.e. correct.

Definition 25. The category of Σ−test cases, denoted TCΣ, has• objects: test cases• morphisms: for a test case morphism C → C 0 , at each instance of C we associate aan instance of C0 with the same item, i.e. an inclusion between the set of instancesof both test cases (or equivalently the logical implication C ⇒ C0 holds).

TCΣ is a finitely cocomplete category: initial object is a an empty test case, pushoutis defined by putting together the instances of both test cases without repetition of sharedinstances.The instantiation of test cases with values generates the test data sets.

Definition 26. A test data set is a subset of consistent ground instances of formulasfrom TCΣ.

Example 27. Consider the viewpoint DEP from the Example 8. As a test cases we couldconsider an uniformity hypothesis like

C1 = {Positive(S) = true,Acc V alue(S) > 0,X > 0, Acc V alue(S) > X}C2 = {Positive(S) = true,Acc V alue(S) > 0,X = 0}C3 = {Positive(S) = true,Acc V alue(S) = 0,X = 0}C4 = {Positive(S) = false,Acc V alue(S) < 0,X > 0,Acc V alue(S) +X < 0}C5 = {Positive(S) = false,Acc V alue(S) < 0,X = 0}C6 = {Positive(S) = false,Acc V alue(S) < 0,X > 0,Acc V alue(S) +X > 0}C7 = {Positive(S) = false,Acc V alue(S) < 0,X > 0,Acc V alue(S) +X = 0}

We can observe that from C one can derive

Positive(S) = true⇔ Acc V alue(S) ≥ 0Using a test notation like

< Positive(S), Acc V alue(S),X, Positive(Add(S,X)), Acc V alue(Add(S,X)) >

a test data set is

146


DDEP ={ < true, 25, 20, true, 45 >,< true, 25, 0, true, 25 >,< true, 0, 0, true, 0 >,< false,−25, 20, false,−5 >,< false,−25, 0, false,−25 >,< false,−20, 25, true,5 >,< false,−25, 25, true,0 > }.

Example 28. Consider the viewpoint CONS from the Example 8. As a test cases wecould consider an uniformity hypothesis like

C1 = {Balance(S) > 0,X > 0, Balance(S) > X}C2 = {Balance(S) > 0,X = 0}C3 = {Balance(S) > 0,X > 0, Balance(S) = X}C4 = {Balance(S) = 0,X = 0}C5 = {Balance(S) > 0,X > 0, Balance(S) < X}C6 = {Balance(S) = 0,X > 0}

Using a test notation like

< Current(S), Balance(S),X,Consume(S,X), Balance(Consume(S,X)) >

a test data set is

DWITHDR ={ < ok, 25, 20, ok, 5 >,< ok, 25, 0, ok, 25 >,< ok, 25, 25, ok, 0 >,< ok, 0, 0, ok, 0 >,< ok, 20, 25, outm,−5 >,< ok, 0, 25, outm,−25 > }.

Definition 29. (Testing functor) We define a functor Test giving for every signature itscategory of Σ−tests

Test : SIGN→ CAT

Test(Σ) = TCΣ

such that the satisfaction condition for tests

M 0 mΣ0 Test(σ)(a)⇔ Sem(σ)(M 0) mΣ a

is satisfied.In a categorical specification logic, a program is identified with a viewpoint PSP and

its execution with the semantics of the specification Sem[PSP ]. Thus, a test goal is aformula a ∈ TH[PSP ], and the satisfaction relations Prog mΣ D and Prog mΣ C arereplaced by the test satisfaction relation for models mΣ⊆ |Mod(Σ)| × |Test(Σ)| for eachΣ ∈ |SIGN|

147


5. Testing Unification by Unification of TestsSuppose we have generated the test instances (CPSP ,DPSP 0) from the viewpoints PSP,PSP 0, correct for the test goalsXPSP , XPSP 0 and similar for the specification CO, whichexpresses the correspondences between the viewpoints. It is important to note that wedo not use any hypotheses about the way tests have been obtained. For example, DPSPcould be obtained from a correctness proof, as in [20], and DPSP 0 could be obtained byany method of generating test cases from a formal specification.Consider the unification obtained by the following pushout of viewpoints,

COm1 . &m2

PSP PSP 0

m01& .m0

2

UNIF

corresponding to the pushout of signatures

Sig[CO]σ1 . & σ2

Sig[PSP ] Sig[PSP 0]σ01 & . σ02

Sig[UNIF ]

We are interested in the way (CUNIF ,DUNIF ) for UNIF can be obtained. In the cor-rectness of the method.

