Specifying the UQ ? editor user-interface with Object-Z Andrew Hussey and David Carrington Software Verification Research Centre School of Information Technology The University of Queensland Brisbane , Qld , 4072 , Australia email : fahussey,davecg@it.uq.edu.au Abstract The specification of a user-interface describes userperceivable functions and information structures in an implementation-independent way . In this paper we specify part of the user-interface for the UQ ? editor . The UQ ? editor is part of an integrated programming environment currently under development at the University of Queensland . We use the Object-Z formal specification language . We demonstrate that Object-Z can be useful for abstractly specifying user-interfaces . 1 Introduction Editors -LRB- and their user-interfaces -RRB- have been a popular choice of case study for formal specification -LSB- 14 , 15 , 17 , 7 -RSB- . This paper provides an example specification of part of the user-interface for the UQ ? editor -LSB- 18 , 19 -RSB- . The edit window of the prototype UQ ? editor user-interface is depicted in Figure 1 . The UQ ? editor is an intrinsically interesting case study for specification because it is an example of a ubiquitous genre of systems while providing several unique facilities that editors do not normally provide . Because the specification in this paper is of the user-interface , it is distinguished from previous specifications of UQ ? -LRB- e.g. , -LSB- 20 -RSB- -RRB- . This paper also differs from such previous specifications because we use Object-Z as our specification language . Our techniques for user-interface specification using Object-Z are novel . The specification described in this paper demonstrates that Object-Z can be used to produce a concise and understandable definition of a large and complex user-interface . The following section provides an informal overview of the functions provided by the UQ ? editor user-interface . In Figure 1 . Edit window Section 3 we consider the partitioning of concerns between design and specification . Section 4 specifies some aspects of the UQ ? editor user-interface using Object-Z . Section 5 uses our specification to demonstrate proof of user-interface properties . 2 Informal description of the UQ ? editor In this section we informally describe aspects of the UQ ? editor that are relevant to cursor-manipulation in the UQ ? user-interface . The description is not exhaustive and is intended to provide the reader with sufficient context to understand the formal specification given in Section 4 . The UQ ? editor is a generic editor for manipulating documents that conform to a defined syntax . The editor provides syntax-directed formatting of the document . UQ ? is a generic language-based editor that achieves genericity via language descriptions expressed in an enhanced EBNF that includes adaptive formatting directives -LSB- 12 -RSB- . The facilities provided by the editor can be divided into three groups . Those concerned with a textual view of the document -LRB- e.g. , cutting , pasting , copying -RRB- , those concerned with the contexts embedded in the document and those concerned with cursor manipulation -LRB- movement and operations to promote and demote the cursor -RRB- . In most editors , the cursor is set at the character level ; however in UQ ? , the cursor may be promoted and demoted through multiple levels from the lexical -LRB- character -RRB- level to the root of the associated parse tree . The cursor is seen by the user to expand and shrink with promotion and demotion ; the text within the cursor indicates the sub-tree rooted at the cursor position . The size of the cursor corresponds to the characters that are descendants at the leaf level of the sub-tree at which the cursor is currently located . Figure 1 shows the cursor at the symbol level . Figure 2 shows the underlying parse tree for the contents of the editor in Figure 1 . We have drawn the lexical level of the tree for only the first symbol -LRB- i.e. , ? MODULE ? -RRB- to prevent the diagram becoming overly cluttered . The symbol ? MODULE ? consists of the characters ` M ' , ` O ' , ` D' , ` U ' , ` L' and ` E ' . 