]> Verizon Labs

50 Sylvan Rd Waltham MA 02451 USA +1 781 296 9722 kerlyn@ieee.org

Johnson Controls, Inc.

507 E. Michigan St Milwaukee WI 53202 USA +1 414 524 4010 jerald.p.martocci@jci.com

Delta Controls, Inc.

17850 56th Ave Surrey BC V3S 1C7 Canada +1 604 575 5913 cneilson@deltacontrols.com

Honeywell Automation & Control Solutions

6670 185th Ave NE Redmond WA 98052 USA stuart.donaldson@honeywell.com

Internet 6Lo Working Group Master-Slave/Token-Passing (MS/TP) is a medium access control method for the RS-485 physical layer, which is used extensively in building automation networks. This specification defines the frame format for transmission of IPv6 packets and the method of forming link-local and statelessly autoconfigured IPv6 addresses on MS/TP networks.

Master-Slave/Token-Passing (MS/TP) is a medium access control (MAC) protocol for the RS-485 physical layer, which is used extensively in building automation networks. This specification defines the frame format for transmission of IPv6 packets and the method of forming link-local and statelessly autoconfigured IPv6 addresses on MS/TP networks. The general approach is to adapt elements of the 6LoWPAN specifications , , and to constrained wired networks. An MS/TP device is typically based on a low-cost microcontroller with limited processing power and memory. Together with low data rates and a small MAC address space, these constraints are similar to those faced in 6LoWPAN networks and suggest some elements of that solution might be leveraged. MS/TP differs significantly from 6LoWPAN in at least three respects: a) MS/TP devices typically have a continuous source of power, b) all MS/TP devices on a segment can communicate directly so there are no hidden node or mesh routing issues, and c) recent changes to MS/TP provide support for larger payloads, eliminating the need for fragmentation and reassembly below IPv6. The following sections provide a brief overview of MS/TP, then describe how to form IPv6 addresses and encapsulate IPv6 packets in MS/TP frames. This document also specifies a header compression mechanism, based on , that is REQUIRED in order to reduce latency and make IPv6 practical on MS/TP networks.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

ASHRAE: American Society of Heating, Refrigerating, and Air- Conditioning Engineers (http://www.ashrae.org) BACnet: An ISO/ANSI/ASHRAE Standard Data Communication Protocol for Building Automation and Control Networks CRC: Cyclic Redundancy Check MAC: Medium Access Control MSDU: MAC Service Data Unit (MAC client data) MTU: Maximum Transmission Unit UART: Universal Asynchronous Transmitter/Receiver

This section provides a brief overview of MS/TP, which is specified in ANSI/ASHRAE 135-2012 (BACnet) Clause 9 and included herein by reference. BACnet also covers physical layer deployment options. MS/TP is designed to enable multidrop networks over shielded twisted pair wiring. It can support network segments up to 1000 meters in length at a data rate of 115,200 bit/s, or segments up to 1200 meters in length at lower bit rates. An MS/TP link requires only a UART, an RS-485 transceiver with a driver that can be disabled, and a 5 ms resolution timer. These features make MS/TP a cost- effective field bus for the most numerous and least expensive devices in a building automation network. The differential signaling used by requires a contention- free MAC. MS/TP uses a token to control access to a multidrop bus. A master node may initiate the transmission of a data frame when it holds the token. After sending at most a configured maximum number of data frames, a master node passes the token to the next master node (as determined by MAC address). If present on the link, legacy MS/TP implementations (including all slave nodes) ignore the frame format defined in this specification. BACnet Addendum 135-2012an [Addendum_an] defines a range of Frame Type values to designate frames that contain larger data and data CRC fields, encoded using Consistent Overhead Byte Stuffing [COBS] (see Appendix B). The purpose of COBS encoding is to eliminate preamble sequences from the Encoded Data and Encoded CRC-32K fields. The maximum length of an MSDU as defined by this specification is 1500 octets (before encoding). The Encoded Data is covered by a 32-bit CRC [CRC32K] (see Appendix C). The CRC-32K is then COBS encoded. MS/TP COBS-encoded frames have the following format:

0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x55 | 0xFF | Frame Type | DA | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | SA | Length (MS octet first) | Header CRC | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . . Encoded Data (2 - 1506 octets) . . . + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | Encoded CRC-32K (5 octets) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+ | | optional 0xFF | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

MS/TP COBS-encoded frame fields have the following descriptions:

