theory IpcCancel_C

lemma tcbEPDequeue_spec:
  "\<forall>s queue. \<Gamma> \<turnstile> \<lbrace>s. \<exists>t. (t, s) \<in> rf_sr
               \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue
               \<and> (ctcb_ptr_to_tcb_ptr \<acute>tcb \<in> set queue)
               \<and> ep_queue_relation' (cslift s) queue (head_C \<acute>queue) (end_C \<acute>queue) \<rbrace>
            Call tcbEPDequeue_'proc
            {t. (head_C (ret__struct_tcb_queue_C_' t) =
                 (if (tcbEPPrev_C (the (cslift s (\<^bsup>s\<^esup>tcb)))) = NULL then
                    (tcbEPNext_C (the (cslift s (\<^bsup>s\<^esup>tcb))))
                 else
                    (head_C \<^bsup>s\<^esup>queue)))
              \<and> (end_C (ret__struct_tcb_queue_C_' t) =
                 (if (tcbEPNext_C (the (cslift s (\<^bsup>s\<^esup>tcb)))) = NULL then
                    (tcbEPPrev_C (the (cslift s (\<^bsup>s\<^esup>tcb))))
                 else
                    (end_C \<^bsup>s\<^esup>queue)))
              \<and> (ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr \<^bsup>s\<^esup>tcb) queue) (head_C (ret__struct_tcb_queue_C_' t)) (end_C (ret__struct_tcb_queue_C_' t))
                \<and> (cslift t |` (- tcb_ptr_to_ctcb_ptr ` set queue)) =
                  (cslift s |` (- tcb_ptr_to_ctcb_ptr ` set queue))
                \<and> option_map tcb_null_ep_ptrs \<circ> (cslift t) =
                  option_map tcb_null_ep_ptrs \<circ> (cslift s))
                \<and> cslift_all_but_tcb_C t s
                \<and> (\<forall>rs. zero_ranges_are_zero rs (\<^bsup>t\<^esup>t_hrs)
                    = zero_ranges_are_zero rs (\<^bsup>s\<^esup>t_hrs))
                \<and> (hrs_htd \<^bsup>t\<^esup>t_hrs) = (hrs_htd \<^bsup>s\<^esup>t_hrs)}" apply (intro allI) apply (rule conseqPre) apply vcg apply (clarsimp split del: if_split) apply (frule (4) tcb_queue_valid_ptrsD [OF _ _ _ _ tcb_queue_relation'_queue_rel]) apply (elim conjE exE) apply (frule (3) tcbEPDequeue_update) apply simp apply (unfold upd_unless_null_def) apply (frule (2) tcb_queue_relation_ptr_rel' [OF tcb_queue_relation'_queue_rel]) prefer 2 apply assumption apply simp apply (frule c_guard_clift) apply (simp add: typ_heap_simps') apply (intro allI conjI impI) apply (clarsimp simp add: typ_heap_simps h_t_valid_clift_Some_iff) apply (clarsimp simp: typ_heap_simps h_t_valid_clift_Some_iff
                           cong: if_weak_cong) apply (rule ext) apply (clarsimp simp add: typ_heap_simps h_t_valid_clift_Some_iff tcb_null_ep_ptrs_def) apply (clarsimp simp add: typ_heap_simps h_t_valid_clift_Some_iff) apply (clarsimp simp add: typ_heap_simps h_t_valid_clift_Some_iff) apply (rule ext) apply (clarsimp simp: typ_heap_simps h_t_valid_clift_Some_iff tcb_null_ep_ptrs_def
                       cong: if_weak_cong) apply (rule ext) apply (clarsimp simp add: typ_heap_simps h_t_valid_clift_Some_iff tcb_null_ep_ptrs_def) apply (clarsimp simp add: typ_heap_simps h_t_valid_clift_Some_iff) apply (clarsimp simp: typ_heap_simps h_t_valid_clift_Some_iff
                    cong: if_weak_cong) apply (rule ext) apply (clarsimp simp add: typ_heap_simps h_t_valid_clift_Some_iff tcb_null_ep_ptrs_def) apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<forall>s queue. \<Gamma>\<turnstile> \<lbrace>s. \<exists>t. (t, s) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr \<acute>tcb \<in> set queue \<and> ep_queue_relation' (cslift s) queue (head_C \<acute>queue) (StateRelation_C.end_C \<acute>queue)\<rbrace> Call tcbEPDequeue_'proc {t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_' s))) = NULL then tcbEPNext_C (the (cslift s (tcb_' s))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_' s))) = NULL then tcbEPPrev_C (the (cslift s (tcb_' s))) else StateRelation_C.end_C (queue_' s)) \<and> (ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_' s)) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift s) \<and> (cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))} proof (prove)
goal (1 subgoal):
 1. \<And>s queue. \<Gamma>\<turnstile> \<lbrace>s. \<exists>t. (t, s) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr \<acute>tcb \<in> set queue \<and> ep_queue_relation' (cslift s) queue (head_C \<acute>queue) (StateRelation_C.end_C \<acute>queue)\<rbrace> Call tcbEPDequeue_'proc {t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_' s))) = NULL then tcbEPNext_C (the (cslift s (tcb_' s))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_' s))) = NULL then tcbEPPrev_C (the (cslift s (tcb_' s))) else StateRelation_C.end_C (queue_' s)) \<and> (ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_' s)) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift s) \<and> (cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))} proof (prove)
