theory Noninterference

lemma scheduler_step_1_confidentiality:
  notes blob = invs_if_def Invs_def sys_mode_of_def
               silc_inv_cur pas_refined_cur guarded_pas_domain_cur internal_state_s0
               domain_can_read_context domain_can_read_context'
               domain_can_read_sys_mode'[simplified sys_mode_of_def]
               domain_can_read_sys_mode[simplified sys_mode_of_def]
  assumes uwr: "(s,t) \<in> uwr PSched"  "(s,t) \<in> uwr u"
  assumes step_s: "(s,s') \<in> data_type.Step (ADT_A_if utf) ()"
  assumes step_t: "(t,t') \<in> data_type.Step (ADT_A_if utf) ()"
  assumes reach_s: "system.reachable (ADT_A_if utf) s0 s"
  assumes reach_t: "system.reachable (ADT_A_if utf) s0 t"
  shows "interrupted_modes (sys_mode_of s) \<Longrightarrow> (s',t') \<in> uwr u" supply [[simp_depth_limit=2]] \<comment> \<open>speedup\<close> apply (insert uwr step_s step_t) apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_s]) apply (cut_tac ADT_A_if_reachable_invs_if[OF reach_t]) apply (cut_tac irq_masks_constant'[OF reach_s, OF refl]) apply (cut_tac irq_masks_constant'[OF reach_t, OF refl]) apply (subgoal_tac "interrupted_modes (sys_mode_of t)") apply (rule_tac s=s and s'=s' in interrupt_step,simp_all) apply (rule_tac s=t and s'=t' in interrupt_step,simp_all) apply (rule equiv_valid_2E[where s="internal_state_if s" and t="internal_state_if t",
                                OF kernel_entry_scheduler_equiv_2
                                     [where aag="initial_aag" and st="s0_internal"
                                        and st'="s0_internal" and l="label_for_partition u",
                                      OF domains_distinct]], assumption, assumption) apply (rule uwr_scheduler_affects_equiv,assumption+) apply ((clarsimp simp: blob)+)[2] apply (rule scheduler_affects_equiv_uwr,simp+) apply (clarsimp simp: blob) apply (rule equiv_valid_2E
                  [where s="internal_state_if s" and t="internal_state_if t",
                   OF ev2_sym[where R'="\<lambda>r r'. r' = user_context_of t \<and> snd r = user_context_of s",
                              OF _ _ _ _ preemption_interrupt_scheduler_invisible
                                           [where aag="initial_aag" and st="s0_internal"
                                              and st'="s0_internal" and l="label_for_partition u"
                                              and uc="user_context_of t" and uc'="user_context_of s",
                                           OF domains_distinct],
                              OF scheduler_equiv_sym scheduler_affects_equiv_sym
                                 scheduler_affects_equiv_sym, simplified]]) apply (fastforce+)[2] apply (rule uwr_scheduler_affects_equiv,assumption+) 
      (* FIXME: manual frule *)
       apply (clarsimp simp: blob) 
      (* this restores normal form for reads_scheduler_cur_domain *)
       apply (rule ccontr[where P = "_ \<inter> _ = {}"]) apply (frule (1) domain_can_read_context[where u = u]) apply (frule domain_can_read_context'[where u = u]) apply (metis uwr_PSched_cur_domain) apply (frule (1) domain_can_read_sys_mode[where u = u, simplified sys_mode_of_def]) apply force apply (clarsimp simp: blob) apply (rule ccontr[where P = "_ \<inter> _ = {}"]) apply (frule (1) domain_can_read_context'[where u = u]) apply (frule domain_can_read_context[where u = u]) apply (metis uwr_PSched_cur_domain) apply (frule (1) domain_can_read_sys_mode'[where u = u, simplified sys_mode_of_def]) apply force apply (rule scheduler_affects_equiv_uwr,simp+) apply (clarsimp simp: blob) apply (rule_tac s=t and s'=t' in interrupt_step,simp_all) apply (rule equiv_valid_2E[where s="internal_state_if s" and t="internal_state_if t",
                               OF preemption_interrupt_scheduler_invisible
                                    [where aag="initial_aag" and st="s0_internal"
                                       and st'="s0_internal" and uc="user_context_of s"
                                       and l="label_for_partition u", OF domains_distinct]],
           assumption, assumption) apply (rule uwr_scheduler_affects_equiv,assumption+) 
      (* FIXME: also clean up here *)
       apply (clarsimp simp: blob) apply (rule ccontr[where P = "_ \<inter> _ = {}"]) apply (frule (1) domain_can_read_context[where u = u]) apply (frule domain_can_read_context'[where u = u]) apply (metis uwr_PSched_cur_domain) apply (frule (1) domain_can_read_sys_mode[where u = u, simplified sys_mode_of_def]) apply force 
     (* FIXME: and here *)
      apply (clarsimp simp: blob) apply (rule ccontr[where P = "_ \<inter> _ = {}"]) apply (frule (1) domain_can_read_context'[where u = u]) apply (frule domain_can_read_context[where u = u]) apply (metis uwr_PSched_cur_domain) apply (frule (1) domain_can_read_sys_mode'[where u = u, simplified sys_mode_of_def]) apply force apply (rule scheduler_affects_equiv_uwr,simp+) apply (clarsimp simp: blob) apply (rule equiv_valid_2E[where s="internal_state_if s" and t="internal_state_if t",
                              OF handle_preemption_reads_respects_scheduler_2
                                   [where aag="initial_aag" and st="s0_internal"
                                      and st'="s0_internal" and l="label_for_partition u",
                                    OF domains_distinct]], assumption, assumption) apply (rule uwr_scheduler_affects_equiv,assumption+) apply ((clarsimp simp: blob)+)[2] apply (rule scheduler_affects_equiv_uwr,simp+) apply (clarsimp simp: blob) apply (clarsimp simp add: sameFor_def sameFor_scheduler_def uwr_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interrupted_modes (sys_mode_of s) \<Longrightarrow> uwr2 s' u t' proof (prove)