3 Specification A specification describes the functions that a system provides to its users without explanation of how those functions are implemented . A user-interface specification is a description of a system from the perspective of its users -LRB- i.e. , a description of the view of the system that is provided to users -RRB- ; such a specification is useful for developing user-interface designs . A user-interface specification can be used to develop a user-interface prototype that provides look-and-feel but without the full functionality of the system . A specification of an interactive system 's user-interface indicates which functional aspects of the system -LRB- data and operations -RRB- are perceivable by the user and the logical organisation of information provided by the interface . The user-interface specification is derived from a more abstract system-oriented specification . A user-interface specification does not describe the presentation -LRB- e.g. , visual/audio -RRB- aspects of the user-interface . The presentation aspects are design concerns -LRB- i.e. , how the user-interface is implemented , rather than an abstract description of what is to be implemented -RRB- . For this reason , a specification of a user-interface provides only part of the information needed to construct an implementation . User-interfaces can be specified as a collection of interacting agents using an agent-based language -LSB- 1 -RSB- . Agents have state , operations upon that state and may respond to and initiate events -LSB- 1 -RSB- . In an interactive system , agents are presented to users . The agent and its presentation together define an interactor -LSB- 3 -RSB- . An interactor has a presentation aspect that reflects the internal state of the application -LSB- 4 -RSB- -LRB- i.e. , as defined by the corresponding agent -RRB- . Interactors can be combined to form larger -LRB- more complex -RRB- interactors -LRB- see Figure 3 -RRB- . Each agent is a specification of a corresponding Presentation Operations State and State and Operations Presentation State and Operations Presentation Interactor B Interactor A System Figure 3 . An interactor specification interactor . The interactor specifications define the logical organisation of information presented by the user-interface and therefore provide a starting point for design of the presentation . The structure of an interactor-based specification -LRB- i.e. , choice of agents -RRB- does not force the structure of a corresponding implementation . Object-Z , an object-oriented extension of Z -LSB- 13 -RSB- , can be used as a notation for interactor-based specification . A brief description of Object-Z is provided in the Appendix . 4 UQ ? specification In this section we present a specification for part of the UQ ? editor user-interface . The following section describes some basic data structures . Section 4.2 describes an interactor for cursor manipulation while Section 4.3 describes text editing . Readers are referred to -LSB- 10 -RSB- for an extended specification that describes an additional interactor -LRB- UQ?Context -RRB- concerned with movement between ? contexts ? within a document . 4.1 Basic State Objects UQ ? is a text recognition editor rather than a templatebased editor . This means that the editor is capable of handling documents that do not conform to the language syntax . For the user , this provides flexibility compared to templatebased editors . UQ ? achieves this flexibility through the concepts of error and hole nodes within the abstract syntax tree . For this user-interface specification , we have not distinguished these special node types . Module-Heading Symbols Characters Module - Heading-End Procedure - `` Example '' `` END '' '' ; '' `` Null '' `` END '' '' ; '' `` PROCEDURE '' '' ; '' Block-Body Block Declaration Procedure-Declaration `` Null '' Heading Module-Block Program-Module M O D U L E `` MODULE '' `` Example '' '' . '' Figure 2 . An instantiation of the UQ ? editor The abstract class Node captures the common hierarchical arrangement of elements within a parse-tree . If the node is the root of the tree , the parent of the node is itself . Node child : iseq #Node C parent : #Node A non-terminal is a node for which the parent is a nonterminal and the sub-nodes are either non-terminals or symbols . Non Terminal Node 8 p : child ffl p 2 -LRB- Non Terminal -LSB- Symbol -RRB- parent 2 Non Terminal Symbols are nodes that have characters as their children . Symbol Node 8 p : child ffl p 2 Char parent 2 Non Terminal Each character is also a node in the parse-tree . Conceptually , characters do not include whitespace . We ignore whitespace for simplicity , i.e. , the system 's behaviour in respect of whitespace is unconstrained by our specification . We assume Character as a given type . -LSB- Character -RSB- Char Node value : Character child = h i parent 2 Symbol Symbols and characters can access previous and next nodes in the