theory Schedule_C

lemma timerTick_ccorres:
  "ccorres dc xfdc invs' UNIV [] timerTick (Call timerTick_'proc)" supply subst_all [simp del] apply (cinit) apply (rule ccorres_pre_getCurThread) apply (ctac add: get_tsType_ccorres2 [where f="\<lambda>s. ksCurThread_' (globals s)"]) apply (rule ccorres_split_nothrow_novcg) apply wpc apply (simp add: "StrictC'_thread_state_defs", rule ccorres_cond_false, rule ccorres_return_Skip)+ 
             (* thread_state.Running *)
              apply simp apply (rule ccorres_cond_true) apply (rule ccorres_pre_threadGet) apply (rule_tac P="cur_tcb'" and P'=\<top> in ccorres_move_c_guards(8)) apply (clarsimp simp: cur_tcb'_def) apply (drule (1) tcb_at_h_t_valid) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def) apply (rule_tac Q="\<lambda>s. obj_at' (\<lambda>tcb. tcbTimeSlice tcb = rva) (ksCurThread s) s"
                         and Q'=\<top> in ccorres_cond_both') apply clarsimp apply (drule (1) obj_at_cslift_tcb) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def) apply (clarsimp simp: typ_heap_simps) apply (clarsimp simp: ctcb_relation_def word_less_nat_alt) apply (rule_tac P="cur_tcb'" and P'=\<top> in ccorres_move_c_guards(8)) apply (clarsimp simp: cur_tcb'_def) apply (fastforce simp: rf_sr_def cstate_relation_def Let_def typ_heap_simps dest: tcb_at_h_t_valid) apply (rule_tac P="cur_tcb'" and P'=\<top> in ccorres_move_c_guards(8)) apply (clarsimp simp: cur_tcb'_def) apply (fastforce simp: rf_sr_def cstate_relation_def Let_def typ_heap_simps dest: tcb_at_h_t_valid) apply (ctac add: threadSet_timeSlice_ccorres) apply (rule ccorres_rhs_assoc)+ apply (ctac) apply simp apply (ctac (no_vcg) add: tcbSchedAppend_ccorres) apply (ctac add: rescheduleRequired_ccorres) apply (wp weak_sch_act_wf_lift_linear threadSet_valid_queues
                         threadSet_pred_tcb_at_state tcbSchedAppend_valid_objs' threadSet_valid_objs' threadSet_tcbDomain_triv
                    | clarsimp simp: st_tcb_at'_def o_def split: if_splits)+ apply (vcg exspec=tcbSchedDequeue_modifies) apply (simp add: "StrictC'_thread_state_defs", rule ccorres_cond_false, rule ccorres_return_Skip)+ apply ceqv apply (clarsimp simp: decDomainTime_def numDomains_sge_1_simp) apply (rule ccorres_when[where R=\<top>]) apply (solves \<open>clarsimp split: if_split\<close>) apply (rule ccorres_split_nothrow_novcg) apply (rule_tac rrel=dc and xf=xfdc and P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: simpler_modify_def) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                                 carch_state_relation_def cmachine_state_relation_def) apply ceqv apply (rule ccorres_pre_getDomainTime) apply (rename_tac rva rv'a rvb) apply (rule_tac P'="{s. ksDomainTime_' (globals s) = rvb}" in ccorres_inst, simp) apply (case_tac "rvb = 0") apply clarsimp apply (rule ccorres_guard_imp2) apply (rule ccorres_cond_true) apply (ctac add: rescheduleRequired_ccorres) apply clarsimp apply assumption apply clarsimp apply (rule ccorres_guard_imp2) apply (rule ccorres_cond_false) apply (rule ccorres_return_Skip) apply clarsimp apply wp apply (clarsimp simp: guard_is_UNIV_def) apply (wp hoare_vcg_conj_lift hoare_vcg_all_lift hoare_drop_imps) apply (wpc | wp threadSet_weak_sch_act_wf threadSet_valid_objs' rescheduleRequired_weak_sch_act_wf
                       tcbSchedAppend_valid_objs' weak_sch_act_wf_lift_linear threadSet_st_tcb_at2 threadGet_wp
                  | simp split del: if_splits)+ apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem word_sle_def word_sless_def) apply (wp gts_wp') apply vcg apply (clarsimp simp: invs_weak_sch_act_wf) apply (fold cur_tcb'_def) apply (rule conjI, clarsimp) apply (rule conjI, clarsimp) apply (rule conjI) apply (clarsimp simp: invs'_def valid_state'_def) apply (auto simp: obj_at'_def inQ_def weak_sch_act_wf_def st_tcb_at'_def
                      valid_pspace'_def ct_idle_or_in_cur_domain'_def valid_tcb'_def valid_idle'_def projectKOs)[1] apply (rule conjI, clarsimp simp: invs'_def valid_state'_def valid_tcb'_def)+ apply (auto simp: obj_at'_def inQ_def weak_sch_act_wf_def st_tcb_at'_def
                      valid_pspace'_def ct_idle_or_in_cur_domain'_def valid_tcb'_def valid_idle'_def projectKOs)[1] apply (auto simp: invs'_def valid_state'_def valid_tcb'_def tcb_cte_cases_def)[1] apply (frule invs_cur') apply (clarsimp simp: cur_tcb'_def) apply (drule (1) obj_at_cslift_tcb) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def typ_heap_simps' Kernel_Config.timeSlice_def) apply (subst unat_sub) apply simp apply (clarsimp simp: ctcb_relation_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' UNIV [] timerTick (Call timerTick_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' UNIV [] timerTick (Call timerTick_'proc) proof (prove)
goal (2 subgoals):
 1. ccorres dc xfdc ?Q9 ?Q'9 [SKIP] (do thread <- getCurThread;
state <- getThreadState thread;
y <- case state of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return ();
when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI;;
IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q9 s \<and> s' \<in> ?Q'9 proof (prove)
goal (2 subgoals):
 1. \<And>thread. ccorres dc xfdc (?P15 thread) (?P'15 thread) [SKIP] (do state <- getThreadState thread;
y <- case state of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return ();
when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI;;
IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P15 rv s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'15 rv} proof (prove)
goal (4 subgoals):
 1. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ccorres dc xfdc (?Q20 thread rv) (?Q'20 thread rv ret__unsigned) [SKIP] (do y <- case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return ();
when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI;;
IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI)
 2. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>?Q20 thread\<rbrace>
 3. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> ?Q'20 thread rv (ret__unsigned_' s)}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (8 subgoals):
 1. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ccorres (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?P236 thread rv) (?Q'20 thread rv ret__unsigned) [] (case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 2. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 3. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; ?r'235 thread rv ret__unsigned y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
 6. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. ?P236 thread rv and ?R237 thread rv\<rbrace>
 7. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> ?Q'20 thread rv (ret__unsigned_' s)}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (15 subgoals):
 1. \<And>thread rv ret__unsigned x11 x12. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnReceive x11 x12\<rbrakk> \<Longrightarrow> ccorres (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?R270 thread rv x11 x12) (?R''268 thread rv ret__unsigned x11 x12) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; awaiting_reply' rv\<rbrakk> \<Longrightarrow> ccorres (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?R271 thread rv) (?R''265 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned x3. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> ccorres (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?R272 thread rv x3) (?R''264 thread rv ret__unsigned x3) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?R273 thread rv) (?R''262 thread rv ret__unsigned) [] (do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (?r'235 thread rv ret__unsigned) (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 9. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; ?r'235 thread rv ret__unsigned y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
A total of 15 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R273 thread rv) (?R''262 thread rv ret__unsigned) [] (do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
 10. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R273 thread rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R273 thread rv) (?R''262 thread rv ret__unsigned) [] (do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
 10. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R273 thread rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R273 thread Structures_H.thread_state.Running) (?R''262 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)) [] (do ts <- threadGet tcbTimeSlice thread;
if Suc 0 < ts then threadSet (tcbTimeSlice_update (\<lambda>_. ts - Suc 0)) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od) (Cond UNIV (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)) SKIP)
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
 10. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R273 thread rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R273 thread Structures_H.thread_state.Running) (?R'314 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)) [] (do ts <- threadGet tcbTimeSlice thread;
if Suc 0 < ts then threadSet (tcbTimeSlice_update (\<lambda>_. ts - Suc 0)) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI))
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
 10. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> ?R273 thread rv s) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?P323 thread rva) (?P'322 thread rva) [] (if Suc 0 < rva then threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI))
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
 10. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ?P320 thread rv s tcb)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>thread s tcb. ?P323 thread (tcbTimeSlice tcb) s \<equiv>\<^sup>? \<lambda>thread. ?P320 thread Structures_H.thread_state.Running
\<lambda>thread tcb. ?P'322 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?P'321 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) proof (prove)
goal (13 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> cur_tcb' s \<and> True \<longrightarrow> s' \<Turnstile>\<^sub>c ksCurThread_' (globals s')
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A570 thread rva) (?C'568 thread rva) [] (if Suc 0 < rva then threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'568 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'565 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread tcb. ?A570 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?A571 thread Structures_H.thread_state.Running proof (prove)
goal (13 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ksCurThread_' (globals s')
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A570 thread rva) (?C'568 thread rva) [] (if Suc 0 < rva then threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'568 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'565 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?A571 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?A570 thread (tcbTimeSlice tcb) proof (prove)
goal (13 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ksCurThread_' (globals s')
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A570 thread rva) (?C'568 thread rva) [] (if Suc 0 < rva then threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'568 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'565 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?A571 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?A570 thread (tcbTimeSlice tcb) proof (prove)
goal (12 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A570 thread rva) (?C'568 thread rva) [] (if Suc 0 < rva then threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
