theory Noninterference

lemma do_user_op_A_if_confidentiality:
  notes read_respects_irq =
    use_ev[OF check_active_irq_if_reads_respects_f_g[where st=s0_internal
                                                       and st'=s0_internal
                                                       and irq=timer_irq
                                                       and aag="current_aag (internal_state_if s)"]]
  and read_respects_user_op =
    use_ev[OF do_user_op_if_reads_respects_f_g[where aag="current_aag (internal_state_if s)"
                                                 and st="s0_internal"]]
  shows
    "\<lbrakk> (s, t) \<in> uwr PSched; (s, t) \<in> uwr (part s); (s, t) \<in> uwr u; invs_if s; invs_if t;
       invs_if s'; invs_if t'; (part s, u) \<in> policyFlows (pasPolicy initial_aag);
       part s \<noteq> PSched; u \<noteq> PSched; sys_mode_of s = InUserMode; sys_mode_of t = InUserMode;
       (fst s, None, s_aux) \<in> check_active_irq_A_if; (fst t, None, t_aux) \<in> check_active_irq_A_if;
       (s_aux, xx, fst s') \<in> do_user_op_A_if utf; (t_aux, yy, fst t') \<in> do_user_op_A_if utf;
       snd s' = f xx; snd t' = f yy \<rbrakk>
       \<Longrightarrow> xx = yy \<and> (s', t') \<in> uwr u \<and> (s', t') \<in> uwr PSched \<and> (s', t') \<in> uwr (part s)" including no_pre supply [[simp_depth_limit=2]] \<comment> \<open>speedup\<close> apply (frule (1) uwr_part_sys_mode_of_user_context_of_eq) apply (clarsimp simp: check_active_irq_A_if_def) apply (case_tac s, case_tac t, simp_all) apply (case_tac u, simp_all) apply (frule (6) uwr_reads_equiv_f_g_affects_equiv) apply (match premises in "s = ((_,p),_)" and "t = ((_,q),_)"
                    and H: "(_,_) \<in> fst (check_active_irq_if _ p)"
                    for p q \<Rightarrow> \<open>rule revcut_rl[OF read_respects_irq[where t=q, OF H]]\<close>) apply assumption apply (clarsimp dest!: invs_if_Invs simp: Invs_def) apply (drule uwr_PSched_cur_domain) apply (clarsimp dest!: invs_if_Invs simp: Invs_def) subgoal by (clarsimp simp: current_aag_def) apply simp apply fastforce apply (simp add: do_user_op_A_if_def | elim exE conjE)+ apply (match premises in "s_aux = (_,p)" and "t_aux = (_,q)"
                    and H: "(_,_) \<in> fst (do_user_op_if _ _ p)"
                    for p q \<Rightarrow> \<open>rule revcut_rl[OF read_respects_user_op[where t=q, OF H]]\<close>) apply assumption apply (match premises in "s = ((_,p),_)" and H: "(_,_) \<in> fst (check_active_irq_if _ p)"
                   for p \<Rightarrow> \<open>rule revcut_rl[OF use_valid[OF H check_active_irq_if_User_det_inv]]\<close>) apply (simp (no_asm_use) add: invs_if_def Invs_def cur_thread_context_of_def) apply metis apply simp apply (erule use_valid) apply (wp check_active_irq_if_wp) apply (clarsimp simp: invs_if_def Invs_def) apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running) apply (match premises in "t_aux = (_,q)" and H: "(_,q) \<in> fst (check_active_irq_if _ _)"
                  for q \<Rightarrow> \<open>rule revcut_rl[OF use_valid[OF H check_active_irq_if_User_det_inv]]\<close>) apply (simp (no_asm_use) add: invs_if_def Invs_def cur_thread_context_of_def) apply metis apply simp apply (erule_tac s'=yc in use_valid) apply (wp check_active_irq_if_wp) apply (clarsimp simp: invs_if_def Invs_def current_aag_eqI[OF uwr_PSched_cur_domain']) apply (match premises in "t = ((_,q),_)" and H: "invs q" for q \<Rightarrow>
              \<open>rule revcut_rl[OF ct_running_not_idle[OF _ invs_valid_idle[OF H]]]\<close>) apply assumption apply (match premises in "t = ((_,q),_)" for q \<Rightarrow>
              \<open>rule revcut_rl[OF current_aag_def[where t=q]]\<close>) apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running) apply simp apply simp apply simp apply (rule reads_equiv_f_g_affects_equiv_uwr) apply ((clarsimp simp: Invs_def dest!: invs_if_Invs; rule TrueI)+) apply (simp add: invs_if_def Invs_def) apply (simp add: invs_if_def Invs_def) apply (erule use_valid[OF _ do_user_op_if_partitionIntegrity]) apply (erule use_valid[OF _ check_active_irq_if_wp]) apply clarsimp apply (frule (1) ct_running_not_idle[OF _ invs_valid_idle]) apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running) apply simp apply (erule_tac s'=s'aa in use_valid[OF _ do_user_op_if_partitionIntegrity]) apply (erule_tac s'=yc in use_valid[OF _ check_active_irq_if_wp]) apply (clarsimp simp: invs_if_def Invs_def) apply (match premises in "t = ((_,q),_)" and H: "invs q" for q \<Rightarrow>
             \<open>rule revcut_rl[OF ct_running_not_idle[OF _ invs_valid_idle[OF H]]]\<close>) apply assumption apply (blast intro!: guarded_pas_is_subject_current_aag[rule_format] active_from_running) apply (simp add: sys_mode_of_def) apply (simp add: user_context_of_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>uwr2 s PSched t; uwr2 s (part s) t; uwr2 s u t; invs_if s; invs_if t; invs_if s'; invs_if t'; policy2 (part s) u; part s \<noteq> PSched; u \<noteq> PSched; sys_mode_of s = InUserMode; sys_mode_of t = InUserMode; (fst s, None, s_aux) \<in> check_active_irq_A_if; (fst t, None, t_aux) \<in> check_active_irq_A_if; (s_aux, xx, fst s') \<in> do_user_op_A_if utf; (t_aux, yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' u t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part s) t' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>uwr2 s PSched t; uwr2 s (part s) t; uwr2 s u t; invs_if s; invs_if t; invs_if s'; invs_if t'; policy2 (part s) u; part s \<noteq> PSched; u \<noteq> PSched; sys_mode_of s = InUserMode; sys_mode_of t = InUserMode; (fst s, None, s_aux) \<in> check_active_irq_A_if; (fst t, None, t_aux) \<in> check_active_irq_A_if; (s_aux, xx, fst s') \<in> do_user_op_A_if utf; (t_aux, yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' u t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part s) t' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>uwr2 s PSched t; uwr2 s (part s) t; uwr2 s u t; invs_if s; invs_if t; invs_if s'; invs_if t'; policy2 (part s) u; part s \<noteq> PSched; u \<noteq> PSched; sys_mode_of s = InUserMode; sys_mode_of t = InUserMode; (fst s, None, s_aux) \<in> check_active_irq_A_if; (fst t, None, t_aux) \<in> check_active_irq_A_if; (s_aux, xx, fst s') \<in> do_user_op_A_if utf; (t_aux, yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' u t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part s) t' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>uwr2 s PSched t; uwr2 s (part s) t; uwr2 s u t; invs_if s; invs_if t; invs_if s'; invs_if t'; policy2 (part s) u; part s \<noteq> PSched; u \<noteq> PSched; sys_mode_of s = InUserMode; sys_mode_of t = InUserMode; (fst s, None, s_aux) \<in> check_active_irq_A_if; (fst t, None, t_aux) \<in> check_active_irq_A_if; (s_aux, xx, fst s') \<in> do_user_op_A_if utf; (t_aux, yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; sys_mode_of s = sys_mode_of t \<and> (user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t)\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' u t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part s) t' proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya xb yb xc yc. \<lbrakk>uwr2 s PSched t; uwr2 s (part s) t; uwr2 s u t; invs_if s; invs_if t; invs_if s'; invs_if t'; policy2 (part s) u; part s \<noteq> PSched; u \<noteq> PSched; sys_mode_of t = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; fst s = (x, y); fst t = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if x y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); sys_mode_of s = InUserMode; user_context_of s = user_context_of t\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' u t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part s) t' proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya xb yb xc yc a b aa ba. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) u ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) u; part ((xa, y), InUserMode) \<noteq> PSched; u \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode)\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' u t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (6 subgoals):