parse-tree that are of the same type as themselves -LRB- e.g. , the next symbol in Figure 2 from ? MODULE ? is ? Example ? -RRB- . To make finding the previous and next nodes easier , we define the auxiliary function TreeToNodeSeq that defines the sequence of nodes of a specified type in the parse tree . -LSB- X -RSB- TreeToNodeSeq : #Node ! -LRB- seq X -RRB- 8 p : #Node ffl p 2 X -RRB- TreeToNodeSeq -LRB- p -RRB- = hpi ^ p 62 X -RRB- TreeToNodeSeq -LRB- p -RRB- = a = -LRB- p : child o9 TreeToNodeSeq -RRB- TreeToNodeSeq -LSB- Symbol -RSB- produces the sequence of nodes at the symbol level -LRB- in the case of our example in Figure 2 this would be h ? MODULE ? , ? Example ? , : : ? Example ? , ? . ? i , where : : indicates elided nodes -RRB- . We define an auxiliary relation that contains all pairs of parse-trees for which the first tree is a sub-tree of the second . SubTreeOf : #Node $ #Node 8 p1 ; p2 : #Node ffl p1 SubTreeOf p2 , p1 = p2 _ p1 : parent SubTreeOf p2 At this point we have defined all the components necessary to define text and cursor manipulation in UQ ? . Note that although we specify the form that a UQ ? documentmust take , we do not describe the grammar for any particular language syntax . This is because we want to specify cursor manipulation generically rather than specific to a particular language . Language-specific instantiations can be derived from the specification provided in this paper . We choose to define separate interactors for each concern identified in Section 2 . Note that each interactor does not necessarily provide a subset of the functions accessible via the UQ ? interface . It is only when the interactors are composed at the system level that the final user accessible operations are defined . 4.2 Cursor Interactor The cursor interactor defines the behaviour of the cursor within the document . The cursor can be set or moved at either the symbol or character level . The user can also promote or demote the cursor . The cursor is defined by a node in the parse-tree and encompasses all the nodes that are descendants of that node . At the root level , the cursor encompasses the entire document . Relative cursor movement -LRB- i.e. , next and previous operations -RRB- is only permitted when the cursor is defined at either the symbol or character level . The function CursorParent is used to define promotion and demotion of the cursor . It defines the closest ancestor node of the argument that has multiple children -LRB- or the argument itself if none , i.e. , in the case of the root node , the parent is the root node itself -RRB- . CursorParent : #Node ! #Node 8 p : #Node ffl -LRB- let par = p : parent ffl -LRB- #par : child > 1 _ par : parent = par -RRB- -RRB- CursorParent -LRB- p -RRB- = par ^ -LRB- #par : child = 1 ^ par : parent < > par -RRB- -RRB- CursorParent -LRB- p -RRB- = CursorParent -LRB- par -RRB- -RRB- UQ?Cursor is an interactor that permits the user to alter the position of a cursor within a document . The Object-Z definition of UQ?Cursor appears as Figure 4 . The cursor is defined by a node within the tree . The user can set the cursor to any node that is either a Symbol or Character . The cursor can also be manipulated both vertically and horizontally within the tree . Promotion moves the cursor from its current position to that node 's parent . Each promotion saves the previous cursor position . so that a corresponding demotion can return the cursor to the same position . For example , if the cursor is at the symbol level and is the third child of that symbol 's parent within child , promotion of the cursor , followed by demotion , would return the cursor to the third child -LRB- rather than the first or last or some other default -RRB- . The operations NextCharacter , PreviousCharacter , NextSymbol and PreviousSymbol move the cursor at the character and symbol levels within the parse tree -LRB- see Figure 2 -RRB- . Relative movement at the symbol level clears the list of previous cursor positions , rendering demotion of the cursor unavailable . The attribute start denotes the start of text object -LRB- of class StartOfText -RRB- for a cursor interactor and is not part of the tree . The StartOfText class has no operations or state . A user can move the cursor to the start of text so that insertion may occur prior to the document text . However , because start is not part of the tree , promotion from and demotion to start is not possible . 