goal (2 subgoals):
 1. \<And>s queue. \<Gamma>\<turnstile> (?P'2 s queue) Call tcbEPDequeue_'proc {t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_' s))) = NULL then tcbEPNext_C (the (cslift s (tcb_' s))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_' s))) = NULL then tcbEPPrev_C (the (cslift s (tcb_' s))) else StateRelation_C.end_C (queue_' s)) \<and> (ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_' s)) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift s) \<and> (cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s))}
 2. \<And>s queue. \<lbrace>s. \<exists>t. (t, s) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr \<acute>tcb \<in> set queue \<and> ep_queue_relation' (cslift s) queue (head_C \<acute>queue) (StateRelation_C.end_C \<acute>queue)\<rbrace> \<subseteq> ?P'2 s queue proof (prove)
goal (1 subgoal):
 1. \<And>s queue. \<lbrace>s. \<exists>t. (t, s) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr \<acute>tcb \<in> set queue \<and> ep_queue_relation' (cslift s) queue (head_C \<acute>queue) (StateRelation_C.end_C \<acute>queue)\<rbrace> \<subseteq> {sa. sa \<Turnstile>\<^sub>c tcb_' sa \<and> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> sa \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])) \<and> sa \<Turnstile>\<^sub>c tcb_' sa \<and> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) \<Turnstile>\<^sub>t tcb_' sa \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) \<Turnstile>\<^sub>t h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])) \<and> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) \<Turnstile>\<^sub>t tcb_' sa \<and> head_C (queue_' sa) = (if tcbEPPrev_C (the (cslift s (tcb_' s))) = NULL then tcbEPNext_C (the (cslift s (tcb_' s))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (queue_' sa) = (if tcbEPNext_C (the (cslift s (tcb_' s))) = NULL then tcbEPPrev_C (the (cslift s (tcb_' s))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))))) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_' s)) queue) (head_C (queue_' sa)) (StateRelation_C.end_C (queue_' sa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) = hrs_htd (t_hrs_' (globals s))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) \<Turnstile>\<^sub>t tcb_' sa \<and> head_C (tcb_queue_C.end_C_update (\<lambda>_. h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))) (queue_' sa)) = (if tcbEPPrev_C (the (cslift s (tcb_' s))) = NULL then tcbEPNext_C (the (cslift s (tcb_' s))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (tcb_queue_C.end_C_update (\<lambda>_. h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))) (queue_' sa)) = (if tcbEPNext_C (the (cslift s (tcb_' s))) = NULL then tcbEPPrev_C (the (cslift s (tcb_' s))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_' s)) queue) (head_C (tcb_queue_C.end_C_update (\<lambda>_. h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))) (queue_' sa))) (StateRelation_C.end_C (tcb_queue_C.end_C_update (\<lambda>_. h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))) (queue_' sa))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals sa))) = hrs_htd (t_hrs_' (globals s)))) \<and> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_' sa \<and> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> sa \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])) \<and> sa \<Turnstile>\<^sub>c tcb_' sa \<and> head_C (head_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))) (queue_' sa)) = (if tcbEPPrev_C (the (cslift s (tcb_' s))) = NULL then tcbEPNext_C (the (cslift s (tcb_' s))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (head_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))) (queue_' sa)) = (if tcbEPNext_C (the (cslift s (tcb_' s))) = NULL then tcbEPPrev_C (the (cslift s (tcb_' s))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa)))) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_' s)) queue) (head_C (head_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))) (queue_' sa))) (StateRelation_C.end_C (head_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))) (queue_' sa))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = cslift