theory Schedule_R

lemma schedule_corres:
  "corres dc (invs and valid_sched and valid_list) invs' (Schedule_A.schedule) ThreadDecls_H.schedule" supply ethread_get_wp[wp del] supply tcbSchedEnqueue_invs'[wp del] supply tcbSchedEnqueue_invs'_not_ResumeCurrentThread[wp del] supply setSchedulerAction_direct[wp] supply if_split[split del] apply (clarsimp simp: Schedule_A.schedule_def Thread_H.schedule_def) apply (subst thread_get_test) apply (subst thread_get_comm) apply (subst schact_bind_inside) apply (rule corres_guard_imp) apply (rule corres_split[OF getCurThread_corres[THEN corres_rel_imp[where r="\<lambda>x y. y = x"],simplified]]) apply (rule corres_split[OF getSchedulerAction_corres]) apply (rule corres_split_sched_act,assumption) apply (rule_tac P="tcb_at ct" in corres_symb_exec_l') apply (rule_tac corres_symb_exec_l) apply simp apply (rule corres_assert_ret) apply ((wpsimp wp: thread_get_wp' gets_exs_valid)+) prefer 2 
         (* choose thread *)
          apply clarsimp apply (rule corres_split[OF thread_get_isRunnable_corres]) apply (rule corres_split) apply (rule corres_when, simp) apply (rule tcbSchedEnqueue_corres) apply (rule scheduleChooseNewThread_corres, simp) apply (wp thread_get_wp' tcbSchedEnqueue_invs' hoare_vcg_conj_lift hoare_drop_imps
                   | clarsimp)+ 
        (* switch to thread *)
         apply (rule corres_split[OF thread_get_isRunnable_corres],
                rename_tac was_running wasRunning) apply (rule corres_split) apply (rule corres_when, simp) apply (rule tcbSchedEnqueue_corres) apply (rule corres_split[OF getIdleThread_corres], rename_tac it it') apply (rule_tac F="was_running \<longrightarrow> ct \<noteq> it" in corres_gen_asm) apply (rule corres_split) apply (rule ethreadget_corres[where r="(=)"]) apply (clarsimp simp: etcb_relation_def) apply (rename_tac tp tp') apply (rule corres_split) apply (rule ethread_get_when_corres[where r="(=)"]) apply (clarsimp simp: etcb_relation_def) apply (rename_tac cp cp') apply (rule corres_split) apply (rule scheduleSwitchThreadFastfail_corres; simp) apply (rule corres_split[OF curDomain_corres]) apply (rule corres_split[OF isHighestPrio_corres]; simp only:) apply (rule corres_if, simp) apply (rule corres_split[OF tcbSchedEnqueue_corres]) apply (simp, fold dc_def) apply (rule corres_split) apply (rule setSchedulerAction_corres; simp) apply (rule scheduleChooseNewThread_corres) apply (wp | simp)+ apply (simp add: valid_sched_def) apply wp apply (rule hoare_vcg_conj_lift) apply (rule_tac t=t in set_scheduler_action_cnt_valid_blocked') apply (wpsimp wp: setSchedulerAction_invs')+ apply (wp tcb_sched_action_enqueue_valid_blocked hoare_vcg_all_lift enqueue_thread_queued) apply (wp tcbSchedEnqueue_invs'_not_ResumeCurrentThread) apply (rule corres_if, fastforce) apply (rule corres_split[OF tcbSchedAppend_corres]) apply (simp, fold dc_def) apply (rule corres_split) apply (rule setSchedulerAction_corres; simp) apply (rule scheduleChooseNewThread_corres) apply (wp | simp)+ apply (simp add: valid_sched_def) apply wp apply (rule hoare_vcg_conj_lift) apply (rule_tac t=t in set_scheduler_action_cnt_valid_blocked') apply (wpsimp wp: setSchedulerAction_invs')+ apply (wp tcb_sched_action_append_valid_blocked hoare_vcg_all_lift append_thread_queued) apply (wp tcbSchedAppend_invs'_not_ResumeCurrentThread) apply (rule corres_split[OF guarded_switch_to_corres], simp) apply (rule setSchedulerAction_corres[simplified dc_def]) apply (wp | simp)+ 

                      (* isHighestPrio *)
                       apply (clarsimp simp: if_apply_def2) apply ((wp (once) hoare_drop_imp)+)[1] apply (simp add: if_apply_def2) apply ((wp (once) hoare_drop_imp)+)[1] apply wpsimp+ apply (clarsimp simp: conj_ac cong: conj_cong) apply wp apply (rule_tac Q="\<lambda>_ s. valid_blocked_except t s \<and> scheduler_action s = switch_thread t"
                    in hoare_post_imp, fastforce) apply (wp add: tcb_sched_action_enqueue_valid_blocked_except
                          tcbSchedEnqueue_invs'_not_ResumeCurrentThread thread_get_wp
                     del: gets_wp)+ apply (clarsimp simp: conj_ac if_apply_def2 cong: imp_cong conj_cong del: hoare_gets) apply (wp gets_wp)+ 

   (* abstract final subgoal *)
    apply clarsimp subgoal for s apply (clarsimp split: Deterministic_A.scheduler_action.splits
                     simp: invs_psp_aligned invs_distinct invs_valid_objs invs_arch_state
                           invs_vspace_objs[simplified] tcb_at_invs) apply (rule conjI, clarsimp) apply (fastforce simp: invs_def
                            valid_sched_def valid_sched_action_def is_activatable_def
                            st_tcb_at_def obj_at_def valid_state_def only_idle_def
                            ) apply (rule conjI, clarsimp) subgoal for candidate apply (clarsimp simp: valid_sched_def invs_def valid_state_def cur_tcb_def
                               valid_arch_caps_def valid_sched_action_def
                               weak_valid_sched_action_def tcb_at_is_etcb_at
                               tcb_at_is_etcb_at[OF st_tcb_at_tcb_at[rotated]]
                               valid_blocked_except_def valid_blocked_def) apply (clarsimp simp add: pred_tcb_at_def obj_at_def is_tcb valid_idle_def) done 
     (* choose new thread case *)
      apply (intro impI conjI allI tcb_at_invs
            | fastforce simp: invs_def cur_tcb_def valid_etcbs_def
                              valid_sched_def  st_tcb_at_def obj_at_def valid_state_def
                              weak_valid_sched_action_def not_cur_thread_def)+ apply (simp add: valid_sched_def valid_blocked_def valid_blocked_except_def) done 

  (* haskell final subgoal *)
   apply (clarsimp simp: if_apply_def2 invs'_def valid_state'_def
                  cong: imp_cong  split: scheduler_action.splits) apply (fastforce simp: cur_tcb'_def valid_pspace'_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' state_ext_sched_class.schedule ThreadDecls_H.schedule proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' state_ext_sched_class.schedule ThreadDecls_H.schedule proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' state_ext_sched_class.schedule ThreadDecls_H.schedule proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' state_ext_sched_class.schedule ThreadDecls_H.schedule proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' state_ext_sched_class.schedule ThreadDecls_H.schedule proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' state_ext_sched_class.schedule ThreadDecls_H.schedule proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' (do ct <- gets cur_thread;
ct_st <- get_thread_state ct;
gets scheduler_action >>= Deterministic_A.scheduler_action.case_scheduler_action (do id <- gets idle_thread;
assert (runnable ct_st \<or> ct = id)
od) (\<lambda>candidate. do y <- when (runnable ct_st) (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority candidate;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue candidate;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if runnable ct_st \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append candidate;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to candidate;
set_scheduler_action resume_cur_thread
od
od) (do y <- when (runnable ct_st) (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od)
od) (do curThread <- getCurThread;
action <- getSchedulerAction;
case action of ResumeCurrentThread \<Rightarrow> return () | ChooseNewThread \<Rightarrow> do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od | SwitchToThread candidate \<Rightarrow> do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od
od) proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' (do ct <- gets cur_thread;
t <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
gets scheduler_action >>= Deterministic_A.scheduler_action.case_scheduler_action (do id <- gets idle_thread;
assert (t \<or> ct = id)
od) (\<lambda>candidate. do y <- when t (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority candidate;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue candidate;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if t \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append candidate;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to candidate;
set_scheduler_action resume_cur_thread
od
od) (do y <- when t (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od)
od) (do curThread <- getCurThread;
getSchedulerAction >>= Structures_H.scheduler_action.case_scheduler_action (return ()) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (\<lambda>candidate. do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od)
od) proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' (do ct <- gets cur_thread;
y <- gets scheduler_action;
x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
case y of resume_cur_thread \<Rightarrow> do id <- gets idle_thread;
assert (x \<or> ct = id)
od | switch_thread candidate \<Rightarrow> do y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority candidate;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue candidate;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append candidate;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to candidate;
set_scheduler_action resume_cur_thread
od
od | choose_new_thread \<Rightarrow> do y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od
od) (do curThread <- getCurThread;
getSchedulerAction >>= Structures_H.scheduler_action.case_scheduler_action (return ()) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (\<lambda>candidate. do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od)
od) proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_sched and valid_list) invs' (do ct <- gets cur_thread;
gets scheduler_action >>= Deterministic_A.scheduler_action.case_scheduler_action (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
id <- gets idle_thread;
assert (x \<or> ct = id)
od) (\<lambda>t. do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od)
od) (do curThread <- getCurThread;
getSchedulerAction >>= Structures_H.scheduler_action.case_scheduler_action (return ()) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (\<lambda>candidate. do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od)
od) proof (prove)
goal (3 subgoals):
 1. corres dc ?Q ?Q' (do ct <- gets cur_thread;
gets scheduler_action >>= Deterministic_A.scheduler_action.case_scheduler_action (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
id <- gets idle_thread;
assert (x \<or> ct = id)
od) (\<lambda>t. do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od)
od) (do curThread <- getCurThread;
getSchedulerAction >>= Structures_H.scheduler_action.case_scheduler_action (return ()) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (\<lambda>candidate. do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od)
od)
 2. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ?Q s
 3. \<And>s. invs' s \<Longrightarrow> ?Q' s proof (prove)
goal (5 subgoals):
 1. \<And>ct curThread. curThread = ct \<Longrightarrow> corres dc (?R4 ct) (?R'4 curThread) (gets scheduler_action >>= Deterministic_A.scheduler_action.case_scheduler_action (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
id <- gets idle_thread;
assert (x \<or> ct = id)
od) (\<lambda>t. do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od)) (getSchedulerAction >>= Structures_H.scheduler_action.case_scheduler_action (return ()) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (\<lambda>candidate. do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od))
 2. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>?R4\<rbrace>
 3. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>?R'4\<rbrace>
 4. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 5. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R9 ct curThread rv) (?R'9 ct curThread rv') (case rv of resume_cur_thread \<Rightarrow> do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
id <- gets idle_thread;
assert (x \<or> ct = id)
od | switch_thread t \<Rightarrow> do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od | choose_new_thread \<Rightarrow> do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (case rv' of ResumeCurrentThread \<Rightarrow> return () | ChooseNewThread \<Rightarrow> do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od | SwitchToThread candidate \<Rightarrow> do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>?R9 ct curThread\<rbrace>
 3. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>?R'9 ct curThread\<rbrace>
 4. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 5. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 6. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 7. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?P16 ct curThread rv) (?P'20 ct curThread rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
id <- gets idle_thread;
assert (x \<or> ct = id)
od) (return ())
 2. \<And>ct curThread rv rv' t. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q17 ct curThread rv t) (?Q'22 ct curThread rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R18 ct curThread rv) (?R'21 ct curThread rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od)
 4. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> ?P16 ct curThread rv | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> ?R18 ct curThread rv\<rbrace>
 5. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> ?P'20 ct curThread rv' | ChooseNewThread \<Rightarrow> ?R'21 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 6. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 7. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 8. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 9. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (11 subgoals):