 10. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (?A571 thread rv tcb and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'568 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'565 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?A571 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?A570 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbTimeSlice tcb = rva) (ksCurThread s) s \<and> True \<longrightarrow> (Suc 0 < rva) = (s' \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace>)
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R839 thread rva) (?R'833 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1))))))
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?R839 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?R841 thread Structures_H.thread_state.Running
\<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?U840 thread Structures_H.thread_state.Running
\<lambda>thread tcb. ?R'833 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?R'835 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) proof (prove)
goal (14 subgoals):
 1. \<And>rva s s'. \<lbrakk>(s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. tcbTimeSlice tcb = rva) (ksCurThread s) s\<rbrakk> \<Longrightarrow> (Suc 0 < rva) = (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(ksCurThread_' (globals s')\<rightarrow>[''tcbTimeSlice_C''])))
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R839 thread rva) (?R'833 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1))))))
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread. ?R841 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?R839 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?R'835 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?R'833 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rva s s'. \<lbrakk>(s, s') \<in> rf_sr; \<exists>ko ko'. ko_at' ko (ksCurThread s) s \<and> tcbTimeSlice ko = rva \<and> cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (Suc 0 < rva) = (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(ksCurThread_' (globals s')\<rightarrow>[''tcbTimeSlice_C''])))
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R839 thread rva) (?R'833 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1))))))
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread. ?R841 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?R839 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?R'835 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?R'833 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>s s' ko ko'. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); ko_at' ko (ksCurThread s) s; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; ctcb_relation ko ko'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> (Suc 0 < tcbTimeSlice ko) = (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbTimeSlice_C''])))
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R839 thread rva) (?R'833 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1))))))
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread. ?R841 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?R839 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?R'835 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?R'833 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>s s' ko ko'. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); ko_at' ko (ksCurThread s) s; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; ctcb_relation ko ko'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> (Suc 0 < tcbTimeSlice ko) = (1 < tcbTimeSlice_C ko')
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R839 thread rva) (?R'833 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1))))))
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread. ?R841 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?R839 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?R'835 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?R'833 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (13 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R839 thread rva) (?R'833 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1))))))
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>thread. ?R841 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?R839 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?R'835 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?R'833 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> cur_tcb' s \<and> True \<longrightarrow> s' \<Turnstile>\<^sub>c ksCurThread_' (globals s')
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A1134 thread rva) (?C'1132 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'1132 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'1129 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread tcb. ?A1134 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?A1135 thread Structures_H.thread_state.Running
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rva s s'. \<lbrakk>Suc 0 < rva; (s, s') \<in> rf_sr; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ksCurThread_' (globals s')
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A1134 thread rva) (?C'1132 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'1132 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'1129 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?A1135 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?A1134 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (13 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A1134 thread rva) (?C'1132 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'1132 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'1129 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?A1135 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?A1134 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> cur_tcb' s \<and> True \<longrightarrow> s' \<Turnstile>\<^sub>c ksCurThread_' (globals s')
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A1439 thread rva) (?C'1437 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1))))
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'1437 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'1434 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread tcb. ?A1439 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?A1440 thread Structures_H.thread_state.Running
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>rva s s'. \<lbrakk>Suc 0 < rva; (s, s') \<in> rf_sr; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ksCurThread_' (globals s')
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A1439 thread rva) (?C'1437 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1))))
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'1437 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'1434 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?A1440 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?A1439 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (13 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?A1439 thread rva) (?C'1437 thread rva) [] (threadSet (tcbTimeSlice_update (\<lambda>_. rva - Suc 0)) thread) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1))))
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc (?xf'235 thread rv ret__unsigned) (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> (?xf'235 thread rv ret__unsigned) rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc (?xf'235 thread rv ret__unsigned) (?Q'235 thread rv ret__unsigned)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?C'1437 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?C'1434 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?A1440 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?A1439 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (12 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'235 thread rv ret__unsigned)
 10. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> ?U840 thread rv tcb s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (12 subgoals):
 1. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U837 thread rva) (?U'831 thread rva) [] (do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
(CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()))
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'235 thread rv ret__unsigned)
 10. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> ?U840 thread rv tcb s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>thread. ?U840 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?U837 thread (tcbTimeSlice tcb)
\<lambda>thread. ?U'834 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<equiv>\<^sup>? \<lambda>thread tcb. ?U'831 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>thread rv ret__unsigned rva rvb xfdca. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva; dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1520 thread rv ret__unsigned rva rvb) (?Q'1520 thread rv ret__unsigned rva rvb xfdca) [] (K_bind (do tcbSchedAppend thread;
rescheduleRequired
od) rvb) (CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1532 thread rva\<rbrace> threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread \<lbrace>?Q1520 thread rv ret__unsigned rva\<rbrace>
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1529 thread rva) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'1520 thread rv ret__unsigned rva rvb (xfdc s)}
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?R'1529 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?R'1527 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?R1535 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?R1532 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>thread rv ret__unsigned rva xfdca. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1520 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) rva ()) (?Q'1520 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) rva () xfdca) [] (do y <- tcbSchedAppend thread;
rescheduleRequired
od) (CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc())
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1532 thread rva\<rbrace> threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread \<lbrace>?Q1520 thread rv ret__unsigned rva\<rbrace>
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1529 thread rva) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'1520 thread rv ret__unsigned rva rvb (xfdc s)}
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?R'1529 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?R'1527 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?R1535 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?R1532 thread (tcbTimeSlice tcb) proof (prove)
goal (15 subgoals):
 1. \<And>thread rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1566 thread rv ret__unsigned rva xfdca rvb) (?Q'1580 thread rva xfdca rvb xfdcb) [] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>thread rv ret__unsigned rva xfdc. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1574 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) rva ()\<rbrace> tcbSchedAppend thread \<lbrace>?Q1566 thread rv ret__unsigned rva xfdc\<rbrace>
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1532 thread rva\<rbrace> threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread \<lbrace>\<lambda>a. Invariants_H.valid_queues and tcb_at' thread and valid_objs' and ?R1574 thread rv ret__unsigned rva a\<rbrace>
 4. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1529 thread rva) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1579 thread rv ret__unsigned rva rvb (xfdc s) t rvc}}
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 9. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
A total of 15 subgoals...
