theory IpcCancel_R

lemma blocked_cancelIPC_corres:
  "\<lbrakk> st = Structures_A.BlockedOnReceive epPtr p' \<or>
     st = Structures_A.BlockedOnSend epPtr p; thread_state_relation st st' \<rbrakk> \<Longrightarrow>
   corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t)
           (blocked_cancel_ipc st t)
           (do ep \<leftarrow> getEndpoint epPtr;
               y \<leftarrow> assert (\<not> (case ep of IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
               ep' \<leftarrow>
               if remove1 t (epQueue ep) = [] then return IdleEP
               else
                 return $ epQueue_update (%_. (remove1 t (epQueue ep))) ep;
               y \<leftarrow> setEndpoint epPtr ep';
               setThreadState Structures_H.thread_state.Inactive t
            od)" apply (simp add: blocked_cancel_ipc_def gbep_ret) apply (rule corres_guard_imp) apply (rule corres_split[OF getEndpoint_corres]) apply (rule_tac F="ep \<noteq> IdleEP" in corres_gen_asm2) apply (rule corres_assert_assume[rotated]) apply (clarsimp split: endpoint.splits) apply (rule_tac P="invs and st_tcb_at ((=) st) t" and
                      P'="invs' and st_tcb_at' ((=) st') t" in corres_inst) apply (case_tac rv) apply (simp add: ep_relation_def) apply (simp add: get_ep_queue_def ep_relation_def split del: if_split) apply (rename_tac list) apply (case_tac "remove1 t list") apply simp apply (rule corres_guard_imp) apply (rule corres_split[OF setEndpoint_corres]) apply (simp add: ep_relation_def) apply (rule setThreadState_corres) apply simp apply (simp add: valid_tcb_state_def pred_conj_def) apply (wp weak_sch_act_wf_lift)+ apply (clarsimp simp: st_tcb_at_tcb_at) apply (clarsimp simp: st_tcb_at_def obj_at_def) apply (erule pspace_valid_objsE) apply fastforce apply (auto simp: valid_tcb_state_def valid_tcb_def
                           valid_obj_def obj_at_def)[1] apply (clarsimp simp: pred_tcb_at') apply (clarsimp simp: pred_tcb_at'_def) apply (drule obj_at_ko_at') apply clarify apply (drule ko_at_valid_objs') apply fastforce apply (simp add: projectKOs) apply (auto simp add: valid_obj'_def valid_tcb'_def
                              valid_tcb_state'_def)[1] apply clarsimp apply (rule corres_guard_imp) apply (rule corres_split[OF setEndpoint_corres]) apply (simp add: ep_relation_def) apply (rule setThreadState_corres) apply simp apply (wp)+ apply (clarsimp simp: st_tcb_at_tcb_at) apply (clarsimp simp: st_tcb_at_def obj_at_def) apply (erule pspace_valid_objsE) apply fastforce apply (auto simp: valid_tcb_state_def valid_tcb_def
                          valid_obj_def obj_at_def)[1] apply (clarsimp simp: pred_tcb_at') apply (clarsimp simp: pred_tcb_at'_def) apply (drule obj_at_ko_at') apply clarify apply (drule ko_at_valid_objs') apply fastforce apply (simp add: projectKOs) apply (auto simp add: valid_obj'_def valid_tcb'_def
                             valid_tcb_state'_def)[1] apply (simp add: get_ep_queue_def ep_relation_def split del: if_split) apply (rename_tac list) apply (case_tac "remove1 t list") apply simp apply (rule corres_guard_imp) apply (rule corres_split[OF setEndpoint_corres]) apply (simp add: ep_relation_def) apply (rule setThreadState_corres) apply simp apply (simp add: valid_tcb_state_def pred_conj_def) apply (wp weak_sch_act_wf_lift)+ apply (clarsimp simp: st_tcb_at_tcb_at) apply (clarsimp simp: st_tcb_at_def obj_at_def) apply (erule pspace_valid_objsE) apply fastforce apply (auto simp: valid_tcb_state_def valid_tcb_def
                          valid_obj_def obj_at_def)[1] apply (clarsimp simp: pred_tcb_at') apply (clarsimp simp: pred_tcb_at'_def) apply (drule obj_at_ko_at') apply clarify apply (drule ko_at_valid_objs') apply fastforce apply (simp add: projectKOs) apply (auto simp add: valid_obj'_def valid_tcb'_def
                             valid_tcb_state'_def)[1] apply clarsimp apply (rule corres_guard_imp) apply (rule corres_split[OF setEndpoint_corres]) apply (simp add: ep_relation_def) apply (rule setThreadState_corres) apply simp apply (wp)+ apply (clarsimp simp: st_tcb_at_tcb_at) apply (clarsimp simp: st_tcb_at_def obj_at_def) apply (erule pspace_valid_objsE) apply fastforce apply (auto simp: valid_tcb_state_def valid_tcb_def
                         valid_obj_def obj_at_def)[1] apply (clarsimp simp: pred_tcb_at') apply (clarsimp simp: pred_tcb_at'_def) apply (drule obj_at_ko_at') apply clarify apply (drule ko_at_valid_objs') apply fastforce apply (simp add: projectKOs) apply (auto simp add: valid_obj'_def valid_tcb'_def
                            valid_tcb_state'_def)[1] apply (wp getEndpoint_wp)+ apply (clarsimp simp: st_tcb_at_def obj_at_def) apply (erule pspace_valid_objsE) apply fastforce apply (auto simp: valid_tcb_state_def valid_tcb_def
                     valid_obj_def obj_at_def)[1] apply clarsimp apply (rule conjI) apply (clarsimp simp: pred_tcb_at'_def) apply (drule obj_at_ko_at') apply clarify apply (drule ko_at_valid_objs') apply fastforce apply (simp add: projectKOs) apply (auto simp add: valid_obj'_def valid_tcb'_def
                         valid_tcb_state'_def)[1] apply (fastforce simp: ko_wp_at'_def obj_at'_def projectKOs dest: sym_refs_st_tcb_atD') done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (blocked_cancel_ipc st t) (do ep <- getEndpoint epPtr;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do ep <- get_endpoint epPtr;
queue <- get_ep_queue ep;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep <- getEndpoint epPtr;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> corres dc ?Q2 ?Q'2 (do ep <- get_endpoint epPtr;
queue <- get_ep_queue ep;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue ep (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep <- getEndpoint epPtr;
y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> ?Q2 s
 3. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> ?Q'2 s proof (prove)
goal (5 subgoals):
