theory Refine

lemma fw_sim_A_H:
  "LI (ADT_A uop)
      (ADT_H uop)
      (lift_state_relation state_relation)
      (full_invs \<times> full_invs')" apply (unfold LI_def full_invs_def full_invs'_def) apply (simp add: ADT_H_def ADT_A_def) apply (intro conjI) apply (rule init_refinement) apply (clarsimp simp: rel_semi_def relcomp_unfold in_lift_state_relation_eq) apply (rename_tac tc ak m ev tc' ck' m' ev' ck) apply (simp add: global_automaton_def) apply (erule_tac P="a \<and> (\<exists>x. b x)" for a b in disjE) apply (clarsimp simp add: kernel_call_H_def kernel_call_A_def) apply (rule rev_mp, rule_tac tc=tc and event=x in entry_corres) apply (clarsimp simp: corres_underlying_def) apply (drule (1) bspec) apply (clarsimp simp: sch_act_simple_def) apply (drule (1) bspec) apply clarsimp apply (rule conjI) apply clarsimp apply (rule_tac x=b in exI) apply (rule conjI) apply (rule impI, simp) apply (frule (2) ct_running_related) apply clarsimp apply (rule_tac x=b in exI) apply (drule use_valid, rule kernelEntry_invs') apply (simp add: sch_act_simple_def) apply clarsimp apply (frule (1) ct_idle_related) apply (clarsimp simp: ct_in_state_def st_tcb_at_def obj_at_def) apply (erule_tac P="a \<and> b" for a b in disjE) apply (clarsimp simp: do_user_op_H_def do_user_op_A_def monad_to_transition_def) apply (rule rev_mp, rule_tac tc1=tc and f1=uop and P="ct_running and einvs" in corres_guard_imp2[OF do_user_op_corres]) apply simp apply (clarsimp simp add: corres_underlying_def) apply (drule (1) bspec, clarsimp) apply (drule (1) bspec, clarsimp) apply fastforce apply (erule_tac P="a \<and> b \<and> c \<and> (\<exists>x. d x)" for a b c d in disjE) apply (clarsimp simp: do_user_op_H_def do_user_op_A_def monad_to_transition_def) apply (rule rev_mp, rule_tac tc1=tc and f1=uop and P="ct_running and einvs" in corres_guard_imp2[OF do_user_op_corres]) apply simp apply (clarsimp simp add: corres_underlying_def) apply (drule (1) bspec, clarsimp) apply (drule (1) bspec, clarsimp) apply fastforce apply (erule_tac P="a \<and> b" for a b in disjE) apply (clarsimp simp: check_active_irq_H_def check_active_irq_A_def) apply (rule rev_mp, rule check_active_irq_corres) apply (clarsimp simp: corres_underlying_def) apply fastforce apply (erule_tac P="a \<and> b" for a b in disjE) apply (clarsimp simp: check_active_irq_H_def check_active_irq_A_def) apply (rule rev_mp, rule check_active_irq_corres) apply (clarsimp simp: corres_underlying_def) apply fastforce apply (clarsimp simp: check_active_irq_H_def check_active_irq_A_def) apply (rule rev_mp, rule check_active_irq_corres) apply (clarsimp simp: corres_underlying_def) apply fastforce apply (clarsimp simp: absKState_correct dest!: lift_state_relationD) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. LI (ADT_A uop) (ADT_H uop) (lift_state_relation state_relation) (full_invs \<times> full_invs') proof (prove)
goal (1 subgoal):
 1. (\<forall>s. Init (ADT_H uop) s \<subseteq> lift_state_relation state_relation `` Init (ADT_A uop) s) \<and> (\<forall>j. lift_state_relation state_relation \<inter> {((tc, s), m, e). einvs s \<and> (ct_running s \<or> ct_idle s) \<and> (m = KernelMode \<longrightarrow> e \<noteq> None) \<and> (m = UserMode \<longrightarrow> ct_running s) \<and> (m = IdleMode \<longrightarrow> ct_idle s) \<and> (e \<noteq> None \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running s) \<and> 0 < domain_time s \<and> valid_domain_list s \<and> scheduler_action s = resume_cur_thread} \<times> {((tc, s), m, e). invs' s \<and> vs_valid_duplicates' (ksPSpace s) \<and> ex_abs einvs s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> (ct_running' s \<or> ct_idle' s) \<and> (m = KernelMode \<longrightarrow> e \<noteq> None) \<and> (m = UserMode \<longrightarrow> ct_running' s) \<and> (m = IdleMode \<longrightarrow> ct_idle' s) \<and> (e \<noteq> None \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running' s) \<and> 0 < ksDomainTime s \<and> valid_domain_list' s} ;;; Step (ADT_H uop) j \<subseteq> Step (ADT_A uop) j ;;; lift_state_relation state_relation) \<and> (\<forall>s s'. (s, s') \<in> lift_state_relation state_relation \<inter> {((tc, s), m, e). einvs s \<and> (ct_running s \<or> ct_idle s) \<and> (m = KernelMode \<longrightarrow> e \<noteq> None) \<and> (m = UserMode \<longrightarrow> ct_running s) \<and> (m = IdleMode \<longrightarrow> ct_idle s) \<and> (e \<noteq> None \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running s) \<and> 0 < domain_time s \<and> valid_domain_list s \<and> scheduler_action s = resume_cur_thread} \<times> {((tc, s), m, e). invs' s \<and> vs_valid_duplicates' (ksPSpace s) \<and> ex_abs einvs s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> (ct_running' s \<or> ct_idle' s) \<and> (m = KernelMode \<longrightarrow> e \<noteq> None) \<and> (m = UserMode \<longrightarrow> ct_running' s) \<and> (m = IdleMode \<longrightarrow> ct_idle' s) \<and> (e \<noteq> None \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running' s) \<and> 0 < ksDomainTime s \<and> valid_domain_list' s} \<longrightarrow> Fin (ADT_H uop) s' = Fin (ADT_A uop) s) proof (prove)
goal (1 subgoal):
 1. Init_H \<subseteq> lift_state_relation state_relation `` Init_A \<and> lift_state_relation state_relation \<inter> {((tc, s), ab). invs s \<and> valid_list s \<and> valid_sched s \<and> (ct_running s \<or> ct_idle s) \<and> (case ab of (m, e) \<Rightarrow> (m = KernelMode \<longrightarrow> (\<exists>y. e = Some y)) \<and> (m = UserMode \<longrightarrow> ct_running s) \<and> (m = IdleMode \<longrightarrow> ct_idle s) \<and> ((\<exists>y. e = Some y) \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running s) \<and> 0 < domain_time s \<and> valid_domain_list s \<and> scheduler_action s = resume_cur_thread)} \<times> {((tc, s), ab). invs' s \<and> vs_valid_duplicates' (ksPSpace s) \<and> ex_abs einvs s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> (ct_running' s \<or> ct_idle' s) \<and> (case ab of (m, e) \<Rightarrow> (m = KernelMode \<longrightarrow> (\<exists>y. e = Some y)) \<and> (m = UserMode \<longrightarrow> ct_running' s) \<and> (m = IdleMode \<longrightarrow> ct_idle' s) \<and> ((\<exists>y. e = Some y) \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running' s) \<and> 0 < ksDomainTime s \<and> valid_domain_list' s)} ;;; global_automaton check_active_irq_H (do_user_op_H uop) kernel_call_H \<subseteq> global_automaton check_active_irq_A (do_user_op_A uop) kernel_call_A ;;; lift_state_relation state_relation \<and> (\<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba) proof (prove)
goal (3 subgoals):
 1. Init_H \<subseteq> lift_state_relation state_relation `` Init_A
 2. lift_state_relation state_relation \<inter> {((tc, s), ab). invs s \<and> valid_list s \<and> valid_sched s \<and> (ct_running s \<or> ct_idle s) \<and> (case ab of (m, e) \<Rightarrow> (m = KernelMode \<longrightarrow> (\<exists>y. e = Some y)) \<and> (m = UserMode \<longrightarrow> ct_running s) \<and> (m = IdleMode \<longrightarrow> ct_idle s) \<and> ((\<exists>y. e = Some y) \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running s) \<and> 0 < domain_time s \<and> valid_domain_list s \<and> scheduler_action s = resume_cur_thread)} \<times> {((tc, s), ab). invs' s \<and> vs_valid_duplicates' (ksPSpace s) \<and> ex_abs einvs s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> (ct_running' s \<or> ct_idle' s) \<and> (case ab of (m, e) \<Rightarrow> (m = KernelMode \<longrightarrow> (\<exists>y. e = Some y)) \<and> (m = UserMode \<longrightarrow> ct_running' s) \<and> (m = IdleMode \<longrightarrow> ct_idle' s) \<and> ((\<exists>y. e = Some y) \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running' s) \<and> 0 < ksDomainTime s \<and> valid_domain_list' s)} ;;; global_automaton check_active_irq_H (do_user_op_H uop) kernel_call_H \<subseteq> global_automaton check_active_irq_A (do_user_op_A uop) kernel_call_A ;;; lift_state_relation state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. lift_state_relation state_relation \<inter> {((tc, s), ab). invs s \<and> valid_list s \<and> valid_sched s \<and> (ct_running s \<or> ct_idle s) \<and> (case ab of (m, e) \<Rightarrow> (m = KernelMode \<longrightarrow> (\<exists>y. e = Some y)) \<and> (m = UserMode \<longrightarrow> ct_running s) \<and> (m = IdleMode \<longrightarrow> ct_idle s) \<and> ((\<exists>y. e = Some y) \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running s) \<and> 0 < domain_time s \<and> valid_domain_list s \<and> scheduler_action s = resume_cur_thread)} \<times> {((tc, s), ab). invs' s \<and> vs_valid_duplicates' (ksPSpace s) \<and> ex_abs einvs s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> (ct_running' s \<or> ct_idle' s) \<and> (case ab of (m, e) \<Rightarrow> (m = KernelMode \<longrightarrow> (\<exists>y. e = Some y)) \<and> (m = UserMode \<longrightarrow> ct_running' s) \<and> (m = IdleMode \<longrightarrow> ct_idle' s) \<and> ((\<exists>y. e = Some y) \<and> e \<noteq> Some Interrupt \<longrightarrow> ct_running' s) \<and> 0 < ksDomainTime s \<and> valid_domain_list' s)} ;;; global_automaton check_active_irq_H (do_user_op_H uop) kernel_call_H \<subseteq> global_automaton check_active_irq_A (do_user_op_A uop) kernel_call_A ;;; lift_state_relation state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba ab bb ac bc bd. \<lbrakk>(b, bd) \<in> state_relation; invs b; invs' bd; valid_list b; vs_valid_duplicates' (ksPSpace bd); valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); ex_abs einvs bd; ct_running b \<or> ct_idle b; ksSchedulerAction bd = ResumeCurrentThread; aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y); ct_running' bd \<or> ct_idle' bd; aa = UserMode \<longrightarrow> ct_running b; aa = IdleMode \<longrightarrow> ct_idle b; aa = UserMode \<longrightarrow> ct_running' bd; (\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b; aa = IdleMode \<longrightarrow> ct_idle' bd; 0 < domain_time b; (\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running' bd; valid_domain_list b; scheduler_action b = resume_cur_thread; 0 < ksDomainTime bd; valid_domain_list' bd; (((a, bd), aa, ba), (ab, bb), ac, bc) \<in> global_automaton check_active_irq_H (do_user_op_H uop) kernel_call_H\<rbrakk> \<Longrightarrow> \<exists>bd. (((a, b), aa, ba), (ab, bd), ac, bc) \<in> global_automaton check_active_irq_A (do_user_op_A uop) kernel_call_A \<and> (bd, bb) \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (((tc, ck), m, ev), (tc', ck'), m', ev') \<in> global_automaton check_active_irq_H (do_user_op_H uop) kernel_call_H\<rbrakk> \<Longrightarrow> \<exists>b. (((tc, ak), m, ev), (tc', b), m', ev') \<in> global_automaton check_active_irq_A (do_user_op_A uop) kernel_call_A \<and> (b, ck') \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ck), m', tc', ck') \<in> kernel_call_H e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = KernelMode \<and> (\<exists>x. ev = Some x \<and> ev' = None \<and> ((tc, ck), m', tc', ck') \<in> kernel_call_H x)\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck)\<rbrakk> \<Longrightarrow> (ct_running' ck' \<longrightarrow> (\<exists>b. (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b)) \<and> (\<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)))
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck)\<rbrakk> \<Longrightarrow> corres (=) (einvs and (\<lambda>s. x \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. 0 < domain_time s) and valid_domain_list and (ct_running or ct_idle) and (\<lambda>s. scheduler_action s = resume_cur_thread)) (invs' and (\<lambda>s. x \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. 0 < ksDomainTime s) and valid_domain_list' and (ct_running' or ct_idle') and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (kernel_entry x tc) (kernelEntry x tc) \<longrightarrow> (ct_running' ck' \<longrightarrow> (\<exists>b. (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b)) \<and> (\<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)))
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<forall>xa\<in>state_relation. case xa of (s, s') \<Rightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> (x \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> 0 < domain_time s \<and> valid_domain_list s \<and> (ct_running s \<or> ct_idle s) \<and> scheduler_action s = resume_cur_thread \<and> invs' s' \<and> (x \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> 0 < ksDomainTime s' \<and> valid_domain_list' s' \<and> (ct_running' s' \<or> ct_idle' s') \<and> ksSchedulerAction s' = ResumeCurrentThread \<and> vs_valid_duplicates' (ksPSpace s') \<longrightarrow> (\<forall>xa\<in>fst (kernelEntry x tc s'). case xa of (r', t') \<Rightarrow> \<exists>x\<in>fst (kernel_entry x tc s). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r') \<and> \<not> snd (kernelEntry x tc s')\<rbrakk> \<Longrightarrow> (ct_running' ck' \<longrightarrow> (\<exists>b. (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b)) \<and> (\<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)))