s \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals sa))) = hrs_htd (t_hrs_' (globals s))) \<and> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(tcb_C ptr) &(tcb_' sa\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_' sa \<and> head_C (tcb_queue_C.end_C_update (\<lambda>_. NULL) (head_C_update (\<lambda>_. NULL) (queue_' sa))) = (if tcbEPPrev_C (the (cslift s (tcb_' s))) = NULL then tcbEPNext_C (the (cslift s (tcb_' s))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (tcb_queue_C.end_C_update (\<lambda>_. NULL) (head_C_update (\<lambda>_. NULL) (queue_' sa))) = (if tcbEPNext_C (the (cslift s (tcb_' s))) = NULL then tcbEPPrev_C (the (cslift s (tcb_' s))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift sa) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_' s)) queue) (head_C (tcb_queue_C.end_C_update (\<lambda>_. NULL) (head_C_update (\<lambda>_. NULL) (queue_' sa)))) (StateRelation_C.end_C (tcb_queue_C.end_C_update (\<lambda>_. NULL) (head_C_update (\<lambda>_. NULL) (queue_' sa)))) \<and> cslift sa|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift sa x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift sa = cslift s \<and> cslift sa = cslift s \<and> cslift sa = cslift s \<and> cslift sa = cslift s \<and> cslift sa = cslift s \<and> cslift sa = cslift s \<and> cslift sa = cslift s \<and> cslift sa = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals sa)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals sa)) = hrs_htd (t_hrs_' (globals s))))} proof (prove)
goal (1 subgoal):
 1. \<And>queue x t. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (1 subgoal):
 1. \<And>queue x t. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); \<exists>tcb. cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb \<and> (tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue) \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (1 subgoal):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (2 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue\<rbrakk> \<Longrightarrow> cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some (?tcb86 queue x t tcb)
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (upd_unless_null (tcbEPNext_C (?tcb86 queue x t tcb)) (tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C (?tcb86 queue x t tcb)) (the (cslift x (tcbEPNext_C (?tcb86 queue x t tcb))))) (upd_unless_null (tcbEPPrev_C (?tcb86 queue x t tcb)) (tcbEPNext_C_update (\<lambda>_. tcbEPNext_C (?tcb86 queue x t tcb)) (the (cslift x (tcbEPPrev_C (?tcb86 queue x t tcb))))) (cslift x))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C (?tcb86 queue x t tcb) = NULL then tcbEPNext_C (?tcb86 queue x t tcb) else head_C (queue_' x)) (if tcbEPNext_C (?tcb86 queue x t tcb) = NULL then tcbEPPrev_C (?tcb86 queue x t tcb) else StateRelation_C.end_C (queue_' x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (1 subgoal):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (upd_unless_null (tcbEPNext_C tcb) (tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb)))) (upd_unless_null (tcbEPPrev_C tcb) (tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) (cslift x))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (1 subgoal):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (3 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x))\<rbrakk> \<Longrightarrow> cslift x (tcb_ptr_to_ctcb_ptr (?tcbp94 queue x t tcb)) = Some (?tcb94 queue x t tcb)
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x))\<rbrakk> \<Longrightarrow> ?tcbp94 queue x t tcb \<in> set queue
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_ptr_to_ctcb_ptr (?tcbp94 queue x t tcb) \<noteq> tcbEPNext_C (?tcb94 queue x t tcb) \<and> tcb_ptr_to_ctcb_ptr (?tcbp94 queue x t tcb) \<noteq> tcbEPPrev_C (?tcb94 queue x t tcb) \<and> (tcbEPNext_C (?tcb94 queue x t tcb) \<noteq> NULL \<longrightarrow> tcbEPNext_C (?tcb94 queue x t tcb) \<noteq> tcbEPPrev_C (?tcb94 queue x t tcb))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (3 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x))\<rbrakk> \<Longrightarrow> ?tcbp94 queue x t tcb \<in> set queue
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x))\<rbrakk> \<Longrightarrow> cslift x (tcb_ptr_to_ctcb_ptr (?tcbp94 queue x t tcb)) = Some (?tcb94 queue x t tcb)