 1. \<And>rv ep. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep\<rbrakk> \<Longrightarrow> corres dc (?R6 rv) (?R'6 ep) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>?R6\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>?R'6\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>rv ep. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> corres dc (?R6 rv) (?P'12 ep) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- assert (\<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False));
ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>?R6\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. ?P'12 ep and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>rv ep s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; ?P'12 ep s\<rbrakk> \<Longrightarrow> \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)
 2. \<And>rv ep. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> corres dc (?R6 rv) (?P'12 ep) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>?R6\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. ?P'12 ep and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>rv ep. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> corres dc (?R6 rv) (?P'12 ep) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>?R6\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. ?P'12 ep and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>rv ep. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False)\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>rv ep. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep x2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>rv ep x2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>rv ep x2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP x2; rv = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t x2 of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t x2));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t x2 = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr Structures_A.endpoint.IdleEP;
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- setEndpoint epPtr Structures_H.endpoint.IdleEP;
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (9 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> corres dc (?Q24 rv ep list) (?Q'24 rv ep list) (do y <- set_endpoint epPtr Structures_A.endpoint.IdleEP;
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- setEndpoint epPtr Structures_H.endpoint.IdleEP;
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> ?Q24 rv ep list s
 3. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> ?Q'24 rv ep list s
 4. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (12 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> ep_relation Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP
 2. \<And>rv ep list y rv'. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; dc y rv'\<rbrakk> \<Longrightarrow> corres dc (?R28 rv ep list y) (?R'28 rv ep list rv') (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 3. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q28 rv ep list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>?R28 rv ep list\<rbrace>
 4. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'28 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>?R'28 rv ep list\<rbrace>
 5. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q28 rv ep list) s
 6. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'28 rv ep list) s
 7. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 8. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 9. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 10. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv ep list y rv'. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; dc y rv'\<rbrakk> \<Longrightarrow> corres dc (?R28 rv ep list y) (?R'28 rv ep list rv') (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 2. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q28 rv ep list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>?R28 rv ep list\<rbrace>
 3. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'28 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>?R'28 rv ep list\<rbrace>
 4. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q28 rv ep list) s
 5. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'28 rv ep list) s
 6. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 7. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 9. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv ep list y rv'. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; dc y rv'\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Inactive Structures_H.thread_state.Inactive
 2. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q28 rv ep list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 3. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'28 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv'. tcb_at' t\<rbrace>
 4. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q28 rv ep list) s
 5. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'28 rv ep list) s
 6. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 7. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 9. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q28 rv ep list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 2. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'28 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv'. tcb_at' t\<rbrace>
 3. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q28 rv ep list) s
 4. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'28 rv ep list) s
 5. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 6. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (10 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q28 (Structures_A.endpoint.SendEP list) (Structures_H.endpoint.SendEP list) list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 2. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'28 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv'. tcb_at' t\<rbrace>
 3. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q28 rv ep list) s
 4. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'28 rv ep list) s
 5. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 6. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and tcb_at t) s