4.3 Text interactor Text manipulation within the UQ ? system is dealt with by a text interactor which we define in Figure 5 . The text interactor is responsible for displaying the document as text -LRB- seq Char -RRB- and performing text operations such as Cut , Copy , PasteToHighlight and PasteToPosition . Operations that alter text -LRB- i.e. , DeleteText , DeleteHighlight , Cut , Insert , PasteToHighlight and PasteToPosition -RRB- result in the tree being automatically re-parsed i.e. , the dependency relationship -LRB- denoted by D -RRB- between tree and text ensures that tree is always a tree-based equivalent of text . We define a Buffer agent that facilitates cutting , pasting and other editing operations . UQ?Cursor ? -LRB- GetCursorPosn ; SetCursorPosn ; GetCursor ; SetCursor ; Promote ; Demote ; NextCharacter ; PreviousCharacter ; NextSymbol ; PreviousSymbol -RRB- cursor : #Node -LSB- StartOfText tree : Non Terminal past : seq #Node start : StartOfText D text : seq -LRB- Char -LSB- StartOfText -RRB- symbols : seq Symbol cursor 2 #Node -RRB- cursor SubTreeOf tree tree : parent = tree text = hstarti aTreeToNodeSeq -LSB- Char -RSB- -LRB- tree -RRB- symbols = TreeToNodeSeq -LSB- Symbol -RSB- -LRB- tree -RRB- INIT past = h i GetCursorPosn posn ! : N cursor = text -LRB- posn ! + 1 -RRB- SetCursorPosn D -LRB- cursor ; past -RRB- posn ? : N past = h i cursor = text -LRB- posn ? + 1 -RRB- GetCursor node ! : #Node -LSB- StartOfText node ! = cursor SetCursor D -LRB- cursor ; past -RRB- node ? : #Node -LSB- StartOfText node ? 2 -LRB- Symbol -LSB- Char -LSB- StartOfText -RRB- cursor = node ? past = h i Promote D -LRB- cursor ; past -RRB- cursor 62 StartOfText CursorParent -LRB- cursor -RRB- < > cursor cursor = CursorParent -LRB- cursor -RRB- past = hcursori a past Demote D -LRB- cursor ; past -RRB- cursor 62 StartOfText past = hcursor i a past NextCharacter D -LRB- cursor -RRB- cursor 2 Char -LSB- StartOfText 9 n : N j cursor = text -LRB- n -RRB- ffl n < #text ^ cursor = text -LRB- n + 1 -RRB- PreviousCharacter D -LRB- cursor -RRB- cursor 2 Char 9 n : N j cursor = text -LRB- n -RRB- ffl n > 1 ^ cursor = text -LRB- n ? 1 -RRB- NextSymbol D -LRB- cursor ; past -RRB- node ! : #Node cursor 2 Symbol 9 n : N j cursor = symbols -LRB- n -RRB- ffl n < #symbols ^ cursor = symbols -LRB- n + 1 -RRB- past = h i node ! = cursor PreviousSymbol D -LRB- cursor ; past -RRB- node ! : #Node cursor 2 Symbol 9 n : N j cursor = symbols -LRB- n -RRB- ffl n > 1 ^ cursor = symbols -LRB- n ? 1 -RRB- past = h i node ! = cursor Figure 4 . UQ?Cursor interactor UQ?Text ? -LRB- DeleteText ; DeleteHighlight ; SelectHighlight ; NodeHighlight ; CancelHighlight ; Insert ; Copy ; Cut ; PasteToHighlight ; PasteToPosition -RRB- buffer : UQ?Buffer tree : Non Terminal highlight : seq Char D start ; finish : N text : seq Char tree : parent = tree highlight < > h i -RRB- highlight = -LRB- start : : finish -RRB- ? text text = TreeToNodeSeq -LSB- Char -RSB- -LRB- tree -RRB- INIT buffer : INIT highlight = h i CancelHighlight D -LRB- highlight -RRB- highlight = h i DeleteText D -LRB- tree ; highlight -RRB- textposn ? ; posn ! : N textposn ? 2 dom text text = ftextposn?g ? text highlight = h i posn ! = textposn ? ? 1 DeleteHighlight D -LRB- tree ; highlight -RRB- posn ! : N highlight < > h i text = squash -LRB- -LRB- start : : finish -RRB- ? C text -RRB- highlight = h i posn ! = start ? 1 SelectHighlight D -LRB- highlight -RRB- start ? ; finish ? : N fstart ? ; finish?g ? dom text highlight = -LRB- start ? : : finish ? -RRB- ? text NodeHighlight D -LRB- highlight -RRB- node ? : #Node -LSB- StartOfText node ? 62 StartOfText highlight = TreeToNodeSeq -LSB- Char -RSB- -LRB- node ? -RRB- Insert D -LRB- tree -RRB- text ? : seq Char posn ? : N highlight = h i text = -LRB- 1 : : posn ? -RRB- ? text a text?a -LRB- -LRB- posn ? + 1 -RRB- : : # -LRB- dom text -RRB- -RRB- ? text DoPasteToHighlight D -LRB- tree ; highlight -RRB- text ? : seq Char highlight < > h i text = -LRB- 1 : : start -RRB- ? text a text?a -LRB- finish + 1 : : #text -RRB- ? text highlight = -LRB- start : : start + #text ? -RRB- ? text Copy b = -LSB- text ! : seq Char j text ! = highlight -RSB- k buffer : SetBuffer Cut b = Copy o9 DeleteHighlight PasteToHighlight b = buffer : Contents k DoPasteToHighlight PasteToPosition b = buffer : Contents k Insert Figure 5 . UQ?Text interactor UQ?Buffer text : seq Char SetBuffer D -LRB- text -RRB- text ? : seq Char text = text ? INIT text = h i Contents text ! : seq Char text ! = text 4.4 Document interactor We build a system by combining the behaviours of the UQ?Context , UQ?Cursor and UQ?Text interactors by instantiating each interactor as a component of a UQ?Document interactor . The