Preamble two octet preamble: 0x55, 0xFF Frame Type one octet Destination Address one octet address Source Address one octet address Length two octets, most significant octet first Header CRC one octet Encoded Data 2 - 1506 octets (see Appendix B) Encoded CRC-32K five octets (see Appendix C) (pad) (optional) at most one octet of trailer: 0xFF

The Frame Type is used to distinguish between different types of MAC frames. The types relevant to this specification (in decimal) are: 0 Token 1 Poll For Master 2 Reply To Poll For Master ... 34 IPv6 over MS/TP (LoBAC) Encapsulation

Frame Types 8 - 31 and 35 - 127 are reserved for assignment by ASHRAE. Frame Types 32 - 127 designate COBS-encoded frames and MUST convey Encoded Data and Encoded CRC-32K fields. All master nodes MUST understand Token, Poll For Master, and Reply to Poll For Master control frames. See for additional details. The Destination and Source Addresses are each one octet in length. See for additional details. For COBS-encoded frames, the Length field indicates the size of the Encoded Data field in octets, plus three. (This adjustment is required in order for legacy MS/TP devices to ignore COBS-encoded frames.) See and Appendices for additional details. The Header CRC field covers the Frame Type, Destination Address, Source Address, and Length fields. The Header CRC generation and check procedures are specified in BACnet .

The primary goal of this specification is to enable IPv6 directly on wired end devices in building automation and control networks by leveraging existing standards to the greatest extent possible. A secondary goal is to co-exist with legacy MS/TP implementations. Only the minimum changes necessary to support IPv6 over MS/TP were specified in BACnet (see ). In order to co-exist with legacy devices, no changes are permitted to the MS/TP addressing modes, frame header format, control frames, or Master Node state machine as specified in BACnet .

ASHRAE has assigned an MS/TP Frame Type value of 34 to indicate IPv6 over MS/TP (LoBAC) Encapsulation. This falls within the range of values that designate COBS-encoded data frames. All MS/TP master nodes (including those that support IPv6) must implement the Master Node state machine specified in BACnet and handle Token, Poll For Master, and Reply to Poll For Master control frames. MS/TP master nodes that support IPv6 must also implement the Receive Frame state machine specified in as extended by BACnet . All MS/TP nodes that support IPv6 MUST support a data rate of 115,200 bit/s and MAY optionally support lower data rates as defined in BACnet .

MS/TP node (MAC) addresses are one octet in length. The method of assigning MAC addresses is outside the scope of this specification. However, each MS/TP node on the link MUST have a unique address in order to ensure correct MAC operation. BACnet specifies that addresses 0 through 127 are valid for master nodes. The method specified in for creating a MAC- layer-derived Interface Identifier (IID) ensures that an IID of all zeros can never result. A Destination Address of 255 (all nodes) indicates a MAC-layer broadcast. MS/TP does not support multicast, therefore all IPv6 multicast packets SHOULD be broadcast at the MAC layer and filtered at the IPv6 layer. A Source Address of 255 MUST NOT be used. Hosts learn IPv6 prefixes via router advertisements according to .

BACnet supports MSDUs up to 2032 octets in length. This specification defines an MSDU length of at least 1280 octets and at most 1500 octets (before encoding). This is sufficient to convey the minimum MTU required by IPv6 without the need for link- layer fragmentation and reassembly. Support for an MSDU length of 1500 octets is RECOMMENDED.

The relatively low data rates of MS/TP indicate header compression as a means to reduce latency. This section specifies an adaptation layer to support compressed IPv6 headers and the compression format is specified in . Implementations MAY also support Generic Header Compression (GHC) for transport layer headers. A node implementing MUST probe its peers for GHC support before applying GHC. The encapsulation format defined in this section (subsequently referred to as the "LoBAC" encapsulation) comprises the MSDU of an IPv6 over MS/TP frame. The LoBAC payload (i.e., an IPv6 packet) follows an encapsulation header stack. LoBAC is a subset of the LoWPAN encapsulation defined in and extended by , therefore the use of "LOWPAN" in literals below is intentional. The primary difference between LoWPAN and LoBAC is omission of the Mesh, Broadcast, Fragmentation, and LOWPAN_HC1 headers. All LoBAC encapsulated datagrams transmitted over MS/TP are prefixed by an encapsulation header stack consisting of a Dispatch value followed by zero or more header fields. The only sequence currently defined for LoBAC is the LOWPAN_IPHC header followed by payload, as shown below:

+---------------+---------------+------...-----+ | IPHC Dispatch | IPHC Header | Payload | +---------------+---------------+------...-----+

The Dispatch value may be treated as an unstructured namespace. Only a single pattern is used to represent current LoBAC functionality.