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = []; invs s; st_tcb_at ((=) st) t s\<rbrakk> \<Longrightarrow> ep_at epPtr s
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = []; invs s; kheap s t = Some (TCB tcb); st = tcb_state tcb\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (9 subgoals):
 1. \<And>list s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = []; invs s; st = tcb_state tcb\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>list s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = []; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 3. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 4. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = []; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = []; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = []; invs' s; obj_at' (\<lambda>ko. st' = tcbState ko) t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = []; invs' s; \<exists>ko. ko_at' ko t s \<and> st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; ko_at' ko t s; st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (9 subgoals):
 1. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>list s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 3. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 4. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 2. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.SendEP list; rv = Structures_A.endpoint.SendEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (Structures_A.endpoint.SendEP (a # lista));
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- setEndpoint epPtr (Structures_H.endpoint.SendEP (a # lista));
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (?Q114 list a lista) (?Q'114 list a lista) (do y <- set_endpoint epPtr (Structures_A.endpoint.SendEP (a # lista));
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- setEndpoint epPtr (Structures_H.endpoint.SendEP (a # lista));
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> ?Q114 list a lista s
 3. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> ?Q'114 list a lista s
 4. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (11 subgoals):
 1. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> ep_relation (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista))
 2. \<And>list a lista y ya. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R118 list a lista y) (?R'118 list a lista ya) (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 3. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q118 list a lista\<rbrace> set_endpoint epPtr (Structures_A.endpoint.SendEP (a # lista)) \<lbrace>?R118 list a lista\<rbrace>
 4. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'118 list a lista\<rbrace> setEndpoint epPtr (Structures_H.endpoint.SendEP (a # lista)) \<lbrace>?R'118 list a lista\<rbrace>
 5. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q118 list a lista) s
 6. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'118 list a lista) s
 7. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 9. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>list a lista y ya. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R118 list a lista y) (?R'118 list a lista ya) (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 2. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q118 list a lista\<rbrace> set_endpoint epPtr (Structures_A.endpoint.SendEP (a # lista)) \<lbrace>?R118 list a lista\<rbrace>
 3. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'118 list a lista\<rbrace> setEndpoint epPtr (Structures_H.endpoint.SendEP (a # lista)) \<lbrace>?R'118 list a lista\<rbrace>
 4. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q118 list a lista) s
 5. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'118 list a lista) s
 6. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (10 subgoals):
 1. \<And>list a lista y ya. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Inactive Structures_H.thread_state.Inactive
 2. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q118 list a lista\<rbrace> set_endpoint epPtr (Structures_A.endpoint.SendEP (a # lista)) \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 3. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'118 list a lista\<rbrace> setEndpoint epPtr (Structures_H.endpoint.SendEP (a # lista)) \<lbrace>\<lambda>ya. tcb_at' t\<rbrace>
 4. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q118 list a lista) s
 5. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'118 list a lista) s
 6. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (9 subgoals):
 1. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q118 list a lista\<rbrace> set_endpoint epPtr (Structures_A.endpoint.SendEP (a # lista)) \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 2. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'118 list a lista\<rbrace> setEndpoint epPtr (Structures_H.endpoint.SendEP (a # lista)) \<lbrace>\<lambda>ya. tcb_at' t\<rbrace>
 3. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q118 list a lista) s
 4. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'118 list a lista) s
 5. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and tcb_at t) s
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; invs s; st_tcb_at ((=) st) t s\<rbrakk> \<Longrightarrow> ep_at epPtr s