operations of UQ?Document are a product of combining operations pro- UQ?Document uqcursor : UQ?Cursor uqcontext : UQ?Context uqtext : UQ?Text uqcursor : tree = uqtext : tree : : : INIT uqcursor : INIT uqcontext : INIT uqtext : INIT SetCursorLexical b = uqcursor : SetCursor ^ -LSB- uqcursor : cursor 2 Char -RSB- ^ uqtext : CancelHighlight SetCursorSymbol b = uqcursor : SetCursor ^ -LSB- uqcursor : cursor 2 Symbol -RSB- ^ uqtext : NodeHighlight NextCharacter b = uqcursor : NextCharacter ^ uqtext : CancelHighlight PreviousCharacter b = uqcursor : PreviousCharacter ^ uqtext : CancelHighlight NextSymbol b = uqtext : CancelHighlight o9 -LRB- uqcursor : NextSymbol k uqtext : NodeHighlight -RRB- PreviousSymbol b = uqtext : CancelHighlight o9 -LRB- uqcursor : PreviousSymbol k uqtext : NodeHighlight -RRB- Promote b = uqcursor : Promote o9 uqcursor : GetCursor k uqtext : NodeHighlight Demote b = uqcursor : Demote o9 uqcursor : GetCursor k uqtext : NodeHighlight Paste b = -LRB- uqcursor : GetCursorPosn k uqtext : PasteToPosition -RRB- -LSB- -RSB- uqtext : PasteToHighlight Copy b = uqtext : Copy Cut b = uqtext : Cut k uqcursor : SetCursorPosn Insert b = -LRB- -LRB- uqtext : DeleteHighlight k uqcursor : SetCursorPosn -RRB- o9 uqcursor : GetCursorPosn k uqtext : Insert -RRB- -LSB- -RSB- -LRB- -LSB- uqtext : highlight = h i -RSB- ^ uqcursor : GetCursorPosn k uqtext : Insert -RRB- SelectHighlight b = uqtext : SelectHighlight Delete b = -LRB- uqtext : DeleteHighlight k uqcursor : SetCursorPosn -RRB- -LSB- -RSB- -LRB- -LRB- uqcursor : GetCursorPosn -LSB- textposn ! = posn ! -RSB- k uqtext : DeleteText -RRB- k uqcursor : SetCursorPosn -RRB- : : : Figure 6 . UQ?Document interactor moted from uqcursor such as uqcursor : SetCursor with operations promoted from uqcontext and uqtext . Acquisition of features by instantiation has been advocated by Johnson et al. -LSB- 11 -RSB- . The absence of a visibility list implies that all the operations of the UQ?Document class are visible . The document interactor is defined in Figure 6 -LRB- where : : : indicates elided operations -RRB- . 5 Properties A strength of formal methods is that they can be used to deduce properties of a system and reason about the consistency of a design . Fully formal proofs are machine checkable . A formal description allows the deduction of properties such as ? the impossibility of reaching states you have determined to be unsafe ? -LSB- 16 -RSB- . In analysing a formal specification , our aim is to show that certain invariants , that we believe to hold , do in fact hold . It is only possible to investigate properties that relate to the syntax and semantics of the user-interface ; lexical properties must be analysed as part of user-interface design . The questions with which we are concerned fall into two distinct groups : ffl Is a certain action possible or impossible either before or after another action ? ffl Is a certain state possible or impossible either before or after an action ? The former are referred to as dialogue properties . Fields et al. -LSB- 8 -RSB- have identified a number of classes of errors defined as properties of the sequences of events that are required to perform a task . The effect of such errors may then be studied and critical errors may be identified . Common error types identified by Fields et al. are : 1 . omission of events -LRB- or whole sequences of events -RRB- ; 2 . substitution of events -LRB- one for another -RRB- ; 3 . reversal of two events -LRB- or two sequences of events -RRB- . To prevent undesirable traces of events occurring , additional interface moding may be required -LSB- 8 -RSB- . However moded constraints may be undesirable . In such cases it may be sufficient to simply provide more information to the user -LRB- i.e. , regarding the probable consequences of an event -RRB- . Properties of the system that should never be true are referred to by Duke et al. as ? conformance ? properties -LSB- 5 -RSB- . Conformance properties may define either dialogue sequences that must not occur , or properties of the system state that must never occur . Atkinson et al. -LSB- 2 -RSB- provide examples of the type of properties that a system specifier may wish to detect . For example , it is useful to know whether a sequence of actions is -LRB- automatically -RRB- performed to produce a safe system state from an acknowledged unsafe system state . Alternatively , it may be desirable to prove that there is no valid sequence of actions that permits such an unsafe outcome . An Object-Z specification enables us to answer questions , such as