flex-flex pairs:
\<lambda>thread rva xfdca t rv. ?Q'1580 thread rva xfdca rv (xfdc t) \<equiv>\<^sup>? \<lambda>thread rva. ?Q'1579 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) rva ()
\<lambda>thread tcb. ?R'1529 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?R'1527 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?R1535 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?R1532 thread (tcbTimeSlice tcb) proof (prove)
goal (14 subgoals):
 1. \<And>thread rv ret__unsigned rva xfdc. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1574 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) rva ()\<rbrace> tcbSchedAppend thread \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs'\<rbrace>
 2. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1532 thread rva\<rbrace> threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread \<lbrace>\<lambda>a. Invariants_H.valid_queues and tcb_at' thread and valid_objs' and ?R1574 thread rv ret__unsigned rva a\<rbrace>
 3. \<And>thread rv ret__unsigned rva. \<lbrakk>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; rv = Structures_H.thread_state.Running; \<not> Suc 0 < rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1529 thread rva) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 7. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 8. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 9. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 10. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?R'1529 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?R'1527 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
\<lambda>thread. ?R1535 thread Structures_H.thread_state.Running \<equiv>\<^sup>? \<lambda>thread tcb. ?R1532 thread (tcbTimeSlice tcb) proof (prove)
goal (12 subgoals):
 1. \<And>thread rva. \<not> Suc 0 < rva \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1529 thread rva) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)) \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 6. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 9. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'235 thread rv ret__unsigned)
 10. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>thread tcb. ?R'1529 thread (tcbTimeSlice tcb) \<equiv>\<^sup>? \<lambda>thread. ?R'1527 thread Structures_H.thread_state.Running (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) proof (prove)
goal (11 subgoals):
 1. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R274 thread rv) (?R''261 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 2. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; idle' rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R275 thread rv) (?R''260 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 3. \<And>thread rv ret__unsigned x71 x72 x73 x74 x75. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R276 thread rv x71 x72 x73 x74 x75) (?R''259 thread rv ret__unsigned x71 x72 x73 x74 x75) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 4. \<And>thread rv ret__unsigned. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R277 thread rv) (?R''253 thread rv ret__unsigned) [] (return ()) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Running THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (IF 1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1)))))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
CALL tcbSchedAppend_'proc(\<acute>ksCurThread);;
CALL rescheduleRequired_'proc()
FI)
FI)
 5. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 6. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 7. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 8. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'235 thread rv ret__unsigned)
 9. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> ?R274 thread rv s) \<and> (idle' rv \<longrightarrow> ?R275 thread rv s) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> ?R276 thread rv x xa xb xc xd s) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> ?R277 thread rv s)) and ?R237 thread rv\<rbrace>
 10. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({sa. rv = Structures_H.thread_state.Inactive \<longrightarrow> sa \<in> ?R''261 thread rv (ret__unsigned_' s)} \<inter> ({sa. idle' rv \<longrightarrow> sa \<in> ?R''260 thread rv (ret__unsigned_' s)} \<inter> ({sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. \<forall>xb. sa \<in> {sa. \<forall>xc. sa \<in> {sa. \<forall>xd. sa \<in> {sa. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> sa \<in> ?R''259 thread rv (ret__unsigned_' s) x xa xb xc xd}}}}}} \<inter> {sa. rv = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?R''253 thread rv (ret__unsigned_' s)}))))))}
A total of 11 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>thread rv ret__unsigned rv' t t'. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI) (?d'235 thread rv ret__unsigned rv')
 2. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (?d'235 thread rv ret__unsigned rv')
 3. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'235 thread rv ret__unsigned)
 5. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 6. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (6 subgoals):
 1. \<And>thread rv ret__unsigned y rv'. \<lbrakk>ret__unsigned = thread_state_to_tsType rv; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q235 thread rv ret__unsigned y) (?Q'235 thread rv ret__unsigned y rv') [SKIP] (when (Suc 0 < numDomains) (do y <- decDomainTime;
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (IF 1 <s Kernel_C.numDomains THEN
  \<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI
FI)
 2. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 3. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'235 thread rv ret__unsigned)
 4. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (6 subgoals):
 1. \<And>thread rv rv'. ccorres dc xfdc (?Q235 thread rv (thread_state_to_tsType rv) ()) (?Q'235 thread rv (thread_state_to_tsType rv) () rv') [SKIP] (when (Suc 0 < numDomains) (do y <- modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>);
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od)) (Cond (if Suc 0 < numDomains then UNIV else {}) (\<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI) SKIP)
 2. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>?Q235 thread rv ret__unsigned\<rbrace>
 3. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'235 thread rv ret__unsigned)
 4. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (7 subgoals):
 1. \<And>thread rv rv'. \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (Suc 0 < numDomains) = (s' \<in> (if Suc 0 < numDomains then UNIV else {}))
 2. \<And>thread rv rv'. ccorres dc xfdc (?Pt1776 thread rv (thread_state_to_tsType rv) ()) (?Rt1775 thread rv (thread_state_to_tsType rv) () rv') [SKIP] (do y <- modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>);
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od) (\<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 3. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ?Pt1776 thread rv ret__unsigned a s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> ?Rt1775 thread rv ret__unsigned a b) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 6. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (6 subgoals):
 1. \<And>thread rv rv'. ccorres dc xfdc (?Pt1776 thread rv (thread_state_to_tsType rv) ()) (?Rt1775 thread rv (thread_state_to_tsType rv) () rv') [SKIP] (do y <- modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>);
domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od) (\<acute>ksDomainTime :== \<acute>ksDomainTime - 1;;
IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ?Pt1776 thread rv ret__unsigned a s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 3. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> ?Rt1775 thread rv ret__unsigned a b) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 4. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rv'. ccorres (?r'1786 thread rv rv') (?xf'1786 thread rv rv') (?P1791 thread rv (thread_state_to_tsType rv) ()) (?Rt1775 thread rv (thread_state_to_tsType rv) () rv') [] (modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>)) (\<acute>ksDomainTime :== \<acute>ksDomainTime - 1)
 2. \<And>thread rv rv' rv'a t t'. ceqv \<Gamma> (?xf'1786 thread rv rv') rv'a t t' (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI) (?d'1786 thread rv rv' rv'a)
 3. \<And>thread rv rv' rva rv'a. ?r'1786 thread rv rv' rva rv'a \<Longrightarrow> ccorres dc xfdc (?Q1786 thread rv rv' rva) (?Q'1786 thread rv rv' rva rv'a) [SKIP] (do domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od) (?d'1786 thread rv rv' rv'a)
 4. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>?Q1786 thread rv rv'\<rbrace>