Pattern Header Type +------------+-----------------------------------------------------+ | 01 1xxxxx | LOWPAN_IPHC - LOWPAN_IPHC compressed IPv6 [RFC6282] | +------------+-----------------------------------------------------+

Other IANA-assigned 6LoWPAN Dispatch values do not apply to 6LoBAC unless otherwise specified.

This section defines how to obtain an IPv6 Interface Identifier. The general procedure for creating a MAC-address-derived IID is described in Appendix A, "Creating Modified EUI-64 Format Interface Identifiers", as updated by . The IID SHOULD NOT embed an or any other globally unique hardware identifier assigned to a device (see ). The Interface Identifier for link-local addresses SHOULD be formed by concatenating a node's' 8-bit MS/TP MAC address to the seven octets 0x00, 0x00, 0x00, 0xFF, 0xFE, 0x00, 0x00. For example, an MS/TP MAC address of hexadecimal value 0x4F results in the following IID:

|0 1|1 3|3 4|4 6| |0 5|6 1|2 7|8 3| +----------------+----------------+----------------+----------------+ |0000000000000000|0000000011111111|1111111000000000|0000000001001111| +----------------+----------------+----------------+----------------+

This is the RECOMMENDED method of forming an IID for use in link-local addresses, as it affords the most efficient header compression provided by the LOWPAN_IPHC format specified in . A 64-bit privacy IID is RECOMMENDED for each forwardable address and SHOULD be locally generated according to one of the methods cited in . A node that generates a 64-bit privacy IID MUST register it with its local router(s) by sending a Neighbor Solicitation (NS) message with the Address Registration Option (ARO) and process Neighbor Advertisements (NA) according to . An IPv6 address prefix used for stateless autoconfiguration of an MS/TP interface MUST have a length of 64 bits.

The IPv6 link-local address for an MS/TP interface is formed by appending the Interface Identifier, as defined above, to the prefix FE80::/64.

10 bits 54 bits 64 bits +----------+-----------------------+----------------------------+ |1111111010| (zeros) | Interface Identifier | +----------+-----------------------+----------------------------+

The address resolution procedure for mapping IPv6 non-multicast addresses into MS/TP MAC-layer addresses follows the general description in Section 7.2 of , unless otherwise specified. The Source/Target Link-layer Address option has the following form when the addresses are 8-bit MS/TP MAC-layer (node) addresses.

0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Length=1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x00 | MS/TP Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | + Padding (all zeros) + | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Option fields: Type: 1: for Source Link-layer address. 2: for Target Link-layer address. Length: This is the length of this option (including the type and length fields) in units of 8 octets. The value of this field is 1 for 8-bit MS/TP MAC addresses. MS/TP Address: The 8-bit address in canonical bit order [RFC2469]. This is the unicast address the interface currently responds to.

All IPv6 multicast packets SHOULD be sent to MS/TP Destination Address 255 (broadcast) and filtered at the IPv6 layer. When represented as a 16-bit address in a compressed header (see ), it MUST be formed by padding on the left with a zero:

0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x00 | 0xFF | +-+-+-+-+-+-+-+-+---------------+

LoBAC uses LOWPAN_IPHC IPv6 compression, which is specified in and included herein by reference. This section will simply identify substitutions that should be made when interpreting the text of . In general the following substitutions should be made: Replace instances of "6LoWPAN" with "MS/TP network" Replace instances of "IEEE 802.15.4 address" with "MS/TP address" When a 16-bit address is called for (i.e., an IEEE 802.15.4 "short address") it MUST be formed by padding the MS/TP address to the left with a zero:

0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x00 | MS/TP address | +-+-+-+-+-+-+-+-+---------------+

If LOWPAN_IPHC compression is used with context, the router(s) directly attached to the MS/TP segment MUST disseminate the 6LoWPAN Context Option (6CO) according to , Section 7.2.

This document uses values previously reserved by and and makes no further requests of IANA. Note to RFC Editor: this section may be removed upon publication.

Forwardable addresses that contain IIDs generated using MS/TP node addresses may expose a network to address scanning attacks. For this reason, it is RECOMMENDED that a different (but stable) IID be generated for each forwardable address in use according to, for example, , , , , or . MS/TP networks are by definition wired and not susceptible to casual eavesdropping. By the same token, MS/TP nodes are stationary and correlation of activities or location tracking of individuals is unlikely.