goal (1 subgoal):
 1. interrupted_modes (sys_mode_of s) \<Longrightarrow> uwr2 s' u t' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) ()\<rbrakk> \<Longrightarrow> uwr2 s' u t' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s\<rbrakk> \<Longrightarrow> uwr2 s' u t' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t\<rbrakk> \<Longrightarrow> uwr2 s' u t' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> uwr2 s' u t' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> uwr2 s' u t' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (3 subgoals):
 1. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (7 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> scheduler_equiv initial_aag (internal_state_if s) (internal_state_if t) \<and> scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s) (internal_state_if t)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>sa. ct_idle sa \<longrightarrow> user_context_of s = idle_context sa) and (\<lambda>sa. reads_scheduler_cur_domain initial_aag (label_for_partition u) sa \<longrightarrow> user_context_of s = user_context_of t)) (internal_state_if s)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>sa. reads_scheduler_cur_domain initial_aag (label_for_partition u) sa \<longrightarrow> user_context_of s = user_context_of t)) (internal_state_if t)
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); snd r = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 6. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 7. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (6 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>sa. ct_idle sa \<longrightarrow> user_context_of s = idle_context sa) and (\<lambda>sa. reads_scheduler_cur_domain initial_aag (label_for_partition u) sa \<longrightarrow> user_context_of s = user_context_of t)) (internal_state_if s)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>sa. reads_scheduler_cur_domain initial_aag (label_for_partition u) sa \<longrightarrow> user_context_of s = user_context_of t)) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); snd r = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 6. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); snd r = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); snd r = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s) \<longrightarrow> user_context_of s = user_context_of t
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (3 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (8 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (?a104 r ra, ?s'104 r ra) \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s))
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (?b104 r ra, ?t'104 r ra) \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t))
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> scheduler_equiv initial_aag (internal_state_if s) (internal_state_if t) \<and> scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s) (internal_state_if t)
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>sa. ct_idle sa \<longrightarrow> user_context_of s = idle_context sa) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if s)
 5. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 6. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (?s'104 r ra) (?t'104 r ra); scheduler_affects_equiv initial_aag (label_for_partition u) (?s'104 r ra) (?t'104 r ra); ?b104 r ra = user_context_of t \<and> snd (?a104 r ra) = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 7. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 8. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (6 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> scheduler_equiv initial_aag (internal_state_if s) (internal_state_if t) \<and> scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s) (internal_state_if t)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>sa. ct_idle sa \<longrightarrow> user_context_of s = idle_context sa) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if s)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 6. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>sa. ct_idle sa \<longrightarrow> user_context_of s = idle_context sa) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if s)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>sa. ct_idle sa \<longrightarrow> user_context_of s = idle_context sa) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if s)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread\<rbrakk> \<Longrightarrow> pasDomainAbs initial_aag (cur_domain (internal_state_if s)) \<inter> reads_scheduler initial_aag (label_for_partition u) = {}
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread\<rbrakk> \<Longrightarrow> pasDomainAbs initial_aag (cur_domain (internal_state_if s)) \<inter> reads_scheduler initial_aag (label_for_partition u) = {}
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s)\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (6 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t\<rbrakk> \<Longrightarrow> reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t)
 2. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t; user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s\<rbrakk> \<Longrightarrow> False
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 6. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t; user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t; user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s; snd s = snd t\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. pasDomainAbs initial_aag (cur_domain s) \<inter> reads_scheduler initial_aag (label_for_partition u) = {})) (internal_state_if t)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread\<rbrakk> \<Longrightarrow> pasDomainAbs initial_aag (cur_domain (internal_state_if t)) \<inter> reads_scheduler initial_aag (label_for_partition u) = {}