Proposition 30. Correctness of test instances is preserved by signature translation andcomposite translation morphisms.

Proposition 31. The test instance (CUNIF ,DUNIF ) obtained by pushout

(CCO,DCO)t1 . & t2

(CPSP ,DPSP ) (CPSP 0 ,DPSP 0)

t01 & . t02(CUNIF ,DUNIF )

is correct for Syn(m01)(XPSP ) ∧ Syn(m0

2)(XPSP 0).Proof. By renaming according to m0

1 we have a test instance (C0PSP ,D

0PSP ) de-

fined on Si g[PSP ] and correct for Syn(m01)(XPSP ) and similar we get a test instance

(C0PSP 0 ,D0PSP 0) defined on Si g[PSP 0] and correct for Syn(m02)(XPSP 0).

We consider a model M 0 defined on Si g[UNIF ] such that M 0 satisfies CUNIF = C0PSP ∧C0PSP 0 . M 0 satisfiesC0PSP and C

0PSP 0 and correctness of (C 0PSP ,D

0PSP ) and (C

0PSP 0 ,D0PSP 0)

givesM 0 |=Si g[UNIF ] Syn(m1)(XPSP )⇐⇒M 0 mSi g[UNIF ] D0UNIF1M 0 |=Si g[UNIF ] Syn(m2)(XPSP 0)⇐⇒M 0 mSi g[UNIF ] D0PSP 0

If M 0 satisfies D0PSPand D0PSP 0 we can build a consistent test case on Si g[UNIF ] by

conjunction, so M 0 satisfies DUNIF . Reversely, if M 0 satisfies DUNIF ,it exists a test caseof DUNIF satisfied by M 0and build by composition of a test case of D0

UNIF1 and a testcase of D0PSP 0 . So M 0 satisfies D0PSPand D

0PSP 0 .

We obtained thatM 0 |=Si g[UNIF ] Syn(m1)(XPSP ) ∧ Syn(m2)(XPSP 0)⇐⇒M 0 mSi g[UNIF ] DUNIF

Because XUNIF = Syn(m1)(XPSP ) ∧ Syn(m2)(XPSP 0) we obtain that the test instance(CUNIF ,DUNIF ) is correct for Syn(m0

1)(XPSP ) ∧ Syn(m02)(XPSP 0).q.e.d.

148


Example 32. We construct now the test instance (CUNIF ,DUNIF ) from (CWITHDR,DWITHDR)and (CDEP ,DDEP ).

We consider the following notation for test data

< op,Current(S), Balance(S),X,Current(op(S,X)), Balance(op(S,X)) >

The symbol op ranges in the values {Add,Consume} and the symbol ⊥ when the attributeis not defined for the current operation. The test data DUNIF isDUNIF ={ < Consume, ok, 25, 20, ok, 5 >,< Consume, ok, 25, 0, ok, 25 >,< Consume, ok, 25, 25, ok, 0 >,< Consume, ok, 0, 0, ok, 0 >,< Consume, ok, 20, 25, outm,−5 >,< Consume, ok, 0, 25, outm,−25 >,< Add, ok, 25, 20, ok, 45 >,< Add, ok, 25, 0, ok, 25 >,< Add, ok, 0, 0, ok, 0 >,< Add, outm,−25, 20, outm,−5 >,< Add, outm,−25, 0, outm,−25 >,< Add, outm,−20, 25, ok, 5 >,< Add, outm,−25, 25, ok, 0 > }.