those described above , with certainty . For example , we may want to know whether a user can promote the cursor from a Char to a Symbol and then move the cursor either left or right -LRB- assuming the promoted cursor is not at the first or last symbol in the document respectively -RRB- . The notation that we use for this example is CSP -LSB- 9 -RSB- . The symbol X denotes the termination of a finite process : User = promote ! -LRB- previous ? symbol j next ? symbol -RRB- ! X -LRB- where promote , previous ? symbol and next ? symbol denote lexical actions by the user to perform the operations Promote , PreviousSymbol and NextSymbol in the specification -RRB- and the state of the uqcursor interactor prior to the promotion is that cursor 2 Char . From the class Char , we know that the parent of a Char is a Symbol . Following promotion , cursor is CursorParent -LRB- cursor -RRB- . Furthermore , since Promote will not proceed if CursorParent -LRB- cursor -RRB- = cursor nor if cursor 2 StartOfText , it follows that following promotion from a Char , cursor 2 Symbol . Both PreviousSymbol and NextSymbol -LRB- and thus the user task defined above -RRB- will proceed if cursor 2 Symbol and the promoted cursor is not on the first or last symbol respectively in the document . 5.1 Example Moving text in the UQ ? editor user-interface follows the standard editor strategy , i.e. , either Move 1 = highlight ! cut ! paste ! X or Move 2 = highlight ! copy ! paste ! cut ! X -LRB- where highlight , cut , paste and copy denote lexical actions by the user to perform the operations SelectHighlight , Cut , Paste and Copy in the specification -RRB- . However it is possible that a user may perform the actions highlight ! cut , then , after a period of distraction to another activity , perform another highlight ! cut followed by paste . We may be interested to investigate the effect of this sequence of actions , i.e. , is the sequence possible , what is its effect on the state and should we introduce additional constraints to prevent the sequence occurring ? Formally the sequence that we investigate is : Double Cut = highlight ! cut ! highlight ! cut ! paste ! X The state of the system following this sequence of user actions is the state that arises from the following equivalent Object-Z operation : Double Cut b = SelectHighlight o9 Cut o9 SelectHighlight o9 Cut o9 Paste This operation is not an existing operation of the class UQ?Document but could be added to that class . The operation Double Cut affects the state of the objects uqtext -LRB- an attribute of the system -RRB- and buffer -LRB- an attribute of uqtext -RRB- . Following the first SelectHighlight and Cut , the following predicates hold for uqtext -LRB- we rename start and finish to start1 and finish1 -RRB- : text = squash -LRB- -LRB- start1 : : finish1 -RRB- ? C text -RRB- highlight = h i and for buffer -LRB- we rename the text attribute of buffer to buffer text -RRB- : buffer text = -LRB- start1 : : finish1 -RRB- ? text The second SelectHighlight and Cut produces a similar result ; there is no restrictive predicate that prevents the operation from proceeding -LRB- and therefore Double Cut as a whole -RRB- . However in this case the effect on buffer from the first cut is lost -LRB- we rename start and finish to start2 and finish2 -RRB- : text 00 = squash -LRB- -LRB- start2 : : finish2 -RRB- ? C text -RRB- highlight 00 = h i and for buffer : buffer text 00 = -LRB- start2 : : finish2 -RRB- ? text So , the effect of SelectHighlight o9 Cut o9 SelectHighlight o9 Cut is as follows : text 00 = squash -LRB- -LRB- start2 : : finish2 -RRB- ? C -LRB- squash -LRB- -LRB- start1 : : finish1 -RRB- ? C text -RRB- -RRB- -RRB- highlight 00 = h i and for buffer : buffer text 00 = -LRB- start2 : : finish2 -RRB- ? text The effect of a Paste operation , from this system state , is therefore : text 000 = -LRB- 1 : : posn ? -RRB- ? text 00 a -LRB- start2 : : finish2 -RRB- ? text a -LRB- -LRB- posn ? + 1 -RRB- : : # -LRB- dom text 00 -RRB- -RRB- ? text 00 So , we can determine that the effect of a SelectHighlight o9 Cut o9 SelectHighlight o9 Cut is the same as SelectHighlight o9 DeleteHighlight o9 Cut -LRB- showing that the resulting state is the same is a straight-forward exercise -RRB- and therefore the results of the first Cut operation are lost . From a userinterface perspective , this result may indicate the need for moding -LRB- i.e. , the user can not cut again until they have pasted the buffer or cancelled the cut -RRB- , or a warning to the user when they select cut a second time without having pasted . 