 1. \<And>ct curThread rv rv' rva. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q'28 ct curThread rv rv' rva) (?P'20 ct curThread rv') (do id <- gets idle_thread;
assert (rva \<or> ct = id)
od) (return ())
 2. \<And>ct curThread rv rv' s. \<lbrakk>curThread = ct; sched_act_relation rv rv'; tcb_at ct s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q30 ct curThread rv\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>?Q'28 ct curThread rv rv'\<rbrace>
 4. \<And>ct curThread rv rv' t. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q17 ct curThread rv t) (?Q'22 ct curThread rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 5. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R18 ct curThread rv) (?R'21 ct curThread rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od)
 6. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and ?Q30 ct curThread rv | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> ?R18 ct curThread rv\<rbrace>
 7. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> ?P'20 ct curThread rv' | ChooseNewThread \<Rightarrow> ?R'21 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 8. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 10. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>ct curThread rv rv' rva id. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q31 ct curThread rv rv' rva id) (?P'20 ct curThread rv') (assert (rva \<or> ct = id)) (return ())
 2. \<And>ct curThread rv rv' rva s. \<lbrakk>curThread = ct; sched_act_relation rv rv'; ?Q'28 ct curThread rv rv' rva s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets idle_thread \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>ct curThread rv rv' rva. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'28 ct curThread rv rv' rva\<rbrace> gets idle_thread \<lbrace>?Q31 ct curThread rv rv' rva\<rbrace>
 4. \<And>ct curThread rv rv' rva. \<lbrakk>curThread = ct; sched_act_relation rv rv'; True\<rbrakk> \<Longrightarrow> no_fail (?Q'28 ct curThread rv rv' rva) (gets idle_thread)
 5. \<And>ct curThread rv rv' s. \<lbrakk>curThread = ct; sched_act_relation rv rv'; tcb_at ct s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q30 ct curThread rv\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>?Q'28 ct curThread rv rv'\<rbrace>
 7. \<And>ct curThread rv rv' t. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q17 ct curThread rv t) (?Q'22 ct curThread rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 8. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R18 ct curThread rv) (?R'21 ct curThread rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od)
 9. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and ?Q30 ct curThread rv | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> ?R18 ct curThread rv\<rbrace>
 10. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> ?P'20 ct curThread rv' | ChooseNewThread \<Rightarrow> ?R'21 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>ct curThread rv rv' rva id. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q31 ct ct rv rv' rva id) (?P'20 ct ct rv') (assert (rva \<or> ct = id)) (return ())
 2. \<And>ct curThread rv rv' rva s. \<lbrakk>curThread = ct; sched_act_relation rv rv'; ?Q'28 ct curThread rv rv' rva s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets idle_thread \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>ct curThread rv rv' rva. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'28 ct curThread rv rv' rva\<rbrace> gets idle_thread \<lbrace>?Q31 ct curThread rv rv' rva\<rbrace>
 4. \<And>ct curThread rv rv' rva. \<lbrakk>curThread = ct; sched_act_relation rv rv'; True\<rbrakk> \<Longrightarrow> no_fail (?Q'28 ct curThread rv rv' rva) (gets idle_thread)
 5. \<And>ct curThread rv rv' s. \<lbrakk>curThread = ct; sched_act_relation rv rv'; tcb_at ct s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q30 ct curThread rv\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>?Q'28 ct curThread rv rv'\<rbrace>
 7. \<And>ct curThread rv rv' t. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q17 ct curThread rv t) (?Q'22 ct curThread rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 8. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R18 ct curThread rv) (?R'21 ct curThread rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od)
 9. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and ?Q30 ct curThread rv | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> ?R18 ct curThread rv\<rbrace>
 10. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> ?P'20 ct curThread rv' | ChooseNewThread \<Rightarrow> ?R'21 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ct curThread rv rv' rva s. \<lbrakk>curThread = ct; sched_act_relation rv rv'; ?Q'28 ct curThread rv rv' rva s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets idle_thread \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>ct curThread rv rv' rva. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'28 ct curThread rv rv' rva\<rbrace> gets idle_thread \<lbrace>\<lambda>a b. rva \<or> curThread = a\<rbrace>
 3. \<And>ct curThread rv rv' rva. \<lbrakk>curThread = ct; sched_act_relation rv rv'; True\<rbrakk> \<Longrightarrow> no_fail (?Q'28 ct curThread rv rv' rva) (gets idle_thread)
 4. \<And>ct curThread rv rv' s. \<lbrakk>curThread = ct; sched_act_relation rv rv'; tcb_at ct s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q30 ct curThread rv\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>?Q'28 ct curThread rv rv'\<rbrace>
 6. \<And>ct curThread rv rv' t. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q17 ct curThread rv t) (?Q'22 ct curThread rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 7. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R18 ct curThread rv) (?R'21 ct curThread rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od)
 8. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and ?Q30 ct curThread rv | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> ?R18 ct curThread rv\<rbrace>
 9. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> ?R'21 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 10. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
A total of 13 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R18 ct curThread rv) (?R'21 ct curThread rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od)
 3. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> ?R18 ct curThread rv\<rbrace>
 4. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> ?R'21 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 5. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 7. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R18 ct curThread rv) (?R'21 ct curThread rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od)
 2. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> ?R18 ct curThread rv\<rbrace>
 4. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> ?R'21 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 5. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 7. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>ct curThread rv rv'. \<lbrakk>curThread = ct; sched_act_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R18 ct curThread rv) (?R'21 ct curThread rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od)
 2. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> ?R18 ct curThread rv\<rbrace>
 4. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> ?R'21 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 5. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 7. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> corres dc (?R18 ct ct rv) (?R'21 ct ct rv') (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do curRunnable <- isRunnable ct;
y <- when curRunnable (tcbSchedEnqueue ct);
scheduleChooseNewThread
od)
 2. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> ?R18 ct curThread rv\<rbrace>
 4. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> ?R'21 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 5. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 7. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 8. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> corres dc (?R56 ct rv rv' x) (?R'56 ct rv rv' curRunnable) (do y <- when x (tcb_sched_action tcb_sched_enqueue ct);
schedule_choose_new_thread
od) (do y <- when curRunnable (tcbSchedEnqueue ct);
scheduleChooseNewThread
od)
 2. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q62 ct ct rv\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>?R56 ct rv rv'\<rbrace>
 3. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'60 ct ct rv'\<rbrace> isRunnable ct \<lbrace>?R'56 ct rv rv'\<rbrace>
 4. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 5. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and ?Q62 ct curThread rv\<rbrace>
 6. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and ?Q'60 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 7. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 9. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (13 subgoals):
 1. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> corres (?r'67 ct rv rv' x curRunnable) (?P68 ct rv rv' x) (?P'70 ct rv rv' curRunnable) (when x (tcb_sched_action tcb_sched_enqueue ct)) (when curRunnable (tcbSchedEnqueue ct))
 2. \<And>ct rv rv' x curRunnable rva rv'a. \<lbrakk>sched_act_relation rv rv'; x = curRunnable; ?r'67 ct rv rv' x curRunnable rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R67 ct rv rv' x curRunnable rva) (?R'67 ct rv rv' x curRunnable rv'a) schedule_choose_new_thread scheduleChooseNewThread
 3. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 ct rv rv' x\<rbrace> when x (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>?R67 ct rv rv' x curRunnable\<rbrace>
 4. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 ct rv rv' curRunnable\<rbrace> when curRunnable (tcbSchedEnqueue ct) \<lbrace>?R'67 ct rv rv' x curRunnable\<rbrace>
 5. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q62 ct ct rv\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>x. ?P68 ct rv rv' x and ?Q69 ct rv rv' x\<rbrace>
 6. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'60 ct ct rv'\<rbrace> isRunnable ct \<lbrace>\<lambda>curRunnable. ?P'70 ct rv rv' curRunnable and ?Q'71 ct rv rv' curRunnable\<rbrace>
 7. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 8. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and ?Q62 ct curThread rv\<rbrace>
 9. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and ?Q'60 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 10. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> corres dc (?P78 ct rv rv' x) (?P'80 ct rv rv' curRunnable) (tcb_sched_action tcb_sched_enqueue ct) (tcbSchedEnqueue ct)
 2. \<And>ct rv rv' x curRunnable rva rv'a. \<lbrakk>sched_act_relation rv rv'; x = curRunnable; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R67 ct rv rv' x curRunnable rva) (?R'67 ct rv rv' x curRunnable rv'a) schedule_choose_new_thread scheduleChooseNewThread
 3. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 ct rv rv' x\<rbrace> when x (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>?R67 ct rv rv' x curRunnable\<rbrace>
 4. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 ct rv rv' curRunnable\<rbrace> when curRunnable (tcbSchedEnqueue ct) \<lbrace>?R'67 ct rv rv' x curRunnable\<rbrace>
 5. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q62 ct ct rv\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>x. (\<lambda>xa. x \<longrightarrow> ?P78 ct rv rv' x xa) and ?Q69 ct rv rv' x\<rbrace>
 6. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'60 ct ct rv'\<rbrace> isRunnable ct \<lbrace>\<lambda>curRunnable. (\<lambda>x. curRunnable \<longrightarrow> ?P'80 ct rv rv' curRunnable x) and ?Q'71 ct rv rv' curRunnable\<rbrace>
 7. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 8. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and ?Q62 ct curThread rv\<rbrace>
 9. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and ?Q'60 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 10. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>ct rv rv' x curRunnable rva rv'a. \<lbrakk>sched_act_relation rv rv'; x = curRunnable; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R67 ct rv rv' x curRunnable rva) (?R'67 ct rv rv' x curRunnable rv'a) schedule_choose_new_thread scheduleChooseNewThread
 2. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 ct rv rv' x\<rbrace> when x (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>?R67 ct rv rv' x curRunnable\<rbrace>
 3. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 ct rv rv' curRunnable\<rbrace> when curRunnable (tcbSchedEnqueue ct) \<lbrace>?R'67 ct rv rv' x curRunnable\<rbrace>
 4. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q62 ct ct rv\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>x. (\<lambda>xa. x \<longrightarrow> is_etcb_at ct xa) and ?Q69 ct rv rv' x\<rbrace>
 5. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'60 ct ct rv'\<rbrace> isRunnable ct \<lbrace>\<lambda>curRunnable. (\<lambda>x. curRunnable \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'71 ct rv rv' curRunnable\<rbrace>
 6. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 7. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and ?Q62 ct curThread rv\<rbrace>