 5. \<And>thread rv rv'. guard_is_UNIV (?r'1786 thread rv rv') (?xf'1786 thread rv rv') (?Q'1786 thread rv rv')
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> (?P1791 thread rv ret__unsigned a and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 7. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> ?Rt1775 thread rv ret__unsigned a b) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 8. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rv'. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ksDomainTime :== \<acute>ksDomainTime - 1 {s. \<exists>(rv, \<sigma>')\<in>fst (modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>thread rv rv' rv'a t t'. ceqv \<Gamma> xfdc rv'a t t' (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI) (?d'1786 thread rv rv' rv'a)
 3. \<And>thread rv rv' rva rv'a. dc rva rv'a \<Longrightarrow> ccorres dc xfdc (?Q1786 thread rv rv' rva) (?Q'1786 thread rv rv' rva rv'a) [SKIP] (do domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od) (?d'1786 thread rv rv' rv'a)
 4. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>?Q1786 thread rv rv'\<rbrace>
 5. \<And>thread rv rv'. guard_is_UNIV dc xfdc (?Q'1786 thread rv rv')
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 7. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 8. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rv' \<sigma>. {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<sigma>). (\<sigma>', globals_update (ksDomainTime_'_update (\<lambda>_. ksDomainTime_' (globals s) - 1)) s) \<in> rf_sr \<and> dc rv (xfdc (globals_update (ksDomainTime_'_update (\<lambda>_. ksDomainTime_' (globals s) - 1)) s))}
 2. \<And>thread rv rv' rv'a t t'. ceqv \<Gamma> xfdc rv'a t t' (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI) (?d'1786 thread rv rv' rv'a)
 3. \<And>thread rv rv' rva rv'a. dc rva rv'a \<Longrightarrow> ccorres dc xfdc (?Q1786 thread rv rv' rva) (?Q'1786 thread rv rv' rva rv'a) [SKIP] (do domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od) (?d'1786 thread rv rv' rv'a)
 4. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>?Q1786 thread rv rv'\<rbrace>
 5. \<And>thread rv rv'. guard_is_UNIV dc xfdc (?Q'1786 thread rv rv')
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 7. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 8. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x. (\<sigma>, x) \<in> rf_sr \<Longrightarrow> (\<sigma>\<lparr>ksDomainTime := ksDomainTime \<sigma> - 1\<rparr>, globals_update (ksDomainTime_'_update (\<lambda>_. ksDomainTime_' (globals x) - 1)) x) \<in> rf_sr
 2. \<And>thread rv rv' rv'a t t'. ceqv \<Gamma> xfdc rv'a t t' (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI) (?d'1786 thread rv rv' rv'a)
 3. \<And>thread rv rv' rva rv'a. dc rva rv'a \<Longrightarrow> ccorres dc xfdc (?Q1786 thread rv rv' rva) (?Q'1786 thread rv rv' rva rv'a) [SKIP] (do domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od) (?d'1786 thread rv rv' rv'a)
 4. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>?Q1786 thread rv rv'\<rbrace>
 5. \<And>thread rv rv'. guard_is_UNIV dc xfdc (?Q'1786 thread rv rv')
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 7. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 8. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (9 subgoals):
 1. \<And>thread rv rv' rv'a t t'. ceqv \<Gamma> xfdc rv'a t t' (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI) (?d'1786 thread rv rv' rv'a)
 2. \<And>thread rv rv' rva rv'a. dc rva rv'a \<Longrightarrow> ccorres dc xfdc (?Q1786 thread rv rv' rva) (?Q'1786 thread rv rv' rva rv'a) [SKIP] (do domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od) (?d'1786 thread rv rv' rv'a)
 3. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>?Q1786 thread rv rv'\<rbrace>
 4. \<And>thread rv rv'. guard_is_UNIV dc xfdc (?Q'1786 thread rv rv')
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (8 subgoals):
 1. \<And>thread rv rv' rva rv'a. dc rva rv'a \<Longrightarrow> ccorres dc xfdc (?Q1786 thread rv rv' rva) (?Q'1786 thread rv rv' rva rv'a) [SKIP] (do domainTime <- getDomainTime;
when (domainTime = 0) rescheduleRequired
od) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>?Q1786 thread rv rv'\<rbrace>
 3. \<And>thread rv rv'. guard_is_UNIV dc xfdc (?Q'1786 thread rv rv')
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 6. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 7. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (8 subgoals):
 1. \<And>thread rv rv' rva rv'a rvb. dc rva rv'a \<Longrightarrow> ccorres dc xfdc (?P3605 thread rv rv' rva rvb) (?P'3604 thread rv rv' rva rv'a rvb) [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rvb. ksDomainTime s = rvb \<longrightarrow> ?P3605 thread rv rv' rva rvb s\<rbrace>
 3. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rvb. ksDomainTime_' (globals s) = rvb \<longrightarrow> s \<in> ?P'3604 thread rv rv' rva rv'a rvb})
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 6. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 7. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (8 subgoals):
 1. \<And>thread rv rv' rva rv'a rvb. dc rva rv'a \<Longrightarrow> ccorres dc xfdc (?P3605 thread rv rv' rva rvb) (?P'3604 thread rv rv' rva rv'a rvb) [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rvb. ksDomainTime s = rvb \<longrightarrow> ?P3605 thread rv rv' rva rvb s\<rbrace>
 3. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rvb. ksDomainTime_' (globals s) = rvb \<longrightarrow> s \<in> ?P'3604 thread rv rv' rva rv'a rvb})
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 6. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 7. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (8 subgoals):
 1. \<And>thread rv rv' rvb. ccorres dc xfdc (?P3605 thread rv rv' () rvb) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rvb. ksDomainTime s = rvb \<longrightarrow> ?P3605 thread rv rv' rva rvb s\<rbrace>
 3. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 6. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 7. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (9 subgoals):
 1. \<And>thread rv rv' rvb. rvb = 0 \<Longrightarrow> ccorres dc xfdc (?P3605 thread rv rv' () rvb) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv rv' rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (?P3605 thread rv rv' () rvb) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 3. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rvb. ksDomainTime s = rvb \<longrightarrow> ?P3605 thread rv rv' rva rvb s\<rbrace>
 4. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (9 subgoals):
 1. \<And>thread rv rv'. ccorres dc xfdc (?P3605 thread rv rv' () 0) \<lbrace>\<acute>ksDomainTime = 0\<rbrace> [SKIP] rescheduleRequired (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv rv' rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (?P3605 thread rv rv' () rvb) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 3. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rvb. ksDomainTime s = rvb \<longrightarrow> ?P3605 thread rv rv' rva rvb s\<rbrace>
 4. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rv'. ccorres dc xfdc (?Q3621 thread rv rv') (?Q'3621 thread rv rv') [SKIP] rescheduleRequired (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv rv' s s'. \<lbrakk>(s, s') \<in> rf_sr; ?P3605 thread rv rv' () 0 s; s' \<in> \<lbrace>\<acute>ksDomainTime = 0\<rbrace>\<rbrakk> \<Longrightarrow> ?Q3621 thread rv rv' s \<and> s' \<in> ?Q'3621 thread rv rv'
 3. \<And>thread rv rv' rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (?P3605 thread rv rv' () rvb) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 4. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rvb. ksDomainTime s = rvb \<longrightarrow> ?P3605 thread rv rv' rva rvb s\<rbrace>
 5. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 7. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 8. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (10 subgoals):
 1. \<And>thread rv rv'. ccorres dc xfdc (?Q3621 thread rv rv') (?R'3624 thread rv rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>thread rv rv' s s'. \<lbrakk>(s, s') \<in> rf_sr; ?P3605 thread rv rv' () 0 s; s' \<in> \<lbrace>\<acute>ksDomainTime = 0\<rbrace>\<rbrakk> \<Longrightarrow> ?Q3621 thread rv rv' s \<and> s' \<in> ?R'3624 thread rv rv' \<inter> \<lbrace>\<acute>ksDomainTime = 0\<rbrace>
 3. \<And>thread rv rv' rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (?P3605 thread rv rv' () rvb) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 4. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rvb. ksDomainTime s = rvb \<longrightarrow> ?P3605 thread rv rv' rva rvb s\<rbrace>