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_ptr_to_ctcb_ptr (?tcbp94 queue x t tcb) \<noteq> tcbEPNext_C (?tcb94 queue x t tcb) \<and> tcb_ptr_to_ctcb_ptr (?tcbp94 queue x t tcb) \<noteq> tcbEPPrev_C (?tcb94 queue x t tcb) \<and> (tcbEPNext_C (?tcb94 queue x t tcb) \<noteq> NULL \<longrightarrow> tcbEPNext_C (?tcb94 queue x t tcb) \<noteq> tcbEPPrev_C (?tcb94 queue x t tcb))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (2 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x))\<rbrakk> \<Longrightarrow> cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some (?tcb94 queue x t tcb)
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x)) \<noteq> tcbEPNext_C (?tcb94 queue x t tcb) \<and> tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x)) \<noteq> tcbEPPrev_C (?tcb94 queue x t tcb) \<and> (tcbEPNext_C (?tcb94 queue x t tcb) \<noteq> NULL \<longrightarrow> tcbEPNext_C (?tcb94 queue x t tcb) \<noteq> tcbEPPrev_C (?tcb94 queue x t tcb))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (1 subgoal):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x)) \<noteq> tcbEPNext_C tcb \<and> tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x)) \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (1 subgoal):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x))) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x)) \<noteq> tcbEPNext_C tcb \<and> tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x)) \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); c_guard (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_' x)))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> head_C (queue_' x) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))\<rightarrow>[''tcbEPNext_C''])) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])))) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) \<and> x \<Turnstile>\<^sub>c tcb_' x \<and> h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> StateRelation_C.end_C (queue_' x) = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C'']))\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) = zero_ranges_are_zero rs (t_hrs_' (globals x)))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPNext_C''])) = NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcb_' x \<and> NULL = (if tcbEPPrev_C (the (cslift x (tcb_' x))) = NULL then tcbEPNext_C (the (cslift x (tcb_' x))) else head_C (queue_' x)) \<and> NULL = (if tcbEPNext_C (the (cslift x (tcb_' x))) = NULL then tcbEPPrev_C (the (cslift x (tcb_' x))) else StateRelation_C.end_C (queue_' x)) \<and> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (1 subgoal):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb)\<rbrakk> \<Longrightarrow> (tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))) \<and> (tcbEPNext_C tcb = NULL \<longrightarrow> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = tcbEPPrev_C tcb \<and> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C'']))) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)))) \<and> (tcbEPPrev_C tcb = NULL \<longrightarrow> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x)) \<and> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))) \<and> (tcbEPNext_C tcb = NULL \<longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL)) proof (prove)
goal (11 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x))
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = tcbEPPrev_C tcb
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))
 6. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 7. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 8. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 9. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 10. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x))))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = tcbEPPrev_C tcb
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 6. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 7. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 8. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 9. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 10. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (9 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = tcbEPPrev_C tcb
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 6. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 7. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 8. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 9. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (9 subgoals):