 8. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and ?Q'60 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 9. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 ct rv rv' curRunnable\<rbrace> when curRunnable (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva s. invs s \<and> valid_sched s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' x curRunnable. \<lbrakk>sched_act_relation rv rv'; x = curRunnable\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 ct rv rv' curRunnable\<rbrace> when curRunnable (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q62 ct ct rv\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>x. (\<lambda>xa. x \<longrightarrow> is_etcb_at ct xa) and ?Q69 ct rv rv' x\<rbrace>
 4. \<And>ct rv rv'. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'60 ct ct rv'\<rbrace> isRunnable ct \<lbrace>\<lambda>curRunnable. (\<lambda>x. curRunnable \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'71 ct rv rv' curRunnable\<rbrace>
 5. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 6. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and ?Q62 ct curThread rv\<rbrace>
 7. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and ?Q'60 ct curThread rv' | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 8. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 10. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
A total of 11 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 3. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 4. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 5. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 6. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 7. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> corres dc (?Q17 ct ct rv t) (?Q'22 ct ct rv' t) (do x <- thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct;
y <- when x (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if x \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do wasRunnable <- isRunnable ct;
y <- when wasRunnable (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> ?Q17 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 3. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> ?Q'22 ct curThread rv' t\<rbrace>
 4. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 5. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 6. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 7. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> corres dc (?R135 ct rv rv' t was_running) (?R'135 ct rv rv' t wasRunning) (do y <- when was_running (tcb_sched_action tcb_sched_enqueue ct);
it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do y <- when wasRunning (tcbSchedEnqueue ct);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>?R135 ct rv rv' t\<rbrace>
 3. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>?R'135 ct rv rv' t\<rbrace>
 4. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 5. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 6. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 7. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 8. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 9. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (12 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> corres (?r'146 ct rv rv' t was_running wasRunning) (?P147 ct rv rv' t was_running) (?P'149 ct rv rv' t wasRunning) (when was_running (tcb_sched_action tcb_sched_enqueue ct)) (when wasRunning (tcbSchedEnqueue ct))
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; ?r'146 ct rv rv' t was_running wasRunning rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R146 ct rv rv' t was_running wasRunning rva) (?R'146 ct rv rv' t was_running wasRunning rv'a) (do it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>?R146 ct rv rv' t was_running wasRunning\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>?R'146 ct rv rv' t was_running wasRunning\<rbrace>
 5. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. ?P147 ct rv rv' t was_running and ?Q148 ct rv rv' t was_running\<rbrace>
 6. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. ?P'149 ct rv rv' t wasRunning and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 7. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 8. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 9. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> corres dc (?P157 ct rv rv' t was_running) (?P'159 ct rv rv' t wasRunning) (tcb_sched_action tcb_sched_enqueue ct) (tcbSchedEnqueue ct)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R146 ct rv rv' t was_running wasRunning rva) (?R'146 ct rv rv' t was_running wasRunning rv'a) (do it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>?R146 ct rv rv' t was_running wasRunning\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>?R'146 ct rv rv' t was_running wasRunning\<rbrace>
 5. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> ?P157 ct rv rv' t was_running x) and ?Q148 ct rv rv' t was_running\<rbrace>
 6. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> ?P'159 ct rv rv' t wasRunning x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 7. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 8. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 9. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R146 ct rv rv' t was_running wasRunning rva) (?R'146 ct rv rv' t was_running wasRunning rv'a) (do it <- gets idle_thread;
target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>?R146 ct rv rv' t was_running wasRunning\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>?R'146 ct rv rv' t was_running wasRunning\<rbrace>
 4. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and ?Q148 ct rv rv' t was_running\<rbrace>
 5. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 6. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 7. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 8. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 10. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'\<rbrakk> \<Longrightarrow> corres dc (?R165 ct rv rv' t was_running wasRunning rva rv'a it) (?R'165 ct rv rv' t was_running wasRunning rva rv'a it') (do target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct it' curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>?R165 ct rv rv' t was_running wasRunning rva rv'a\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>?R'165 ct rv rv' t was_running wasRunning rva rv'a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
 6. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and ?Q148 ct rv rv' t was_running\<rbrace>
 7. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 8. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 9. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 10. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> corres dc (?P172 ct rv rv' t was_running wasRunning rva rv'a it) (?R'165 ct rv rv' t was_running wasRunning rva rv'a it') (do target_prio <- ethread_get tcb_priority t;
ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio target_prio;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom target_prio);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = target_prio then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do targetPrio <- threadGet tcbPriority t;
curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct it' curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = targetPrio then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. ?P172 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>?R'165 ct rv rv' t was_running wasRunning rva rv'a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
 6. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and ?Q148 ct rv rv' t was_running\<rbrace>
 7. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 8. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 9. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 10. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> corres (?r'173 ct rv rv' t was_running wasRunning rva rv'a it it') (?P174 ct rv rv' t was_running wasRunning rva rv'a it) (?P'176 ct rv rv' t was_running wasRunning rva rv'a it') (ethread_get tcb_priority t) (threadGet tcbPriority t)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; ?r'173 ct rv rv' t was_running wasRunning rva rv'a it it' rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R173 ct rv rv' t was_running wasRunning rva rv'a it it' rvb) (?R'173 ct rv rv' t was_running wasRunning rva rv'a it it' rv'b) (do ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio rvb;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom rvb);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = rvb then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct it' curPrio rv'b;
curDom <- curDomain;
highest <- isHighestPrio curDom rv'b;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = rv'b then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>?R173 ct rv rv' t was_running wasRunning rva rv'a it it'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>?R'173 ct rv rv' t was_running wasRunning rva rv'a it it'\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. ?P174 ct rv rv' t was_running wasRunning rva rv'a it and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. ?P'176 ct rv rv' t was_running wasRunning rva rv'a it' and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
 9. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and ?Q148 ct rv rv' t was_running\<rbrace>
 10. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' etcb tcb'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; etcb_relation etcb tcb'\<rbrakk> \<Longrightarrow> tcb_priority etcb = tcbPriority tcb'
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; rvb = rv'b\<rbrakk> \<Longrightarrow> corres dc (?R173 ct rv rv' t was_running wasRunning rva rv'a it it' rvb) (?R'173 ct rv rv' t was_running wasRunning rva rv'a it it' rv'b) (do ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio rvb;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom rvb);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = rvb then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct it' curPrio rv'b;
curDom <- curDomain;
highest <- isHighestPrio curDom rv'b;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = rv'b then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>?R173 ct rv rv' t was_running wasRunning rva rv'a it it'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>?R'173 ct rv rv' t was_running wasRunning rva rv'a it it'\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
 9. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and ?Q148 ct rv rv' t was_running\<rbrace>
 10. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; rvb = rv'b\<rbrakk> \<Longrightarrow> corres dc (?R173 ct rv rv' t was_running wasRunning rva rv'a it it' rvb) (?R'173 ct rv rv' t was_running wasRunning rva rv'a it it' rv'b) (do ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio rvb;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom rvb);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = rvb then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct it' curPrio rv'b;
curDom <- curDomain;
highest <- isHighestPrio curDom rv'b;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = rv'b then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>?R173 ct rv rv' t was_running wasRunning rva rv'a it it'\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>?R'173 ct rv rv' t was_running wasRunning rva rv'a it it'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
 8. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and ?Q148 ct rv rv' t was_running\<rbrace>
 9. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 10. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> corres dc (?R173 ct rv rv' t was_running wasRunning rva rv'a it it' tp) (?R'173 ct rv rv' t was_running wasRunning rva rv'a it it' tp') (do ct_prio <- ethread_get_when (ct \<noteq> it) tcb_priority ct;
fastfail <- schedule_switch_thread_fastfail ct it ct_prio tp;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom tp);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> ct_prio = tp then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do curPrio <- threadGet tcbPriority ct;
fastfail <- scheduleSwitchThreadFastfail ct it' curPrio tp';
curDom <- curDomain;
highest <- isHighestPrio curDom tp';
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> curPrio = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>?R173 ct rv rv' t was_running wasRunning rva rv'a it it'\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>?R'173 ct rv rv' t was_running wasRunning rva rv'a it it'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
 8. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and ?Q148 ct rv rv' t was_running\<rbrace>
 9. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 10. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> corres (?r'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp') (?P187 ct rv rv' t was_running wasRunning rva rv'a it it' tp) (?P'189 ct rv rv' t was_running wasRunning rva rv'a it it' tp') (ethread_get_when (ct \<noteq> it) tcb_priority ct) (threadGet tcbPriority ct)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ?r'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rvb) (?R'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rv'b) (do fastfail <- schedule_switch_thread_fastfail ct it rvb tp;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom tp);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> rvb = tp then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do fastfail <- scheduleSwitchThreadFastfail ct it' rv'b tp';