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); case (ak, ck) of (s, s') \<Rightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> (x \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> 0 < domain_time s \<and> valid_domain_list s \<and> (ct_running s \<or> ct_idle s) \<and> scheduler_action s = resume_cur_thread \<and> invs' s' \<and> (x \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> 0 < ksDomainTime s' \<and> valid_domain_list' s' \<and> (ct_running' s' \<or> ct_idle' s') \<and> ksSchedulerAction s' = ResumeCurrentThread \<and> vs_valid_duplicates' (ksPSpace s') \<longrightarrow> (\<forall>xa\<in>fst (kernelEntry x tc s'). case xa of (r', t') \<Rightarrow> \<exists>x\<in>fst (kernel_entry x tc s). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r') \<and> \<not> snd (kernelEntry x tc s')\<rbrakk> \<Longrightarrow> (ct_running' ck' \<longrightarrow> (\<exists>b. (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b)) \<and> (\<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)))
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<forall>xa\<in>fst (kernelEntry x tc ck). case xa of (r', t') \<Rightarrow> \<exists>x\<in>fst (kernel_entry x tc ak). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r'; \<not> snd (kernelEntry x tc ck)\<rbrakk> \<Longrightarrow> (ct_running' ck' \<longrightarrow> (\<exists>b. (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b)) \<and> (\<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)))
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); case (tc', ck') of (r', t') \<Rightarrow> \<exists>x\<in>fst (kernel_entry x tc ak). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r'\<rbrakk> \<Longrightarrow> (ct_running' ck' \<longrightarrow> (\<exists>b. (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b)) \<and> (\<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)))
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> (ct_running' ck' \<longrightarrow> (\<exists>b. (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b)) \<and> (\<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)))
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (4 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> ct_running' ck' \<longrightarrow> (\<exists>b. (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b)
 2. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> \<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation))
 3. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 4. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (4 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; ct_running' ck'\<rbrakk> \<Longrightarrow> \<exists>b. (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b
 2. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> \<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation))
 3. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 4. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (4 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; ct_running' ck'\<rbrakk> \<Longrightarrow> (ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation) \<and> ct_running b
 2. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> \<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation))
 3. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 4. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (5 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; ct_running' ck'\<rbrakk> \<Longrightarrow> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; ct_running' ck'\<rbrakk> \<Longrightarrow> ct_running b
 3. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> \<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation))
 4. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 5. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (4 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; ct_running' ck'\<rbrakk> \<Longrightarrow> ct_running b
 2. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> \<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation))
 3. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 4. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> \<not> ct_running' ck' \<longrightarrow> (\<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation))