Similar we construct CUNIF

C1 = {Op, ok,Balance(S) > 0,X = 0}C2 = {Op, ok,Balance(S) = 0,X = 0}C3 = {Op, ok,Balance(S) > 0,X > 0, Balance(S) > X}C4 = {Consume, ok,Balance(S) > 0,X > 0, Balance(S) = X}C5 = {Consume, ok,Balance(S) > 0,X > 0, Balance(S) < X}C6 = {Consume, ok,Balance(S) = 0,X > 0}C7 = {Add, outm,Balance(S) < 0,X > 0, Balance(S) +X < 0}C8 = {Add, outm,Balance(S) < 0,X = 0}C9 = {Add, outm,Balance(S) < 0,X > 0, Balance(S) +X > 0}C10 = {Add, outm,Balance(S) < 0,X > 0, Balance(S) +X = 0}

6. ConclusionsAs the title suggests, this work is only preliminary. Much more remains to be done in thesense of using effective test case procedures and describing concrete development relationsto be used in the unification process. We intend to instantiate our framework with moreformal notations, like temporal logics and co-algebraic specifications.The basic achievements of this work are:

• a method of unification of heterogeneous viewpoints using category theory,• corresponding to this, a method of testing the unification by unifying the testsgenerated from the viewpoints

• an exemplification using a small case study (a simplified telephone account)• a formal framework for constructing proofs of correctness preservation for the uni-fication process.

149


The formal testing theory we have presented here is connected with general logics onlyon their model theoretic counterpart. Despite of a careful presentation of proof theory,issues like general logics for theorem provers, mappings of viewpoint logics into a universallogic didn’t get their natural place now. A future work might describe all these issues inconnection with using correctness proofs as a source for test case generation [20].This work is all theoretical, conducted by a toy example. A next step is to consider

an executable logical framework (like LF [15], Maude or HOL) in which the Grothendieckviewpoint logic should be embedded, and a real life case study (we target an air trafficcontrol example).As future ’test’ study, we will concentrate on testing of ODP and UML system specifi-

cations. ODP defines a basic framework for conformance as part of the reference model,rather than it being retrofitted later, as in OSI. UML allows systems UML allows sys-tems to be described using diagrams and notations of various kinds, but none of theseis assumed to fully characterise the behaviour of the system being specified. Thus, foran UML specification, any diagram could be mapped into a viewpoint specification, andconsequently develop a specific theory of testing. We also intend to apply our logicalviewpoint specification and testing framework to hybrid systems. This can be done infew ways, for example by extending UML capabilities to specify hybrid systems or bymodelling them using a particular categorical logic.AcknowledgementsAuthors want to thank Dr. Eerke Boiten who contributed to the first part of this paper

(we have actually used his work on a categorical framework for viewpoint specifications)and read a draft of this paper. The financial support from EPSRC under the grantGR/N03389/01 is also fully acknowledged.

References[1] J. Adamek, H. Herrlich, G. Strecker Abstract and Concrete Categories Wiley,

New York, 1990.

[2] G Bernot, M—C Gaudel, B Marre Software Testing Based on Formal Specifications:a Theory and a Tool Software Engineering Journal, Nov 1991.

[3] J. Bicarregui, M. Bishop, T. Dimitrakos, K. Lano, T. Maibaum, B. Matthews,B. Ritchie Supporting Co-Use of VDM and B by Translation In J. Bicarregui, J.Fitzgerald (Eds) VDM in 2000! Proceedings of the 2nd VDM workshop, 2000.

[4] E.A. Boiten, J. Derrick A Constructive Framework for Partial Spec-ification EPSRC Fast Stream Research Proposal Case for Supporthttp://www.cs.ukc.ac.uk/research/tcs/framework/

[5] E.A. Boiten, H. Bowman, J. Derrick, P.F. Linington, M.W.A. Steen Viewpoint Con-sistency in ODP. Computer Networks, 34(3):503-537, 2000.

[6] H. Bowman, E. A. Boiten, J. Derrick, M. W. A. Steen. Strategies for ConsistencyChecking Based on Unification. Science of Computer Programming, 33:261-298, 1999.

[7] M.C. Bujorianu, E.A. Boiten Consistency Checking and Unification of Partial Spec-ifications Using Category Theory submitted.