curDom <- curDomain;
highest <- isHighestPrio curDom tp';
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> rv'b = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>?R186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>?R'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. ?P187 ct rv rv' t was_running wasRunning rva rv'a it it' tp and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. ?P'189 ct rv rv' t was_running wasRunning rva rv'a it it' tp' and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' etcb tcb'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; etcb_relation etcb tcb'\<rbrakk> \<Longrightarrow> tcb_priority etcb = tcbPriority tcb'
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> rvb = rv'b\<rbrakk> \<Longrightarrow> corres dc (?R186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rvb) (?R'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rv'b) (do fastfail <- schedule_switch_thread_fastfail ct it rvb tp;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom tp);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> rvb = tp then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do fastfail <- scheduleSwitchThreadFastfail ct it' rv'b tp';
curDom <- curDomain;
highest <- isHighestPrio curDom tp';
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> rv'b = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>?R186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>?R'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> rvb = rv'b\<rbrakk> \<Longrightarrow> corres dc (?R186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rvb) (?R'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' rv'b) (do fastfail <- schedule_switch_thread_fastfail ct it rvb tp;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom tp);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> rvb = tp then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do fastfail <- scheduleSwitchThreadFastfail ct it' rv'b tp';
curDom <- curDomain;
highest <- isHighestPrio curDom tp';
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> rv'b = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>?R186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>?R'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
 10. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and ?Q148 ct rv rv' t was_running\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> corres dc (?R186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp) (?R'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp') (do fastfail <- schedule_switch_thread_fastfail ct it cp tp;
cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom tp);
if fastfail \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> cp = tp then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do fastfail <- scheduleSwitchThreadFastfail ct it' cp' tp';
curDom <- curDomain;
highest <- isHighestPrio curDom tp';
if fastfail \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>?R186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>?R'186 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace>
 10. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and ?Q148 ct rv rv' t was_running\<rbrace>
A total of 17 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> corres (?r'199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp') (?P200 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp) (?P'202 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp') (schedule_switch_thread_fastfail ct it cp tp) (scheduleSwitchThreadFastfail ct it' cp' tp')
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; ?r'199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb) (?R'199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b) (do cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom tp);
if rvb \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> cp = tp then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do curDom <- curDomain;
highest <- isHighestPrio curDom tp';
if rv'b \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>?R199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>?R'199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. ?P200 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. ?P'202 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp' and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> corres dc (?R199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb) (?R'199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b) (do cur_dom <- gets cur_domain;
highest <- gets (is_highest_prio cur_dom tp);
if rvb \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> cp = tp then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do curDom <- curDomain;
highest <- isHighestPrio curDom tp';
if rv'b \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>?R199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>?R'199 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
A total of 19 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> corres dc (?R222 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc) (?R'222 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c) (do highest <- gets (is_highest_prio rvc tp);
if rvb \<and> \<not> highest then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if was_running \<and> cp = tp then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od
od) (do highest <- isHighestPrio rv'c tp';
if rv'b \<and> \<not> highest then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>?R222 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>?R'222 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?R229 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?R'229 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if rv'b \<and> \<not> rv'd then do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if rv'b \<and> \<not> rv'd then do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>?R229 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>?R'229 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?P262 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?P'258 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do tcb_sched_action tcb_sched_enqueue t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od) (do tcbSchedEnqueue t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then ?P262 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then ?P'258 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
A total of 24 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rve rv'e. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd; dc rve rv'e\<rbrakk> \<Longrightarrow> corres dc (?R267 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rve) (?R'267 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rv'e) (K_bind (do set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od) rve) (K_bind (do setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) rv'e)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>?R267 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>?R'267 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?R267 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (?R'267 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (do a <- set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od) (do a <- setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>?R267 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>?R'267 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
A total of 26 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres (?r'278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd) (?P289 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (?P'285 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (set_scheduler_action choose_new_thread) (setSchedulerAction ChooseNewThread)
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd; ?r'278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva) (?R'278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rv'a) schedule_choose_new_thread scheduleChooseNewThread
 3. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q287 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>?R278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'283 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?R'278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>\<lambda>a. ?P289 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a and ?Q287 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. ?P'285 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a and ?Q'283 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva) (?R'278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rv'a) schedule_choose_new_thread scheduleChooseNewThread
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q287 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>?R278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'283 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?R'278 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q287 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'283 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q287 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rva s. invs s \<and> valid_sched s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'283 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q287 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'283 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'303 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_sched s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'283 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> ?P'303 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'283 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'303 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> ct_not_in_q s \<and> valid_sched_action s \<and> ct_in_cur_domain s \<and> valid_blocked s \<and> valid_idle_etcb s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'283 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> ?P'303 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'283 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'333 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_blocked s \<and> valid_idle_etcb s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'283 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> valid_etcbs b \<and> DetSchedInvs_AI.valid_queues b \<and> True \<and> True \<and> True \<and> ?P'333 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'283 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P340 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv. valid_blocked\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'339 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_idle_etcb s \<and> scheduler_action s = choose_new_thread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'283 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> valid_etcbs b \<and> DetSchedInvs_AI.valid_queues b \<and> True \<and> True \<and> True \<and> ?P340 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b \<and> ?P'339 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'283 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'339 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_idle_etcb s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'283 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> valid_etcbs b \<and> DetSchedInvs_AI.valid_queues b \<and> True \<and> True \<and> True \<and> (valid_blocked and (\<lambda>s. scheduler_action s = switch_thread t \<and> (\<exists>d p. t \<in> set (ready_queues s d p)))) b \<and> ?P'339 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'283 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and ?Q273 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>ct rv rv' t wasRunning it' tp' cp cp' rv'b rv'c rv'd. \<lbrakk>sched_act_relation rv rv'; wasRunning \<longrightarrow> ct \<noteq> it'; ct \<noteq> it' \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?P'402 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_enqueue t \<lbrace>\<lambda>rv s. valid_blocked s \<and> scheduler_action s = switch_thread t \<and> (\<exists>d p. t \<in> set (ready_queues s d p)) \<and> valid_idle_etcb s\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. invs' a \<and> True)\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>b. True \<and> invs b \<and> valid_etcbs b \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) b \<and> True \<and> True \<and> True \<and> ?P'402 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a b) else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedEnqueue t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. invs' a \<and> True)\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'271 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (if wasRunning \<and> cp = tp' then do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od else do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (if wasRunning \<and> cp' = tp' then do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else ?Q260 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else ?Q'256 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?P459 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?P'455 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do tcb_sched_action tcb_sched_append t;
set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od) (do tcbSchedAppend t;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then ?P459 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then ?P'455 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