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; \<not> ct_running' ck'\<rbrakk> \<Longrightarrow> \<exists>b. \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (tc', ck') \<in> fst (kernelEntry x tc ck); \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; \<not> ct_running' ck'\<rbrakk> \<Longrightarrow> \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (4 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; \<not> ct_running' ck'\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. x \<noteq> Interrupt \<longrightarrow> ct_running' s) and (ct_running' or ct_idle') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. 0 < ksDomainTime s) and valid_domain_list') ck
 2. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; \<not> ct_running' ck'; ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (invs' and (ct_running' or ct_idle')) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. 0 < ksDomainTime s) and valid_domain_list') ck'\<rbrakk> \<Longrightarrow> \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)
 3. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 4. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; \<not> ct_running' ck'; ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (invs' and (ct_running' or ct_idle')) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. 0 < ksDomainTime s) and valid_domain_list') ck'\<rbrakk> \<Longrightarrow> \<not> ct_running b \<and> (\<not> ct_running b \<longrightarrow> (tc', b) \<in> fst (kernel_entry x tc ak) \<and> (b, ck') \<in> state_relation)
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; \<not> ct_running' ck'; ksSchedulerAction ck' = ResumeCurrentThread; invs' ck'; ct_idle' ck'; vs_valid_duplicates' (ksPSpace ck'); 0 < ksDomainTime ck'; valid_domain_list' ck'; ct_running b\<rbrakk> \<Longrightarrow> False
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x b. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; ct_running' ck \<or> ct_idle' ck; x \<noteq> Interrupt \<longrightarrow> ct_running ak; 0 < domain_time ak; x \<noteq> Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; \<not> snd (kernelEntry x tc ck); (tc', b) \<in> fst (kernel_entry x tc ak); (b, ck') \<in> state_relation; \<not> ct_running' ck'; ksSchedulerAction ck' = ResumeCurrentThread; invs' ck'; ct_idle' ck'; vs_valid_duplicates' (ksPSpace ck'); 0 < ksDomainTime ck'; valid_domain_list' ck'; ct_running b; ct_idle b\<rbrakk> \<Longrightarrow> False
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ck), None, tc', ck') \<in> do_user_op_H uop\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((None, tc'), ck') \<in> fst (doUserOp uop tc ck)\<rbrakk> \<Longrightarrow> \<exists>b. ((None, tc'), b) \<in> fst (do_user_op uop tc ak) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (4 subgoals):
 1. \<And>tc ak tc' ck' ck s. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((None, tc'), ck') \<in> fst (doUserOp uop tc ck); (ct_running and einvs) s\<rbrakk> \<Longrightarrow> (einvs and ct_running) s
 2. \<And>tc ak tc' ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((None, tc'), ck') \<in> fst (doUserOp uop tc ck)\<rbrakk> \<Longrightarrow> corres (=) (ct_running and einvs) (invs' and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_running') (do_user_op uop tc) (doUserOp uop tc) \<longrightarrow> (\<exists>b. ((None, tc'), b) \<in> fst (do_user_op uop tc ak) \<and> (b, ck') \<in> state_relation)
 3. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 4. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((None, tc'), ck') \<in> fst (doUserOp uop tc ck)\<rbrakk> \<Longrightarrow> corres (=) (ct_running and einvs) (invs' and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_running') (do_user_op uop tc) (doUserOp uop tc) \<longrightarrow> (\<exists>b. ((None, tc'), b) \<in> fst (do_user_op uop tc ak) \<and> (b, ck') \<in> state_relation)