6 Conclusions We have demonstrated that Object-Z is helpful for specifying user-interfaces . The specification is concise and the effect of user actions and their allowable sequencing is clear . The approach taken produces a clear distinction between specification concerns when constructing a user-interface and design concerns . In particular , we distinguish between : ffl how to display the system state and obtain input , and ffl what is displayed , the available operations and the effects of such operations on what is displayed . In an Object-Z specification , we explicitly define those operations that are available to the user by including them in the export list of the system-level class . Such a specification provides an accurate mechanism for communicating the characteristics of a user-interface from a designer to an implementer . The effort required to produce such a formal specification is well spent ; the exercise is inherently useful for requirements analysis and the product is clear and succinct documentation of the user-interface . The specification demonstrates some key aspects that distinguish an Object-Z user-interface specification from other Object-Z specifications of the system : 1 . Our focus is on the user-interface therefore we only describe what is necessary to illuminate the perceivable functions of the user-interface . 2 . The specification describes the model that a user could construct of the system from interaction with the userinterface i.e. , the specification formalises the anticipated user model . 3 . Agents are used to encapsulate key aspects of system behaviour . 4 . Operations on agents -LRB- e.g. , an instance of UQ?Cursor -RRB- can be used to define user tasks . This work forms part of a research project that aims to determine mechanisms for formally specifying and designing user-interfaces . Our current work is directed toward defining a refinement path from specifications of the type illustrated by this case study to designs . Acknowledgements The authors are grateful to Anthony MacDonald for suggesting the UQ ? editor as a case study for specification and to Steven Atkinson for reviewing a draft of this paper . References -LSB- 1 -RSB- G. D. Abowd . Formal descriptions of user interfaces . Colloquium Digest , 192:7 / 1 ? 7/3 , 1991 . -LSB- 2 -RSB- W. Atkinson and J. Cunningham . Proving properties of a safety-critical system . Software Engineering Journal , pages 41 ? 50 , Mar. 1991 . -LSB- 3 -RSB- J. Coutaz , L. Nigay , and D. Salber . Agent-Based Architecture Modelling for Interactive Systems . Technical Report SM/WP53 , LGI-IMAG , Grenoble , Apr. 1995 . ESPRITBRA 7040 Amodeus-2 . -LSB- 4 -RSB- D. J. Duke and M. D. Harrison . Abstract Interaction Objects . Computer Graphics Forum Conference Issue , 12 -LRB- 3 -RRB- :25 ? 36 , Sept. 1993 . -LSB- 5 -RSB- D. J. Duke and M. D. Harrison . From Formal Models to Formal Methods . In R. N. Taylor and J. Coutaz , editors , ICSE WorkshoponSE-HCI : Joint Research Issues : Sorrento , Italy , LNCS 896 , pages 159 ? 173 . Springer-Verlag , 1994 . -LSB- 6 -RSB- R. Duke , G. Rose , and G. Smith . Object-Z : a Specification Language Advocated for the Description of Standards . Computer Standards and Interfaces , 17:511 ? 533 , 1995 . -LSB- 7 -RSB- B. Fields , M. Harrison , and P. Wright . Modelling Interactive Systems and Providing Task Relevant Information . In F. Paterno , editor , Interactive Systems : Design , Specification and Verification ? 1st Eurographics Workshop , pages 253 ? 266 . Springer-Verlag , June 1994 . -LSB- 8 -RSB- B. Fields , P. Wright , and M. Harrison . Applying Formal Methods for Human Error Tolerant Design . In R. N. Taylor and J. Coutaz , editors , ICSE Workshop on SE-HCI : Joint Research Issues : Sorrento , Italy , LNCS 896 , pages 184 ? 195 . Springer-Verlag , 1994 . -LSB- 9 -RSB- C. A. R. Hoare . Communicating Sequential Processes . Prentice-Hall International , 1985 . -LSB- 10 -RSB- A. Hussey and D. Carrington . Specifying the UQ ? userinterface with Object-Z . Software Verification Research Centre TR97-02 , The University of Queensland , Apr. 1997 . -LSB- 11 -RSB- R. E. Johnson and B. Foote . Designing Reuseable Classes . Journal of Object-Oriented Programming , 1 -LRB- 2 -RRB- :22 ? 47 , June 1988 . -LSB- 12 -RSB- G. A. Roseand J. Welsh . Formatted programming languages . Software?Practice and Experience , 11:651 ? 69 , 1981 . -LSB- 13 -RSB- J. M. Spivey . The Z notation : a reference manual . PrenticeHall , 2nd edition , 1992 . -LSB- 14 -RSB- B. Sufrin . Formal Specification of a Display-Oriented Text Editor . Science of Computer Programming , 1:157 ? 