 5. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 7. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 8. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 9. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (9 subgoals):
 1. \<And>thread rv rv' s s'. \<lbrakk>(s, s') \<in> rf_sr; ?P3605 thread rv rv' () 0 s; s' \<in> \<lbrace>\<acute>ksDomainTime = 0\<rbrace>\<rbrakk> \<Longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s \<and> s' \<in> {s. s \<in> UNIV} \<inter> \<lbrace>\<acute>ksDomainTime = 0\<rbrace>
 2. \<And>thread rv rv' rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (?P3605 thread rv rv' () rvb) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 3. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rvb. ksDomainTime s = rvb \<longrightarrow> ?P3605 thread rv rv' rva rvb s\<rbrace>
 4. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (9 subgoals):
 1. \<And>thread rv rv' s s'. \<lbrakk>(s, s') \<in> rf_sr; ?P3605 thread rv rv' () 0 s; ksDomainTime_' (globals s') = 0\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s
 2. \<And>thread rv rv' rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (?P3605 thread rv rv' () rvb) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 3. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rvb. ksDomainTime s = rvb \<longrightarrow> ?P3605 thread rv rv' rva rvb s\<rbrace>
 4. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (8 subgoals):
 1. \<And>thread rv rv' rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (\<lambda>a. Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (when (rvb = 0) rescheduleRequired) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rv. ksDomainTime s = rv \<longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 3. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 6. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 7. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (8 subgoals):
 1. \<And>rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (\<lambda>a. Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a) \<lbrace>\<acute>ksDomainTime = rvb\<rbrace> [SKIP] (return ()) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rv. ksDomainTime s = rv \<longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 3. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 6. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 7. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (9 subgoals):
 1. \<And>rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (?Q3637 rvb) (?Q'3637 rvb) [SKIP] (return ()) (IF \<acute>ksDomainTime = 0 THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>rvb s s'. \<lbrakk>rvb \<noteq> 0; (s, s') \<in> rf_sr; Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> \<lbrace>\<acute>ksDomainTime = rvb\<rbrace>\<rbrakk> \<Longrightarrow> ?Q3637 rvb s \<and> s' \<in> ?Q'3637 rvb
 3. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rv. ksDomainTime s = rv \<longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 4. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (9 subgoals):
 1. \<And>rvb. rvb \<noteq> 0 \<Longrightarrow> ccorres dc xfdc (?Q3637 rvb) (?R'3640 rvb) [SKIP] (return ()) SKIP
 2. \<And>rvb s s'. \<lbrakk>rvb \<noteq> 0; (s, s') \<in> rf_sr; Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> \<lbrace>\<acute>ksDomainTime = rvb\<rbrace>\<rbrakk> \<Longrightarrow> ?Q3637 rvb s \<and> s' \<in> ?R'3640 rvb \<inter> - \<lbrace>\<acute>ksDomainTime = 0\<rbrace>
 3. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rv. ksDomainTime s = rv \<longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 4. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 6. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 7. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 8. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (8 subgoals):
 1. \<And>rvb s s'. \<lbrakk>rvb \<noteq> 0; (s, s') \<in> rf_sr; Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> \<lbrace>\<acute>ksDomainTime = rvb\<rbrace>\<rbrakk> \<Longrightarrow> True \<and> s' \<in> UNIV \<inter> - \<lbrace>\<acute>ksDomainTime = 0\<rbrace>
 2. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rv. ksDomainTime s = rv \<longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 3. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 5. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 6. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 7. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (7 subgoals):
 1. \<And>thread rv rv'. \<lbrace>?R1789 thread rv (thread_state_to_tsType rv) ()\<rbrace> modify (\<lambda>ks. ks\<lparr>ksDomainTime := ksDomainTime ks - 1\<rparr>) \<lbrace>\<lambda>rva s. \<forall>rv. ksDomainTime s = rv \<longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 3. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and ?R1789 thread rv ret__unsigned a) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 6. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (6 subgoals):
 1. \<And>thread rv rv'. guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. \<forall>rv. ksDomainTime_' (globals s) = rv \<longrightarrow> s \<in> \<lbrace>\<acute>ksDomainTime = rv\<rbrace>})
 2. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<forall>rv. ksDomainTime (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>) = rv \<longrightarrow> Invariants_H.valid_queues (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>) \<and> weak_sch_act_wf (ksSchedulerAction (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>)) (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>) \<and> valid_objs' (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>))) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 3. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 4. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 5. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (5 subgoals):
 1. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?R237 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. Suc 0 < numDomains \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<forall>rv. ksDomainTime (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>) = rv \<longrightarrow> Invariants_H.valid_queues (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>) \<and> weak_sch_act_wf (ksSchedulerAction (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>)) (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>) \<and> valid_objs' (a\<lparr>ksDomainTime := ksDomainTime a - 1\<rparr>))) s) and (\<lambda>s. \<not> Suc 0 < numDomains \<longrightarrow> True)\<rbrace>
 2. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 3. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and ?R237 thread rv\<rbrace>
 4. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (7 subgoals):
 1. \<And>thread rv ret__unsigned rva. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?P3666 thread rv rva\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>rv s. Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)\<rbrace>
 2. \<And>thread rv ret__unsigned rva. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?P'3667 thread rv rva\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>rv s. weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)\<rbrace>
 3. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> \<lbrace>?P'3650 thread rv\<rbrace> case rv of Structures_H.thread_state.Running \<Rightarrow> do ts <- threadGet tcbTimeSlice thread;
ts' <- return (ts - 1);
if 0 < ts' then threadSet (tcbTimeSlice_update (\<lambda>_. ts')) thread else do threadSet (tcbTimeSlice_update (\<lambda>_. timeSlice)) thread;
tcbSchedAppend thread;
rescheduleRequired
od
od | _ \<Rightarrow> return () \<lbrace>\<lambda>rv s. \<not> Suc 0 < numDomains \<longrightarrow> True\<rbrace>
 4. \<And>thread rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. (s \<in> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> (if Suc 0 < numDomains then UNIV else {}) \<longrightarrow> s \<in> UNIV)})
 5. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and (\<lambda>s. (True \<and> True \<and> (\<forall>x. ?P3666 thread rv x s \<and> ?P'3667 thread rv x s)) \<and> ?P'3650 thread rv s)\<rbrace>
 6. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (4 subgoals):
 1. \<And>rv ret__unsigned. ret__unsigned = thread_state_to_tsType rv \<Longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>a b. UNIV)