A total of 24 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rve rv'e. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd; dc rve rv'e\<rbrakk> \<Longrightarrow> corres dc (?R488 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rve) (?R'488 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rv'e) (K_bind (do set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od) rve) (K_bind (do setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) rv'e)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>?R488 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>?R'488 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?R488 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (?R'488 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (do a <- set_scheduler_action choose_new_thread;
schedule_choose_new_thread
od) (do a <- setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>?R488 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>?R'488 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
A total of 26 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres (?r'499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd) (?P510 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (?P'506 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (set_scheduler_action choose_new_thread) (setSchedulerAction ChooseNewThread)
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd; ?r'499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva) (?R'499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rv'a) schedule_choose_new_thread scheduleChooseNewThread
 3. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q508 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>?R499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'504 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?R'499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>\<lambda>a. ?P510 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a and ?Q508 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. ?P'506 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a and ?Q'504 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rva) (?R'499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd rv'a) schedule_choose_new_thread scheduleChooseNewThread
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q508 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>?R499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'504 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?R'499 ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q508 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'504 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q508 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rva s. invs s \<and> valid_sched s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'504 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q508 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'504 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'524 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_sched s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'504 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> ?P'524 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'504 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'524 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> ct_not_in_q s \<and> valid_sched_action s \<and> ct_in_cur_domain s \<and> valid_blocked s \<and> valid_idle_etcb s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'504 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> ?P'524 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'504 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'554 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_blocked s \<and> valid_idle_etcb s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'504 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> valid_etcbs b \<and> DetSchedInvs_AI.valid_queues b \<and> True \<and> True \<and> True \<and> ?P'554 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'504 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P561 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv. valid_blocked\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'560 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_idle_etcb s \<and> scheduler_action s = choose_new_thread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'504 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> valid_etcbs b \<and> DetSchedInvs_AI.valid_queues b \<and> True \<and> True \<and> True \<and> ?P561 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b \<and> ?P'560 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'504 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?P'560 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> set_scheduler_action choose_new_thread \<lbrace>\<lambda>rv s. valid_idle_etcb s \<and> scheduler_action s = choose_new_thread\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'504 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>rv'a s. invs' s \<and> ksSchedulerAction s = ChooseNewThread\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. invs b \<and> valid_etcbs b \<and> DetSchedInvs_AI.valid_queues b \<and> True \<and> True \<and> True \<and> (valid_blocked and (\<lambda>s. scheduler_action s = switch_thread t \<and> (\<exists>d p. t \<in> set (ready_queues s d p)))) b \<and> ?P'560 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a b)\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q'504 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and ?Q494 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
A total of 27 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>ct rv rv' t wasRunning it' tp' cp cp' rv'b rv'c rv'd. \<lbrakk>sched_act_relation rv rv'; wasRunning \<longrightarrow> ct \<noteq> it'; ct \<noteq> it' \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?P'623 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcb_sched_action tcb_sched_append t \<lbrace>\<lambda>rv s. valid_blocked s \<and> scheduler_action s = switch_thread t \<and> (\<exists>d p. t \<in> set (ready_queues s d p)) \<and> valid_idle_etcb s\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. invs' a \<and> True)\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and (\<lambda>b. True \<and> invs b \<and> valid_etcbs b \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) b \<and> True \<and> True \<and> True \<and> ?P'623 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a b) else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> tcbSchedAppend t \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. invs' a \<and> True)\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and ?Q'492 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres dc (?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd) (do guarded_switch_to t;
set_scheduler_action resume_cur_thread
od) (do global.switchToThread t;
setSchedulerAction ResumeCurrentThread
od)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else ?Q457 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else ?Q'453 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
A total of 23 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R669 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (?R'669 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd rv'd ()) (set_scheduler_action resume_cur_thread) (setSchedulerAction ResumeCurrentThread)
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q676 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> guarded_switch_to t \<lbrace>?R669 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'674 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> global.switchToThread t \<lbrace>?R'669 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else valid_arch_state and valid_objs and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and st_tcb_at runnable t and valid_etcbs and ?Q676 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else valid_arch_state' and valid_pspace' and Invariants_H.valid_queues and st_tcb_at' runnable' t and cur_tcb' and ?Q'674 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> sched_act_relation resume_cur_thread ResumeCurrentThread
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q676 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> guarded_switch_to t \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c rvd rv'd. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c; rvd = rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?Q'674 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c rv'd\<rbrace> global.switchToThread t \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q231 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> gets (is_highest_prio rv'c tp') \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else valid_arch_state and valid_objs and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and st_tcb_at runnable t and valid_etcbs and ?Q676 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else valid_arch_state' and valid_pspace' and Invariants_H.valid_queues and st_tcb_at' runnable' t and cur_tcb' and ?Q'674 ct rv rv' t wasRunning wasRunning rva rv'a it' it' tp' tp' cp cp' rv'b rv'b rv'c rv'c a\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and ?Q231 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rvc\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
A total of 25 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else valid_arch_state' and valid_pspace' and Invariants_H.valid_queues and st_tcb_at' runnable' t and cur_tcb' and (\<lambda>a. True)\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and (\<lambda>a. (if rv'b \<and> \<not> is_highest_prio rvc tp' a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else valid_arch_state and valid_objs and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and st_tcb_at runnable t and valid_etcbs and (\<lambda>a. True)) a)\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b rvc rv'c. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a. if rv'b \<and> \<not> a then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else if wasRunning \<and> cp' = tp' then tcb_at' t and Invariants_H.valid_queues and valid_queues' and (\<lambda>a. True \<and> (invs' and st_tcb_at' runnable' t and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> True) else valid_arch_state' and valid_pspace' and Invariants_H.valid_queues and st_tcb_at' runnable' t and cur_tcb' and (\<lambda>a. True)\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and (\<lambda>a. (if rv'b \<and> \<not> is_highest_prio rvc tp' a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else valid_arch_state and valid_objs and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and st_tcb_at runnable t and valid_etcbs and (\<lambda>a. True)) a)\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>ct rv rv' t wasRunning it' tp' cp cp' rv'b rv'c. \<lbrakk>sched_act_relation rv rv'; wasRunning \<longrightarrow> ct \<noteq> it'; ct \<noteq> it' \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'232 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b rv'b rv'c\<rbrace> isHighestPrio rv'c tp' \<lbrace>\<lambda>a x. (rv'b \<and> \<not> a \<longrightarrow> tcb_at' t x \<and> Invariants_H.valid_queues x \<and> valid_queues' x \<and> invs' x \<and> st_tcb_at' runnable' t x \<and> ksSchedulerAction x \<noteq> ResumeCurrentThread) \<and> ((rv'b \<longrightarrow> a) \<longrightarrow> (wasRunning \<and> cp' = tp' \<longrightarrow> tcb_at' t x \<and> Invariants_H.valid_queues x \<and> valid_queues' x \<and> invs' x \<and> st_tcb_at' runnable' t x \<and> ksSchedulerAction x \<noteq> ResumeCurrentThread) \<and> ((wasRunning \<longrightarrow> cp' \<noteq> tp') \<longrightarrow> valid_arch_state' x \<and> valid_pspace' x \<and> Invariants_H.valid_queues x \<and> st_tcb_at' runnable' t x \<and> cur_tcb' x))\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and (\<lambda>a. (if rv'b \<and> \<not> is_highest_prio rvc tp' a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else valid_arch_state and valid_objs and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and st_tcb_at runnable t and valid_etcbs and (\<lambda>a. True)) a)\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and ?Q'232 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b rv'c\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc. (\<lambda>_. True) and (\<lambda>a. (if rv'b \<and> \<not> is_highest_prio rvc tp' a then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else if wasRunning \<and> cp = tp' then is_etcb_at t and (\<lambda>a. True \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable t) a \<and> True \<and> True \<and> True \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> True \<and> valid_idle_etcb a) else valid_arch_state and valid_objs and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and st_tcb_at runnable t and valid_etcbs and (\<lambda>a. True)) a)\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a)\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; it = it'; wasRunning \<longrightarrow> ct \<noteq> it'; tp = tp'; ct \<noteq> it' \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q223 ct rv rv' t wasRunning wasRunning () () it' it' tp' tp' cp cp' rv'b\<rbrace> gets cur_domain \<lbrace>\<lambda>rvc a. (rv'b \<and> \<not> is_highest_prio rvc tp' a \<longrightarrow> is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> ((rv'b \<longrightarrow> is_highest_prio rvc tp' a) \<longrightarrow> (wasRunning \<and> cp = tp' \<longrightarrow> is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> ((wasRunning \<longrightarrow> cp' \<noteq> tp') \<longrightarrow> valid_arch_state a \<and> valid_objs a \<and> valid_asid_map a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_vs_lookup a \<and> valid_global_objs a \<and> unique_table_refs (caps_of_state a) \<and> st_tcb_at runnable t a \<and> valid_etcbs a))\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a)\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q223 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rvb rv'b. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'; rvb = rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace> curDomain \<lbrace>\<lambda>rv'c. Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a)\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace> schedule_switch_thread_fastfail ct it cp tp \<lbrace>\<lambda>rvb. (\<lambda>_. True) and (\<lambda>a. (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> valid_arch_state a \<and> valid_objs a \<and> valid_asid_map a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_vs_lookup a \<and> valid_global_objs a \<and> unique_table_refs (caps_of_state a) \<and> st_tcb_at runnable t a \<and> valid_etcbs a)\<rbrace>