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list a lista s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = a # lista; invs s; kheap s t = Some (TCB tcb); st = tcb_state tcb\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list a lista s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = a # lista; invs s; st = tcb_state tcb\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>list a lista s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = a # lista; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 3. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 4. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list a lista s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = a # lista; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; invs' s; obj_at' (\<lambda>ko. st' = tcbState ko) t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; invs' s; \<exists>ko. ko_at' ko t s \<and> st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; ko_at' ko t s; st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>list a lista s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 3. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 4. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list a lista s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 2. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 3. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep_relation rv ep; ep \<noteq> Structures_H.endpoint.IdleEP; \<not> (case ep of Structures_H.endpoint.IdleEP \<Rightarrow> True | _ \<Rightarrow> False); rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do queue <- get_ep_queue rv;
y <- set_endpoint epPtr (case remove1 t queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t queue));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t (epQueue ep) = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>rv ep x3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP x3; rv = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t x3 of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> update_ep_queue rv (remove1 t x3));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t x3 = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr Structures_A.endpoint.IdleEP;
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- setEndpoint epPtr Structures_H.endpoint.IdleEP;
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> corres dc (?Q197 rv ep list) (?Q'197 rv ep list) (do y <- set_endpoint epPtr Structures_A.endpoint.IdleEP;
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- setEndpoint epPtr Structures_H.endpoint.IdleEP;
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> ?Q197 rv ep list s
 3. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> ?Q'197 rv ep list s
 4. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (11 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> ep_relation Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP
 2. \<And>rv ep list y rv'. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; dc y rv'\<rbrakk> \<Longrightarrow> corres dc (?R201 rv ep list y) (?R'201 rv ep list rv') (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 3. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 rv ep list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>?R201 rv ep list\<rbrace>
 4. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'201 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>?R'201 rv ep list\<rbrace>
 5. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q201 rv ep list) s
 6. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'201 rv ep list) s
 7. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 9. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv ep list y rv'. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; dc y rv'\<rbrakk> \<Longrightarrow> corres dc (?R201 rv ep list y) (?R'201 rv ep list rv') (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 2. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 rv ep list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>?R201 rv ep list\<rbrace>
 3. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'201 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>?R'201 rv ep list\<rbrace>
 4. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q201 rv ep list) s
 5. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'201 rv ep list) s
 6. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (10 subgoals):
 1. \<And>rv ep list y rv'. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; dc y rv'\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Inactive Structures_H.thread_state.Inactive
 2. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 rv ep list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 3. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'201 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv'. tcb_at' t\<rbrace>
 4. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q201 rv ep list) s
 5. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'201 rv ep list) s
 6. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (9 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 rv ep list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 2. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'201 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv'. tcb_at' t\<rbrace>
 3. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q201 rv ep list) s
 4. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'201 rv ep list) s
 5. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (9 subgoals):
 1. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 (Structures_A.endpoint.RecvEP list) (Structures_H.endpoint.RecvEP list) list\<rbrace> set_endpoint epPtr Structures_A.endpoint.IdleEP \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 2. \<And>rv ep list. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'201 rv ep list\<rbrace> setEndpoint epPtr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv'. tcb_at' t\<rbrace>
 3. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q201 rv ep list) s
 4. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'201 rv ep list) s
 5. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and tcb_at t) s
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = []; invs s; st_tcb_at ((=) st) t s\<rbrakk> \<Longrightarrow> ep_at epPtr s