 2. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and (\<lambda>s. (True \<and> True \<and> (\<forall>x. ((\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (awaiting_reply' rv \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (0 < tcbTimeSlice tcb - 1 \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> 0 < tcbTimeSlice tcb - 1 \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' thread s \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s))) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (idle' rv \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>))) \<and> (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (awaiting_reply' rv \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (0 < tcbTimeSlice tcb - 1 \<longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and (\<lambda>s. \<forall>tcba. valid_tcb' tcba s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. tcbTimeSlice tcb - 1) tcba) s)) s) \<and> (\<not> 0 < tcbTimeSlice tcb - 1 \<longrightarrow> True \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s))) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (idle' rv \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)))) \<and> (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True))\<rbrace>
 3. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (3 subgoals):
 1. \<And>thread. \<lbrace>?R20 thread\<rbrace> getThreadState thread \<lbrace>\<lambda>rv. (\<lambda>s. (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' thread and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if thread = thread then True else True) thread a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread s \<longrightarrow> thread \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' thread a \<longrightarrow> (if thread = thread then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) thread a else st_tcb_at' runnable' thread a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> True)) and (\<lambda>s. (True \<and> True \<and> (\<forall>x. ((\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (awaiting_reply' rv \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (0 < tcbTimeSlice tcb - 1 \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> 0 < tcbTimeSlice tcb - 1 \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' thread s \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s))) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (idle' rv \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>))) \<and> (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (awaiting_reply' rv \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> (0 < tcbTimeSlice tcb - 1 \<longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and (\<lambda>s. \<forall>tcba. valid_tcb' tcba s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. tcbTimeSlice tcb - 1) tcba) s)) s) \<and> (\<not> 0 < tcbTimeSlice tcb - 1 \<longrightarrow> True \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s))) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (idle' rv \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)))) \<and> (\<forall>x xa. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (awaiting_reply' rv \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (\<forall>x. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb thread s \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True)) \<and> (rv = Structures_H.thread_state.Inactive \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (idle' rv \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True))\<rbrace>
 2. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and ?R20 rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (2 subgoals):
 1. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20 thread) \<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>ksCurThread\<rightarrow>[''tcbState_C'']))) {s. \<forall>rv. ret__unsigned_' s = thread_state_to_tsType rv \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. rv = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s \<in> UNIV \<inter> - {}}}} \<inter> ({s. awaiting_reply' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. rv = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s \<in> UNIV \<inter> - {}}} \<inter> ({s. rv = Structures_H.thread_state.Running \<longrightarrow> s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>1 < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbTimeSlice_C'']))\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> unat 5 = timeSlice\<rbrace> \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)})} \<inter> \<lbrace>True\<rbrace>} \<inter> UNIV} \<inter> ({s. rv = Structures_H.thread_state.Inactive \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. idle' rv \<longrightarrow> s \<in> UNIV \<inter> - {}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. rv = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s \<in> UNIV \<inter> - {}}}}}}} \<inter> {s. rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV \<inter> - {}}))))))}
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and (\<lambda>s. \<forall>st. st_tcb_at' ((=) st) rv s \<longrightarrow> ((\<lambda>s. (\<forall>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' st \<longrightarrow> True) \<and> (\<forall>x. st = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' rv and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' rv and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) rv s \<longrightarrow> rv \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if rv = rv then True else True) rv a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) rv s \<longrightarrow> rv \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' rv a \<longrightarrow> (if rv = rv then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) rv a else st_tcb_at' runnable' rv a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' st \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> True)) and (\<lambda>s. (True \<and> True \<and> (\<forall>x. ((\<forall>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (awaiting_reply' st \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x. st = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> (0 < tcbTimeSlice tcb - 1 \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> 0 < tcbTimeSlice tcb - 1 \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' rv s \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>))) \<and> (\<forall>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (awaiting_reply' st \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x. st = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> (0 < tcbTimeSlice tcb - 1 \<longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and (\<lambda>s. \<forall>tcba. valid_tcb' tcba s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. tcbTimeSlice tcb - 1) tcba) s)) s) \<and> (\<not> 0 < tcbTimeSlice tcb - 1 \<longrightarrow> True \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (idle' st \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)))) \<and> (\<forall>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (awaiting_reply' st \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (\<forall>x. st = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True)) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (idle' st \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True))) s)) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> ?R'20 rv \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (tcb_at' rv and (\<lambda>s. \<forall>st. st_tcb_at' ((=) st) rv s \<longrightarrow> ((\<lambda>s. (\<forall>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> True) \<and> (awaiting_reply' st \<longrightarrow> True) \<and> (\<forall>x. st = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> True) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> ((\<lambda>s. obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s) and (\<lambda>s. Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' rv and cur_tcb' and cur_tcb') s) and (\<lambda>s. \<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (tcb_at' rv and (\<lambda>a. (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) rv s \<longrightarrow> rv \<notin> set (ksReadyQueues s (d, p)))) a \<and> obj_at' (\<lambda>obj. if rv = rv then True else True) rv a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> (Invariants_H.valid_queues and (\<lambda>s. \<forall>d p. (\<exists>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) \<longrightarrow> obj_at' (\<lambda>tcb. (inQ d p tcb \<and> runnable' (tcbState tcb)) \<and> \<not> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<and> runnable' (tcbState (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) rv s \<longrightarrow> rv \<notin> set (ksReadyQueues s (d, p)))) a \<and> (tcb_at' rv a \<longrightarrow> (if rv = rv then obj_at' (\<lambda>tcb. runnable' (itcbState (tcb_to_itcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb)))) rv a else st_tcb_at' runnable' rv a)) \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) a)) s) and cur_tcb') s)) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> True) \<and> (idle' st \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> True) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> True)) and (\<lambda>s. (True \<and> True \<and> (\<forall>x. ((\<forall>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (awaiting_reply' st \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x. st = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> (0 < tcbTimeSlice tcb - 1 \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> 0 < tcbTimeSlice tcb - 1 \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' rv s \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s \<and> weak_sch_act_wf (ksSchedulerAction s) s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>))) \<and> (\<forall>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (awaiting_reply' st \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x. st = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> (0 < tcbTimeSlice tcb - 1 \<longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and (\<lambda>s. \<forall>tcba. valid_tcb' tcba s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. tcbTimeSlice tcb - 1) tcba) s)) s) \<and> (\<not> 0 < tcbTimeSlice tcb - 1 \<longrightarrow> True \<and> (valid_objs' and (\<lambda>s. \<forall>tcb. valid_tcb' tcb s \<longrightarrow> valid_tcb' (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) s)) s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (idle' st \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (\<forall>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> weak_sch_act_wf (ksSchedulerAction (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)) (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>) \<and> valid_objs' (s\<lparr>ksDomainTime := ksDomainTime s - 1\<rparr>)))) \<and> (\<forall>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (awaiting_reply' st \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (\<forall>x. st = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb rv s \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True)) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (idle' st \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> \<not> Suc 0 < numDomains \<longrightarrow> True))) s)) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C'']))) s \<in> UNIV \<inter> \<lbrace>\<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s. cslift s (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])) = Some (thread_state_' s)}} \<inter> {s. \<forall>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])))) \<longrightarrow> (\<forall>rva. tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbState_C''])))) = thread_state_to_tsType rva \<longrightarrow> (\<forall>x xa. rva = Structures_H.thread_state.BlockedOnReceive x xa \<longrightarrow> s\<lparr>ret__unsigned_' := thread_state_to_tsType (Structures_H.thread_state.BlockedOnReceive x xa)\<rparr> \<in> - {}) \<and> (awaiting_reply' rva \<longrightarrow> s\<lparr>ret__unsigned_' := thread_state_to_tsType Structures_H.thread_state.BlockedOnReply\<rparr> \<in> - {}) \<and> (\<forall>x. rva = Structures_H.thread_state.BlockedOnNotification x \<longrightarrow> s\<lparr>ret__unsigned_' := thread_state_to_tsType (Structures_H.thread_state.BlockedOnNotification x)\<rparr> \<in> - {}) \<and> (rva = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb ctcb. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> unat (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> unat 5 = timeSlice \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> s \<Turnstile>\<^sub>c ksCurThread_' (globals s)))) \<and> (rva = Structures_H.thread_state.Inactive \<longrightarrow> s\<lparr>ret__unsigned_' := thread_state_to_tsType Structures_H.thread_state.Inactive\<rparr> \<in> - {}) \<and> (idle' rva \<longrightarrow> s\<lparr>ret__unsigned_' := thread_state_to_tsType Structures_H.thread_state.IdleThreadState\<rparr> \<in> - {}) \<and> (\<forall>x xa xb xc xd. rva = Structures_H.thread_state.BlockedOnSend x xa xb xc xd \<longrightarrow> s\<lparr>ret__unsigned_' := thread_state_to_tsType (Structures_H.thread_state.BlockedOnSend x xa xb xc xd)\<rparr> \<in> - {}) \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> s\<lparr>ret__unsigned_' := thread_state_to_tsType Structures_H.thread_state.Restart\<rparr> \<in> - {}))} \<inter> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)}} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>st. st_tcb_at' ((=) st) (ksCurThread s) s \<longrightarrow> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s \<and> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> tcb_at' (ksCurThread s) s \<and> cur_tcb' s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> tcb_at' (ksCurThread s) s \<and> valid_objs' s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> (tcb_at' (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>tcb. runnable' (tcbState tcb)) (ksCurThread s) s) \<and> valid_objs' s) \<and> cur_tcb' s)) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> Invariants_H.valid_queues s) \<and> (awaiting_reply' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_objs' s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues s) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> valid_objs' s) \<and> (awaiting_reply' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<exists>tcb. ko_at' tcb (ksCurThread s) s) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> valid_objs' s) \<and> (idle' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> valid_objs' s)) \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> cur_tcb' s \<and> (\<forall>st. st_tcb_at' ((=) st) (ksCurThread s) s \<longrightarrow> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s \<and> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> cur_tcb' s \<and> cur_tcb' s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> cur_tcb' s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> cur_tcb' s \<and> valid_objs' s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> (cur_tcb' s \<longrightarrow> obj_at' (\<lambda>tcb. runnable' (tcbState tcb)) (ksCurThread s) s) \<and> valid_objs' s) \<and> cur_tcb' s)) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> Invariants_H.valid_queues s) \<and> (awaiting_reply' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_objs' s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues s) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> valid_objs' s) \<and> (awaiting_reply' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<exists>tcb. ko_at' tcb (ksCurThread s) s) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> valid_objs' s) \<and> (idle' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> valid_objs' s)) \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> (\<forall>st. st_tcb_at' ((=) st) (ksCurThread s) s \<longrightarrow> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s \<and> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> cur_tcb' s \<and> cur_tcb' s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> cur_tcb' s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> cur_tcb' s \<and> valid_objs' s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> (cur_tcb' s \<longrightarrow> obj_at' (\<lambda>tcb. runnable' (tcbState tcb)) (ksCurThread s) s) \<and> valid_objs' s) \<and> cur_tcb' s)) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> Invariants_H.valid_queues s) \<and> (awaiting_reply' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_objs' s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues s) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> valid_objs' s) \<and> (awaiting_reply' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<exists>tcb. ko_at' tcb (ksCurThread s) s) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> valid_objs' s) \<and> (idle' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> valid_objs' s)) \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv) proof (prove)
goal (2 subgoals):
 1. \<And>s s' st. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) st) (ksCurThread s) s\<rbrakk> \<Longrightarrow> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s \<and> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> cur_tcb' s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> cur_tcb' s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> cur_tcb' s \<and> valid_objs' s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> (cur_tcb' s \<longrightarrow> obj_at' (\<lambda>tcb. runnable' (tcbState tcb)) (ksCurThread s) s) \<and> valid_objs' s) \<and> cur_tcb' s)) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> Invariants_H.valid_queues s) \<and> (awaiting_reply' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_objs' s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues s) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> valid_objs' s) \<and> (awaiting_reply' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<exists>tcb. ko_at' tcb (ksCurThread s) s) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> valid_objs' s) \<and> (idle' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> valid_objs' s)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (3 subgoals):