 1. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> (?rv'24 x y xa ya xb yb xc yc a b aa ba x1, ?t'24 x y xa ya xb yb xc yc a b aa ba x1) \<in> fst (check_active_irq_if xa ya)
 2. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and invs and only_timer_irq_inv timer_irq s0_internal) y
 3. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and invs and only_timer_irq_inv timer_irq s0_internal) ya
 4. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) y ya
 5. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) y ya
 6. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)); ?rv'24 x y xa ya xb yb xc yc a b aa ba x1 = (None, xb) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) yb (?t'24 x y xa ya xb yb xc yc a b aa ba x1) \<and> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) yb (?t'24 x y xa ya xb yb xc yc a b aa ba x1)\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and invs and only_timer_irq_inv timer_irq s0_internal) y
 2. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and invs and only_timer_irq_inv timer_irq s0_internal) ya
 3. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) y ya
 4. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) y ya
 5. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)); (None, xc) = (None, xb) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc \<and> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) yb yc\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and invs and only_timer_irq_inv timer_irq s0_internal) ya
 2. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) y ya
 3. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) y ya
 4. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)); (None, xc) = (None, xb) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc \<and> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) yb yc\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)); cur_domain (internal_state_if ((xa, y), InUserMode)) = cur_domain (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and invs and only_timer_irq_inv timer_irq s0_internal) ya
 2. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) y ya
 3. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) y ya
 4. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)); (None, xc) = (None, xb) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc \<and> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) yb yc\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>y xa ya xb yb xc yc x1. \<lbrakk>uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; cur_domain y = cur_domain ya; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') (internal_state_if s'); det_inv (sys_mode_of t') (cur_thread_context_of t') (internal_state_if t'); invs y; invs ya; invs (internal_state_if s'); invs (internal_state_if t'); valid_list y; valid_list ya; valid_list (internal_state_if s'); valid_list (internal_state_if t'); valid_sched_2 (ready_queues y) (ekheap y) (scheduler_action y) (cur_domain ya) (kheap y) (cur_thread y) (idle_thread y); valid_sched ya; valid_sched (internal_state_if s'); valid_sched (internal_state_if t'); only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal (internal_state_if s'); only_timer_irq_inv timer_irq s0_internal (internal_state_if t'); silc_inv (current_aag y) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s'); silc_inv (current_aag (internal_state_if t')) s0_internal (internal_state_if t'); domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal (internal_state_if s'); domain_sep_inv False s0_internal (internal_state_if t'); pas_refined (current_aag y) y; pas_refined (current_aag ya) ya; pas_refined_if s'; pas_refined_if t'; guarded_pas_domain (current_aag y) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain_if s'; guarded_pas_domain_if t'; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal (internal_state_if s'); idle_equiv s0_internal (internal_state_if t'); valid_domain_list y; valid_vspace_objs_if y; valid_domain_list ya; valid_vspace_objs_if ya; valid_domain_list (internal_state_if s'); valid_vspace_objs_if (internal_state_if s'); valid_domain_list (internal_state_if t'); valid_vspace_objs_if (internal_state_if t')\<rbrakk> \<Longrightarrow> silc_inv (current_aag y) s0_internal ya
 2. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) y ya
 3. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) y ya
 4. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)); (None, xc) = (None, xb) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc \<and> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) yb yc\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>uwr2 ((xa_, y_), InUserMode) (part ((xa_, y_), InUserMode)) ((xa_, ya_), InUserMode); uwr2 ((xa_, y_), InUserMode) (Partition x1_) ((xa_, ya_), InUserMode); policy2 (part ((xa_, y_), InUserMode)) (Partition x1_); part ((xa_, y_), InUserMode) \<noteq> PSched; ((xb_, yb_), xx, fst s') \<in> do_user_op_A_if utf; ((xc_, yc_), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; ((None, xb_), yb_) \<in> fst (check_active_irq_if xa_ y_); s_aux = (xb_, yb_); ((None, xc_), yc_) \<in> fst (check_active_irq_if xa_ ya_); t_aux = (xc_, yc_); s = ((xa_, y_), InUserMode); t = ((xa_, ya_), InUserMode); u = Partition x1_; cur_domain y_ = cur_domain ya_; reads_equiv_f_g (current_aag y_) y_ ya_; affects_equiv (current_aag y_) (OrdinaryLabel x1_) y_ ya_; det_inv InUserMode (cur_thread_context_of ((xa_, y_), InUserMode)) y_; det_inv InUserMode (cur_thread_context_of ((xa_, ya_), InUserMode)) ya_; det_inv (sys_mode_of s') (cur_thread_context_of s') (internal_state_if s'); det_inv (sys_mode_of t') (cur_thread_context_of t') (internal_state_if t'); invs y_; invs ya_; invs (internal_state_if s'); invs (internal_state_if t'); valid_list y_; valid_list ya_; valid_list (internal_state_if s'); valid_list (internal_state_if t'); valid_sched_2 (ready_queues y_) (ekheap y_) (scheduler_action y_) (cur_domain ya_) (kheap y_) (cur_thread y_) (idle_thread y_); valid_sched ya_; valid_sched (internal_state_if s'); valid_sched (internal_state_if t'); only_timer_irq_inv timer_irq s0_internal y_; only_timer_irq_inv timer_irq s0_internal ya_; only_timer_irq_inv timer_irq s0_internal (internal_state_if s'); only_timer_irq_inv timer_irq s0_internal (internal_state_if t'); silc_inv (current_aag y_) s0_internal y_; silc_inv (current_aag ya_) s0_internal ya_; silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s'); silc_inv (current_aag (internal_state_if t')) s0_internal (internal_state_if t'); domain_sep_inv False s0_internal y_; domain_sep_inv False s0_internal ya_; domain_sep_inv False s0_internal (internal_state_if s'); domain_sep_inv False s0_internal (internal_state_if t'); pas_refined (current_aag y_) y_; pas_refined (current_aag ya_) ya_; pas_refined_if s'; pas_refined_if t'; guarded_pas_domain (current_aag y_) y_; guarded_pas_domain (current_aag ya_) ya_; guarded_pas_domain_if s'; guarded_pas_domain_if t'; idle_equiv s0_internal y_; idle_equiv s0_internal ya_; idle_equiv s0_internal (internal_state_if s'); idle_equiv s0_internal (internal_state_if t'); valid_domain_list y_; valid_vspace_objs_if y_; valid_domain_list ya_; valid_vspace_objs_if ya_; valid_domain_list (internal_state_if s'); valid_vspace_objs_if (internal_state_if s'); valid_domain_list (internal_state_if t'); valid_vspace_objs_if (internal_state_if t')\<rbrakk> \<Longrightarrow> silc_inv (current_aag y_) s0_internal ya_ proof (prove)