We are grateful to the authors of and members of the IETF 6LoWPAN working group; this document borrows liberally from their work. Ralph Droms and Brian Haberman provided indispensable guidance and support from the outset. Peter van der Stok, James Woodyatt, and Carsten Bormann provided detailed reviews. Stuart Cheshire invented the very clever COBS encoding. Michael Osborne made the critical observation that separately encoding the data and CRC32K fields would allow the CRC to be calculated on-the-fly. Alexandru Petrescu, Brian Frank, Geoff Mulligan, and Don Sturek offered valuable comments.

&RFC2119; &RFC2460; &RFC4291; &RFC4861; &RFC4862; &RFC4944; &RFC6282; &RFC6775; &RFC7136; &RFC7400; &RFC3315; &RFC3972; &RFC4941; &RFC5535; &RFC7217; American Society of Heating, Refrigerating, and Air-Conditioning Engineers ASHRAE IEEE &RFC2469; Telecommunications Industry Association

This Appendix is informative and not part of the standard. BACnet provides support for MAC-layer clients through its SendFrame and ReceivedDataNoReply procedures. However, it does not define a network-protocol independent abstract interface for the MAC. This is provided below as an aid to implementation.

This primitive defines the transfer of data from a MAC client entity to a single peer entity or multiple peer entities in the case of a broadcast address.

The semantics of the primitive are as follows: MA-DATA.request ( destination_address, source_address, data, type )

The 'destination_address' parameter may specify either an individual or a broadcast MAC entity address. It must contain sufficient information to create the Destination Address field (see ) that is prepended to the frame by the local MAC sublayer entity. The 'source_address' parameter, if present, must specify an individual MAC address. If the source_address parameter is omitted, the local MAC sublayer entity will insert a value associated with that entity. The 'data' parameter specifies the MAC service data unit (MSDU) to be transferred by the MAC sublayer entity. There is sufficient information associated with the MSDU for the MAC sublayer entity to determine the length of the data unit. The 'type' parameter specifies the value of the MS/TP Frame Type field that is prepended to the frame by the local MAC sublayer entity.

This primitive is generated by the MAC client entity whenever data shall be transferred to a peer entity or entities. This can be in response to a request from higher protocol layers or from data generated internally to the MAC client, such as a Token frame.

Receipt of this primitive will cause the MAC entity to insert all MAC specific fields, including Destination Address, Source Address, Frame Type, and any fields that are unique to the particular media access method, and pass the properly formed frame to the lower protocol layers for transfer to the peer MAC sublayer entity or entities.

This primitive defines the transfer of data from the MAC sublayer entity to the MAC client entity or entities in the case of a broadcast address.

The semantics of the primitive are as follows: MA-DATA.indication ( destination_address, source_address, data, type )

The 'destination_address' parameter may be either an individual or a broadcast address as specified by the Destination Address field of the incoming frame. The 'source_address' parameter is an individual address as specified by the Source Address field of the incoming frame. The 'data' parameter specifies the MAC service data unit (MSDU) as received by the local MAC entity. There is sufficient information associated with the MSDU for the MAC sublayer client to determine the length of the data unit. The 'type' parameter is the value of the MS/TP Frame Type field of the incoming frame.

The MA_DATA.indication is passed from the MAC sublayer entity to the MAC client entity or entities to indicate the arrival of a frame to the local MAC sublayer entity that is destined for the MAC client. Such frames are reported only if they are validly formed, received without error, and their destination address designates the local MAC entity. Frames destined for the MAC Control sublayer are not passed to the MAC client.

The effect of receipt of this primitive by the MAC client is unspecified.

This Appendix is informative and not part of the standard. BACnet corrects a long-standing issue with the MS/TP specification; namely that preamble sequences were not escaped whenever they appeared in the Data or Data CRC fields. In rare cases, this resulted in dropped frames due to loss of frame synchronization. The solution is to encode the Data and 32-bit Data CRC fields before transmission using Consistent Overhead Byte Stuffing and decode these fields upon reception. COBS is a run-length encoding method that nominally removes '0x00' octets from its input. Any selected octet value may be removed by XOR'ing that value with each octet of the COBS output. BACnet specifies the preamble octet '0x55' for removal. The minimum overhead of COBS is one octet per encoded field. The worst-case overhead in long fields is bounded to one octet per 254, or less than 0.4%, as described in . Frame encoding proceeds logically in two passes. The Encoded Data field is prepared by passing the MSDU through the COBS encoder and XOR'ing the preamble octet '0x55' with each octet of the output. The Encoded CRC-32K field is then prepared by calculating a CRC-32K over the Encoded Data field and formatting it for transmission as described in . The combined length of these fields, minus two octets for compatibility with existing MS/TP devices, is placed in the MS/TP header Length field before transmission. Example COBS encoder and decoder functions are shown below for illustration. Complete examples of use and test vectors are provided in BACnet .