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = []; invs s; kheap s t = Some (TCB tcb); st = tcb_state tcb\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = []; invs s; st = tcb_state tcb\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>list s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = []; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 3. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 4. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = []; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>rv ep list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = []; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = []; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = []; invs' s; obj_at' (\<lambda>ko. st' = tcbState ko) t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = []; invs' s; \<exists>ko. ko_at' ko t s \<and> st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; ko_at' ko t s; st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>list s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 3. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 4. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 2. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 3. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = []; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>rv ep list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; ep = Structures_H.endpoint.RecvEP list; rv = Structures_A.endpoint.RecvEP list; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (case remove1 t list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> update_ep_queue rv (remove1 t list));
set_thread_state t Structures_A.thread_state.Inactive
od) (do ep' <- if remove1 t list = [] then return Structures_H.endpoint.IdleEP else return $ epQueue_update (\<lambda>_. remove1 t (epQueue ep)) ep;
y <- setEndpoint epPtr ep';
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (invs and st_tcb_at ((=) st) t) (invs' and st_tcb_at' ((=) st') t) (do y <- set_endpoint epPtr (Structures_A.endpoint.RecvEP (a # lista));
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- setEndpoint epPtr (Structures_H.endpoint.RecvEP (a # lista));
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> corres dc (?Q287 list a lista) (?Q'287 list a lista) (do y <- set_endpoint epPtr (Structures_A.endpoint.RecvEP (a # lista));
set_thread_state t Structures_A.thread_state.Inactive
od) (do y <- setEndpoint epPtr (Structures_H.endpoint.RecvEP (a # lista));
setThreadState Structures_H.thread_state.Inactive t
od)
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> ?Q287 list a lista s
 3. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> ?Q'287 list a lista s
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (10 subgoals):
 1. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> ep_relation (Structures_A.endpoint.RecvEP (a # lista)) (Structures_H.endpoint.RecvEP (a # lista))
 2. \<And>list a lista y ya. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R291 list a lista y) (?R'291 list a lista ya) (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 3. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 list a lista\<rbrace> set_endpoint epPtr (Structures_A.endpoint.RecvEP (a # lista)) \<lbrace>?R291 list a lista\<rbrace>
 4. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'291 list a lista\<rbrace> setEndpoint epPtr (Structures_H.endpoint.RecvEP (a # lista)) \<lbrace>?R'291 list a lista\<rbrace>
 5. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q291 list a lista) s
 6. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'291 list a lista) s
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 8. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 10. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (9 subgoals):
 1. \<And>list a lista y ya. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R291 list a lista y) (?R'291 list a lista ya) (set_thread_state t Structures_A.thread_state.Inactive) (setThreadState Structures_H.thread_state.Inactive t)
 2. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 list a lista\<rbrace> set_endpoint epPtr (Structures_A.endpoint.RecvEP (a # lista)) \<lbrace>?R291 list a lista\<rbrace>
 3. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'291 list a lista\<rbrace> setEndpoint epPtr (Structures_H.endpoint.RecvEP (a # lista)) \<lbrace>?R'291 list a lista\<rbrace>
 4. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q291 list a lista) s
 5. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'291 list a lista) s
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (9 subgoals):
 1. \<And>list a lista y ya. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Inactive Structures_H.thread_state.Inactive
 2. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 list a lista\<rbrace> set_endpoint epPtr (Structures_A.endpoint.RecvEP (a # lista)) \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 3. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'291 list a lista\<rbrace> setEndpoint epPtr (Structures_H.endpoint.RecvEP (a # lista)) \<lbrace>\<lambda>ya. tcb_at' t\<rbrace>
 4. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q291 list a lista) s
 5. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'291 list a lista) s
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 7. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 9. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (8 subgoals):
 1. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 list a lista\<rbrace> set_endpoint epPtr (Structures_A.endpoint.RecvEP (a # lista)) \<lbrace>\<lambda>y. tcb_at t\<rbrace>
 2. \<And>list a lista. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'291 list a lista\<rbrace> setEndpoint epPtr (Structures_H.endpoint.RecvEP (a # lista)) \<lbrace>\<lambda>ya. tcb_at' t\<rbrace>
 3. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q291 list a lista) s
 4. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'291 list a lista) s
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 6. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 8. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and tcb_at t) s
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; invs s; st_tcb_at ((=) st) t s\<rbrakk> \<Longrightarrow> ep_at epPtr s
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = a # lista; invs s; kheap s t = Some (TCB tcb); st = tcb_state tcb\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list a lista s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = a # lista; invs s; st = tcb_state tcb\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>list a lista s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = a # lista; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 3. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; remove1 t list = a # lista; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and tcb_at' t) s