 3. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'; ct \<noteq> it \<longrightarrow> cp = cp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace> scheduleSwitchThreadFastfail ct it' cp' tp' \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'224 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp cp' rv'b\<rbrace>
 4. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace> ethread_get_when (ct \<noteq> it) tcb_priority ct \<lbrace>\<lambda>cp. is_etcb_at ct and ?Q201 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp\<rbrace>
 5. \<And>ct rv rv' t was_running wasRunning rva rv'a it it' tp tp'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it; tp = tp'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace> threadGet tcbPriority ct \<lbrace>\<lambda>cp'. tcb_at' ct and ?Q'203 ct rv rv' t was_running wasRunning rva rv'a it it' tp tp' cp'\<rbrace>
 6. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q175 ct rv rv' t was_running wasRunning rva rv'a it\<rbrace> ethread_get tcb_priority t \<lbrace>\<lambda>tp. is_etcb_at ct and ?Q188 ct rv rv' t was_running wasRunning rva rv'a it it' tp\<rbrace>
 7. \<And>ct rv rv' t was_running wasRunning rva rv'a it it'. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a; it = it'; was_running \<longrightarrow> ct \<noteq> it\<rbrakk> \<Longrightarrow> \<lbrace>?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>tp'. tcb_at' ct and ?Q'190 ct rv rv' t was_running wasRunning rva rv'a it it' tp'\<rbrace>
 8. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q166 ct rv rv' t was_running wasRunning rva\<rbrace> gets idle_thread \<lbrace>\<lambda>it. is_etcb_at t and ?Q175 ct rv rv' t was_running wasRunning rva rv'a it and (\<lambda>s. was_running \<longrightarrow> ct \<noteq> it)\<rbrace>
 9. \<And>ct rv rv' t was_running wasRunning rva rv'a. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'167 ct rv rv' t was_running wasRunning rv'a\<rbrace> getIdleThread \<lbrace>\<lambda>it'. tcb_at' t and ?Q'177 ct rv rv' t was_running wasRunning rva rv'a it'\<rbrace>
 10. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q148 ct rv rv' t was_running\<rbrace> when was_running (tcb_sched_action tcb_sched_enqueue ct) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q166 ct rv rv' t was_running wasRunning rva\<rbrace>
A total of 19 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; wasRunning; was_running\<rbrakk> \<Longrightarrow> \<lbrace>?P'823 ct rv rv' t (ds_id True)\<rbrace> tcb_sched_action tcb_sched_enqueue ct \<lbrace>\<lambda>rv s. valid_blocked_except t s \<and> scheduler_action s = switch_thread t \<and> valid_idle_etcb s \<and> is_etcb_at t s \<and> invs s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> st_tcb_at runnable t s \<and> valid_blocked_except t s \<and> scheduler_action s = switch_thread t \<and> valid_idle_etcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> unique_table_refs (caps_of_state s) \<and> st_tcb_at runnable t s \<and> valid_etcbs s \<and> ct \<noteq> idle_thread s\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (tcb_at' t and (tcb_at' ct and (tcb_at' ct and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))))\<rbrace>
 3. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and (\<lambda>s. True \<and> (if was_running then \<lambda>a. is_etcb_at t a \<and> is_etcb_at ct a \<and> is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable ct) a \<and> st_tcb_at runnable t a \<and> ?P'823 ct rv rv' t was_running a else (\<lambda>s. (is_etcb_at t and (is_etcb_at ct and (is_etcb_at ct and ((\<lambda>_. True) and (\<lambda>a. (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> valid_arch_state a \<and> valid_objs a \<and> valid_asid_map a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_vs_lookup a \<and> valid_global_objs a \<and> unique_table_refs (caps_of_state a) \<and> st_tcb_at runnable t a \<and> valid_etcbs a)))) and (\<lambda>sa. was_running \<longrightarrow> ct \<noteq> idle_thread s)) s)) s)\<rbrace>
 4. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 5. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 6. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 7. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 9. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; wasRunning; was_running\<rbrakk> \<Longrightarrow> \<lbrace>?P'823 ct rv rv' t (ds_id True)\<rbrace> tcb_sched_action tcb_sched_enqueue ct \<lbrace>\<lambda>rv s. valid_arch_state s \<and> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> invs s \<and> valid_objs s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at t s \<and> ct \<noteq> idle_thread s \<and> st_tcb_at runnable t s \<and> valid_etcbs s \<and> scheduler_action s = switch_thread t \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 t (ready_queues s) (kheap s) (switch_thread t) (cur_thread s)\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (tcb_at' t and (tcb_at' ct and (tcb_at' ct and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))))\<rbrace>
 3. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and (\<lambda>s. True \<and> (if was_running then \<lambda>a. is_etcb_at t a \<and> is_etcb_at ct a \<and> is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable ct) a \<and> st_tcb_at runnable t a \<and> ?P'823 ct rv rv' t was_running a else (\<lambda>s. (is_etcb_at t and (is_etcb_at ct and (is_etcb_at ct and ((\<lambda>_. True) and (\<lambda>a. (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> valid_arch_state a \<and> valid_objs a \<and> valid_asid_map a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_vs_lookup a \<and> valid_global_objs a \<and> unique_table_refs (caps_of_state a) \<and> st_tcb_at runnable t a \<and> valid_etcbs a)))) and (\<lambda>sa. was_running \<longrightarrow> ct \<noteq> idle_thread s)) s)) s)\<rbrace>
 4. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 5. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 6. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 7. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 9. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; wasRunning; was_running\<rbrakk> \<Longrightarrow> \<lbrace>?P'997 ct rv rv' t (ds_id True)\<rbrace> tcb_sched_action tcb_sched_enqueue ct \<lbrace>\<lambda>rv s. valid_blocked_except_2 t (ready_queues s) (kheap s) (switch_thread t) (cur_thread s)\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (tcb_at' t and (tcb_at' ct and (tcb_at' ct and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))))\<rbrace>
 3. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and (\<lambda>s. True \<and> (if was_running then \<lambda>a. is_etcb_at t a \<and> is_etcb_at ct a \<and> is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable ct) a \<and> st_tcb_at runnable t a \<and> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at t a \<and> ct \<noteq> idle_thread a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable ct) a \<and> ?P'997 ct rv rv' t was_running a else (\<lambda>s. (is_etcb_at t and (is_etcb_at ct and (is_etcb_at ct and ((\<lambda>_. True) and (\<lambda>a. (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> valid_arch_state a \<and> valid_objs a \<and> valid_asid_map a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_vs_lookup a \<and> valid_global_objs a \<and> unique_table_refs (caps_of_state a) \<and> st_tcb_at runnable t a \<and> valid_etcbs a)))) and (\<lambda>sa. was_running \<longrightarrow> ct \<noteq> idle_thread s)) s)) s)\<rbrace>
 4. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 5. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 6. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 7. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 9. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; wasRunning; was_running\<rbrakk> \<Longrightarrow> \<lbrace>?P'997 ct rv rv' t (ds_id True)\<rbrace> tcb_sched_action tcb_sched_enqueue ct \<lbrace>\<lambda>_ s. valid_blocked_except t s \<and> scheduler_action s = switch_thread t\<rbrace>
 2. \<And>ct rv rv' t was_running wasRunning. \<lbrakk>sched_act_relation rv rv'; was_running = wasRunning\<rbrakk> \<Longrightarrow> \<lbrace>?Q'150 ct rv rv' t wasRunning\<rbrace> when wasRunning (tcbSchedEnqueue ct) \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (tcb_at' t and (tcb_at' ct and (tcb_at' ct and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))))\<rbrace>
 3. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q141 ct ct rv t\<rbrace> thread_get (\<lambda>tcb. runnable (tcb_state tcb)) ct \<lbrace>\<lambda>was_running. (\<lambda>x. was_running \<longrightarrow> is_etcb_at ct x) and (\<lambda>s. True \<and> (if was_running then \<lambda>a. is_etcb_at t a \<and> is_etcb_at ct a \<and> is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable ct) a \<and> st_tcb_at runnable t a \<and> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at t a \<and> ct \<noteq> idle_thread a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable ct) a \<and> ?P'997 ct rv rv' t was_running a else (\<lambda>s. (is_etcb_at t and (is_etcb_at ct and (is_etcb_at ct and ((\<lambda>_. True) and (\<lambda>a. (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> valid_arch_state a \<and> valid_objs a \<and> valid_asid_map a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_vs_lookup a \<and> valid_global_objs a \<and> unique_table_refs (caps_of_state a) \<and> st_tcb_at runnable t a \<and> valid_etcbs a)))) and (\<lambda>sa. was_running \<longrightarrow> ct \<noteq> idle_thread s)) s)) s)\<rbrace>
 4. \<And>ct rv rv' t. sched_act_relation rv rv' \<Longrightarrow> \<lbrace>?Q'139 ct ct rv' t\<rbrace> isRunnable ct \<lbrace>\<lambda>wasRunning. (\<lambda>x. wasRunning \<longrightarrow> (tcb_at' ct and Invariants_H.valid_queues and valid_queues') x) and ?Q'150 ct rv rv' t wasRunning\<rbrace>
 5. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and ?Q141 ct curThread rv t | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 6. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and ?Q'139 ct curThread rv' t\<rbrace>
 7. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 9. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 10. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>\<lambda>rv. case rv of resume_cur_thread \<Rightarrow> tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> curThread = idle_thread a) | switch_thread t \<Rightarrow> tcb_at curThread and (\<lambda>a. obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. True \<and> (if runnable (tcb_state tcb) then \<lambda>a. is_etcb_at t a \<and> is_etcb_at curThread a \<and> is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable curThread) a \<and> st_tcb_at runnable t a \<and> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at t a \<and> curThread \<noteq> idle_thread a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> (DetSchedInvs_AI.valid_queues and st_tcb_at runnable curThread) a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t else (\<lambda>s. (is_etcb_at t and (is_etcb_at curThread and (is_etcb_at curThread and ((\<lambda>_. True) and (\<lambda>a. (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> (is_etcb_at t a \<and> invs a \<and> valid_etcbs a \<and> DetSchedInvs_AI.valid_queues a \<and> st_tcb_at runnable t a \<and> valid_blocked_except t a \<and> scheduler_action a = switch_thread t \<and> valid_idle_etcb a) \<and> valid_arch_state a \<and> valid_objs a \<and> valid_asid_map a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_vs_lookup a \<and> valid_global_objs a \<and> unique_table_refs (caps_of_state a) \<and> st_tcb_at runnable t a \<and> valid_etcbs a)))) and (\<lambda>sa. runnable (tcb_state tcb) \<longrightarrow> curThread \<noteq> idle_thread s)) s)) s)) a) curThread a) | choose_new_thread \<Rightarrow> tcb_at curThread and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) curThread a \<longrightarrow> ((\<lambda>x. runnable (tcb_state tcb) \<longrightarrow> is_etcb_at curThread x) and (\<lambda>s. (if runnable (tcb_state tcb) then invs else invs) s \<and> (if runnable (tcb_state tcb) then valid_sched_except_blocked and st_tcb_at runnable curThread and not_cur_thread curThread and valid_blocked_except curThread else valid_sched) s \<and> (if runnable (tcb_state tcb) then \<lambda>a. scheduler_action a = choose_new_thread else (\<lambda>s. scheduler_action s = choose_new_thread)) s)) a)\<rbrace>