202 , 1982 . -LSB- 15 -RSB- B. Sufrin and J. He . Formal Methods in Human-Computer Interaction , chapter 6 - Specification , analysis and refinement of interactive processes , pages 153 ? 200 . Cambridge University Press , Cambridge , 1990 . -LSB- 16 -RSB- M. Thomas . The role of formal methods in achieving dependable software . Reliability Engineering and System Safety , 43:129 ? 134 , 1994 . -LSB- 17 -RSB- R. Took . Surface Interaction : A Paradigm and Model for separating Application and Interface . In J. C. Chew and J. Whiteside , editors , Human Factors in Computing Systems : Empowering People : CHI '90 Conference Proceedings Special Issue of the ACM-SIGCHI Bulletin , pages 35 ? 42 , 1990 . -LSB- 18 -RSB- J. Welsh , B. Broom , and D. Kiong . A Design Rationale for a Language-Based Editor . Software Practice and Experience , 21 -LRB- 9 -RRB- :923 ? 48 , 1991 . -LSB- 19 -RSB- J. Welsh and J. Han . Software Documents : Concepts and Tools . Software-Concepts and Tools , 15:12 ? 25 , 1994 . -LSB- 20 -RSB- L. Wildman and I. Hayes . Composing grammar transformations to construct a specification of a parser . Software Verification Research Centre TR95-3 , The University of Queensland , Jan. 1995 . Appendix : Modelling using Object-Z This appendix assumes that you understand Z -LSB- 13 -RSB- . It provides a brief description of those features of Object-Z that are not part of Z and that are used in this paper . Further details can be found in -LSB- 6 -RSB- . In an Object-Z description , a class is defined by a named box encapsulating a visibility list , state , initialisation and operations . A simple example class defining a stack of natural numbers appears below : Stack ? -LRB- Push ; Pop ; Top -RRB- elements : seq N D top : N top = last -LRB- elements -RRB- Push D -LRB- elements -RRB- num ? : N elements0 = elements a hnum?i INIT elements = h i Top top ! : N top ! = top Pop D -LRB- elements -RRB- num ! : N elements = elements0 a hnum!i The visibility list -LRB- prefixed by ? -RRB- defines those operations and attributes that are visible to clients of the class . If there is no visibility list , all operations are visible . The state schema is un-named and contains attribute declarations and a constraining invariant . Some attributes may be dependent on other attributes -LRB- i.e. , their value is always derivable from those other attributes -RRB- . Such dependencies are denoted by a D on a separate line preceding the dependent attributes -LRB- e.g. , top -RRB- . The nature of this dependency is captured by the class invariant . The initialisation schema is labelled INIT and defines the initial state of instances of the class . An operation schema is divided into two parts . The upper part defines the context of the operation includinginputs and outputs . The D-list defines which state attributes are altered by an operation . State variables not listed in the D-list are unchanged by that operation . The lower part defines a predicate relating the initial and final states of the operation . Classes may inherit from other classes . Inheritance results in a merger of state , INIT and operation schemas with the same name . For example , we define a new stack class that can return its size : NewStack Stack Size size ! : N size ! = #elements A class may be instantiated . For example , the declaration stack : Stack defines an object stack of type Stack . The polymorphic operator -LRB- # -RRB- defines the type of an object as either the specified base class or any class that inherits from the base class . Operations applied to such an attribute must be polymorphic , i.e. , regardless of the actual class of the object , the operation must be defined . For example , the declaration stack : #Stack defines an object stack that can be an instance of any class that inherits from Stack . Operations and attributes of class instances may be accessed . For example , the term s : elements denotes the value of the attribute elements of s while -LRB- where s is an object of class Stack -RRB- while the term s : Push denotes the operation Push applied to s. Operations may be combined using an extension of the Z schema calculus -LSB- 13 -RSB- , including sequential composition -LRB- o9 -RRB- and conjunction -LRB- ^ -RRB- . Object-Z also provides a concurrency operator -LRB- k -RRB- that conjoins operation schemas -LRB- i.e. , merges state and predicates -RRB- and identifies inputs with outputs having the same base name .

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O