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t)\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s\<rbrakk> \<Longrightarrow> reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s)
 2. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s; user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t\<rbrakk> \<Longrightarrow> False
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s; user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; ((a, user_context_of s), internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); snd s = KernelEntry Interrupt; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); snd t = KernelPreempted; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched_2 (ready_queues (internal_state_if s)) (ekheap (internal_state_if s)) resume_cur_thread (cur_domain (internal_state_if s)) (kheap (internal_state_if s)) (cur_thread (internal_state_if s)) (idle_thread (internal_state_if s)); valid_sched (internal_state_if t); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv (KernelEntry Interrupt) (cur_thread_context_of s) (internal_state_if s); det_inv KernelPreempted (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) \<noteq> 0; domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s); scheduler_action (internal_state_if s) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s; user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t; snd t = snd s\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (3 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; snd r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); ra = user_context_of t \<and> snd r = user_context_of s\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (3 subgoals):
 1. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (r, internal_state_if s') \<in> fst (kernel_entry_if Interrupt (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelEntry Interrupt; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); snd r = user_context_of s\<rbrakk> \<Longrightarrow> reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s) \<longrightarrow> user_context_of s = user_context_of t
 2. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (2 subgoals):
 1. \<And>r. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); interrupted_modes (sys_mode_of t); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (3 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (6 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> scheduler_equiv initial_aag (internal_state_if s) (internal_state_if t) \<and> scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s) (internal_state_if t)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>sa. ct_idle sa \<longrightarrow> user_context_of s = idle_context sa) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if s)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 6. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>sa. ct_idle sa \<longrightarrow> user_context_of s = idle_context sa) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if s)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>sa. ct_idle sa \<longrightarrow> user_context_of s = idle_context sa) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if s)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread\<rbrakk> \<Longrightarrow> pasDomainAbs initial_aag (cur_domain (internal_state_if s)) \<inter> reads_scheduler initial_aag (label_for_partition u) = {}
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s)\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (6 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t\<rbrakk> \<Longrightarrow> reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t)
 2. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t; user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s\<rbrakk> \<Longrightarrow> False
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 6. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t; user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s); user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t; user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s; snd s = snd t\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s) and (\<lambda>s. ct_idle s \<longrightarrow> user_context_of t = idle_context s) and (\<lambda>s. \<not> reads_scheduler_cur_domain initial_aag (label_for_partition u) s)) (internal_state_if t)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread\<rbrakk> \<Longrightarrow> pasDomainAbs initial_aag (cur_domain (internal_state_if t)) \<inter> reads_scheduler initial_aag (label_for_partition u) = {}
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t)\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s\<rbrakk> \<Longrightarrow> reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s)
 2. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s; user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t\<rbrakk> \<Longrightarrow> False