 2. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. True \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. tcb_at' t a \<and> tcb_at' curThread a \<and> tcb_at' curThread a \<and> True \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' curThread and valid_objs') a \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' curThread and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' curThread) a \<and> (invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' curThread and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' curThread) a \<and> (invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> valid_arch_state' a \<and> valid_pspace' a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' curThread and valid_objs') a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a else (\<lambda>s. tcb_at' t s \<and> (tcb_at' curThread and (tcb_at' curThread and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))) s)) s)) a)\<rbrace>
 3. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 4. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 5. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 6. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>ct. \<lbrace>?Q10 ct\<rbrace> gets scheduler_action \<lbrace>Deterministic_A.scheduler_action.case_scheduler_action (tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> runnable (tcb_state tcb) \<or> ct = idle_thread a)) (\<lambda>t. tcb_at ct and (\<lambda>a. obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at ct a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at ct a \<and> is_etcb_at t a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at t a \<and> ct \<noteq> idle_thread a \<and> st_tcb_at runnable ct a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a))) ct a)) (tcb_at ct and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) ct a \<longrightarrow> invs a \<and> scheduler_action a = choose_new_thread \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at ct a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues a) (ekheap a) choose_new_thread (cur_domain a) (kheap a) (cur_thread a) (idle_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb a \<and> not_cur_thread_2 ct choose_new_thread (cur_thread a) \<and> st_tcb_at runnable ct a \<and> valid_etcbs a \<and> ct_not_in_q_2 (ready_queues a) choose_new_thread (cur_thread a) \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 ct (ready_queues a) (kheap a) choose_new_thread (cur_thread a))))\<rbrace>
 2. \<And>ct curThread. curThread = ct \<Longrightarrow> \<lbrace>?Q'11 curThread\<rbrace> getSchedulerAction \<lbrace>\<lambda>rv'. case rv' of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. (if st_tcb_at' runnable' curThread a then invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread) else invs') s \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) s)) a) | SwitchToThread t \<Rightarrow> tcb_at' curThread and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' curThread a \<longrightarrow> (tcb_at' curThread and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>s. True \<and> (if st_tcb_at' runnable' curThread a then \<lambda>a. tcb_at' t a \<and> tcb_at' curThread a \<and> tcb_at' curThread a \<and> True \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' curThread and valid_objs') a \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' curThread and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' curThread) a \<and> (invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' curThread and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' curThread) a \<and> (invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> valid_arch_state' a \<and> valid_pspace' a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' curThread and valid_objs') a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a else (\<lambda>s. tcb_at' t s \<and> (tcb_at' curThread and (tcb_at' curThread and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))) s)) s)) a)\<rbrace>
 3. \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>ct. (\<lambda>_. True) and ?Q10 ct\<rbrace>
 4. \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>curThread. (\<lambda>_. True) and ?Q'11 curThread\<rbrace>
 5. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 6. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (2 subgoals):
 1. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. (case scheduler_action sa of resume_cur_thread \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) (cur_thread s) a \<longrightarrow> runnable (tcb_state tcb) \<or> cur_thread s = idle_thread a) | switch_thread t \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at (cur_thread s) a \<and> is_etcb_at t a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at t a \<and> cur_thread s \<noteq> idle_thread a \<and> st_tcb_at runnable (cur_thread s) a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a))) (cur_thread s) a) | choose_new_thread \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) (cur_thread s) a \<longrightarrow> invs a \<and> scheduler_action a = choose_new_thread \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues a) (ekheap a) choose_new_thread (cur_domain a) (kheap a) (cur_thread a) (idle_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb a \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread a) \<and> st_tcb_at runnable (cur_thread s) a \<and> valid_etcbs a \<and> ct_not_in_q_2 (ready_queues a) choose_new_thread (cur_thread a) \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 (cur_thread s) (ready_queues a) (kheap a) choose_new_thread (cur_thread a)))) sa)) s)) s
 2. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>a. (case ksSchedulerAction a of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. (if st_tcb_at' runnable' (ksCurThread s) a then invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>sa. ksSchedulerAction sa = ResumeCurrentThread \<longrightarrow> ksCurThread sa \<noteq> ksCurThread s) else invs') sa \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) sa)) a) | SwitchToThread t \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. True \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. tcb_at' t a \<and> tcb_at' (ksCurThread s) a \<and> tcb_at' (ksCurThread s) a \<and> True \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> valid_arch_state' a \<and> valid_pspace' a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a else (\<lambda>sa. tcb_at' t sa \<and> (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))) sa)) sa)) a)) a)) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>s. (invs and valid_sched and valid_list) s \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. (case scheduler_action sa of resume_cur_thread \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) (cur_thread s) a \<longrightarrow> runnable (tcb_state tcb) \<or> cur_thread s = idle_thread a) | switch_thread t \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at (cur_thread s) a \<and> is_etcb_at t a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at t a \<and> cur_thread s \<noteq> idle_thread a \<and> st_tcb_at runnable (cur_thread s) a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a))) (cur_thread s) a) | choose_new_thread \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) (cur_thread s) a \<longrightarrow> invs a \<and> scheduler_action a = choose_new_thread \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues a) (ekheap a) choose_new_thread (cur_domain a) (kheap a) (cur_thread a) (idle_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb a \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread a) \<and> st_tcb_at runnable (cur_thread s) a \<and> valid_etcbs a \<and> ct_not_in_q_2 (ready_queues a) choose_new_thread (cur_thread a) \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 (cur_thread s) (ready_queues a) (kheap a) choose_new_thread (cur_thread a)))) sa)) s)) s
 2. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>a. (case ksSchedulerAction a of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. (if st_tcb_at' runnable' (ksCurThread s) a then invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>sa. ksSchedulerAction sa = ResumeCurrentThread \<longrightarrow> ksCurThread sa \<noteq> ksCurThread s) else invs') sa \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) sa)) a) | SwitchToThread t \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. True \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. tcb_at' t a \<and> tcb_at' (ksCurThread s) a \<and> tcb_at' (ksCurThread s) a \<and> True \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> valid_arch_state' a \<and> valid_pspace' a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a else (\<lambda>sa. tcb_at' t sa \<and> (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))) sa)) sa)) a)) a)) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs s; valid_sched s; valid_list s\<rbrakk> \<Longrightarrow> (case scheduler_action s of resume_cur_thread \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) (cur_thread s) a \<longrightarrow> runnable (tcb_state tcb) \<or> cur_thread s = idle_thread a) | switch_thread t \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at (cur_thread s) a \<and> is_etcb_at t a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at t a \<and> cur_thread s \<noteq> idle_thread a \<and> st_tcb_at runnable (cur_thread s) a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a))) (cur_thread s) a) | choose_new_thread \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) (cur_thread s) a \<longrightarrow> invs a \<and> scheduler_action a = choose_new_thread \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues a) (ekheap a) choose_new_thread (cur_domain a) (kheap a) (cur_thread a) (idle_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb a \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread a) \<and> st_tcb_at runnable (cur_thread s) a \<and> valid_etcbs a \<and> ct_not_in_q_2 (ready_queues a) choose_new_thread (cur_thread a) \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 (cur_thread s) (ready_queues a) (kheap a) choose_new_thread (cur_thread a)))) s
 2. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>a. (case ksSchedulerAction a of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. (if st_tcb_at' runnable' (ksCurThread s) a then invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>sa. ksSchedulerAction sa = ResumeCurrentThread \<longrightarrow> ksCurThread sa \<noteq> ksCurThread s) else invs') sa \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) sa)) a) | SwitchToThread t \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. True \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. tcb_at' t a \<and> tcb_at' (ksCurThread s) a \<and> tcb_at' (ksCurThread s) a \<and> True \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> valid_arch_state' a \<and> valid_pspace' a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a else (\<lambda>sa. tcb_at' t sa \<and> (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))) sa)) sa)) a)) a)) s)) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; valid_sched s; valid_list s\<rbrakk> \<Longrightarrow> (case scheduler_action s of resume_cur_thread \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) (cur_thread s) a \<longrightarrow> runnable (tcb_state tcb) \<or> cur_thread s = idle_thread a) | switch_thread t \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at (cur_thread s) a \<and> is_etcb_at t a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_arch_state a \<and> valid_asid_map a \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> invs a \<and> valid_objs a \<and> unique_table_refs (caps_of_state a) \<and> valid_idle_etcb a \<and> is_etcb_at t a \<and> cur_thread s \<noteq> idle_thread a \<and> st_tcb_at runnable (cur_thread s) a \<and> st_tcb_at runnable t a \<and> valid_etcbs a \<and> scheduler_action a = switch_thread t \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 t (ready_queues a) (kheap a) (switch_thread t) (cur_thread a))) (cur_thread s) a) | choose_new_thread \<Rightarrow> tcb_at (cur_thread s) and (\<lambda>a. \<forall>tcb. ko_at (TCB tcb) (cur_thread s) a \<longrightarrow> invs a \<and> scheduler_action a = choose_new_thread \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) a) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues a) (ekheap a) choose_new_thread (cur_domain a) (kheap a) (cur_thread a) (idle_thread a)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb a \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread a) \<and> st_tcb_at runnable (cur_thread s) a \<and> valid_etcbs a \<and> ct_not_in_q_2 (ready_queues a) choose_new_thread (cur_thread a) \<and> DetSchedInvs_AI.valid_queues a \<and> valid_blocked_except_2 (cur_thread s) (ready_queues a) (kheap a) choose_new_thread (cur_thread a)))) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; valid_sched s; valid_list s\<rbrakk> \<Longrightarrow> (scheduler_action s = resume_cur_thread \<longrightarrow> (\<forall>tcb. ko_at (TCB tcb) (cur_thread s) s \<longrightarrow> runnable (tcb_state tcb) \<or> cur_thread s = idle_thread s)) \<and> (\<forall>x2. scheduler_action s = switch_thread x2 \<longrightarrow> obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at (cur_thread s) s \<and> is_etcb_at x2 s \<and> st_tcb_at runnable x2 s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 x2 (ready_queues s) (kheap s) (switch_thread x2) (cur_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at x2 s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at runnable (cur_thread s) s \<and> st_tcb_at runnable x2 s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 x2 (ready_queues s) (kheap s) (switch_thread x2) (cur_thread s))) (cur_thread s) s) \<and> (scheduler_action s = choose_new_thread \<longrightarrow> (\<forall>tcb. ko_at (TCB tcb) (cur_thread s) s \<longrightarrow> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues s) (ekheap s) choose_new_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb s \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread s) \<and> st_tcb_at runnable (cur_thread s) s \<and> valid_etcbs s \<and> ct_not_in_q_2 (ready_queues s) choose_new_thread (cur_thread s) \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 (cur_thread s) (ready_queues s) (kheap s) choose_new_thread (cur_thread s)))) proof (prove)