goal (3 subgoals):
 1. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) y ya
 2. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) y ya
 3. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)); (None, xc) = (None, xb) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc \<and> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) yb yc\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (2 subgoals):
 1. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode))\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) y ya
 2. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)); (None, xc) = (None, xb) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc \<and> affects_equiv (current_aag (internal_state_if s)) (?l25 x y xa ya xb yb xc yc a b aa ba x1) yb yc\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya xb yb xc yc a b aa ba x1. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; ((xb, yb), xx, fst s') \<in> do_user_op_A_if utf; ((xc, yc), yy, fst t') \<in> do_user_op_A_if utf; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xc), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xc, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)) \<and> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if ((xa, y), InUserMode)) (internal_state_if ((xa, ya), InUserMode)); (None, xc) = (None, xb) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc \<and> affects_equiv (current_aag (internal_state_if s)) (OrdinaryLabel x1) yb yc\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (6 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (?rv'135 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa, ?t'135 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) \<in> fst (do_user_op_if utf xb yc)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yb
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 6. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); ?rv'135 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a (?t'135 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a (?t'135 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa)\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yb
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (6 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode xa and ct_running) y
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (case fst (None, xb) of None \<Rightarrow> det_inv InUserMode (snd (None, xb)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, xb))) yb\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yb
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 6. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (6 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs y \<and> valid_list y \<and> valid_sched y \<and> only_timer_irq_inv timer_irq s0_internal y \<and> silc_inv (current_aag y) s0_internal y \<and> domain_sep_inv False s0_internal y \<and> pas_refined (current_aag y) y \<and> guarded_pas_domain (current_aag y) y \<and> idle_equiv s0_internal y \<and> valid_domain_list y \<and> valid_vspace_objs_if y \<and> det_inv InUserMode xa y \<and> 0 < domain_time y \<and> (domain_time y = 0 \<longrightarrow> scheduler_action y = choose_new_thread) \<and> (ct_idle y \<longrightarrow> xa = idle_context y) \<and> ct_running y \<and> scheduler_action y = resume_cur_thread; invs ya \<and> valid_list ya \<and> valid_sched ya \<and> only_timer_irq_inv timer_irq s0_internal ya \<and> silc_inv (current_aag ya) s0_internal ya \<and> domain_sep_inv False s0_internal ya \<and> pas_refined (current_aag ya) ya \<and> guarded_pas_domain (current_aag ya) ya \<and> idle_equiv s0_internal ya \<and> valid_domain_list ya \<and> valid_vspace_objs_if ya \<and> det_inv InUserMode xa ya \<and> 0 < domain_time ya \<and> (domain_time ya = 0 \<longrightarrow> scheduler_action ya = choose_new_thread) \<and> (ct_idle ya \<longrightarrow> xa = idle_context ya) \<and> ct_running ya \<and> scheduler_action ya = resume_cur_thread; invs (internal_state_if s') \<and> valid_list (internal_state_if s') \<and> valid_sched (internal_state_if s') \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if s') \<and> silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s') \<and> domain_sep_inv False s0_internal (internal_state_if s') \<and> pas_refined_if s' \<and> guarded_pas_domain_if s' \<and> idle_equiv s0_internal (internal_state_if s') \<and> valid_domain_list (internal_state_if s') \<and> valid_vspace_objs_if (internal_state_if s') \<and> det_inv (sys_mode_of s') (case sys_mode_of s' of KernelPreempted \<Rightarrow> cur_context (internal_state_if s') | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s') | KernelExit \<Rightarrow> cur_context (internal_state_if s') | _ \<Rightarrow> user_context_of s') (internal_state_if s') \<and> (snd s' \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s')) \<and> (domain_time (internal_state_if s') = 0 \<longrightarrow> scheduler_action (internal_state_if s') = choose_new_thread) \<and> (snd s' \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s') \<longrightarrow> user_context_of s' = idle_context (internal_state_if s')) \<and> (case snd s' of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True); invs (internal_state_if t') \<and> valid_list (internal_state_if t') \<and> valid_sched (internal_state_if t') \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t') \<and> silc_inv (current_aag (internal_state_if t')) s0_internal (internal_state_if t') \<and> domain_sep_inv False s0_internal (internal_state_if t') \<and> pas_refined_if t' \<and> guarded_pas_domain_if t' \<and> idle_equiv s0_internal (internal_state_if t') \<and> valid_domain_list (internal_state_if t') \<and> valid_vspace_objs_if (internal_state_if t') \<and> det_inv (sys_mode_of t') (case sys_mode_of t' of KernelPreempted \<Rightarrow> cur_context (internal_state_if t') | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t') | KernelExit \<Rightarrow> cur_context (internal_state_if t') | _ \<Rightarrow> user_context_of t') (internal_state_if t') \<and> (snd t' \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t')) \<and> (domain_time (internal_state_if t') = 0 \<longrightarrow> scheduler_action (internal_state_if t') = choose_new_thread) \<and> (snd t' \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t') \<longrightarrow> user_context_of t' = idle_context (internal_state_if t')) \<and> (case snd t' of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> invs y \<and> valid_list y \<and> valid_sched y \<and> det_inv InUserMode xa y \<and> ct_running y
