Typecast integer to enum

Below is my test code which throws polyspace warning when i tried to typecast unsigned integer to enum. Is the typecasting of integer to enum not allowed in polyspace tool?

typedef enum
{
    Active,  
    Inactive
}EnumType;
void Set_Action(unsigned long Status)
{
    switch((EnumType)Status)
    {
        case Active:
        {
            printf("1");
            break;
        }
        case INACTIVE:
        {
            printf("2");
            break;
        }
        default;
    }
}

[Les Beckham]

What is the warning? I see an issue in the fact that your second case has INACTIVE in all caps which isn't a valid enum value.

[srinivasan kandaswamy]

typedef enum

{

FAULT_INACTIVE = 0,

FAULT_ACTIVE

}EnumType;

void Set_Action(uint32 Event_Sts)

{

EventStruct[1].status = (EnumType)Event_Sts;

switch((EnumType)Event_Sts)

{

case FAULT_INACTIVE:

{

//Action 1

break;

}

case FAULT_ACTIVE:

{

//Action 2

break;

}

default:

{

//Action 3

break;

}

}

}

The warning observed in EventStruct[1].status = (EnumType)Event_Sts;

Below is the warning we observed when we tried to typecast integer to enum.

MISRA 10.3 The value of an expression shall not be assigned to an object with a narrower essential type or of a different essential type category.

The expression (of essential type category unsigned) is assigned to an object with a different essential type category (enum)

[Les Beckham]

Well, this is looking much more like code that might actually compile. However, you haven't provided the definition of the EventStruct or even why it exists, since you are still basing the switch on the typecast of EventSts.

I'm definitely not an expert on the MISRA rules, but it sounds like you are definitely violating the rule, as stated in the warning message. You are taking a uint32 which can have over 4 billion possible values and casting it to your enum type which only can take two different values. Sounds dangerous and error prone (thus the warning).

It looks like you need to look at the design of this code and the code that is calling this. If Event_Sts can only have values of 0 and 1, why isn't it defined as boolean instead of uint32, for example.

Answer 1

[Kausthub]

Hi all,

These indeed are MISRA violations.

• MISRA C 2012 Rule 10.3 states "The value of an expression shall not be assigned to an object with a narrower essential type or of a different essential type category". https://www.mathworks.com/help/bugfinder/ref/misrac2012rule10.3.html

EventStruct[1].status = (EnumType)Event_Sts

Here I beleive the issue is because you are trying to assign "status" of essential type category unsigned with "(EnumType)Event_Sts" which is of a different essential type category (enum). You can assign an unsigned variable with an unsigned expression / value only and same rule applies to enums as well i.e., you can assign an enum with an enum expression or value only.

• MISRA C 2012 Rule 10.5 states "The value of an expression should not be cast to an inappropriate essential type" which restricts casting of enums to any type and vice versa. https://www.mathworks.com/help/bugfinder/ref/misrac2012rule10.5.html

switch((EnumType)Status)

Here you are trying to convert "Status" which is of essential type category unsigned to esstential type category enum. Rule 10.5 restricts the conversion of enums to any type and vice versa.

Yes, as mentioned by @Les Beckham if "Status" has only two states "Active" and "Inactive" then it can be converted to a boolean value. But here again casting an unsigned integer to a boolean will cause a MISRA C 2012 Rule 10.5 violation for which a solution would be to compare the unsigned value with 0:

bool isActive = (bool)Status;     % MISRA C 2012 Rule 10.3 violation

bool isActive = (Status != 0U);   % No violation

But if you use "isActive" inside the switch statement it will lead to a MISRA C 2012 Rule 16.7 violation which states " A switch-expression shall not have essentially Boolean type" for which the solution would be to wrap it in a conditional statement.

switch(isActive)                 % MISRA C 2012 Rule 16.7 violation
    
switch((isActive ? 1 : 0))       % No violation

Hope this helps!