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; invs' s; obj_at' (\<lambda>ko. st' = tcbState ko) t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>list a lista s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; remove1 t list = a # lista; invs' s; \<exists>ko. ko_at' ko t s \<and> st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; ko_at' ko t s; st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (7 subgoals):
 1. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>list a lista s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 3. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 5. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 7. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (6 subgoals):
 1. \<And>list a lista s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 2. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 4. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 6. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (5 subgoals):
 1. \<And>list a lista s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); remove1 t list = a # lista; invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 3. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 5. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q6\<rbrace> get_endpoint epPtr \<lbrace>\<lambda>rv. invs and st_tcb_at ((=) st) t\<rbrace>
 2. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'6\<rbrace> getEndpoint epPtr \<lbrace>\<lambda>ep. invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)\<rbrace>
 3. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and ?Q6) s
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and ?Q'6) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs and st_tcb_at ((=) st) t) s\<rbrakk> \<Longrightarrow> (ep_at epPtr and (invs and st_tcb_at ((=) st) t)) s
 2. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and (\<lambda>s. \<forall>ep. ko_at' ep epPtr s \<longrightarrow> (invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; invs s; kheap s t = Some (TCB tcb); st = tcb_state tcb\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and (\<lambda>s. \<forall>ep. ko_at' ep epPtr s \<longrightarrow> (invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)) s)) s proof (prove)
goal (3 subgoals):
 1. \<And>s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; invs s; st = tcb_state tcb\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 3. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and (\<lambda>s. \<forall>ep. ko_at' ep epPtr s \<longrightarrow> (invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>s tcb. \<lbrakk>tcb_state tcb = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> tcb_state tcb = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation (tcb_state tcb) st'; invs s; st = tcb_state tcb; kheap s t = Some (TCB tcb); valid_obj t (TCB tcb) s\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s epPtr = Some ko \<and> is_ep ko
 2. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and (\<lambda>s. \<forall>ep. ko_at' ep epPtr s \<longrightarrow> (invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; (invs' and st_tcb_at' ((=) st') t) s\<rbrakk> \<Longrightarrow> (ep_at' epPtr and (\<lambda>s. \<forall>ep. ko_at' ep epPtr s \<longrightarrow> (invs' and st_tcb_at' ((=) st') t and (\<lambda>s. ep \<noteq> Structures_H.endpoint.IdleEP)) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s \<and> (\<forall>ep. ko_at' ep epPtr s \<longrightarrow> ep \<noteq> Structures_H.endpoint.IdleEP) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep epPtr s \<longrightarrow> ep \<noteq> Structures_H.endpoint.IdleEP proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; obj_at' (\<lambda>ko. st' = tcbState ko) t s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep epPtr s \<longrightarrow> ep \<noteq> Structures_H.endpoint.IdleEP proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; \<exists>ko. ko_at' ko t s \<and> st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep epPtr s \<longrightarrow> ep \<noteq> Structures_H.endpoint.IdleEP proof (prove)
goal (2 subgoals):
 1. \<And>s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); invs' s; ko_at' ko t s; st' = tcbState ko\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep epPtr s \<longrightarrow> ep \<noteq> Structures_H.endpoint.IdleEP proof (prove)
goal (4 subgoals):
 1. \<And>s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); invs' s; st' = tcbState ko\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 3. \<And>s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 4. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep epPtr s \<longrightarrow> ep \<noteq> Structures_H.endpoint.IdleEP proof (prove)
goal (3 subgoals):
 1. \<And>s ko koa. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); invs' s; st' = tcbState ko; projectKO_opt koa = Some ko\<rbrakk> \<Longrightarrow> injectKO ko = koa
 2. \<And>s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 3. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep epPtr s \<longrightarrow> ep \<noteq> Structures_H.endpoint.IdleEP proof (prove)
goal (2 subgoals):
 1. \<And>s ko. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st (tcbState ko); invs' s; st' = tcbState ko; valid_obj' (injectKO ko) s\<rbrakk> \<Longrightarrow> ep_at' epPtr s
 2. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep epPtr s \<longrightarrow> ep \<noteq> Structures_H.endpoint.IdleEP proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>st = Structures_A.thread_state.BlockedOnReceive epPtr p' \<or> st = Structures_A.thread_state.BlockedOnSend epPtr p; thread_state_relation st st'; invs' s; st_tcb_at' ((=) st') t s\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep epPtr s \<longrightarrow> ep \<noteq> Structures_H.endpoint.IdleEP proof (prove)
goal:
No subgoals!