[8] M.C. Bujorianu, M.L. Bujorianu On the Hilbert Machines Quantitative Com-putational Model QAPL’01 Workshop on Quantitative Aspects of ProgrammingLaguages, Satellite Event of PLI’02, September 3 - 7, 2001 — Firenze, Italy. Toappear in Vol. 60 of Electronic Notes in Theretical Computer Science, Elsevier,www.elsevier.locate/tcs/

150


[9] M.C. Bujorianu, M.L. Bujorianu Linear Logic: From Stochastic Analysis to SoftwareTesting BCTCS 18 British Colloquium for Theoretical Computer Science, Bristol,UK, 2002.

[10] R. Diaconescu. Extra Theory Morphisms for Institutions: Logical Semantics forMulti-paradigm Languages. Technical Report IS-RR-96-0024S, Japan Institute of Sci-ence and Technology, 1996.

[11] A. Finkelstein, J. Kramer, B. Nuseibeh, L. Finkelstein, M. Goedicke.VIEWPOINTS:a Framework for Integrating Multiple Perspectives in System Development. Interna-tional Journal on Software Engineering and Knowledge Engineering, 2(1):31-58, 1992.

[12] M.C. Gaudel, P.R. James Testing Algebraic Data Types and Processes: A UnifyingTheory. Formal Aspects of Computing , 10(5-6), pp. 436-451, 1998.

[13] M.C. Gaudel Testing Can Be Formal, Too. TAPSOFT 1995, pp. 82-96, 1994.

[14] J. Goguen, G. Rosu Institution Morphisms to appear in Formal Aspects of Comput-ing.

[15] T. Harper, R., Sannella, D., Tarlecki, A. Structured Theory Presentations and LogicRepresentations. Annals of Pure and Applied Logic 67:113—160 1994.

[16] P.F. Linington, J. Derrick, H. Bowman The Specification and Conformance of ODPSystems. In 9th International Workshop on Testing of Communicating Systems, IFIPTC6/WG6.1, Chapman & Hall, pp. 93-114. 1996.

[17] I. MacColl, D. Carrington Testing MATIS: a Case Study on Specification-based Test-ing of Interactive Systems Formal Aspects of Human Computer Interaction Work-shop, Sheffield, UK September 1998

[18] P. D. L. Machado. On Oracles for Interpreting Test Results Against Algebraic Speci-fications. In Proceedings of AMAST’98, volume 1548 of LNCS, Springer, 1999.

[19] S. Maharaj Towards a Method of Test Case Extraction from Correctness Proofs. inProceedings of the 14th International Workshop on Algebraic Development Tech-niques, Bonas, France, pp 45-46, November 1999.

[20] S. Maharaj Test Case Extraction from Correctness Proofs Case for Support 2000http://www.cs.stir.ac.uk/~sma/testing.ps

[21] B. Marre, P. Thévenod-Fosse, H. Waeselynck, P. Le Gall et Y. Crouzet. An Exper-imental Evaluation of Formal Testing and Statistical Testing, IV. Fault Removal.Section C., pages 273—281. ESPRIT Basic Research Series, Predictably DependableComputing Systems. Springer-Verlag, 1995. Also SAFECOMP’92, Randell, B. andLaprie, J.-C. and Kopetz, H. and Littlewood, B. (ed.)

[22] J. Meseguer General Logics. In Logic Colloquium’87, pp. 275—329, North Holland,1989.

[23] D. Pemberton, I. Sommerville VOCAL: A Framework For Test Identification & De-ployment in IEE Proceedings - Software Engineering, Vol. 144, Issue 5-6, , p. 249 -260, 1997.

[24] V. Wiels, S. EasterbrookManagement of Evolving Specifications Using Category The-ory Automated Software Engineering 98 October 13-16 1998, Hawai

151

Formal Approaches to Testing of Softwarecsstrmh/concur2002/Fates02_proceedings.pdf · Rob Hierons...

Documents

Transcript of Formal Approaches to Testing of Softwarecsstrmh/concur2002/Fates02_proceedings.pdf · Rob Hierons...