#include /* * Encodes 'length' octets of data located at 'from' and * writes one or more COBS code blocks at 'to', removing any * 'mask' octets that may present be in the encoded data. * Returns the length of the encoded data. */ size_t cobs_encode (uint8_t *to, const uint8_t *from, size_t length, uint8_t mask) { size_t code_index = 0; size_t read_index = 0; size_t write_index = 1; uint8_t code = 1; uint8_t data, last_code; while (read_index < length) { data = from[read_index++]; /* * In the case of encountering a non-zero octet in the data, * simply copy input to output and increment the code octet. */ if (data != 0) { to[write_index++] = data ^ mask; code++; if (code != 255) continue; } /* * In the case of encountering a zero in the data or having * copied the maximum number (254) of non-zero octets, store * the code octet and reset the encoder state variables. */ last_code = code; to[code_index] = code ^ mask; code_index = write_index++; code = 1; } /* * If the last chunk contains exactly 254 non-zero octets, then * this exception is handled above (and returned length must be * adjusted). Otherwise, encode the last chunk normally, as if * a "phantom zero" is appended to the data. */ if ((last_code == 255) && (code == 1)) write_index--; else to[code_index] = code ^ mask; return write_index; } ]]>

#include /* * Decodes 'length' octets of data located at 'from' and * writes the original client data at 'to', restoring any * 'mask' octets that may present in the encoded data. * Returns the length of the encoded data or zero if error. */ size_t cobs_decode (uint8_t *to, const uint8_t *from, size_t length, uint8_t mask) { size_t read_index = 0; size_t write_index = 0; uint8_t code, last_code; while (read_index < length) { code = from[read_index] ^ mask; last_code = code; /* * Sanity check the encoding to prevent the while() loop below * from overrunning the output buffer. */ if (read_index + code > length) return 0; read_index++; while (--code > 0) to[write_index++] = from[read_index++] ^ mask; /* * Restore the implicit zero at the end of each decoded block * except when it contains exactly 254 non-zero octets or the * end of data has been reached. */ if ((last_code != 255) && (read_index < length)) to[write_index++] = 0; } return write_index; } ]]>

This Appendix is informative and not part of the standard. Extending the payload of MS/TP to 1500 octets required upgrading the Data CRC from 16 bits to 32 bits. P.Koopman has authored several papers on evaluating CRC polynomials for network applications. In , he surveyed the entire 32-bit polynomial space and noted some that exceed the polynomial in performance. BACnet specifies the CRC-32K (Koopman) polynomial. The specified use of the calc_crc32K() function is as follows. Before a frame is transmitted, 'crc_value' is initialized to all ones. After passing each octet of the Encoded Data through the function, the ones complement of the resulting 'crc_value' is arranged in LSB-first order and is itself encoded. The length of the resulting Encoded CRC-32K field is always five octets. Upon reception of a frame, 'crc_value' is initialized to all ones. The octets of the Encoded Data field are accumulated by the calc_crc32K() function before decoding. The Encoded CRC-32K field is then decoded and the resulting four octets are accumulated by the calc_crc32K() function. If the result is the expected residue value 'CRC32K_RESIDUE', then the frame was received correctly. An example CRC-32K function in shown below for illustration. Complete examples of use and test vectors are provided in BACnet .

/* See BACnet Addendum 135-2012an, section G.3.2 */ #define CRC32K_INITIAL_VALUE (0xFFFFFFFF) #define CRC32K_RESIDUE (0x0843323B) /* CRC-32K polynomial, 1 + x**1 + ... + x**30 (+ x**32) */ #define CRC32K_POLY (0xEB31D82E) /* * Accumulate 'data_value' into the CRC in 'crc_value'. * Return updated CRC. * * Note: crc_value must be set to CRC32K_INITIAL_VALUE * before initial call. */ uint32_t calc_crc32K (uint8_t data_value, uint32_t crc_value) { int b; for (b = 0; b < 8; b++) { if ((data_value & 1) ^ (crc_value & 1)) { crc_value >>= 1; crc_value ^= CRC32K_POLY; } else { crc_value >>= 1; } data_value >>= 1; } return crc_value; } ]]>

This Appendix is informative and not part of the standard.