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((None, tc'), ck') \<in> fst (doUserOp uop tc ck); \<forall>x\<in>state_relation. case x of (s, s') \<Rightarrow> ct_running s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> invs' s' \<and> ksSchedulerAction s' = ResumeCurrentThread \<and> ct_running' s' \<longrightarrow> (\<forall>x\<in>fst (doUserOp uop tc s'). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (do_user_op uop tc s). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r') \<and> \<not> snd (doUserOp uop tc s')\<rbrakk> \<Longrightarrow> \<exists>b. ((None, tc'), b) \<in> fst (do_user_op uop tc ak) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((None, tc'), ck') \<in> fst (doUserOp uop tc ck); \<forall>x\<in>fst (doUserOp uop tc ck). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (do_user_op uop tc ak). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r'; \<not> snd (doUserOp uop tc ck)\<rbrakk> \<Longrightarrow> \<exists>b. ((None, tc'), b) \<in> fst (do_user_op uop tc ak) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck ba. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((None, tc'), ck') \<in> fst (doUserOp uop tc ck); \<not> snd (doUserOp uop tc ck); ((None, tc'), ba) \<in> fst (do_user_op uop tc ak); (ba, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> \<exists>b. ((None, tc'), b) \<in> fst (do_user_op uop tc ak) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ck), Some e, tc', ck') \<in> do_user_op_H uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>x. ev' = Some x \<and> ((tc, ck), Some x, tc', ck') \<in> do_user_op_H uop)\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((Some x, tc'), ck') \<in> fst (doUserOp uop tc ck)\<rbrakk> \<Longrightarrow> \<exists>b. (((Some x, tc'), b) \<in> fst (do_user_op uop tc ak) \<or> x = Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (4 subgoals):
 1. \<And>tc ak tc' ck' ck x s. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((Some x, tc'), ck') \<in> fst (doUserOp uop tc ck); (ct_running and einvs) s\<rbrakk> \<Longrightarrow> (einvs and ct_running) s
 2. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((Some x, tc'), ck') \<in> fst (doUserOp uop tc ck)\<rbrakk> \<Longrightarrow> corres (=) (ct_running and einvs) (invs' and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_running') (do_user_op uop tc) (doUserOp uop tc) \<longrightarrow> (\<exists>b. (((Some x, tc'), b) \<in> fst (do_user_op uop tc ak) \<or> x = Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation)
 3. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 4. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((Some x, tc'), ck') \<in> fst (doUserOp uop tc ck)\<rbrakk> \<Longrightarrow> corres (=) (ct_running and einvs) (invs' and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_running') (do_user_op uop tc) (doUserOp uop tc) \<longrightarrow> (\<exists>b. (((Some x, tc'), b) \<in> fst (do_user_op uop tc ak) \<or> x = Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation)
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((Some x, tc'), ck') \<in> fst (doUserOp uop tc ck); \<forall>x\<in>state_relation. case x of (s, s') \<Rightarrow> ct_running s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> invs' s' \<and> ksSchedulerAction s' = ResumeCurrentThread \<and> ct_running' s' \<longrightarrow> (\<forall>x\<in>fst (doUserOp uop tc s'). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (do_user_op uop tc s). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r') \<and> \<not> snd (doUserOp uop tc s')\<rbrakk> \<Longrightarrow> \<exists>b. (((Some x, tc'), b) \<in> fst (do_user_op uop tc ak) \<or> x = Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((Some x, tc'), ck') \<in> fst (doUserOp uop tc ck); \<forall>x\<in>fst (doUserOp uop tc ck). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (do_user_op uop tc ak). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r'; \<not> snd (doUserOp uop tc ck)\<rbrakk> \<Longrightarrow> \<exists>b. (((Some x, tc'), b) \<in> fst (do_user_op uop tc ak) \<or> x = Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck x ba. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; ((Some x, tc'), ck') \<in> fst (doUserOp uop tc ck); \<not> snd (doUserOp uop tc ck); ((Some x, tc'), ba) \<in> fst (do_user_op uop tc ak); (ba, ck') \<in> state_relation\<rbrakk> \<Longrightarrow> \<exists>b. (((Some x, tc'), b) \<in> fst (do_user_op uop tc ak) \<or> x = Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (True, ck') \<in> fst (checkActiveIRQ ck)\<rbrakk> \<Longrightarrow> \<exists>b. (((tc, ak), Some Interrupt, tc', b) \<in> do_user_op_A uop \<or> (True, b) \<in> fst (check_active_irq ak)) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (True, ck') \<in> fst (checkActiveIRQ ck)\<rbrakk> \<Longrightarrow> corres (=) (invs and (ct_running or ct_idle) and einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and (\<lambda>s. 0 < domain_time s) and valid_domain_list) (invs' and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. 0 < ksDomainTime s) and valid_domain_list' and (ct_running' or ct_idle') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) check_active_irq checkActiveIRQ \<longrightarrow> (\<exists>b. (((tc, ak), Some Interrupt, tc', b) \<in> do_user_op_A uop \<or> (True, b) \<in> fst (check_active_irq ak)) \<and> (b, ck') \<in> state_relation)
