![](bg6.png)
1D e f i n i t i o n s a f e m u l t ( a b : Unsigned32 . i n t )
2: o p t i o n Unsigned32 . i n t :=
3i f b =? 0%u n s i g n e d 3 2
4then Some ( a ∗b )
5e l s e i f a <=? ( Un s i gned32 . m a x u ns i g ne d / b )
6then Some ( a ∗b )
7e l s e None .
8
9D e f i n i t i o n t i c k
10( c o u n t e r c l o c k F r e q u e n c y d e l a y : U n s i g n e d 3 2 . i n t )
11: o p t i o n Unsigned32 . i n t :=
12m atch ( s a f e m u l t c o u n t e r d e l a y ,
13s a f e m u l t c o u n t e r c l o c k F r e q u e n c y ) w i t h
14| ( Some a , Some b ) =>
15i f a <? b e l s e Some ( c o u n t e r +1%u n s i g n e d 3 2 )
16then Some (1% u n s i g n e d 3 2 )
17| => None
18end .
Listing 5: Function definitions in Coq.
clear distinction is needed between the occurrence of
the overflow and the result of the applied operation.
Coq describes a specification by total functions which
we used to define such a distinction. The safe mult
function, seen in Listing 5, implements the behavior
of the function described in Listing 4.
In order to clearly distinguish an overflow from
the result of the multiplication, the safe mult func-
tion returns a value of Coq’s built-in container type
option. This container type has the same semantic
behavior as the option type, defined in Listing 4. In
contrast to the SysML/OCL specification, introduced
in Section 2, our approach allows the definition of
an overflow save integer multiplication function at
the specification level. As a result, the multiplica-
tion operation in the tick function is replaced by the
safe mult function.
4.3.2 Proving Overflow Detection
To ensure that the above specification detects the
unsigned multiplication overflow reliable, properties
that describe how this overflow is detected are re-
quired. Considering the semantic gap between Z and
N/32, discussed in Section 2.2, two properties have
to be satisfied to either detect an overflow or to return
the result of the multiplication. These properties are
defined as theorem in Coq, as shown in Listing 6.
1 Theorem d e t e c t o v e r f l o w :
2 f o r a l l a b : Z ,
3 a <= Unsigned3 2 . m a x un s i g n e d / \
4 b <= Unsigned 3 2 . m a x uns i g n e d / \
5 a ∗ b > U n s i g n e d32 . m a x u n s i g n e d <−>
6 s a f e m u l t ( Un s i g n e d 3 2 . r e p r a )
7 ( Unsigned32 . r e p r b ) = None .
8
9 Theorem n o ov e r f l o w :
10 f o r a l l a b : Z ,
11 a <= Unsigned3 2 . m a x un s i g n e d / \
12 b <= Unsigned 3 2 . m a x uns i g n e d / \
13 a ∗ b <= Un signed32 . m a x u n s i g n e d <−>
14 s a f e m u l t ( Un s i g n e d 3 2 . r e p r a )
15 ( Unsigned32 . r e p r b ) =
16 Some ( ( Unsigned32 . r e p r a ) ∗
17 ( Unsigned32 . r e p r b ) ) .
Listing 6: Theorems in Coq to verify the behavior of the
safe mult function.
1Theorem s a f e t y p r o p e r t y n o o v e r f l o w :
2f o r a l l c o u n t e r d e l a y c l o c k F r e q u e n c y a b
3: Unsigned32 . i n t ,
4d e l a y < c l o c k F r e q u e n c y / \
5Some ( a ) = s a f e m u l t c o u n t e r d e l a y / \
6Some ( b ) = s a f e m u l t c o u n t e r c l o c k F r e q u e n c y
7<−> a <= b / \
8t i c k c o u n t e r d e l a y c l o c k F r e q u e n c y <> None .
9
10Theorem s a f e t y p r o p e r t y o v e r f l o w :
11f o r a l l c o u n t e r d e l a y c l o c k F r e q u e n c y
12: Unsigned32 . i n t ,
13d e l a y < c l o c k F r e q u e n c y / \
14None = s a f e m u l t c o u n t e r d e l a y / \
15None = s a f e m u l t c o u n t e r c l o c k F r e q u e n c y <−>
16t i c k c o u n t e r d e l a y c l o c k F r e q u e n c y = None .
Listing 7: Theorem in Coq that represents the OCL safety
property adapted to finite integer types.
The detect overflow theorem says: for all a and b
of the type Z which are less than or equal to the max-
imal unsigned32 value and the multiplication of both
values is greater than this maximal value if and only
if (<->) our defined safe mult function returns None
for the same values that are converted to equivalent
elements of the quotient ring Unsigned32. This prop-
erty ensures that only in the case of an overflow None
is returned. The second property that has to be sat-
isfied is that the result of the multiplication operation
has to be returned if no overflow occurs. The theorem
no overflow specifies this property and says: for all
a and b of the type Z which are less than or equal to
the maximal unsigned32 value and the multiplication
of both values is less than or equal to this maximal
value if and only if (<->) our defined safe mult func-
tion returns Some(). This property ensures that only
in the case where no overflow occurs the result of the
multiplication is returned.
To verify the derived safety property (stated as an
OCL invariant), described in Section 2, this invariant
has to be transformed first, as the proposed specifica-
tion uses finite types and the integer overflow has to
be considered. The resulting theorems are shown in
Listing 7.
For illustration purposes, we only explain
the theorem safety property no overflow in detail,
as the safety property overflow theorem works ana-
log. The theorem says: for all counter, delay
and clockFrequency, where the delay is smaller than
the clockFrequency and the multiplication does not
overflow (Some(a) and Some(b) are returned) if and
only if a is less than or equal to b and the spec-
ified tick function returns a constructor that is not
None, i.e. either Some(counter +1%unsigned32) or
Some(1%unsigned32), since the option type has two
constructors, as described above. As we have seen
above, the problem discussed in Section 2.2 was ad-
dressed my providing a total function that wraps the
multiplication operation. This function clearly distin-
MODELSWARD 2020 - 8th International Conference on Model-Driven Engineering and Software Development
46