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (case fst (None, xb) of None \<Rightarrow> det_inv InUserMode (snd (None, xb)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, xb))) yb\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yb
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 6. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (case fst (None, xb) of None \<Rightarrow> det_inv InUserMode (snd (None, xb)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, xb))) yb\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yb
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yb\<rbrakk> \<Longrightarrow> silc_inv (current_aag y) s0_internal yb \<and> pas_refined (current_aag y) yb \<and> valid_vspace_objs_if yb \<and> invs yb \<and> valid_list yb \<and> valid_sched yb \<and> is_subject (current_aag y) (cur_thread yb) \<and> ct_running yb
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (6 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yb\<rbrakk> \<Longrightarrow> \<lbrace>?P140 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa\<rbrace> check_active_irq_if xa \<lbrace>\<lambda>a b. silc_inv (current_aag y) s0_internal b \<and> pas_refined (current_aag y) b \<and> valid_vspace_objs_if b \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> is_subject (current_aag y) (cur_thread b) \<and> ct_running b\<rbrace>
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yb\<rbrakk> \<Longrightarrow> ?P140 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa y
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 6. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yb\<rbrakk> \<Longrightarrow> silc_inv (current_aag y) s0_internal (y\<lparr>machine_state := machine_state y\<lparr>irq_state := irq_state_of_state y + 1\<rparr>\<rparr>) \<and> pas_refined (current_aag y) (y\<lparr>machine_state := machine_state y\<lparr>irq_state := irq_state_of_state y + 1\<rparr>\<rparr>) \<and> valid_vspace_objs_if (y\<lparr>machine_state := machine_state y\<lparr>irq_state := irq_state_of_state y + 1\<rparr>\<rparr>) \<and> invs (y\<lparr>machine_state := machine_state y\<lparr>irq_state := irq_state_of_state y + 1\<rparr>\<rparr>) \<and> valid_list (y\<lparr>machine_state := machine_state y\<lparr>irq_state := irq_state_of_state y + 1\<rparr>\<rparr>) \<and> valid_sched (y\<lparr>machine_state := machine_state y\<lparr>irq_state := irq_state_of_state y + 1\<rparr>\<rparr>) \<and> is_subject (current_aag y) (cur_thread (y\<lparr>machine_state := machine_state y\<lparr>irq_state := irq_state_of_state y + 1\<rparr>\<rparr>)) \<and> ct_running (y\<lparr>machine_state := machine_state y\<lparr>irq_state := irq_state_of_state y + 1\<rparr>\<rparr>)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f yy; s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yb; invs y; invs ya; invs s'a; invs s'aa; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag y) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag y) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag y) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f yy \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f yy \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f yy of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread\<rbrakk> \<Longrightarrow> is_subject (current_aag y) (cur_thread y)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode xa and ct_running) ya
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (case fst (None, xb) of None \<Rightarrow> det_inv InUserMode (snd (None, xb)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, xb))) yc\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs y \<and> valid_list y \<and> valid_sched y \<and> only_timer_irq_inv timer_irq s0_internal y \<and> silc_inv (current_aag y) s0_internal y \<and> domain_sep_inv False s0_internal y \<and> pas_refined (current_aag y) y \<and> guarded_pas_domain (current_aag y) y \<and> idle_equiv s0_internal y \<and> valid_domain_list y \<and> valid_vspace_objs_if y \<and> det_inv InUserMode xa y \<and> 0 < domain_time y \<and> (domain_time y = 0 \<longrightarrow> scheduler_action y = choose_new_thread) \<and> (ct_idle y \<longrightarrow> xa = idle_context y) \<and> ct_running y \<and> scheduler_action y = resume_cur_thread; invs ya \<and> valid_list ya \<and> valid_sched ya \<and> only_timer_irq_inv timer_irq s0_internal ya \<and> silc_inv (current_aag ya) s0_internal ya \<and> domain_sep_inv False s0_internal ya \<and> pas_refined (current_aag ya) ya \<and> guarded_pas_domain (current_aag ya) ya \<and> idle_equiv s0_internal ya \<and> valid_domain_list ya \<and> valid_vspace_objs_if ya \<and> det_inv InUserMode xa ya \<and> 0 < domain_time ya \<and> (domain_time ya = 0 \<longrightarrow> scheduler_action ya = choose_new_thread) \<and> (ct_idle ya \<longrightarrow> xa = idle_context ya) \<and> ct_running ya \<and> scheduler_action ya = resume_cur_thread; invs (internal_state_if s') \<and> valid_list (internal_state_if s') \<and> valid_sched (internal_state_if s') \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if s') \<and> silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s') \<and> domain_sep_inv False s0_internal (internal_state_if s') \<and> pas_refined_if s' \<and> guarded_pas_domain_if s' \<and> idle_equiv s0_internal (internal_state_if s') \<and> valid_domain_list (internal_state_if s') \<and> valid_vspace_objs_if (internal_state_if s') \<and> det_inv (sys_mode_of s') (case sys_mode_of s' of KernelPreempted \<Rightarrow> cur_context (internal_state_if s') | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s') | KernelExit \<Rightarrow> cur_context (internal_state_if s') | _ \<Rightarrow> user_context_of s') (internal_state_if s') \<and> (snd s' \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s')) \<and> (domain_time (internal_state_if s') = 0 \<longrightarrow> scheduler_action (internal_state_if s') = choose_new_thread) \<and> (snd s' \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s') \<longrightarrow> user_context_of s' = idle_context (internal_state_if s')) \<and> (case snd s' of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True); invs (internal_state_if t') \<and> valid_list (internal_state_if t') \<and> valid_sched (internal_state_if t') \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t') \<and> silc_inv (current_aag (internal_state_if t')) s0_internal (internal_state_if t') \<and> domain_sep_inv False s0_internal (internal_state_if t') \<and> pas_refined_if t' \<and> guarded_pas_domain_if t' \<and> idle_equiv s0_internal (internal_state_if t') \<and> valid_domain_list (internal_state_if t') \<and> valid_vspace_objs_if (internal_state_if t') \<and> det_inv (sys_mode_of t') (case sys_mode_of t' of KernelPreempted \<Rightarrow> cur_context (internal_state_if t') | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t') | KernelExit \<Rightarrow> cur_context (internal_state_if t') | _ \<Rightarrow> user_context_of t') (internal_state_if t') \<and> (snd t' \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t')) \<and> (domain_time (internal_state_if t') = 0 \<longrightarrow> scheduler_action (internal_state_if t') = choose_new_thread) \<and> (snd t' \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t') \<longrightarrow> user_context_of t' = idle_context (internal_state_if t')) \<and> (case snd t' of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> invs ya \<and> valid_list ya \<and> valid_sched ya \<and> det_inv InUserMode xa ya \<and> ct_running ya
