Mechanisation in Isabelle/UTP. In addition to the validation, we have also made substantial progress towards the mechani- sation of our semantics in Isabelle/UTP. We have mechanised the universe for VDM-RT, Usl, and proved injectivity theorems for the majority of VDM-SL type equivalents in Is- abelle. In particular, this includes the real numbers which necessitated the mechanisation of Xxxxxx’x proof that reals can be represented as infinite binary sequences, which are Figure 14: VDM-SL assignment in Isabelle/UTP the equivalent to P N5. As we mentioned in Section 2.5, we already mechanised the theory of designs and reactive designs, and this allows us to represent the semantics of VDM-SL expressions and state- ments. In particular, it allows us to account for expression (un)definedness. We define a model for VDM-SL expressions, (τ, α) vexpr, for return type τ and alphabet type α, based on partial functions. We then use this to define the constructs of Section 3.2, along with all the functions for manipulating numbers, sequences, sets, maps etc., which is done by lifting corresponding functions in Isabelle/HOL. HOL functions are total and do not give an explicit account of undefinedness: an arbitrary but defined value is returned for such cases. Thus in order to account for undefinedness we introduce the following additional lifting partial functions: vuop : (σ → τ ) → (σ, α) vexpr → (τ, α) vexpr vbop : (σ1 × σ2 → τ ) → (σ1, α) vexpr → (σ2, α) vexpr → (τ, α) vexpr ⊥ ⊥ ⊥ JhJd(e))J = uop {xs '→ hd(xs) | xs /= []} e These functions lift unary and binary partial functions to VDM-SL expressions. They are both strict in the sense that vuop f v = vbop f v e = vbop f e v, that is, if either parameter is undefined, then the whole expression is also undefined. We can then define partial operations, like division, by lifting as the following definitions demonstrate: e/f = vbop {(m, n) '→ m/n | n 0} e f f (x) = vbop {(m, k) '→ m(k) | k ∈ dom(m)} f x We define division by rJestri)cting the domain of the function to those whose denominator is non-zero. Simiarly for the hd function that takes the head of a list, we disallow non-empty lists. Finally, for application of a map f to a key x, we require that x is in the domain of f . Naturally, operators that are not partial can be trivially lifted. We can then use such 5This mechanised proof is located at xxxxx://xxxxxx.xxx/isabelle-utp/utp-main/blob/master/utils/ Real_Bit.thy Figure 15: VDM-SL assignment experiments definitions to prove definedness theo...
Mechanisation in Isabelle/UTP. Our Isabelle/UTP model of the FCU follows the approach in Section 3.2. The components representing FMUs act on a centralised state space, st fcu, which contains the variables of all the components of the model, with each FMU only updating the variables that belong to it.