 1. \<And>s s' st. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) st) (ksCurThread s) s\<rbrakk> \<Longrightarrow> st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s \<and> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> cur_tcb' s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> cur_tcb' s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> cur_tcb' s \<and> valid_objs' s \<and> Invariants_H.valid_queues s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> (cur_tcb' s \<longrightarrow> obj_at' (\<lambda>tcb. runnable' (tcbState tcb)) (ksCurThread s) s) \<and> valid_objs' s) \<and> cur_tcb' s)
 2. \<And>s s' st. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) st) (ksCurThread s) s\<rbrakk> \<Longrightarrow> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> Invariants_H.valid_queues s) \<and> (awaiting_reply' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_objs' s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues s) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> valid_objs' s) \<and> (awaiting_reply' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<exists>tcb. ko_at' tcb (ksCurThread s) s) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> valid_objs' s) \<and> (idle' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> valid_objs' s)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; ko_at' tcb (ksCurThread s) s\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>tcba. tcbTimeSlice tcba = tcbTimeSlice tcb) (ksCurThread s) s \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> valid_objs' s \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) \<longrightarrow> obj_at' (\<lambda>tcb. inQ d p tcb \<and> runnable' (tcbState tcb) \<and> (inQ d p (tcbTimeSlice_update (\<lambda>_. timeSlice) tcb) \<longrightarrow> \<not> runnable' (tcbState tcb))) (ksCurThread s) s \<longrightarrow> ksCurThread s \<notin> set (ksReadyQueues s (d, p))) \<and> obj_at' (\<lambda>tcb. runnable' (tcbState tcb)) (ksCurThread s) s \<and> valid_objs' s)
 2. \<And>s s' st. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) st) (ksCurThread s) s\<rbrakk> \<Longrightarrow> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> Invariants_H.valid_queues s) \<and> (awaiting_reply' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_objs' s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues s) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> valid_objs' s) \<and> (awaiting_reply' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<exists>tcb. ko_at' tcb (ksCurThread s) s) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> valid_objs' s) \<and> (idle' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> valid_objs' s)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (2 subgoals):
 1. \<And>s s' st. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) st) (ksCurThread s) s\<rbrakk> \<Longrightarrow> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> Invariants_H.valid_queues s) \<and> (awaiting_reply' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s) \<and> (\<not> Suc 0 < tcbTimeSlice tcb \<longrightarrow> Invariants_H.valid_queues s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_objs' s))) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues s) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> valid_objs' s) \<and> (awaiting_reply' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<exists>tcb. ko_at' tcb (ksCurThread s) s) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> valid_objs' s) \<and> (idle' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> valid_objs' s)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; ko_at' tcb (ksCurThread s) s; \<not> Suc 0 < tcbTimeSlice tcb\<rbrakk> \<Longrightarrow> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_objs' s
 2. \<And>s s' st. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) st) (ksCurThread s) s\<rbrakk> \<Longrightarrow> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues s) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> valid_objs' s) \<and> (awaiting_reply' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<exists>tcb. ko_at' tcb (ksCurThread s) s) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> valid_objs' s) \<and> (idle' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> valid_objs' s)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (2 subgoals):
 1. \<And>s s' st. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' ((=) st) (ksCurThread s) s\<rbrakk> \<Longrightarrow> (st = Structures_H.thread_state.Inactive \<longrightarrow> Invariants_H.valid_queues s) \<and> (idle' st \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> Invariants_H.valid_queues s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> Invariants_H.valid_queues s) \<and> ((\<exists>x xa. st = Structures_H.thread_state.BlockedOnReceive x xa) \<longrightarrow> valid_objs' s) \<and> (awaiting_reply' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x. st = Structures_H.thread_state.BlockedOnNotification x) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Running \<longrightarrow> (\<exists>tcb. ko_at' tcb (ksCurThread s) s) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Inactive \<longrightarrow> valid_objs' s) \<and> (idle' st \<longrightarrow> valid_objs' s) \<and> ((\<exists>x xa xb xc xd. st = Structures_H.thread_state.BlockedOnSend x xa xb xc xd) \<longrightarrow> valid_objs' s) \<and> (st = Structures_H.thread_state.Restart \<longrightarrow> valid_objs' s)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cur_tcb' s\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (1 subgoal):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; tcb_at' (ksCurThread s) s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv\<rbrakk> \<Longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (1 subgoal):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; \<exists>ko ko'. ko_at' ko (ksCurThread s) s \<and> True \<and> cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> cslift s' (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])) = Some (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))) \<and> ((\<exists>t. ret__unsigned_' t = tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> unat (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) - 1) = tcbTimeSlice tcb - Suc 0) \<and> (\<not> 1 < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbTimeSlice_C''])) \<longrightarrow> timeSlice = 5 \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv))) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv proof (prove)
goal (1 subgoal):
 1. \<And>s s' ko ko' t tcb. \<lbrakk>invs' s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); ko_at' ko (ksCurThread s) s; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; ctcb_relation ko ko'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; ctcb_relation tcb ko'; 1 < tcbTimeSlice_C ko'\<rbrakk> \<Longrightarrow> unat (tcbTimeSlice_C ko' - 1) = tcbTimeSlice tcb - Suc 0 proof (prove)
goal (2 subgoals):
 1. \<And>s s' ko ko' t tcb. \<lbrakk>invs' s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); ko_at' ko (ksCurThread s) s; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; ctcb_relation ko ko'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; ctcb_relation tcb ko'; 1 < tcbTimeSlice_C ko'\<rbrakk> \<Longrightarrow> 1 \<le> tcbTimeSlice_C ko'
 2. \<And>s s' ko ko' t tcb. \<lbrakk>invs' s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); ko_at' ko (ksCurThread s) s; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; ctcb_relation ko ko'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; ctcb_relation tcb ko'; 1 < tcbTimeSlice_C ko'\<rbrakk> \<Longrightarrow> unat (tcbTimeSlice_C ko') - unat 1 = tcbTimeSlice tcb - Suc 0 proof (prove)
goal (1 subgoal):
 1. \<And>s s' ko ko' t tcb. \<lbrakk>invs' s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); ko_at' ko (ksCurThread s) s; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; ctcb_relation ko ko'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; ctcb_relation tcb ko'; 1 < tcbTimeSlice_C ko'\<rbrakk> \<Longrightarrow> unat (tcbTimeSlice_C ko') - unat 1 = tcbTimeSlice tcb - Suc 0 proof (prove)
goal:
No subgoals!