Testing from a Z Specification