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s; user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>a. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); irq_masks_of_state (internal_state_if s) = irq_masks_of_state s0_internal; irq_masks_of_state (internal_state_if t) = irq_masks_of_state s0_internal; (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); snd s = KernelPreempted; snd s' = KernelSchedule True; user_context_of s' = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); ((a, user_context_of t), internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); snd t = KernelEntry Interrupt; snd t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); invs (internal_state_if s); invs (internal_state_if t); valid_list (internal_state_if s); valid_list (internal_state_if t); valid_sched (internal_state_if s); valid_sched_2 (ready_queues (internal_state_if t)) (ekheap (internal_state_if t)) resume_cur_thread (cur_domain (internal_state_if t)) (kheap (internal_state_if t)) (cur_thread (internal_state_if t)) (idle_thread (internal_state_if t)); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if t); silc_inv initial_aag s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if t); domain_sep_inv False s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if t); pas_refined initial_aag (internal_state_if s); pas_refined initial_aag (internal_state_if t); guarded_pas_domain initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if t); idle_equiv s0_internal (internal_state_if s); idle_equiv s0_internal (internal_state_if t); valid_domain_list (internal_state_if s); valid_domain_list (internal_state_if t); valid_vspace_objs_if (internal_state_if s); valid_vspace_objs_if (internal_state_if t); det_inv KernelPreempted (cur_thread_context_of s) (internal_state_if s); det_inv (KernelEntry Interrupt) (cur_thread_context_of t) (internal_state_if t); 0 < domain_time (internal_state_if s); 0 < domain_time (internal_state_if t); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); domain_time (internal_state_if t) \<noteq> 0; ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t); ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t); scheduler_action (internal_state_if t) = resume_cur_thread; reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if t); user_modes (sys_mode_of t) \<longrightarrow> user_context_of t = user_context_of s; user_modes (sys_mode_of s) \<longrightarrow> user_context_of s = user_context_of t; snd t = snd s\<rbrakk> \<Longrightarrow> False
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (3 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; snd ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> snd ra = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (3 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (ra, internal_state_if t') \<in> fst (kernel_entry_if Interrupt (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelEntry Interrupt; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); snd ra = user_context_of t\<rbrakk> \<Longrightarrow> reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s) \<longrightarrow> user_context_of s = user_context_of t
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 3. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (2 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (5 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> scheduler_equiv initial_aag (internal_state_if s) (internal_state_if t) \<and> scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s) (internal_state_if t)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s)) (internal_state_if s)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s)) (internal_state_if t)
 4. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> user_context_of t = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 5. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (4 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s)) (internal_state_if s)
 2. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t)\<rbrakk> \<Longrightarrow> (einvs and pas_refined initial_aag and guarded_pas_domain initial_aag and domain_sep_inv False s0_internal and silc_inv initial_aag s0_internal and (\<lambda>s. irq_masks_of_state s0_internal = irq_masks_of_state s)) (internal_state_if t)
 3. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> user_context_of t = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 4. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (2 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t'); user_context_of s = user_context_of s \<and> user_context_of t = user_context_of t\<rbrakk> \<Longrightarrow> uwr2 s' u t'
 2. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (2 subgoals):
 1. \<And>r ra. \<lbrakk>uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0); (user_context_of s, internal_state_if s') \<in> fst (handle_preemption_if (user_context_of s) (internal_state_if s)); sys_mode_of s = KernelPreempted; sys_mode_of s' = KernelSchedule True; user_context_of s' = user_context_of s; r = user_context_of s; cur_domain (internal_state_if s') = cur_domain (internal_state_if s); (user_context_of t, internal_state_if t') \<in> fst (handle_preemption_if (user_context_of t) (internal_state_if t)); sys_mode_of t = KernelPreempted; sys_mode_of t' = KernelSchedule True; user_context_of t' = user_context_of t; ra = user_context_of t; cur_domain (internal_state_if t') = cur_domain (internal_state_if t); scheduler_equiv initial_aag (internal_state_if s') (internal_state_if t'); scheduler_affects_equiv initial_aag (label_for_partition u) (internal_state_if s') (internal_state_if t')\<rbrakk> \<Longrightarrow> reads_scheduler_cur_domain initial_aag (label_for_partition u) (internal_state_if s) \<longrightarrow> user_context_of s = user_context_of t
 2. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>interrupted_modes (sys_mode_of s); uwr2 s PSched t; uwr2 s u t; (s, s') \<in> data_type.Step (ADT_A_if utf) (); (t, t') \<in> data_type.Step (ADT_A_if utf) (); invs_if s; invs_if t; irq_masks_of_state (internal_state_if s) = irq_masks_of_state (internal_state_if s0); irq_masks_of_state (internal_state_if t) = irq_masks_of_state (internal_state_if s0)\<rbrakk> \<Longrightarrow> interrupted_modes (sys_mode_of t) proof (prove)
goal:
No subgoals!