goal (2 subgoals):
 1. \<And>tcb. \<lbrakk>invs s; valid_sched_2 (ready_queues s) (ekheap s) resume_cur_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s); valid_list s; scheduler_action s = resume_cur_thread; ko_at (TCB tcb) (cur_thread s) s; cur_thread s \<noteq> idle_thread s\<rbrakk> \<Longrightarrow> runnable (tcb_state tcb)
 2. \<lbrakk>invs s; valid_sched s; valid_list s\<rbrakk> \<Longrightarrow> (\<forall>x2. scheduler_action s = switch_thread x2 \<longrightarrow> obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at (cur_thread s) s \<and> is_etcb_at x2 s \<and> st_tcb_at runnable x2 s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 x2 (ready_queues s) (kheap s) (switch_thread x2) (cur_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at x2 s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at runnable (cur_thread s) s \<and> st_tcb_at runnable x2 s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 x2 (ready_queues s) (kheap s) (switch_thread x2) (cur_thread s))) (cur_thread s) s) \<and> (scheduler_action s = choose_new_thread \<longrightarrow> (\<forall>tcb. ko_at (TCB tcb) (cur_thread s) s \<longrightarrow> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues s) (ekheap s) choose_new_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb s \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread s) \<and> st_tcb_at runnable (cur_thread s) s \<and> valid_etcbs s \<and> ct_not_in_q_2 (ready_queues s) choose_new_thread (cur_thread s) \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 (cur_thread s) (ready_queues s) (kheap s) choose_new_thread (cur_thread s)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; valid_sched s; valid_list s\<rbrakk> \<Longrightarrow> (\<forall>x2. scheduler_action s = switch_thread x2 \<longrightarrow> obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at (cur_thread s) s \<and> is_etcb_at x2 s \<and> st_tcb_at runnable x2 s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 x2 (ready_queues s) (kheap s) (switch_thread x2) (cur_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at x2 s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at runnable (cur_thread s) s \<and> st_tcb_at runnable x2 s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 x2 (ready_queues s) (kheap s) (switch_thread x2) (cur_thread s))) (cur_thread s) s) \<and> (scheduler_action s = choose_new_thread \<longrightarrow> (\<forall>tcb. ko_at (TCB tcb) (cur_thread s) s \<longrightarrow> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues s) (ekheap s) choose_new_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb s \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread s) \<and> st_tcb_at runnable (cur_thread s) s \<and> valid_etcbs s \<and> ct_not_in_q_2 (ready_queues s) choose_new_thread (cur_thread s) \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 (cur_thread s) (ready_queues s) (kheap s) choose_new_thread (cur_thread s)))) proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>invs s; valid_sched_2 (ready_queues s) (ekheap s) (switch_thread x2) (cur_domain s) (kheap s) (cur_thread s) (idle_thread s); valid_list s; scheduler_action s = switch_thread x2\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at (cur_thread s) s \<and> is_etcb_at x2 s \<and> st_tcb_at runnable x2 s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 x2 (ready_queues s) (kheap s) (switch_thread x2) (cur_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at x2 s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at runnable (cur_thread s) s \<and> st_tcb_at runnable x2 s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 x2 (ready_queues s) (kheap s) (switch_thread x2) (cur_thread s))) (cur_thread s) s
 2. \<lbrakk>invs s; valid_sched s; valid_list s\<rbrakk> \<Longrightarrow> scheduler_action s = choose_new_thread \<longrightarrow> (\<forall>tcb. ko_at (TCB tcb) (cur_thread s) s \<longrightarrow> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues s) (ekheap s) choose_new_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb s \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread s) \<and> st_tcb_at runnable (cur_thread s) s \<and> valid_etcbs s \<and> ct_not_in_q_2 (ready_queues s) choose_new_thread (cur_thread s) \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 (cur_thread s) (ready_queues s) (kheap s) choose_new_thread (cur_thread s))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; valid_sched_2 (ready_queues s) (ekheap s) (switch_thread candidate) (cur_domain s) (kheap s) (cur_thread s) (idle_thread s); valid_list s; scheduler_action s = switch_thread candidate\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at (cur_thread s) s \<and> is_etcb_at candidate s \<and> st_tcb_at runnable candidate s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 candidate (ready_queues s) (kheap s) (switch_thread candidate) (cur_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_asid_map s \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> valid_idle_etcb s \<and> is_etcb_at candidate s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at runnable (cur_thread s) s \<and> st_tcb_at runnable candidate s \<and> valid_etcbs s \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 candidate (ready_queues s) (kheap s) (switch_thread candidate) (cur_thread s))) (cur_thread s) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_list s; scheduler_action s = switch_thread candidate; valid_pspace s; valid_etcbs s; valid_mdb s; DetSchedInvs_AI.valid_queues s; valid_ioc s; ct_not_in_q_2 (ready_queues s) (switch_thread candidate) (cur_thread s); valid_idle s; st_tcb_at runnable candidate s; only_idle s; switch_in_cur_domain_2 (switch_thread candidate) (ekheap s) (cur_domain s); if_unsafe_then_cap s; \<forall>t. not_queued t s \<longrightarrow> (\<forall>st. st_tcb_at ((=) st) t s \<longrightarrow> t \<noteq> cur_thread s \<longrightarrow> candidate \<noteq> t \<longrightarrow> st \<noteq> Structures_A.thread_state.Running \<and> st \<noteq> Structures_A.thread_state.Restart); valid_idle_etcb s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> (runnable (tcb_state tcb) \<longrightarrow> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at runnable (cur_thread s) s)) (cur_thread s) s proof (prove)
goal:
No subgoals! proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; valid_sched s; valid_list s\<rbrakk> \<Longrightarrow> scheduler_action s = choose_new_thread \<longrightarrow> (\<forall>tcb. ko_at (TCB tcb) (cur_thread s) s \<longrightarrow> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues s) (ekheap s) choose_new_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb s \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread s) \<and> st_tcb_at runnable (cur_thread s) s \<and> valid_etcbs s \<and> ct_not_in_q_2 (ready_queues s) choose_new_thread (cur_thread s) \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 (cur_thread s) (ready_queues s) (kheap s) choose_new_thread (cur_thread s))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; valid_sched s; valid_list s\<rbrakk> \<Longrightarrow> scheduler_action s = choose_new_thread \<longrightarrow> (\<forall>tcb. ko_at (TCB tcb) (cur_thread s) s \<longrightarrow> (runnable (tcb_state tcb) \<longrightarrow> is_etcb_at (cur_thread s) s) \<and> (\<not> runnable (tcb_state tcb) \<longrightarrow> valid_sched_2 (ready_queues s) (ekheap s) choose_new_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s)) \<and> (runnable (tcb_state tcb) \<longrightarrow> valid_idle_etcb s \<and> not_cur_thread_2 (cur_thread s) choose_new_thread (cur_thread s) \<and> st_tcb_at runnable (cur_thread s) s \<and> valid_etcbs s \<and> ct_not_in_q_2 (ready_queues s) choose_new_thread (cur_thread s) \<and> DetSchedInvs_AI.valid_queues s \<and> valid_blocked_except_2 (cur_thread s) (ready_queues s) (kheap s) choose_new_thread (cur_thread s))) proof (prove)
goal (1 subgoal):
 1. \<And>tcb. \<lbrakk>invs s; valid_sched s; valid_list s; scheduler_action s = choose_new_thread; ko_at (TCB tcb) (cur_thread s) s; runnable (tcb_state tcb)\<rbrakk> \<Longrightarrow> valid_blocked_except_2 (cur_thread s) (ready_queues s) (kheap s) choose_new_thread (cur_thread s) proof (prove)
goal:
No subgoals! proof (prove)
goal (1 subgoal):
 1. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>a. (case ksSchedulerAction a of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. (if st_tcb_at' runnable' (ksCurThread s) a then invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>sa. ksSchedulerAction sa = ResumeCurrentThread \<longrightarrow> ksCurThread sa \<noteq> ksCurThread s) else invs') sa \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) sa)) a) | SwitchToThread t \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. True \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. tcb_at' t a \<and> tcb_at' (ksCurThread s) a \<and> tcb_at' (ksCurThread s) a \<and> True \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> valid_arch_state' a \<and> valid_pspace' a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a else (\<lambda>sa. tcb_at' t sa \<and> (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))) sa)) sa)) a)) a)) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. invs' s \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>a. (case ksSchedulerAction a of ResumeCurrentThread \<Rightarrow> \<lambda>a. True | ChooseNewThread \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. (if st_tcb_at' runnable' (ksCurThread s) a then invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>sa. ksSchedulerAction sa = ResumeCurrentThread \<longrightarrow> ksCurThread sa \<noteq> ksCurThread s) else invs') sa \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. ksSchedulerAction a = ChooseNewThread else (\<lambda>s. ksSchedulerAction s = ChooseNewThread)) sa)) a) | SwitchToThread t \<Rightarrow> tcb_at' (ksCurThread s) and (\<lambda>a. ((\<lambda>x. st_tcb_at' runnable' (ksCurThread s) a \<longrightarrow> (tcb_at' (ksCurThread s) and Invariants_H.valid_queues and valid_queues') x) and (\<lambda>sa. True \<and> (if st_tcb_at' runnable' (ksCurThread s) a then \<lambda>a. tcb_at' t a \<and> tcb_at' (ksCurThread s) a \<and> tcb_at' (ksCurThread s) a \<and> True \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> tcb_at' t a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> (valid_queues' and st_tcb_at' runnable' (ksCurThread s)) a \<and> (invs' and st_tcb_at' runnable' (ksCurThread s) and (\<lambda>s. ksSchedulerAction s \<noteq> ResumeCurrentThread)) a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread \<and> valid_arch_state' a \<and> valid_pspace' a \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' (ksCurThread s) and valid_objs') a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a else (\<lambda>sa. tcb_at' t sa \<and> (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and ((\<lambda>_. True) and (Invariants_H.valid_queues and (\<lambda>a. (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> (tcb_at' t a \<and> Invariants_H.valid_queues a \<and> valid_queues' a \<and> invs' a \<and> st_tcb_at' runnable' t a \<and> ksSchedulerAction a \<noteq> ResumeCurrentThread) \<and> valid_arch_state' a \<and> valid_pspace' a \<and> Invariants_H.valid_queues a \<and> st_tcb_at' runnable' t a \<and> cur_tcb' a))))) sa)) sa)) a)) a)) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s\<rbrakk> \<Longrightarrow> (ksSchedulerAction s = ChooseNewThread \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (st_tcb_at' runnable' (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s)) \<and> (\<forall>x3. ksSchedulerAction s = SwitchToThread x3 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (st_tcb_at' runnable' (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s) \<and> (st_tcb_at' runnable' (ksCurThread s) s \<longrightarrow> tcb_at' x3 s \<and> tcb_at' (ksCurThread s) s \<and> valid_objs' s \<and> tcb_at' x3 s \<and> valid_objs' s \<and> st_tcb_at' runnable' x3 s \<and> tcb_in_cur_domain' x3 s \<and> st_tcb_at' runnable' x3 s \<and> tcb_at' x3 s \<and> valid_objs' s \<and> st_tcb_at' runnable' x3 s \<and> tcb_in_cur_domain' x3 s \<and> st_tcb_at' runnable' x3 s \<and> valid_objs' s \<and> st_tcb_at' runnable' x3 s) \<and> (\<not> st_tcb_at' runnable' (ksCurThread s) s \<longrightarrow> tcb_at' x3 s \<and> tcb_at' (ksCurThread s) s \<and> tcb_at' x3 s \<and> st_tcb_at' runnable' x3 s \<and> tcb_in_cur_domain' x3 s \<and> st_tcb_at' runnable' x3 s \<and> tcb_at' x3 s \<and> st_tcb_at' runnable' x3 s \<and> tcb_in_cur_domain' x3 s \<and> st_tcb_at' runnable' x3 s)) proof (prove)
goal:
No subgoals!