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (case fst (None, xb) of None \<Rightarrow> det_inv InUserMode (snd (None, xb)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, xb))) yc\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (case fst (None, xb) of None \<Rightarrow> det_inv InUserMode (snd (None, xb)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, xb))) yc\<rbrakk> \<Longrightarrow> (silc_inv (current_aag (internal_state_if s)) s0_internal and (pas_refined (current_aag (internal_state_if s)) and valid_vspace_objs_if and einvs and is_subject (current_aag (internal_state_if s)) \<circ> cur_thread and det_inv InUserMode xb and ct_running)) yc
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yc\<rbrakk> \<Longrightarrow> silc_inv (current_aag y) s0_internal yc \<and> pas_refined (current_aag y) yc \<and> valid_vspace_objs_if yc \<and> invs yc \<and> valid_list yc \<and> valid_sched yc \<and> is_subject (current_aag y) (cur_thread yc) \<and> ct_running yc
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yc\<rbrakk> \<Longrightarrow> \<lbrace>?P230 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa\<rbrace> check_active_irq_if xa \<lbrace>\<lambda>a b. silc_inv (current_aag y) s0_internal b \<and> pas_refined (current_aag y) b \<and> valid_vspace_objs_if b \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> is_subject (current_aag y) (cur_thread b) \<and> ct_running b\<rbrace>
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yc\<rbrakk> \<Longrightarrow> ?P230 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa ya
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yc\<rbrakk> \<Longrightarrow> silc_inv (current_aag y) s0_internal (ya\<lparr>machine_state := machine_state ya\<lparr>irq_state := irq_state_of_state ya + 1\<rparr>\<rparr>) \<and> pas_refined (current_aag y) (ya\<lparr>machine_state := machine_state ya\<lparr>irq_state := irq_state_of_state ya + 1\<rparr>\<rparr>) \<and> valid_vspace_objs_if (ya\<lparr>machine_state := machine_state ya\<lparr>irq_state := irq_state_of_state ya + 1\<rparr>\<rparr>) \<and> invs (ya\<lparr>machine_state := machine_state ya\<lparr>irq_state := irq_state_of_state ya + 1\<rparr>\<rparr>) \<and> valid_list (ya\<lparr>machine_state := machine_state ya\<lparr>irq_state := irq_state_of_state ya + 1\<rparr>\<rparr>) \<and> valid_sched (ya\<lparr>machine_state := machine_state ya\<lparr>irq_state := irq_state_of_state ya + 1\<rparr>\<rparr>) \<and> is_subject (current_aag y) (cur_thread (ya\<lparr>machine_state := machine_state ya\<lparr>irq_state := irq_state_of_state ya + 1\<rparr>\<rparr>)) \<and> ct_running (ya\<lparr>machine_state := machine_state ya\<lparr>irq_state := irq_state_of_state ya + 1\<rparr>\<rparr>)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f yy; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag ya) y ya; affects_equiv (current_aag ya) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag ya) yb yc; affects_equiv (current_aag ya) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yc; invs y; invs ya; invs s'a; invs s'aa; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag ya) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag ya) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag ya) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f yy \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f yy \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f yy of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread\<rbrakk> \<Longrightarrow> is_subject (current_aag ya) (cur_thread ya)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (5 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f yy; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag ya) y ya; affects_equiv (current_aag ya) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag ya) yb yc; affects_equiv (current_aag ya) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yc; invs y; invs ya; invs s'a; invs s'aa; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag ya) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag ya) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag ya) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f yy \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f yy \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f yy of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread\<rbrakk> \<Longrightarrow> ct_running ya
 2. \<And>y xa ya xb yb yc x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f yy; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag ya) y ya; affects_equiv (current_aag ya) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag ya) yb yc; affects_equiv (current_aag ya) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yc; invs y; invs ya; invs s'a; invs s'aa; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag ya) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag ya) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag ya) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f yy \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f yy \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f yy of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread; cur_thread ya \<noteq> idle_thread ya\<rbrakk> \<Longrightarrow> is_subject (current_aag ya) (cur_thread ya)
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f yy; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag ya) y ya; affects_equiv (current_aag ya) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag ya) yb yc; affects_equiv (current_aag ya) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yc; invs y; invs ya; invs s'a; invs s'aa; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag ya) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag ya) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag ya) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f yy \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f yy \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f yy of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread; cur_thread ya \<noteq> idle_thread ya\<rbrakk> \<Longrightarrow> is_subject (current_aag ya) (cur_thread ya)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (4 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f yy; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag ya) y ya; affects_equiv (current_aag ya) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag ya) yb yc; affects_equiv (current_aag ya) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); det_inv InUserMode xb yc; invs y; invs ya; invs s'a; invs s'aa; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag ya) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag ya) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag ya) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f yy \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f yy \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f yy of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread; cur_thread ya \<noteq> idle_thread ya; current_aag ya \<equiv> initial_aag\<lparr>pasSubject := the_elem (pasDomainAbs initial_aag (cur_domain ya))\<rparr>\<rbrakk> \<Longrightarrow> is_subject (current_aag ya) (cur_thread ya)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (3 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if s)) yb yc