 1. \<And>queue x t tcb xa. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) (tcbEPNext_C tcb)) (t_hrs_' (globals x)))) xa) = map_option tcb_null_ep_ptrs (cslift x xa)
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = tcbEPPrev_C tcb
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 6. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 7. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 8. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 9. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (8 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])) = tcbEPPrev_C tcb
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 6. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 7. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 8. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (7 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (head_C (queue_' x)) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))) (PTR(tcb_C ptr) &(tcb_' x\<rightarrow>[''tcbEPPrev_C''])))
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 6. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 7. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (6 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 6. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (6 subgoals):
 1. \<And>queue x t tcb xa. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>) xa = (cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>) xa
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 6. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (5 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (5 subgoals):
 1. \<And>queue x t tcb xa. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb \<noteq> NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPPrev_C tcb\<rightarrow>[''tcbEPNext_C''])) NULL) (t_hrs_' (globals x))) xa) = map_option tcb_null_ep_ptrs (cslift x xa)
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 5. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (4 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (tcbEPNext_C tcb) (StateRelation_C.end_C (queue_' x))
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 4. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (3 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub>
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 3. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (2 subgoals):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> (\<lambda>xa. map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa))
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (2 subgoals):
 1. \<And>queue x t tcb xa. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb \<noteq> NULL\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs (clift (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcbEPNext_C tcb\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))) xa) = map_option tcb_null_ep_ptrs (cslift x xa)
 2. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal (1 subgoal):
 1. \<And>queue x t tcb. \<lbrakk>(t, x) \<in> rf_sr; \<forall>tcb\<in>set queue. tcb_at' tcb t; distinct queue; ctcb_ptr_to_tcb_ptr (tcb_' x) \<in> set queue; ep_queue_relation' (cslift x) queue (head_C (queue_' x)) (StateRelation_C.end_C (queue_' x)); cslift x (tcb_' x) = Some tcb; tcbEPPrev_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPPrev_C tcb \<and> tcbEPPrev_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c tcbEPNext_C tcb \<and> tcbEPNext_C tcb \<in> tcb_ptr_to_ctcb_ptr ` set queue; ep_queue_relation' (if tcbEPNext_C tcb = NULL then if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))) else (if tcbEPPrev_C tcb = NULL then cslift x else (cslift x)(tcbEPPrev_C tcb \<mapsto> tcbEPNext_C_update (\<lambda>_. tcbEPNext_C tcb) (the (cslift x (tcbEPPrev_C tcb)))))(tcbEPNext_C tcb \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcbEPPrev_C tcb) (the (cslift x (tcbEPNext_C tcb))))) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) (if tcbEPPrev_C tcb = NULL then tcbEPNext_C tcb else head_C (queue_' x)) (if tcbEPNext_C tcb = NULL then tcbEPPrev_C tcb else StateRelation_C.end_C (queue_' x)); tcb_' x \<noteq> tcbEPNext_C tcb \<and> tcb_' x \<noteq> tcbEPPrev_C tcb \<and> (tcbEPNext_C tcb \<noteq> NULL \<longrightarrow> tcbEPNext_C tcb \<noteq> tcbEPPrev_C tcb); tcbEPPrev_C tcb = NULL; tcbEPNext_C tcb = NULL\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (remove1 (ctcb_ptr_to_tcb_ptr (tcb_' x)) queue) NULL NULL proof (prove)
goal:
No subgoals!