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak tc' ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_running ak; ct_running' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (True, ck') \<in> fst (checkActiveIRQ ck); \<forall>x\<in>state_relation. case x of (s, s') \<Rightarrow> invs s \<and> (ct_running s \<or> ct_idle s) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> ksSchedulerAction s' = ResumeCurrentThread \<and> 0 < ksDomainTime s' \<and> valid_domain_list' s' \<and> (ct_running' s' \<or> ct_idle' s') \<and> vs_valid_duplicates' (ksPSpace s') \<longrightarrow> (\<forall>x\<in>fst (checkActiveIRQ s'). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (check_active_irq s). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r') \<and> \<not> snd (checkActiveIRQ s')\<rbrakk> \<Longrightarrow> \<exists>b. (((tc, ak), Some Interrupt, tc', b) \<in> do_user_op_A uop \<or> (True, b) \<in> fst (check_active_irq ak)) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ck), False, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>ak ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_idle ak; ct_idle' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (False, ck') \<in> fst (checkActiveIRQ ck)\<rbrakk> \<Longrightarrow> \<exists>b. (False, b) \<in> fst (check_active_irq ak) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>ak ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_idle ak; ct_idle' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (False, ck') \<in> fst (checkActiveIRQ ck)\<rbrakk> \<Longrightarrow> corres (=) (invs and (ct_running or ct_idle) and einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and (\<lambda>s. 0 < domain_time s) and valid_domain_list) (invs' and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. 0 < ksDomainTime s) and valid_domain_list' and (ct_running' or ct_idle') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) check_active_irq checkActiveIRQ \<longrightarrow> (\<exists>b. (False, b) \<in> fst (check_active_irq ak) \<and> (b, ck') \<in> state_relation)
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (3 subgoals):
 1. \<And>ak ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_idle ak; ct_idle' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (False, ck') \<in> fst (checkActiveIRQ ck); \<forall>x\<in>state_relation. case x of (s, s') \<Rightarrow> invs s \<and> (ct_running s \<or> ct_idle s) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> ksSchedulerAction s' = ResumeCurrentThread \<and> 0 < ksDomainTime s' \<and> valid_domain_list' s' \<and> (ct_running' s' \<or> ct_idle' s') \<and> vs_valid_duplicates' (ksPSpace s') \<longrightarrow> (\<forall>x\<in>fst (checkActiveIRQ s'). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (check_active_irq s). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r') \<and> \<not> snd (checkActiveIRQ s')\<rbrakk> \<Longrightarrow> \<exists>b. (False, b) \<in> fst (check_active_irq ak) \<and> (b, ck') \<in> state_relation
 2. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 3. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>tc ak m ev tc' ck' m' ev' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ct_running ak \<or> ct_idle ak; ksSchedulerAction ck = ResumeCurrentThread; m = KernelMode \<longrightarrow> (\<exists>y. ev = Some y); ct_running' ck \<or> ct_idle' ck; m = UserMode \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle ak; m = UserMode \<longrightarrow> ct_running' ck; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running ak; m = IdleMode \<longrightarrow> ct_idle' ck; 0 < domain_time ak; (\<exists>y. ev = Some y) \<and> ev \<noteq> Some Interrupt \<longrightarrow> ct_running' ck; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ck), True, tc', ck') \<in> check_active_irq_H\<rbrakk> \<Longrightarrow> \<exists>b. (m = KernelMode \<and> (\<exists>e. ev = Some e \<and> ev' = None \<and> ((tc, ak), m', tc', b) \<in> kernel_call_A e) \<or> m = UserMode \<and> ev = None \<and> m' = UserMode \<and> ev' = None \<and> ((tc, ak), None, tc', b) \<in> do_user_op_A uop \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> (\<exists>e. ev' = Some e \<and> ((tc, ak), Some e, tc', b) \<in> do_user_op_A uop) \<or> m = UserMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = IdleMode \<and> ev' = None \<and> ((tc, ak), False, tc', b) \<in> check_active_irq_A \<or> m = IdleMode \<and> ev = None \<and> m' = KernelMode \<and> ev' = Some Interrupt \<and> ((tc, ak), True, tc', b) \<in> check_active_irq_A) \<and> (b, ck') \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>ak ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_idle ak; ct_idle' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (True, ck') \<in> fst (checkActiveIRQ ck)\<rbrakk> \<Longrightarrow> \<exists>b. (True, b) \<in> fst (check_active_irq ak) \<and> (b, ck') \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>ak ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_idle ak; ct_idle' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (True, ck') \<in> fst (checkActiveIRQ ck)\<rbrakk> \<Longrightarrow> corres (=) (invs and (ct_running or ct_idle) and einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and (\<lambda>s. 0 < domain_time s) and valid_domain_list) (invs' and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. 0 < ksDomainTime s) and valid_domain_list' and (ct_running' or ct_idle') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) check_active_irq checkActiveIRQ \<longrightarrow> (\<exists>b. (True, b) \<in> fst (check_active_irq ak) \<and> (b, ck') \<in> state_relation)
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (2 subgoals):
 1. \<And>ak ck' ck. \<lbrakk>(ak, ck) \<in> state_relation; invs ak; invs' ck; valid_list ak; vs_valid_duplicates' (ksPSpace ck); valid_sched_2 (ready_queues ak) (ekheap ak) resume_cur_thread (cur_domain ak) (kheap ak) (cur_thread ak) (idle_thread ak); ex_abs einvs ck; ksSchedulerAction ck = ResumeCurrentThread; ct_idle ak; ct_idle' ck; 0 < domain_time ak; valid_domain_list ak; scheduler_action ak = resume_cur_thread; 0 < ksDomainTime ck; valid_domain_list' ck; (True, ck') \<in> fst (checkActiveIRQ ck); \<forall>x\<in>state_relation. case x of (s, s') \<Rightarrow> invs s \<and> (ct_running s \<or> ct_idle s) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> ksSchedulerAction s' = ResumeCurrentThread \<and> 0 < ksDomainTime s' \<and> valid_domain_list' s' \<and> (ct_running' s' \<or> ct_idle' s') \<and> vs_valid_duplicates' (ksPSpace s') \<longrightarrow> (\<forall>x\<in>fst (checkActiveIRQ s'). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (check_active_irq s). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> r = r') \<and> \<not> snd (checkActiveIRQ s')\<rbrakk> \<Longrightarrow> \<exists>b. (True, b) \<in> fst (check_active_irq ak) \<and> (b, ck') \<in> state_relation
 2. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal (1 subgoal):
 1. \<forall>a b aa ba ab bb ac bc. (((a, b), aa, ba), (ab, bb), ac, bc) \<in> lift_state_relation state_relation \<and> invs b \<and> valid_list b \<and> valid_sched b \<and> (ct_running b \<or> ct_idle b) \<and> (aa = KernelMode \<longrightarrow> (\<exists>y. ba = Some y)) \<and> (aa = UserMode \<longrightarrow> ct_running b) \<and> (aa = IdleMode \<longrightarrow> ct_idle b) \<and> ((\<exists>y. ba = Some y) \<and> ba \<noteq> Some Interrupt \<longrightarrow> ct_running b) \<and> 0 < domain_time b \<and> valid_domain_list b \<and> scheduler_action b = resume_cur_thread \<and> invs' bb \<and> vs_valid_duplicates' (ksPSpace bb) \<and> ex_abs einvs bb \<and> ksSchedulerAction bb = ResumeCurrentThread \<and> (ct_running' bb \<or> ct_idle' bb) \<and> (ac = KernelMode \<longrightarrow> (\<exists>y. bc = Some y)) \<and> (ac = UserMode \<longrightarrow> ct_running' bb) \<and> (ac = IdleMode \<longrightarrow> ct_idle' bb) \<and> ((\<exists>y. bc = Some y) \<and> bc \<noteq> Some Interrupt \<longrightarrow> ct_running' bb) \<and> 0 < ksDomainTime bb \<and> valid_domain_list' bb \<longrightarrow> ab = a \<and> absKState bb = abs_state b \<and> ac = aa \<and> bc = ba proof (prove)
goal:
No subgoals!