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (2 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc)\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) yb yc
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (?l136 x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc tca s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f yy; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tca, s'aa); ((yy, tca), s'aa) \<in> fst (do_user_op_if utf xb yc); (yy, tca) = (xx, tc) \<and> reads_equiv_f_g (current_aag (internal_state_if s)) s'a s'aa \<and> affects_equiv (current_aag (internal_state_if s)) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> xx = yy \<and> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> uwr2 s' (Partition x1) t' \<and> uwr2 s' PSched t' \<and> uwr2 s' (part ((xa, y), InUserMode)) t' proof (prove)
goal (10 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> reads_equiv_f_g (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if s') (internal_state_if t')
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> affects_equiv (current_aag (internal_state_if ((xa, y), InUserMode))) (OrdinaryLabel x1) (internal_state_if s') (internal_state_if t')
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> policy2 (part ((xa, y), InUserMode)) (Partition x1)
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> part ((xa, y), InUserMode) \<noteq> PSched
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> silc_inv (current_aag (internal_state_if s')) s0_internal (internal_state_if s')
 6. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> uwr2 ((xa, y), InUserMode) PSched (?t315 x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa)
 7. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if s')
 8. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if (?t315 x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa))) (internal_state_if (?t315 x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa)) (internal_state_if t')
 9. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 10. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (5 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> uwr2 ((xa, y), InUserMode) PSched (?t315 x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if s')
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if (?t315 x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa))) (internal_state_if (?t315 x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa)) (internal_state_if t')
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 5. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if ((xa, y), InUserMode))) (internal_state_if ((xa, y), InUserMode)) (internal_state_if s')
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if (aa, ba))) (internal_state_if (aa, ba)) (internal_state_if t')
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs y \<and> valid_list y \<and> valid_sched y \<and> only_timer_irq_inv timer_irq s0_internal y \<and> silc_inv (current_aag y) s0_internal y \<and> domain_sep_inv False s0_internal y \<and> pas_refined (current_aag y) y \<and> guarded_pas_domain (current_aag y) y \<and> idle_equiv s0_internal y \<and> valid_domain_list y \<and> valid_vspace_objs_if y \<and> det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y \<and> 0 < domain_time y \<and> (domain_time y = 0 \<longrightarrow> scheduler_action y = choose_new_thread) \<and> (ct_idle y \<longrightarrow> xa = idle_context y) \<and> ct_running y \<and> scheduler_action y = resume_cur_thread; invs ya \<and> valid_list ya \<and> valid_sched ya \<and> only_timer_irq_inv timer_irq s0_internal ya \<and> silc_inv (current_aag ya) s0_internal ya \<and> domain_sep_inv False s0_internal ya \<and> pas_refined (current_aag ya) ya \<and> guarded_pas_domain (current_aag ya) ya \<and> idle_equiv s0_internal ya \<and> valid_domain_list ya \<and> valid_vspace_objs_if ya \<and> det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya \<and> 0 < domain_time ya \<and> (domain_time ya = 0 \<longrightarrow> scheduler_action ya = choose_new_thread) \<and> (ct_idle ya \<longrightarrow> xa = idle_context ya) \<and> ct_running ya \<and> scheduler_action ya = resume_cur_thread; invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> only_timer_irq_inv timer_irq s0_internal s'a \<and> silc_inv (current_aag s'a) s0_internal s'a \<and> domain_sep_inv False s0_internal s'a \<and> pas_refined (current_aag s'a) s'a \<and> guarded_pas_domain (current_aag s'a) s'a \<and> idle_equiv s0_internal s'a \<and> valid_domain_list s'a \<and> valid_vspace_objs_if s'a \<and> det_inv (sys_mode_of s') (cur_thread_context_of s') s'a \<and> (f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a) \<and> (domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread) \<and> (f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a) \<and> (case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True); invs s'aa \<and> valid_list s'aa \<and> valid_sched s'aa \<and> only_timer_irq_inv timer_irq s0_internal s'aa \<and> silc_inv (current_aag s'aa) s0_internal s'aa \<and> domain_sep_inv False s0_internal s'aa \<and> pas_refined (current_aag s'aa) s'aa \<and> guarded_pas_domain (current_aag s'aa) s'aa \<and> idle_equiv s0_internal s'aa \<and> valid_domain_list s'aa \<and> valid_vspace_objs_if s'aa \<and> det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa \<and> (f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa) \<and> (domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread) \<and> (f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa) \<and> (case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag y) y s'a
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if (aa, ba))) (internal_state_if (aa, ba)) (internal_state_if t')
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs y \<and> valid_list y \<and> valid_sched y \<and> only_timer_irq_inv timer_irq s0_internal y \<and> silc_inv (current_aag y) s0_internal y \<and> domain_sep_inv False s0_internal y \<and> pas_refined (current_aag y) y \<and> guarded_pas_domain (current_aag y) y \<and> idle_equiv s0_internal y \<and> valid_domain_list y \<and> valid_vspace_objs_if y \<and> det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y \<and> 0 < domain_time y \<and> (domain_time y = 0 \<longrightarrow> scheduler_action y = choose_new_thread) \<and> (ct_idle y \<longrightarrow> xa = idle_context y) \<and> ct_running y \<and> scheduler_action y = resume_cur_thread; invs ya \<and> valid_list ya \<and> valid_sched ya \<and> only_timer_irq_inv timer_irq s0_internal ya \<and> silc_inv (current_aag ya) s0_internal ya \<and> domain_sep_inv False s0_internal ya \<and> pas_refined (current_aag ya) ya \<and> guarded_pas_domain (current_aag ya) ya \<and> idle_equiv s0_internal ya \<and> valid_domain_list ya \<and> valid_vspace_objs_if ya \<and> det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya \<and> 0 < domain_time ya \<and> (domain_time ya = 0 \<longrightarrow> scheduler_action ya = choose_new_thread) \<and> (ct_idle ya \<longrightarrow> xa = idle_context ya) \<and> ct_running ya \<and> scheduler_action ya = resume_cur_thread; invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> only_timer_irq_inv timer_irq s0_internal s'a \<and> silc_inv (current_aag s'a) s0_internal s'a \<and> domain_sep_inv False s0_internal s'a \<and> pas_refined (current_aag s'a) s'a \<and> guarded_pas_domain (current_aag s'a) s'a \<and> idle_equiv s0_internal s'a \<and> valid_domain_list s'a \<and> valid_vspace_objs_if s'a \<and> det_inv (sys_mode_of s') (cur_thread_context_of s') s'a \<and> (f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a) \<and> (domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread) \<and> (f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a) \<and> (case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True); invs s'aa \<and> valid_list s'aa \<and> valid_sched s'aa \<and> only_timer_irq_inv timer_irq s0_internal s'aa \<and> silc_inv (current_aag s'aa) s0_internal s'aa \<and> domain_sep_inv False s0_internal s'aa \<and> pas_refined (current_aag s'aa) s'aa \<and> guarded_pas_domain (current_aag s'aa) s'aa \<and> idle_equiv s0_internal s'aa \<and> valid_domain_list s'aa \<and> valid_vspace_objs_if s'aa \<and> det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa \<and> (f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa) \<and> (domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread) \<and> (f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa) \<and> (case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> (partitionIntegrity (current_aag y) y and pas_refined (current_aag y) and invs and is_subject (current_aag y) \<circ> cur_thread) yb
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if (aa, ba))) (internal_state_if (aa, ba)) (internal_state_if t')
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (4 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs y \<and> valid_list y \<and> valid_sched y \<and> only_timer_irq_inv timer_irq s0_internal y \<and> silc_inv (current_aag y) s0_internal y \<and> domain_sep_inv False s0_internal y \<and> pas_refined (current_aag y) y \<and> guarded_pas_domain (current_aag y) y \<and> idle_equiv s0_internal y \<and> valid_domain_list y \<and> valid_vspace_objs_if y \<and> det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y \<and> 0 < domain_time y \<and> (domain_time y = 0 \<longrightarrow> scheduler_action y = choose_new_thread) \<and> (ct_idle y \<longrightarrow> xa = idle_context y) \<and> ct_running y \<and> scheduler_action y = resume_cur_thread; invs ya \<and> valid_list ya \<and> valid_sched ya \<and> only_timer_irq_inv timer_irq s0_internal ya \<and> silc_inv (current_aag ya) s0_internal ya \<and> domain_sep_inv False s0_internal ya \<and> pas_refined (current_aag ya) ya \<and> guarded_pas_domain (current_aag ya) ya \<and> idle_equiv s0_internal ya \<and> valid_domain_list ya \<and> valid_vspace_objs_if ya \<and> det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya \<and> 0 < domain_time ya \<and> (domain_time ya = 0 \<longrightarrow> scheduler_action ya = choose_new_thread) \<and> (ct_idle ya \<longrightarrow> xa = idle_context ya) \<and> ct_running ya \<and> scheduler_action ya = resume_cur_thread; invs s'a \<and> valid_list s'a \<and> valid_sched s'a \<and> only_timer_irq_inv timer_irq s0_internal s'a \<and> silc_inv (current_aag s'a) s0_internal s'a \<and> domain_sep_inv False s0_internal s'a \<and> pas_refined (current_aag s'a) s'a \<and> guarded_pas_domain (current_aag s'a) s'a \<and> idle_equiv s0_internal s'a \<and> valid_domain_list s'a \<and> valid_vspace_objs_if s'a \<and> det_inv (sys_mode_of s') (cur_thread_context_of s') s'a \<and> (f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a) \<and> (domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread) \<and> (f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a) \<and> (case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True); invs s'aa \<and> valid_list s'aa \<and> valid_sched s'aa \<and> only_timer_irq_inv timer_irq s0_internal s'aa \<and> silc_inv (current_aag s'aa) s0_internal s'aa \<and> domain_sep_inv False s0_internal s'aa \<and> pas_refined (current_aag s'aa) s'aa \<and> guarded_pas_domain (current_aag s'aa) s'aa \<and> idle_equiv s0_internal s'aa \<and> valid_domain_list s'aa \<and> valid_vspace_objs_if s'aa \<and> det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa \<and> (f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa) \<and> (domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread) \<and> (f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa) \<and> (case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> (partitionIntegrity (current_aag y) y and pas_refined (current_aag y) and invs and is_subject (current_aag y) \<circ> cur_thread) (y\<lparr>machine_state := machine_state y\<lparr>irq_state := irq_state_of_state y + 1\<rparr>\<rparr>)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if (aa, ba))) (internal_state_if (aa, ba)) (internal_state_if t')
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (4 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f xx; s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); invs y; invs ya; invs s'a; invs s'aa; yy = xx; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; reads_equiv_f_g (current_aag y) s'a s'aa; affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag y) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag y) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag y) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread\<rbrakk> \<Longrightarrow> is_subject (current_aag y) (cur_thread y)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if (aa, ba))) (internal_state_if (aa, ba)) (internal_state_if t')
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (4 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f xx; s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); invs y; invs ya; invs s'a; invs s'aa; yy = xx; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; reads_equiv_f_g (current_aag y) s'a s'aa; affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag y) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag y) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag y) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread; cur_thread y \<noteq> idle_thread y\<rbrakk> \<Longrightarrow> is_subject (current_aag y) (cur_thread y)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if (aa, ba))) (internal_state_if (aa, ba)) (internal_state_if t')
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (3 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag (internal_state_if (aa, ba))) (internal_state_if (aa, ba)) (internal_state_if t')
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (3 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> partitionIntegrity (current_aag ya) ya s'aa
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (3 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> (partitionIntegrity (current_aag ya) ya and pas_refined (current_aag ya) and invs and is_subject (current_aag ya) \<circ> cur_thread) yc