98;: 25 24 27 26 21 20 23 22 2d 2c 2f 2e 29 28 2b 2a %$'&! #"-,/.)(+* d5 d4 d7 d6 d1 d0 d3 d2 dd dc df de d9 d8 db da ................ c5 c4 c7 c6 c1 c0 c3 c2 cd cc cf ce c9 c8 cb ca ................ f5 f4 f7 f6 f1 f0 f3 f2 fd fc ff fe f9 f8 fb fa ................ e5 e4 e7 e6 e1 e0 e3 e2 ed ec ef ee e9 e8 eb ea ................ 95 94 97 96 91 90 93 92 9d 9c 9f 9e 99 98 9b 9a ................ 85 84 87 86 81 80 83 82 8d 8c 8f 8e 89 88 8b 8a ................ b5 b4 b7 b6 b1 b0 b3 b2 bd bc bf be b9 b8 bb ba ................ a5 a4 a7 a6 a1 a0 a3 a2 ad ac af ae a9 a8 ab aa ................ ab 54 57 56 51 50 53 52 5d 5c 5f 5e 59 58 5b 5a .TWVQPSR]\_^YX[Z 45 44 47 46 41 40 43 42 4d 4c 4f 4e 49 48 4b 4a EDGFA@CBMLONIHKJ 75 74 77 76 71 70 73 72 7d 7c 7f 7e 79 78 7b 7a utwvqpsr}|.~yx{z 65 64 67 66 61 60 63 62 6d 6c 6f 6e 69 68 6b 6a edgfa`cbmlonihkj 15 14 17 16 11 10 13 12 1d 1c 1f 1e 19 18 1b 1a ................ 05 04 07 06 01 00 03 02 0d 0c 0f 0e 09 08 0b 0a ................ 35 34 37 36 31 30 33 32 3d 3c 3f 3e 39 38 3b 3a 54761032=98;: 25 24 27 26 21 20 23 22 2d 2c 2f 2e 29 28 2b 2a %$'&! #"-,/.)(+* d5 d4 d7 d6 d1 d0 d3 d2 dd dc df de d9 d8 db da ................ c5 c4 c7 c6 c1 c0 c3 c2 cd cc cf ce c9 c8 cb ca ................ f5 f4 f7 f6 f1 f0 f3 f2 fd fc ff fe f9 f8 fb fa ................ e5 e4 e7 e6 e1 e0 e3 e2 ed ec ef ee e9 e8 eb ea ................ 95 94 97 96 91 90 93 92 9d 9c 9f 9e 99 98 9b 9a ................ 85 84 87 86 81 80 83 82 8d 8c 8f 8e 89 88 8b 8a ................ b5 b4 b7 b6 b1 b0 b3 b2 bd bc bf be b9 b8 bb ba ................ a5 a4 a7 a6 a1 a0 a3 a2 ad ac af ae a9 a8 50 cb ..............P. 27 0c b7 '.. ]]>

?@ABCDEFGH 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 IJKLMNOPQRSTUVWX 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 YZ[\]^_`abcdefgh 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 ijklmnopqrstuvwx 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 yz{|}~.......... 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 ................ 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 ................ a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 ................ b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 ................ c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 ................ d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 ................ e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 ................ f9 fa fb fc fd fe ff 00 01 02 03 04 05 06 07 08 ................ 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 ................ 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 ....... !"#$%&'( 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 )*+,-./012345678 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 9:;<=>?@ABCDEFGH 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 IJKLMNOPQRSTUVWX 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 YZ[\]^_`abcdefgh 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 ijklmnopqrstuvwx 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 yz{|}~.......... 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 ................ 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 ................ a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 ................ b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 ................ c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 ................ d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 ................ e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 ................ f9 fa fb fc fd 9e 72 59 e2 ......rY. ]]>

? 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f PQRSTUVWXYZ[\]^_ 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f `abcdefghijklmno 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f pqrstuvwxyz{|}~. 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................ 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................ a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af ................ b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf ................ c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf ................ d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df ................ e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef ................ f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff ................ 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f ................ 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................ 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./ 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;<=>? 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f PQRSTUVWXYZ[\]^_ 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f `abcdefghijklmno 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f pqrstuvwxyz{|}~. 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................ 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................ a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af ................ b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf ................ c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf ................ d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df ................ e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef ................ f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd .............. ]]>