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (3 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> (partitionIntegrity (current_aag ya) ya and pas_refined (current_aag ya) and invs and is_subject (current_aag ya) \<circ> cur_thread) (ya\<lparr>machine_state := machine_state ya\<lparr>irq_state := irq_state_of_state ya + 1\<rparr>\<rparr>)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (3 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f xx; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); invs y; invs ya; invs s'a; invs s'aa; yy = xx; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; reads_equiv_f_g (current_aag y) s'a s'aa; affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag y) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag y) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag y) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread\<rbrakk> \<Longrightarrow> is_subject (current_aag ya) (cur_thread ya)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (4 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f xx; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); invs y; invs ya; invs s'a; invs s'aa; yy = xx; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; reads_equiv_f_g (current_aag y) s'a s'aa; affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag y) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag y) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag y) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread\<rbrakk> \<Longrightarrow> ct_running ya
 2. \<And>y xa ya xb yb yc x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f xx; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); invs y; invs ya; invs s'a; invs s'aa; yy = xx; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; reads_equiv_f_g (current_aag y) s'a s'aa; affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag y) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag y) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag y) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread; cur_thread ya \<noteq> idle_thread ya\<rbrakk> \<Longrightarrow> is_subject (current_aag ya) (cur_thread ya)
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 4. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (3 subgoals):
 1. \<And>y xa ya xb yb yc x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; snd s' = f xx; snd t' = f xx; ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); t_aux = (xb, yc); s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); invs y; invs ya; invs s'a; invs s'aa; yy = xx; valid_list y; valid_list ya; valid_list s'a; valid_list s'aa; reads_equiv_f_g (current_aag y) s'a s'aa; affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa; valid_sched_2 (ready_queues y) (ekheap y) resume_cur_thread (cur_domain y) (kheap y) (cur_thread y) (idle_thread y); valid_sched_2 (ready_queues ya) (ekheap ya) resume_cur_thread (cur_domain ya) (kheap ya) (cur_thread ya) (idle_thread ya); valid_sched s'a; valid_sched s'aa; only_timer_irq_inv timer_irq s0_internal y; only_timer_irq_inv timer_irq s0_internal ya; only_timer_irq_inv timer_irq s0_internal s'a; only_timer_irq_inv timer_irq s0_internal s'aa; silc_inv (current_aag y) s0_internal y; silc_inv (current_aag ya) s0_internal ya; silc_inv (current_aag s'a) s0_internal s'a; silc_inv (current_aag s'aa) s0_internal s'aa; domain_sep_inv False s0_internal y; domain_sep_inv False s0_internal ya; domain_sep_inv False s0_internal s'a; domain_sep_inv False s0_internal s'aa; pas_refined (current_aag y) y; pas_refined (current_aag ya) ya; pas_refined (current_aag s'a) s'a; pas_refined (current_aag s'aa) s'aa; guarded_pas_domain (current_aag y) y; guarded_pas_domain (current_aag ya) ya; guarded_pas_domain (current_aag s'a) s'a; guarded_pas_domain (current_aag s'aa) s'aa; idle_equiv s0_internal y; idle_equiv s0_internal ya; idle_equiv s0_internal s'a; idle_equiv s0_internal s'aa; valid_domain_list y; valid_domain_list ya; valid_domain_list s'a; valid_domain_list s'aa; valid_vspace_objs_if y; valid_vspace_objs_if ya; valid_vspace_objs_if s'a; valid_vspace_objs_if s'aa; det_inv InUserMode (cur_thread_context_of ((xa, y), InUserMode)) y; det_inv InUserMode (cur_thread_context_of ((xa, ya), InUserMode)) ya; det_inv (sys_mode_of s') (cur_thread_context_of s') s'a; det_inv (sys_mode_of t') (cur_thread_context_of t') s'aa; 0 < domain_time y; 0 < domain_time ya; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'a; f xx \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time s'aa; domain_time y \<noteq> 0; domain_time ya \<noteq> 0; domain_time s'a = 0 \<longrightarrow> scheduler_action s'a = choose_new_thread; domain_time s'aa = 0 \<longrightarrow> scheduler_action s'aa = choose_new_thread; ct_idle y \<longrightarrow> xa = idle_context y; ct_idle ya \<longrightarrow> xa = idle_context ya; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'a \<longrightarrow> user_context_of s' = idle_context s'a; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s') \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s')) \<and> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s') \<or> ct_idle (internal_state_if s')) \<and> scheduler_action (internal_state_if s') = resume_cur_thread | _ \<Rightarrow> True; f xx \<noteq> KernelExit \<longrightarrow> ct_idle s'aa \<longrightarrow> user_context_of t' = idle_context s'aa; case f xx of InUserMode \<Rightarrow> ct_running (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t') \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t')) \<and> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t') \<or> ct_idle (internal_state_if t')) \<and> scheduler_action (internal_state_if t') = resume_cur_thread | _ \<Rightarrow> True; ct_running y; scheduler_action y = resume_cur_thread; ct_running ya; scheduler_action ya = resume_cur_thread; cur_thread ya \<noteq> idle_thread ya\<rbrakk> \<Longrightarrow> is_subject (current_aag ya) (cur_thread ya)
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 3. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (2 subgoals):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> sys_mode_of s' = sys_mode_of t'
 2. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya xb yb yc a b aa ba x1 tc s'a s'aa. \<lbrakk>uwr2 ((xa, y), InUserMode) PSched ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (part ((xa, y), InUserMode)) ((xa, ya), InUserMode); uwr2 ((xa, y), InUserMode) (Partition x1) ((xa, ya), InUserMode); invs_if ((xa, y), InUserMode); invs_if ((xa, ya), InUserMode); invs_if s'; invs_if t'; policy2 (part ((xa, y), InUserMode)) (Partition x1); part ((xa, y), InUserMode) \<noteq> PSched; ba = InUserMode; snd s' = f xx; snd t' = f xx; a = (xa, y); aa = (xa, ya); ((None, xb), yb) \<in> fst (check_active_irq_if xa y); s_aux = (xb, yb); ((None, xb), yc) \<in> fst (check_active_irq_if xa ya); t_aux = (xb, yc); b = InUserMode; x = xa; s = ((xa, y), InUserMode); t = ((xa, ya), InUserMode); u = Partition x1; reads_equiv_f_g (current_aag y) y ya; affects_equiv (current_aag y) (OrdinaryLabel x1) y ya; reads_equiv_f_g (current_aag y) yb yc; affects_equiv (current_aag y) (OrdinaryLabel x1) yb yc; fst s' = (tc, s'a); ((xx, tc), s'a) \<in> fst (do_user_op_if utf xb yb); fst t' = (tc, s'aa); ((xx, tc), s'aa) \<in> fst (do_user_op_if utf xb yc); yy = xx \<and> reads_equiv_f_g (current_aag y) s'a s'aa \<and> affects_equiv (current_aag y) (OrdinaryLabel x1) s'a s'aa\<rbrakk> \<Longrightarrow> user_context_of s' = user_context_of t' proof (prove)
goal:
No subgoals!